# ELSA-2026-500249: Security update for 19 packages ELSA-2026-500249, released September 4, 2026, fixes 588 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/elsa-2026-500249 - Platform: Linux - Released: Sep 4, 2026 - Priority: Urgent (Closes CVE-2026-68160, rated Critical) - CVEs: 588, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://linux.oracle.com/errata/ELSA-2026-500249.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek](https://patchblox.com/security/data/product/linux/kernel-uek.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek](https://patchblox.com/security/data/product/linux/kernel-uek.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-container](https://patchblox.com/security/data/product/linux/kernel-uek-container.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-container](https://patchblox.com/security/data/product/linux/kernel-uek-container.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-container-debug](https://patchblox.com/security/data/product/linux/kernel-uek-container-debug.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-container-debug](https://patchblox.com/security/data/product/linux/kernel-uek-container-debug.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-core](https://patchblox.com/security/data/product/linux/kernel-uek-core.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-core](https://patchblox.com/security/data/product/linux/kernel-uek-core.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-debug](https://patchblox.com/security/data/product/linux/kernel-uek-debug.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-debug](https://patchblox.com/security/data/product/linux/kernel-uek-debug.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-debug-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-core.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-debug-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-core.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-debug-devel](https://patchblox.com/security/data/product/linux/kernel-uek-debug-devel.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-debug-devel](https://patchblox.com/security/data/product/linux/kernel-uek-debug-devel.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-debug-modules](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-debug-modules](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-devel](https://patchblox.com/security/data/product/linux/kernel-uek-devel.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-devel](https://patchblox.com/security/data/product/linux/kernel-uek-devel.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-doc](https://patchblox.com/security/data/product/linux/kernel-uek-doc.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-doc](https://patchblox.com/security/data/product/linux/kernel-uek-doc.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-modules](https://patchblox.com/security/data/product/linux/kernel-uek-modules.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-modules](https://patchblox.com/security/data/product/linux/kernel-uek-modules.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek64k](https://patchblox.com/security/data/product/linux/kernel-uek64k.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek64k](https://patchblox.com/security/data/product/linux/kernel-uek64k.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek64k-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-core.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek64k-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-core.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek64k-devel](https://patchblox.com/security/data/product/linux/kernel-uek64k-devel.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek64k-devel](https://patchblox.com/security/data/product/linux/kernel-uek64k-devel.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek64k-modules](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek64k-modules](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek64k-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra.md) | ol 8 | 0:5.15.0-324.217.5.2.el9uek | | [kernel-uek64k-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra.md) | ol 9 | 0:5.15.0-324.217.5.2.el9uek | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-68160](https://patchblox.com/security/data/cve/CVE-2026-68160.md) | Urgent | ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() | 9.8 | 0.0077 | | | [CVE-2026-74279](https://patchblox.com/security/data/cve/CVE-2026-74279.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong... | 10.0 | 0.0076 | | | [CVE-2026-72226](https://patchblox.com/security/data/cve/CVE-2026-72226.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow... | 9.8 | 0.0076 | | | [CVE-2026-80630](https://patchblox.com/security/data/cve/CVE-2026-80630.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq_codel: Do not call qdisc_tree_... | 9.8 | 0.0076 | | | [CVE-2026-72084](https://patchblox.com/security/data/cve/CVE-2026-72084.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing t... | 9.8 | 0.0075 | | | [CVE-2026-72299](https://patchblox.com/security/data/cve/CVE-2026-72299.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tra... | 9.8 | 0.0075 | | | [CVE-2026-72319](https://patchblox.com/security/data/cve/CVE-2026-72319.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in... | 9.8 | 0.0075 | | | [CVE-2026-72339](https://patchblox.com/security/data/cve/CVE-2026-72339.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on b... | 9.8 | 0.0075 | | | [CVE-2026-72351](https://patchblox.com/security/data/cve/CVE-2026-72351.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: gue: validate REMCSUM private option length GUE... | 9.8 | 0.0075 | | | [CVE-2026-72466](https://patchblox.com/security/data/cve/CVE-2026-72466.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek... | 9.8 | 0.0074 | | | [CVE-2026-80609](https://patchblox.com/security/data/cve/CVE-2026-80609.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe->len_list[... | 9.8 | 0.0074 | | | [CVE-2026-72234](https://patchblox.com/security/data/cve/CVE-2026-72234.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: batman-adv: access unicast_ttvn skb->data only a... | 9.8 | 0.0073 | | | [CVE-2026-72065](https://patchblox.com/security/data/cve/CVE-2026-72065.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported b... | 9.8 | 0.0073 | | | [CVE-2026-72322](https://patchblox.com/security/data/cve/CVE-2026-72322.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed wo... | 9.8 | 0.0072 | | | [CVE-2026-72491](https://patchblox.com/security/data/cve/CVE-2026-72491.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: net/9p: fix race condition on rdma->state in tra... | 9.8 | 0.0072 | | | [CVE-2026-72014](https://patchblox.com/security/data/cve/CVE-2026-72014.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range p... | 9.8 | 0.0072 | | | [CVE-2026-68477](https://patchblox.com/security/data/cve/CVE-2026-68477.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport... | 9.8 | 0.0071 | | | [CVE-2026-72020](https://patchblox.com/security/data/cve/CVE-2026-72020.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ip_vs_seq structs in ip_vs_conn... | 9.8 | 0.0071 | | | [CVE-2026-72129](https://patchblox.com/security/data/cve/CVE-2026-72129.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero of... | 9.8 | 0.0071 | | | [CVE-2026-72251](https://patchblox.com/security/data/cve/CVE-2026-72251.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: reload possible stale dat... | 9.8 | 0.0071 | | | [CVE-2026-74267](https://patchblox.com/security/data/cve/CVE-2026-74267.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_codel: Do not call qdisc_tree_red... | 9.8 | 0.0071 | | | [CVE-2026-72348](https://patchblox.com/security/data/cve/CVE-2026-72348.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extens... | 9.1 | 0.0063 | | | [CVE-2026-80603](https://patchblox.com/security/data/cve/CVE-2026-80603.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_irc: fix parse_dcc() off... | 9.1 | 0.0060 | | | [CVE-2026-72421](https://patchblox.com/security/data/cve/CVE-2026-72421.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/mai... | 10.0 | 0.0057 | | | [CVE-2026-64535](https://patchblox.com/security/data/cve/CVE-2026-64535.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch... | 9.8 | 0.0055 | | | [CVE-2026-74394](https://patchblox.com/security/data/cve/CVE-2026-74394.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate dat... | 9.8 | 0.0054 | | | [CVE-2026-68144](https://patchblox.com/security/data/cve/CVE-2026-68144.md) | Urgent | phonet: pep: fix use-after-free in pep_get_sb() | 9.8 | 0.0054 | | | [CVE-2026-68131](https://patchblox.com/security/data/cve/CVE-2026-68131.md) | Urgent | rbd: Reset positive result codes to zero in object map update path | 9.8 | 0.0052 | | | [CVE-2026-74384](https://patchblox.com/security/data/cve/CVE-2026-74384.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nv... | 9.8 | 0.0051 | | | [CVE-2026-74398](https://patchblox.com/security/data/cve/CVE-2026-74398.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dad_failure when sta... | 9.8 | 0.0051 | | | [CVE-2026-64551](https://patchblox.com/security/data/cve/CVE-2026-64551.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALE_COOKIE cause length before... | 9.1 | 0.0051 | | | [CVE-2026-74287](https://patchblox.com/security/data/cve/CVE-2026-74287.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded address parameter length... | 9.1 | 0.0051 | | | [CVE-2026-74376](https://patchblox.com/security/data/cve/CVE-2026-74376.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: md/raid10: reset read_slot when reusing r10bio f... | 9.8 | 0.0050 | | | [CVE-2026-74255](https://patchblox.com/security/data/cve/CVE-2026-74255.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in tipc_l2_send_msg() Syzbot repo... | 9.8 | 0.0050 | | | [CVE-2026-80681](https://patchblox.com/security/data/cve/CVE-2026-80681.md) | Urgent | vxlan: re-fetch eth header after route_shortcircuit() | 9.8 | 0.0050 | | | [CVE-2026-68121](https://patchblox.com/security/data/cve/CVE-2026-68121.md) | Urgent | pppoe: reload header pointer after dev_hard_header() | 9.8 | 0.0037 | | | [CVE-2026-64534](https://patchblox.com/security/data/cve/CVE-2026-64534.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_un... | 9.8 | 0.0032 | | | [CVE-2026-68354](https://patchblox.com/security/data/cve/CVE-2026-68354.md) | Urgent | firewire: net: Fix fragmented datagram reassembly | 9.8 | 0.0028 | | | [CVE-2026-68198](https://patchblox.com/security/data/cve/CVE-2026-68198.md) | Urgent | wifi: ath6kl: fix use-after-free in aggr_reset_state() | 9.8 | 0.0028 | | | [CVE-2026-68402](https://patchblox.com/security/data/cve/CVE-2026-68402.md) | Urgent | wifi: cfg80211: bound element ID read when checking non-inheritance | 9.8 | 0.0027 | | | [CVE-2026-68212](https://patchblox.com/security/data/cve/CVE-2026-68212.md) | Urgent | media: saa7134: Fix a possible memory leak in saa7134_video_init1 | 9.8 | 0.0022 | | | [CVE-2026-68214](https://patchblox.com/security/data/cve/CVE-2026-68214.md) | Urgent | media: rtl2832: fix use-after-free in rtl2832_remove() | 9.8 | 0.0022 | | | [CVE-2026-68218](https://patchblox.com/security/data/cve/CVE-2026-68218.md) | Urgent | media: pci: dm1105: Free allocated workqueue | 9.8 | 0.0022 | | | [CVE-2026-68180](https://patchblox.com/security/data/cve/CVE-2026-68180.md) | Urgent | intel_th: fix MSC output device reference leak | 9.8 | 0.0022 | | | [CVE-2026-68349](https://patchblox.com/security/data/cve/CVE-2026-68349.md) | Urgent | wifi: carl9170: fix buffer overflow in rx_stream failover path | 9.8 | 0.0020 | | | [CVE-2026-68132](https://patchblox.com/security/data/cve/CVE-2026-68132.md) | Urgent | super: fix emergency thaw deadlock on frozen block devices | 9.8 | 0.0018 | | | [CVE-2026-68146](https://patchblox.com/security/data/cve/CVE-2026-68146.md) | Urgent | ftrace: Add global mutex to serialize trace_parser access | 9.8 | 0.0018 | | | [CVE-2026-68325](https://patchblox.com/security/data/cve/CVE-2026-68325.md) | Urgent | iommu/amd: Bound the early ACPI HID map | 9.8 | 0.0018 | | | [CVE-2026-68406](https://patchblox.com/security/data/cve/CVE-2026-68406.md) | Urgent | wifi: cfg80211: validate PMSR FTM preamble range | 9.8 | 0.0018 | | | [CVE-2026-72085](https://patchblox.com/security/data/cve/CVE-2026-72085.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command in... | 9.3 | 0.0018 | | | [CVE-2026-64562](https://patchblox.com/security/data/cve/CVE-2026-64562.md) | Urgent | KVM: nVMX: Hide shadow VMCS right after VMCLEAR | 9.8 | 0.0016 | | | [CVE-2026-80715](https://patchblox.com/security/data/cve/CVE-2026-80715.md) | Urgent | igc: remove napi_synchronize() in igc_down() | 9.8 | 0.0016 | | | [CVE-2026-74517](https://patchblox.com/security/data/cve/CVE-2026-74517.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Cancel delayed I/O APIC EOI handling b... | 9.3 | 0.0014 | | | [CVE-2026-68377](https://patchblox.com/security/data/cve/CVE-2026-68377.md) | Urgent | net/sched: act_tunnel_key: Defer dst_release to RCU callback | 9.8 | 0.0013 | | | [CVE-2026-68153](https://patchblox.com/security/data/cve/CVE-2026-68153.md) | Urgent | libceph: remove debugfs files before client teardown | 9.8 | 0.0013 | | | [CVE-2026-68142](https://patchblox.com/security/data/cve/CVE-2026-68142.md) | Urgent | geneve: require CAP_NET_ADMIN in the device netns for changelink | 9.8 | 0.0012 | | | [CVE-2026-68143](https://patchblox.com/security/data/cve/CVE-2026-68143.md) | Urgent | net: slip: serialize receive against buffer reallocation | 9.8 | 0.0011 | | | [CVE-2026-74469](https://patchblox.com/security/data/cve/CVE-2026-74469.md) | High | sctp: prevent peer transport count overflow | 8.8 | 0.0147 | | | [CVE-2026-68159](https://patchblox.com/security/data/cve/CVE-2026-68159.md) | High | libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE | 9.8 | 0.0075 | | | [CVE-2026-72083](https://patchblox.com/security/data/cve/CVE-2026-72083.md) | High | kernel-debug-modules-extra: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: s... | 9.8 | 0.0072 | | | [CVE-2026-72409](https://patchblox.com/security/data/cve/CVE-2026-72409.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: mvneta: re-enable percpu interrupt on resum... | 7.5 | 0.0072 | | | [CVE-2026-72418](https://patchblox.com/security/data/cve/CVE-2026-72418.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: prevent connlimit drops... | 7.5 | 0.0072 | | | [CVE-2026-72502](https://patchblox.com/security/data/cve/CVE-2026-72502.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid... | 7.5 | 0.0072 | | | [CVE-2026-74321](https://patchblox.com/security/data/cve/CVE-2026-74321.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid pointer dereference in __btrf... | 7.5 | 0.0072 | | | [CVE-2026-80646](https://patchblox.com/security/data/cve/CVE-2026-80646.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in __in6... | 7.5 | 0.0072 | | | [CVE-2026-68154](https://patchblox.com/security/data/cve/CVE-2026-68154.md) | High | libceph: reject zero bucket types in crush_decode | 9.8 | 0.0071 | | | [CVE-2026-68158](https://patchblox.com/security/data/cve/CVE-2026-68158.md) | High | libceph: Fix multiplication overflow in decode_new_up_state_weight() | 9.8 | 0.0071 | | | [CVE-2026-68155](https://patchblox.com/security/data/cve/CVE-2026-68155.md) | High | libceph: Reject monmaps advertising zero monitors | 8.8 | 0.0070 | | | [CVE-2026-72242](https://patchblox.com/security/data/cve/CVE-2026-72242.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk_socket dereference in selinux_... | 8.8 | 0.0070 | | | [CVE-2026-68157](https://patchblox.com/security/data/cve/CVE-2026-68157.md) | High | libceph: guard missing CRUSH type name lookup | 7.8 | 0.0070 | | | [CVE-2026-72247](https://patchblox.com/security/data/cve/CVE-2026-72247.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: fix zone comparison in... | 7.5 | 0.0070 | | | [CVE-2026-72253](https://patchblox.com/security/data/cve/CVE-2026-72253.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: validate skb_dst()... | 7.5 | 0.0070 | | | [CVE-2026-74282](https://patchblox.com/security/data/cve/CVE-2026-74282.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tipc: prevent snt_unacked underflow on CONN_ACK... | 7.5 | 0.0070 | | | [CVE-2026-68156](https://patchblox.com/security/data/cve/CVE-2026-68156.md) | High | libceph: refresh auth->authorizer_buf{,_len} after authorizer update | 9.8 | 0.0069 | | | [CVE-2026-74281](https://patchblox.com/security/data/cve/CVE-2026-74281.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer b... | 7.5 | 0.0068 | | | [CVE-2026-72231](https://patchblox.com/security/data/cve/CVE-2026-72231.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid request storms during pend... | 7.5 | 0.0068 | | | [CVE-2026-53399](https://patchblox.com/security/data/cve/CVE-2026-53399.md) | High | nfsd: release layout stid on setlease failure | 9.8 | 0.0066 | | | [CVE-2026-64530](https://patchblox.com/security/data/cve/CVE-2026-64530.md) | High | net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle | 9.8 | 0.0066 | | | [CVE-2026-72107](https://patchblox.com/security/data/cve/CVE-2026-72107.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-... | 8.8 | 0.0065 | | | [CVE-2026-72160](https://patchblox.com/security/data/cve/CVE-2026-72160.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject dinodes with non-canonical i_mode... | 8.8 | 0.0065 | | | [CVE-2026-72310](https://patchblox.com/security/data/cve/CVE-2026-72310.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl b... | 8.1 | 0.0064 | | | [CVE-2026-68376](https://patchblox.com/security/data/cve/CVE-2026-68376.md) | High | sctp: fix auth_hmacs array size in struct sctp_cookie | 8.1 | 0.0061 | | | [CVE-2026-72021](https://patchblox.com/security/data/cve/CVE-2026-72021.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state... | 8.2 | 0.0059 | | | [CVE-2026-72035](https://patchblox.com/security/data/cve/CVE-2026-72035.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: Replace direct dequeue ca... | 8.2 | 0.0059 | | | [CVE-2026-72057](https://patchblox.com/security/data/cve/CVE-2026-72057.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: preserve tc_skb_cb across def... | 8.2 | 0.0059 | | | [CVE-2026-68300](https://patchblox.com/security/data/cve/CVE-2026-68300.md) | High | sctp: auth: verify auth requirement when auth_chunk is NULL | 9.8 | 0.0058 | | | [CVE-2026-74480](https://patchblox.com/security/data/cve/CVE-2026-74480.md) | High | net: bridge: stop fast-leave after deleting a port group | 9.8 | 0.0058 | | | [CVE-2026-80590](https://patchblox.com/security/data/cve/CVE-2026-80590.md) | High | inet: frags: strip GSO state from fragments before reassembly | 8.8 | 0.0058 | | | [CVE-2026-64545](https://patchblox.com/security/data/cve/CVE-2026-64545.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_re... | 7.5 | 0.0058 | | | [CVE-2026-68123](https://patchblox.com/security/data/cve/CVE-2026-68123.md) | High | openvswitch: fix GSO userspace truncation underflow | 9.8 | 0.0055 | | | [CVE-2026-72099](https://patchblox.com/security/data/cve/CVE-2026-72099.md) | High | kernel-64k-debug-devel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: t... | 7.8 | 0.0055 | | | [CVE-2026-74597](https://patchblox.com/security/data/cve/CVE-2026-74597.md) | High | ip6_tunnel: clear skb2->cb[] in ip6ip6_err() | 9.8 | 0.0054 | | | [CVE-2026-64450](https://patchblox.com/security/data/cve/CVE-2026-64450.md) | High | tipc: fix out-of-bounds read in broadcast Gap ACK blocks | 9.1 | 0.0054 | | | [CVE-2026-74746](https://patchblox.com/security/data/cve/CVE-2026-74746.md) | High | netfilter: flowtable: publish GC-visible tuple last | 9.8 | 0.0054 | | | [CVE-2026-68096](https://patchblox.com/security/data/cve/CVE-2026-68096.md) | High | audit: fix recursive locking deadlock in audit_dupe_exe() | 7.5 | 0.0053 | | | [CVE-2026-53392](https://patchblox.com/security/data/cve/CVE-2026-53392.md) | High | NFSv4/flexfiles: reject zero filehandle version count | 8.8 | 0.0053 | | | [CVE-2026-68117](https://patchblox.com/security/data/cve/CVE-2026-68117.md) | High | tipc: clear sock->sk on the failed-insert path in tipc_sk_create() | 9.8 | 0.0053 | | | [CVE-2026-74473](https://patchblox.com/security/data/cve/CVE-2026-74473.md) | High | vxlan: use pskb_network_may_pull() in route_shortcircuit() | 9.8 | 0.0053 | | | [CVE-2026-74495](https://patchblox.com/security/data/cve/CVE-2026-74495.md) | High | igbvf: Fix leak in TX DMA error cleanup | 9.8 | 0.0051 | | | [CVE-2026-74669](https://patchblox.com/security/data/cve/CVE-2026-74669.md) | High | ipvs: clear IPv4 options after rebasing tunnel ICMP errors | 9.8 | 0.0051 | | | [CVE-2026-80528](https://patchblox.com/security/data/cve/CVE-2026-80528.md) | High | ceph: avoid fs reclaim while using current->journal_info | 9.8 | 0.0051 | | | [CVE-2026-80558](https://patchblox.com/security/data/cve/CVE-2026-80558.md) | High | libceph: Avoid using invalid osd indices from primary_temp | 9.8 | 0.0051 | | | [CVE-2026-80561](https://patchblox.com/security/data/cve/CVE-2026-80561.md) | High | libceph: fix multiple unsafe decodes in decode_locker() | 9.8 | 0.0051 | | | [CVE-2026-64355](https://patchblox.com/security/data/cve/CVE-2026-64355.md) | High | bpf: Reject fragmented frames in devmap | 9.8 | 0.0051 | | | [CVE-2026-74616](https://patchblox.com/security/data/cve/CVE-2026-74616.md) | High | xdp: reject clones that overrun skb_shared_info tailroom | 9.8 | 0.0051 | | | [CVE-2026-68315](https://patchblox.com/security/data/cve/CVE-2026-68315.md) | High | sctp: validate stream count in sctp_process_strreset_inreq() | 8.8 | 0.0051 | | | [CVE-2026-68129](https://patchblox.com/security/data/cve/CVE-2026-68129.md) | High | gve: fix Rx queue stall on alloc failure | 7.5 | 0.0051 | | | [CVE-2026-74730](https://patchblox.com/security/data/cve/CVE-2026-74730.md) | High | NFS: Pin the 'struct nfs_server' during a FREE_STATEID call | 9.8 | 0.0051 | | | [CVE-2026-64560](https://patchblox.com/security/data/cve/CVE-2026-64560.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-lead... | 7.8 | 0.0050 | | | [CVE-2026-68299](https://patchblox.com/security/data/cve/CVE-2026-68299.md) | High | vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets | 8.8 | 0.0050 | | | [CVE-2026-80527](https://patchblox.com/security/data/cve/CVE-2026-80527.md) | High | ceph: fix hanging __ceph_get_caps() with stale mds_wanted | 7.8 | 0.0050 | | | [CVE-2026-64312](https://patchblox.com/security/data/cve/CVE-2026-64312.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parall... | 7.5 | 0.0050 | | | [CVE-2026-74523](https://patchblox.com/security/data/cve/CVE-2026-74523.md) | High | qede: sync udp_tunnel ports outside qede_lock in the recovery path | 7.5 | 0.0050 | | | [CVE-2026-74625](https://patchblox.com/security/data/cve/CVE-2026-74625.md) | High | netfilter: bridge: release template ct on non-IP path | 7.5 | 0.0050 | | | [CVE-2026-74717](https://patchblox.com/security/data/cve/CVE-2026-74717.md) | High | net/mlx5: fw_tracer, return NULL on create error | 7.5 | 0.0050 | | | [CVE-2026-74705](https://patchblox.com/security/data/cve/CVE-2026-74705.md) | High | udp: fix potential use-after-free in tunnel segmentation | 10.0 | 0.0050 | | | [CVE-2026-74586](https://patchblox.com/security/data/cve/CVE-2026-74586.md) | High | sctp: clear new_transport when removing a peer | 9.8 | 0.0050 | | | [CVE-2026-74587](https://patchblox.com/security/data/cve/CVE-2026-74587.md) | High | sctp: fix use-after-free of cached ASCONF chunk | 9.8 | 0.0050 | | | [CVE-2026-74588](https://patchblox.com/security/data/cve/CVE-2026-74588.md) | High | sctp: keep chunk->transport in step with the list it is queued on | 9.8 | 0.0050 | | | [CVE-2026-74688](https://patchblox.com/security/data/cve/CVE-2026-74688.md) | High | sctp: clear control chunk transport if it is being removed | 9.8 | 0.0050 | | | [CVE-2026-68082](https://patchblox.com/security/data/cve/CVE-2026-68082.md) | High | libceph: fix two unsafe bare decodes in decode_lockers() | 9.8 | 0.0050 | | | [CVE-2026-74621](https://patchblox.com/security/data/cve/CVE-2026-74621.md) | High | net/sched: act_ct: fix sk_buff leak when the header checks reject a packet | 7.5 | 0.0049 | | | [CVE-2026-74696](https://patchblox.com/security/data/cve/CVE-2026-74696.md) | High | tcp: fix TFO max_qlen accounting across reuseport migration | 7.5 | 0.0049 | | | [CVE-2026-80714](https://patchblox.com/security/data/cve/CVE-2026-80714.md) | High | ipvs: do not propagate one-packet flag to synced conns | 9.8 | 0.0048 | | | [CVE-2026-64448](https://patchblox.com/security/data/cve/CVE-2026-64448.md) | High | smb: client: restrict implied bcc[0] exemption to responses without data area | 8.2 | 0.0046 | | | [CVE-2026-74490](https://patchblox.com/security/data/cve/CVE-2026-74490.md) | High | tipc: avoid use-after-free in poll trace queue dumps | 8.8 | 0.0046 | | | [CVE-2026-74475](https://patchblox.com/security/data/cve/CVE-2026-74475.md) | High | vxlan: use neigh_ha_snapshot() in route_shortcircuit() | 10.0 | 0.0045 | | | [CVE-2026-74697](https://patchblox.com/security/data/cve/CVE-2026-74697.md) | High | bnxt_en: Disable EOP for TPA on all chips to prevent data corruption | 8.2 | 0.0045 | | | [CVE-2026-64380](https://patchblox.com/security/data/cve/CVE-2026-64380.md) | High | smb: client: harden POSIX SID length parsing | 8.2 | 0.0044 | | | [CVE-2026-74704](https://patchblox.com/security/data/cve/CVE-2026-74704.md) | High | net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter | 8.2 | 0.0044 | | | [CVE-2026-63830](https://patchblox.com/security/data/cve/CVE-2026-63830.md) | High | net: skmsg: preserve sg.copy across SG transforms | 9.4 | 0.0044 | | | [CVE-2026-74598](https://patchblox.com/security/data/cve/CVE-2026-74598.md) | High | ipv6: fix Route Information option length validation | 7.5 | 0.0043 | | | [CVE-2026-74581](https://patchblox.com/security/data/cve/CVE-2026-74581.md) | High | net: ipv6: clear suppressed fib6 rule result | 9.8 | 0.0042 | | | [CVE-2026-74340](https://patchblox.com/security/data/cve/CVE-2026-74340.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count... | 8.1 | 0.0042 | | | [CVE-2026-74410](https://patchblox.com/security/data/cve/CVE-2026-74410.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX descr... | 8.1 | 0.0042 | | | [CVE-2026-80599](https://patchblox.com/security/data/cve/CVE-2026-80599.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible eth_hdr proto... | 8.1 | 0.0042 | | | [CVE-2026-68352](https://patchblox.com/security/data/cve/CVE-2026-68352.md) | High | wifi: ath6kl: fix OOB read from firmware IE lengths in connect event | 8.3 | 0.0042 | | | [CVE-2026-74408](https://patchblox.com/security/data/cve/CVE-2026-74408.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx sta... | 8.8 | 0.0041 | | | [CVE-2026-80604](https://patchblox.com/security/data/cve/CVE-2026-80604.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for nu... | 8.8 | 0.0041 | | | [CVE-2026-74580](https://patchblox.com/security/data/cve/CVE-2026-74580.md) | High | vhost: reset the vring metadata cache on vring reconfiguration | 8.8 | 0.0041 | | | [CVE-2026-68192](https://patchblox.com/security/data/cve/CVE-2026-68192.md) | High | wifi: brcmfmac: make release_scratchbuffers idempotent | 8.8 | 0.0041 | | | [CVE-2026-80601](https://patchblox.com/security/data/cve/CVE-2026-80601.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only aft... | 8.8 | 0.0040 | | | [CVE-2026-74556](https://patchblox.com/security/data/cve/CVE-2026-74556.md) | High | scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer | 9.8 | 0.0040 | | | [CVE-2026-80586](https://patchblox.com/security/data/cve/CVE-2026-80586.md) | High | mptcp: options: reset DSS fields in case of unexpected size | 9.8 | 0.0040 | | | [CVE-2026-46135](https://patchblox.com/security/data/cve/CVE-2026-46135.md) | High | nvmet-tcp: fix race between ICReq handling and queue teardown | 9.8 | 0.0040 | | | [CVE-2026-74569](https://patchblox.com/security/data/cve/CVE-2026-74569.md) | High | netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() | 9.8 | 0.0039 | | | [CVE-2026-64374](https://patchblox.com/security/data/cve/CVE-2026-64374.md) | High | sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT | 7.5 | 0.0039 | | | [CVE-2026-68199](https://patchblox.com/security/data/cve/CVE-2026-68199.md) | High | wifi: ath6kl: fix OOB access from firmware ADDBA window size | 8.8 | 0.0038 | | | [CVE-2026-68433](https://patchblox.com/security/data/cve/CVE-2026-68433.md) | High | libceph: bound get_version reply decode to front len | 8.6 | 0.0036 | | | [CVE-2026-64313](https://patchblox.com/security/data/cve/CVE-2026-64313.md) | High | crypto: ecc - Fix carry overflow in vli multiplication | 8.8 | 0.0036 | | | [CVE-2026-64364](https://patchblox.com/security/data/cve/CVE-2026-64364.md) | High | HID: multitouch: fix out-of-bounds bit access on mt_io_flags | 8.8 | 0.0036 | | | [CVE-2026-72121](https://patchblox.com/security/data/cve/CVE-2026-72121.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and t... | 8.8 | 0.0035 | | | [CVE-2026-72124](https://patchblox.com/security/data/cve/CVE-2026-72124.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under... | 8.8 | 0.0035 | | | [CVE-2026-72233](https://patchblox.com/security/data/cve/CVE-2026-72233.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: reacquire gw address after skb... | 8.8 | 0.0034 | | | [CVE-2026-72235](https://patchblox.com/security/data/cve/CVE-2026-72235.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: batman-adv: retrieve ethhdr after potential skb... | 8.8 | 0.0034 | | | [CVE-2024-58240](https://patchblox.com/security/data/cve/CVE-2024-58240.md) | High | tls: separate no-async decryption request handling from async | 7.8 | 0.0034 | | | [CVE-2026-64435](https://patchblox.com/security/data/cve/CVE-2026-64435.md) | High | audit: Fix data races of skb_queue_len() readers on audit_queue | 8.2 | 0.0033 | | | [CVE-2026-74557](https://patchblox.com/security/data/cve/CVE-2026-74557.md) | High | scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer | 7.5 | 0.0033 | | | [CVE-2026-80707](https://patchblox.com/security/data/cve/CVE-2026-80707.md) | High | can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer | 7.5 | 0.0033 | | | [CVE-2026-80717](https://patchblox.com/security/data/cve/CVE-2026-80717.md) | High | sctp: validate Adaptation Indication parameter length | 7.5 | 0.0033 | | | [CVE-2026-64445](https://patchblox.com/security/data/cve/CVE-2026-64445.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and... | 8.8 | 0.0032 | | | [CVE-2026-68125](https://patchblox.com/security/data/cve/CVE-2026-68125.md) | High | mac802154: llsec: reject frames shorter than the authentication tag | 8.8 | 0.0032 | | | [CVE-2026-64379](https://patchblox.com/security/data/cve/CVE-2026-64379.md) | High | smb: client: mask server-provided mode to 07777 in modefromsid | 7.8 | 0.0031 | | | [CVE-2026-72115](https://patchblox.com/security/data/cve/CVE-2026-72115.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for AN... | 8.1 | 0.0030 | | | [CVE-2026-74649](https://patchblox.com/security/data/cve/CVE-2026-74649.md) | High | staging: rtl8723bs: fix missing shared-key auth challenge length check | 8.8 | 0.0029 | | | [CVE-2026-64442](https://patchblox.com/security/data/cve/CVE-2026-64442.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in... | 8.1 | 0.0029 | | | [CVE-2026-64444](https://patchblox.com/security/data/cve/CVE-2026-64444.md) | High | staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop | 8.1 | 0.0029 | | | [CVE-2026-68353](https://patchblox.com/security/data/cve/CVE-2026-68353.md) | High | wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler | 8.1 | 0.0029 | | | [CVE-2026-64547](https://patchblox.com/security/data/cve/CVE-2026-64547.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before pa... | 8.1 | 0.0028 | | | [CVE-2026-64443](https://patchblox.com/security/data/cve/CVE-2026-64443.md) | High | staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop | 8.1 | 0.0028 | | | [CVE-2026-64540](https://patchblox.com/security/data/cve/CVE-2026-64540.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in geneli... | 8.1 | 0.0028 | | | [CVE-2026-68373](https://patchblox.com/security/data/cve/CVE-2026-68373.md) | High | wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() | 8.1 | 0.0028 | | | [CVE-2026-64406](https://patchblox.com/security/data/cve/CVE-2026-64406.md) | High | Bluetooth: fix UAF in bt_accept_dequeue() | 8.0 | 0.0028 | | | [CVE-2026-74651](https://patchblox.com/security/data/cve/CVE-2026-74651.md) | High | staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() | 8.1 | 0.0027 | | | [CVE-2026-64440](https://patchblox.com/security/data/cve/CVE-2026-64440.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT_caps_han... | 8.1 | 0.0027 | | | [CVE-2026-64403](https://patchblox.com/security/data/cve/CVE-2026-64403.md) | High | Bluetooth: L2CAP: validate option length before reading conf opt value | 7.1 | 0.0027 | | | [CVE-2026-64408](https://patchblox.com/security/data/cve/CVE-2026-64408.md) | High | Bluetooth: bnep: pin L2CAP connection during netdev registration | 8.8 | 0.0026 | | | [CVE-2026-68091](https://patchblox.com/security/data/cve/CVE-2026-68091.md) | High | HID: wacom: stop hardware after post-start probe failures | 8.8 | 0.0026 | | | [CVE-2026-68326](https://patchblox.com/security/data/cve/CVE-2026-68326.md) | High | wifi: mwifiex: bound uAP association event IEs to the event buffer | 8.8 | 0.0026 | | | [CVE-2026-74508](https://patchblox.com/security/data/cve/CVE-2026-74508.md) | High | Bluetooth: HIDP: reject frames without a transaction header | 8.8 | 0.0026 | | | [CVE-2026-68425](https://patchblox.com/security/data/cve/CVE-2026-68425.md) | High | IB/mad: Drop unmatched RMPP responses before reassembly | 7.1 | 0.0026 | | | [CVE-2026-64536](https://patchblox.com/security/data/cve/CVE-2026-64536.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_tk... | 8.1 | 0.0026 | | | [CVE-2026-64441](https://patchblox.com/security/data/cve/CVE-2026-64441.md) | High | staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() | 8.8 | 0.0026 | | | [CVE-2026-72108](https://patchblox.com/security/data/cve/CVE-2026-72108.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consiste... | 7.8 | 0.0026 | | | [CVE-2026-64434](https://patchblox.com/security/data/cve/CVE-2026-64434.md) | High | Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref | 8.8 | 0.0026 | | | [CVE-2026-64554](https://patchblox.com/security/data/cve/CVE-2026-64554.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in... | 8.8 | 0.0026 | | | [CVE-2026-74488](https://patchblox.com/security/data/cve/CVE-2026-74488.md) | High | wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames | 8.8 | 0.0026 | | | [CVE-2026-74540](https://patchblox.com/security/data/cve/CVE-2026-74540.md) | High | Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp | 8.8 | 0.0026 | | | [CVE-2026-64206](https://patchblox.com/security/data/cve/CVE-2026-64206.md) | High | Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock | 8.8 | 0.0025 | | | [CVE-2026-64586](https://patchblox.com/security/data/cve/CVE-2026-64586.md) | High | wifi: brcmfmac: drain bus_reset work on device removal | 8.8 | 0.0025 | | | [CVE-2026-74507](https://patchblox.com/security/data/cve/CVE-2026-74507.md) | High | Bluetooth: HIDP: validate numbered report payloads | 7.1 | 0.0024 | | | [CVE-2026-80722](https://patchblox.com/security/data/cve/CVE-2026-80722.md) | High | wifi: mac80211: validate individual TWT params before driver setup | 9.8 | 0.0024 | | | [CVE-2026-74575](https://patchblox.com/security/data/cve/CVE-2026-74575.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-af... | 8.8 | 0.0024 | | | [CVE-2026-68398](https://patchblox.com/security/data/cve/CVE-2026-68398.md) | High | ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF | 9.8 | 0.0023 | | | [CVE-2026-68414](https://patchblox.com/security/data/cve/CVE-2026-68414.md) | High | wifi: cfg80211: cancel sched scan results work on unregister | 7.5 | 0.0023 | | | [CVE-2026-68138](https://patchblox.com/security/data/cve/CVE-2026-68138.md) | High | net/sched: serialize qdisc_rtab_list against concurrent get/put | 8.8 | 0.0022 | | | [CVE-2026-64452](https://patchblox.com/security/data/cve/CVE-2026-64452.md) | High | 6lowpan: fix NHC entry use-after-free on error path | 7.1 | 0.0022 | | | [CVE-2026-68351](https://patchblox.com/security/data/cve/CVE-2026-68351.md) | High | wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read | 7.1 | 0.0022 | | | [CVE-2026-68188](https://patchblox.com/security/data/cve/CVE-2026-68188.md) | High | Bluetooth: RFCOMM: Fix session UAF in set_termios | 8.8 | 0.0022 | | | [CVE-2026-68186](https://patchblox.com/security/data/cve/CVE-2026-68186.md) | High | binfmt_misc: set have_execfd only once the interpreter is opened | 7.8 | 0.0022 | | | [CVE-2026-68368](https://patchblox.com/security/data/cve/CVE-2026-68368.md) | High | usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() | 7.1 | 0.0022 | | | [CVE-2026-72218](https://patchblox.com/security/data/cve/CVE-2026-72218.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file refcount leak on cached nlm... | 7.0 | 0.0022 | | | [CVE-2026-72219](https://patchblox.com/security/data/cve/CVE-2026-72219.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file leak when nlm_do_fopen() fa... | 7.0 | 0.0022 | | | [CVE-2026-72306](https://patchblox.com/security/data/cve/CVE-2026-72306.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: vduse: Fix race in vduse_dev_msg_sync and vduse_... | n/a | 0.0022 | | | [CVE-2026-63810](https://patchblox.com/security/data/cve/CVE-2026-63810.md) | High | block: Avoid mounting the bdev pseudo-filesystem in userspace | 7.1 | 0.0021 | | | [CVE-2026-64572](https://patchblox.com/security/data/cve/CVE-2026-64572.md) | High | ipv4: fib: free fib_alias with kfree_rcu() on insert error path | 8.8 | 0.0020 | | | [CVE-2026-68162](https://patchblox.com/security/data/cve/CVE-2026-68162.md) | High | sctp: avoid auth_enable sysctl UAF during netns teardown | 8.8 | 0.0020 | | | [CVE-2026-80593](https://patchblox.com/security/data/cve/CVE-2026-80593.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_atk0110) Check package count before... | 8.4 | 0.0020 | | | [CVE-2026-68255](https://patchblox.com/security/data/cve/CVE-2026-68255.md) | High | drm/virtio: bound EDID block reads to the response buffer | 7.7 | 0.0019 | | | [CVE-2026-72116](https://patchblox.com/security/data/cve/CVE-2026-72116.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device remov... | 7.1 | 0.0019 | | | [CVE-2026-72289](https://patchblox.com/security/data/cve/CVE-2026-72289.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: t... | 9.3 | 0.0019 | | | [CVE-2026-72298](https://patchblox.com/security/data/cve/CVE-2026-72298.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: L... | 8.8 | 0.0019 | | | [CVE-2026-74256](https://patchblox.com/security/data/cve/CVE-2026-74256.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpf_msg_po... | 8.4 | 0.0019 | | | [CVE-2026-64484](https://patchblox.com/security/data/cve/CVE-2026-64484.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ALSA: es1938: check snd_ctl_new1() return value... | n/a | 0.0019 | | | [CVE-2026-68363](https://patchblox.com/security/data/cve/CVE-2026-68363.md) | High | wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request | 8.8 | 0.0018 | | | [CVE-2026-64470](https://patchblox.com/security/data/cve/CVE-2026-64470.md) | High | Bluetooth: btusb: fix use-after-free on marvell probe failure | 7.1 | 0.0018 | | | [CVE-2026-64471](https://patchblox.com/security/data/cve/CVE-2026-64471.md) | High | Bluetooth: btusb: fix use-after-free on registration failure | 7.1 | 0.0018 | | | [CVE-2026-68350](https://patchblox.com/security/data/cve/CVE-2026-68350.md) | High | wifi: carl9170: fix OOB read from off-by-two in TX status handler | 7.1 | 0.0018 | | | [CVE-2026-68365](https://patchblox.com/security/data/cve/CVE-2026-68365.md) | High | USB: serial: io_edgeport: cap received transmit credits | 7.1 | 0.0018 | | | [CVE-2026-64483](https://patchblox.com/security/data/cve/CVE-2026-64483.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count t... | 7.0 | 0.0018 | | | [CVE-2026-64461](https://patchblox.com/security/data/cve/CVE-2026-64461.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fai... | n/a | 0.0018 | | | [CVE-2025-38560](https://patchblox.com/security/data/cve/CVE-2025-38560.md) | High | x86/sev: Evict cache lines during SNP memory validation | 7.5 | 0.0018 | | | [CVE-2026-68202](https://patchblox.com/security/data/cve/CVE-2026-68202.md) | High | ALSA: seq: close a re-opened queue timer in the destructor | 7.8 | 0.0018 | | | [CVE-2026-68213](https://patchblox.com/security/data/cve/CVE-2026-68213.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: media: rtl2832_sdr: Return queued buffers on sta... | 7.8 | 0.0018 | | | [CVE-2026-68216](https://patchblox.com/security/data/cve/CVE-2026-68216.md) | High | media: pwc: Return queued buffers on start_streaming() failure | 7.8 | 0.0018 | | | [CVE-2026-72066](https://patchblox.com/security/data/cve/CVE-2026-72066.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output... | 7.8 | 0.0018 | | | [CVE-2026-72067](https://patchblox.com/security/data/cve/CVE-2026-72067.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback err... | 7.8 | 0.0018 | | | [CVE-2026-72225](https://patchblox.com/security/data/cve/CVE-2026-72225.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: jbd2: fix integer underflow in jbd2_journal_init... | 7.8 | 0.0018 | | | [CVE-2026-64514](https://patchblox.com/security/data/cve/CVE-2026-64514.md) | High | userfaultfd: gate must_wait writability check on pte_present() | 7.1 | 0.0018 | | | [CVE-2026-74498](https://patchblox.com/security/data/cve/CVE-2026-74498.md) | High | ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set | 7.0 | 0.0018 | | | [CVE-2026-74499](https://patchblox.com/security/data/cve/CVE-2026-74499.md) | High | ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() | 7.0 | 0.0018 | | | [CVE-2026-74682](https://patchblox.com/security/data/cve/CVE-2026-74682.md) | High | ALSA: usb-audio: fix OOB write on Type II inbound URBs | 7.0 | 0.0018 | | | [CVE-2026-64503](https://patchblox.com/security/data/cve/CVE-2026-64503.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on w... | n/a | 0.0018 | | | [CVE-2026-72255](https://patchblox.com/security/data/cve/CVE-2026-72255.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: t... | 8.8 | 0.0018 | | | [CVE-2026-68461](https://patchblox.com/security/data/cve/CVE-2026-68461.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields... | 7.8 | 0.0018 | | | [CVE-2026-72282](https://patchblox.com/security/data/cve/CVE-2026-72282.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvm_io_bus_get_dev() locking responsib... | 7.8 | 0.0018 | | | [CVE-2026-72314](https://patchblox.com/security/data/cve/CVE-2026-72314.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: regulator: core: regulator_lock_two() should tes... | 7.8 | 0.0018 | | | [CVE-2026-72350](https://patchblox.com/security/data/cve/CVE-2026-72350.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_u32: reject invalid shift counts... | 7.8 | 0.0018 | | | [CVE-2026-72400](https://patchblox.com/security/data/cve/CVE-2026-72400.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed f... | 7.8 | 0.0018 | | | [CVE-2026-74297](https://patchblox.com/security/data/cve/CVE-2026-74297.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE si... | 7.8 | 0.0018 | | | [CVE-2026-74305](https://patchblox.com/security/data/cve/CVE-2026-74305.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for pr... | 7.8 | 0.0018 | | | [CVE-2026-80677](https://patchblox.com/security/data/cve/CVE-2026-80677.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: driver core: use READ_ONCE() for dev->driver in... | 7.8 | 0.0018 | | | [CVE-2026-72347](https://patchblox.com/security/data/cve/CVE-2026-72347.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_connmark: reject invalid shift par... | 7.3 | 0.0017 | | | [CVE-2026-72019](https://patchblox.com/security/data/cve/CVE-2026-72019.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: macsec: don't read an unset MAC header in macsec... | 7.3 | 0.0017 | | | [CVE-2026-74346](https://patchblox.com/security/data/cve/CVE-2026-74346.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registrati... | n/a | 0.0017 | | | [CVE-2026-64317](https://patchblox.com/security/data/cve/CVE-2026-64317.md) | High | isofs: bound Rock Ridge symlink components to the SL record | 7.1 | 0.0017 | | | [CVE-2026-64604](https://patchblox.com/security/data/cve/CVE-2026-64604.md) | High | KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode | 8.4 | 0.0017 | | | [CVE-2026-72126](https://patchblox.com/security/data/cve/CVE-2026-72126.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronize_rcu()... | 7.8 | 0.0017 | | | [CVE-2026-72476](https://patchblox.com/security/data/cve/CVE-2026-72476.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dma_r... | 7.8 | 0.0017 | | | [CVE-2026-80622](https://patchblox.com/security/data/cve/CVE-2026-80622.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: char: tlclk: fix use-after-free in tlclk_cleanup... | 7.8 | 0.0017 | | | [CVE-2026-53402](https://patchblox.com/security/data/cve/CVE-2026-53402.md) | High | fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() | 7.1 | 0.0017 | | | [CVE-2026-74283](https://patchblox.com/security/data/cve/CVE-2026-74283.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutato... | 9.8 | 0.0017 | | | [CVE-2026-64276](https://patchblox.com/security/data/cve/CVE-2026-64276.md) | High | Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count | 8.8 | 0.0017 | | | [CVE-2026-64304](https://patchblox.com/security/data/cve/CVE-2026-64304.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths... | 8.8 | 0.0017 | | | [CVE-2026-72102](https://patchblox.com/security/data/cve/CVE-2026-72102.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dm_early_create: fix freeing used table on dm_re... | 8.8 | 0.0017 | | | [CVE-2026-72136](https://patchblox.com/security/data/cve/CVE-2026-72136.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_interface: require CAP_NET_ADMIN in t... | 8.8 | 0.0017 | | | [CVE-2026-64270](https://patchblox.com/security/data/cve/CVE-2026-64270.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an oversized device packe... | 7.8 | 0.0017 | | | [CVE-2026-64271](https://patchblox.com/security/data/cve/CVE-2026-64271.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the packet index on ever... | 7.8 | 0.0017 | | | [CVE-2026-64272](https://patchblox.com/security/data/cve/CVE-2026-64272.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S a... | 7.8 | 0.0017 | | | [CVE-2026-64296](https://patchblox.com/security/data/cve/CVE-2026-64296.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfat_find_dir_e... | 7.8 | 0.0017 | | | [CVE-2026-64322](https://patchblox.com/security/data/cve/CVE-2026-64322.md) | High | udf: validate sparing table length as an entry count, not a byte count | 7.8 | 0.0017 | | | [CVE-2026-64333](https://patchblox.com/security/data/cve/CVE-2026-64333.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix write buffer c... | 7.8 | 0.0017 | | | [CVE-2026-64363](https://patchblox.com/security/data/cve/CVE-2026-64363.md) | High | HID: appleir: fix UAF on pending key_up_timer in remove() | 7.8 | 0.0017 | | | [CVE-2026-68479](https://patchblox.com/security/data/cve/CVE-2026-68479.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds... | 7.8 | 0.0017 | | | [CVE-2026-72036](https://patchblox.com/security/data/cve/CVE-2026-72036.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_multiq: Replace direct dequeue ca... | 7.8 | 0.0017 | | | [CVE-2026-72105](https://patchblox.com/security/data/cve/CVE-2026-72105.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitset_size overflow on 32bit mach... | 7.8 | 0.0017 | | | [CVE-2026-72110](https://patchblox.com/security/data/cve/CVE-2026-72110.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf,fork: wipe ->bpf_storage before bailouts tha... | 7.8 | 0.0017 | | | [CVE-2026-72113](https://patchblox.com/security/data/cve/CVE-2026-72113.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN fi... | 7.8 | 0.0017 | | | [CVE-2026-72114](https://patchblox.com/security/data/cve/CVE-2026-72114.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcm_rx_setup(... | 7.8 | 0.0017 | | | [CVE-2026-72119](https://patchblox.com/security/data/cve/CVE-2026-72119.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm_tx_lock usage for data and... | 7.8 | 0.0017 | | | [CVE-2026-72120](https://patchblox.com/security/data/cve/CVE-2026-72120.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and o... | 7.8 | 0.0017 | | | [CVE-2026-72123](https://patchblox.com/security/data/cve/CVE-2026-72123.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rx_op deallocation to workqueue t... | 7.8 | 0.0017 | | | [CVE-2026-72135](https://patchblox.com/security/data/cve/CVE-2026-72135.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable... | 7.8 | 0.0017 | | | [CVE-2026-72164](https://patchblox.com/security/data/cve/CVE-2026-72164.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ocfs2: avoid moving extents to occupied clusters... | 7.8 | 0.0017 | | | [CVE-2026-72170](https://patchblox.com/security/data/cve/CVE-2026-72170.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: 9p: skip nlink update in cacheless mode to fix W... | 7.8 | 0.0017 | | | [CVE-2026-72250](https://patchblox.com/security/data/cve/CVE-2026-72250.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_reasm: guard mac_header... | 7.8 | 0.0017 | | | [CVE-2026-72252](https://patchblox.com/security/data/cve/CVE-2026-72252.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: don't leak bad clone... | 7.8 | 0.0017 | | | [CVE-2026-72406](https://patchblox.com/security/data/cve/CVE-2026-72406.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup gem_init_o... | 7.8 | 0.0017 | | | [CVE-2026-72435](https://patchblox.com/security/data/cve/CVE-2026-72435.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfree_rcu() and r... | 7.8 | 0.0017 | | | [CVE-2026-72450](https://patchblox.com/security/data/cve/CVE-2026-72450.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen dur... | 7.8 | 0.0017 | | | [CVE-2026-64563](https://patchblox.com/security/data/cve/CVE-2026-64563.md) | High | rhashtable: clear stale iter->p on table restart | 8.1 | 0.0017 | | | [CVE-2026-74295](https://patchblox.com/security/data/cve/CVE-2026-74295.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: hdac_hdmi: Validate written enum v... | 7.1 | 0.0017 | | | [CVE-2026-64593](https://patchblox.com/security/data/cve/CVE-2026-64593.md) | High | btrfs: do not trim a device which is not writeable | 9.8 | 0.0017 | | | [CVE-2026-64299](https://patchblox.com/security/data/cve/CVE-2026-64299.md) | High | tracing: Prevent out-of-bounds read in glob matching | 7.1 | 0.0017 | | | [CVE-2026-64323](https://patchblox.com/security/data/cve/CVE-2026-64323.md) | High | udf: validate VAT header length against the VAT inode size | 7.1 | 0.0017 | | | [CVE-2026-64504](https://patchblox.com/security/data/cve/CVE-2026-64504.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FI... | n/a | 0.0017 | | | [CVE-2026-64346](https://patchblox.com/security/data/cve/CVE-2026-64346.md) | High | usb: gadget: udc: Fix use-after-free in gadget_match_driver | 7.8 | 0.0016 | | | [CVE-2026-72005](https://patchblox.com/security/data/cve/CVE-2026-72005.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work se... | 7.8 | 0.0016 | | | [CVE-2026-72125](https://patchblox.com/security/data/cve/CVE-2026-72125.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurr... | 7.8 | 0.0016 | | | [CVE-2026-72165](https://patchblox.com/security/data/cve/CVE-2026-72165.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix condition in 'nand_select_targ... | 7.8 | 0.0016 | | | [CVE-2026-72389](https://patchblox.com/security/data/cve/CVE-2026-72389.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bridge: stp: Fix a potential use-after-free when... | 7.8 | 0.0016 | | | [CVE-2026-72122](https://patchblox.com/security/data/cve/CVE-2026-72122.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and si... | 7.3 | 0.0016 | | | [CVE-2026-72297](https://patchblox.com/security/data/cve/CVE-2026-72297.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in... | 7.1 | 0.0016 | | | [CVE-2026-64324](https://patchblox.com/security/data/cve/CVE-2026-64324.md) | High | udf: validate free block extents against the partition length | 7.8 | 0.0016 | | | [CVE-2026-64294](https://patchblox.com/security/data/cve/CVE-2026-64294.md) | High | mm: do file ownership checks with the proper mount idmap | 7.1 | 0.0016 | | | [CVE-2026-64306](https://patchblox.com/security/data/cve/CVE-2026-64306.md) | High | crypto: drbg - Fix returning success on failure in CTR_DRBG | 7.0 | 0.0016 | | | [CVE-2026-72061](https://patchblox.com/security/data/cve/CVE-2026-72061.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAP_NET_ADMIN in the device ne... | 8.8 | 0.0016 | | | [CVE-2026-72232](https://patchblox.com/security/data/cve/CVE-2026-72232.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX... | 7.8 | 0.0016 | | | [CVE-2026-63806](https://patchblox.com/security/data/cve/CVE-2026-63806.md) | High | KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() | 7.3 | 0.0016 | | | [CVE-2026-74465](https://patchblox.com/security/data/cve/CVE-2026-74465.md) | High | net: openvswitch: fix potential UAF on meter attach failure | 7.8 | 0.0015 | | | [CVE-2026-68294](https://patchblox.com/security/data/cve/CVE-2026-68294.md) | High | net: qrtr: restrict socket creation to the initial network namespace | 8.8 | 0.0015 | | | [CVE-2026-72045](https://patchblox.com/security/data/cve/CVE-2026-72045.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing... | 8.8 | 0.0015 | | | [CVE-2026-72051](https://patchblox.com/security/data/cve/CVE-2026-72051.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: ip6_tunnel: require CAP_NET_ADMIN in the de... | 8.8 | 0.0015 | | | [CVE-2026-72052](https://patchblox.com/security/data/cve/CVE-2026-72052.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: ip6_gre: require CAP_NET_ADMIN in the devic... | 8.8 | 0.0015 | | | [CVE-2026-72053](https://patchblox.com/security/data/cve/CVE-2026-72053.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAP_NET_ADMIN in the device n... | 8.8 | 0.0015 | | | [CVE-2026-72054](https://patchblox.com/security/data/cve/CVE-2026-72054.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: ip_vti: require CAP_NET_ADMIN in the device... | 8.8 | 0.0015 | | | [CVE-2026-72055](https://patchblox.com/security/data/cve/CVE-2026-72055.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: ip6_vti: require CAP_NET_ADMIN in the devic... | 8.8 | 0.0015 | | | [CVE-2026-64456](https://patchblox.com/security/data/cve/CVE-2026-64456.md) | High | hwrng: virtio: clamp device-reported used.len at copy_data() | 8.4 | 0.0015 | | | [CVE-2026-43491](https://patchblox.com/security/data/cve/CVE-2026-43491.md) | High | net: qrtr: ns: Limit the maximum server registration per node | 7.0 | 0.0015 | | | [CVE-2026-63829](https://patchblox.com/security/data/cve/CVE-2026-63829.md) | High | net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink | 8.8 | 0.0015 | | | [CVE-2026-64298](https://patchblox.com/security/data/cve/CVE-2026-64298.md) | High | NFSv4: include MAY_WRITE in open permission mask for O_TRUNC | 8.8 | 0.0015 | | | [CVE-2026-68432](https://patchblox.com/security/data/cve/CVE-2026-68432.md) | High | vxlan: require CAP_NET_ADMIN in the device netns for changelink | 8.8 | 0.0015 | | | [CVE-2026-74519](https://patchblox.com/security/data/cve/CVE-2026-74519.md) | High | pinctrl: devicetree: don't free uninitialized dev_name on error path | 7.8 | 0.0015 | | | [CVE-2026-74684](https://patchblox.com/security/data/cve/CVE-2026-74684.md) | High | net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() | 7.1 | 0.0015 | | | [CVE-2026-64446](https://patchblox.com/security/data/cve/CVE-2026-64446.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in... | 7.8 | 0.0015 | | | [CVE-2026-64510](https://patchblox.com/security/data/cve/CVE-2026-64510.md) | High | ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup | 7.1 | 0.0014 | | | [CVE-2026-72049](https://patchblox.com/security/data/cve/CVE-2026-72049.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ieee802154: admin-gate legacy LLSEC dump operati... | 7.1 | 0.0014 | | | [CVE-2026-68253](https://patchblox.com/security/data/cve/CVE-2026-68253.md) | High | drm/i915/hdcp: check streams[] bounds before overflow | 7.8 | 0.0014 | | | [CVE-2026-64548](https://patchblox.com/security/data/cve/CVE-2026-64548.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in b... | 8.4 | 0.0014 | | | [CVE-2026-74492](https://patchblox.com/security/data/cve/CVE-2026-74492.md) | High | netfilter: ipset: do not update comments from kernel-side hash adds | 8.4 | 0.0014 | | | [CVE-2026-74497](https://patchblox.com/security/data/cve/CVE-2026-74497.md) | High | ALSA: usb-audio: Clamp frame size in implicit-feedback mode | 8.4 | 0.0014 | | | [CVE-2026-74614](https://patchblox.com/security/data/cve/CVE-2026-74614.md) | High | vsock/virtio: read virtqueues under worker locks | 8.4 | 0.0014 | | | [CVE-2026-80678](https://patchblox.com/security/data/cve/CVE-2026-80678.md) | High | i2c: imx: Fix slave registration race and error handling | 8.4 | 0.0014 | | | [CVE-2026-80731](https://patchblox.com/security/data/cve/CVE-2026-80731.md) | High | net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header | 7.8 | 0.0014 | | | [CVE-2026-53090](https://patchblox.com/security/data/cve/CVE-2026-53090.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ld_{abs,ind} failure path analysis in s... | 7.8 | 0.0014 | | | [CVE-2026-64475](https://patchblox.com/security/data/cve/CVE-2026-64475.md) | High | vfio/pci: Release the VGA arbiter client on register_device() failure | 8.8 | 0.0014 | | | [CVE-2026-74748](https://patchblox.com/security/data/cve/CVE-2026-74748.md) | High | netfilter: ipset: fix refcount race between list:set GC and swap | 7.8 | 0.0014 | | | [CVE-2026-74461](https://patchblox.com/security/data/cve/CVE-2026-74461.md) | High | i2c: imx: Cancel hrtimer before clearing slave pointer | 8.4 | 0.0014 | | | [CVE-2026-74589](https://patchblox.com/security/data/cve/CVE-2026-74589.md) | High | bpf, sockmap: Fix sk_redir use-after-free in send verdict | 8.4 | 0.0014 | | | [CVE-2026-74604](https://patchblox.com/security/data/cve/CVE-2026-74604.md) | High | Revert "thermal/drivers/hwmon: Cleanup coding style a bit" | 8.4 | 0.0014 | | | [CVE-2026-64422](https://patchblox.com/security/data/cve/CVE-2026-64422.md) | High | net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes | 7.1 | 0.0014 | | | [CVE-2026-68338](https://patchblox.com/security/data/cve/CVE-2026-68338.md) | High | net/packet: avoid fanout hook re-registration after unregister | 8.8 | 0.0014 | | | [CVE-2026-53400](https://patchblox.com/security/data/cve/CVE-2026-53400.md) | High | i2c: core: fix adapter registration race | 7.8 | 0.0014 | | | [CVE-2026-74601](https://patchblox.com/security/data/cve/CVE-2026-74601.md) | High | ring-buffer: Use current_context for safe per-CPU buffer swap | 7.8 | 0.0014 | | | [CVE-2026-74667](https://patchblox.com/security/data/cve/CVE-2026-74667.md) | High | net/packet: reset the MAC header on the packet-socket transmit path | 7.8 | 0.0014 | | | [CVE-2026-68284](https://patchblox.com/security/data/cve/CVE-2026-68284.md) | High | bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() | 7.8 | 0.0014 | | | [CVE-2026-64279](https://patchblox.com/security/data/cve/CVE-2026-64279.md) | High | i2c: core: fix adapter deregistration race | 7.8 | 0.0013 | | | [CVE-2026-80574](https://patchblox.com/security/data/cve/CVE-2026-80574.md) | High | Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet | 8.4 | 0.0013 | | | [CVE-2026-64423](https://patchblox.com/security/data/cve/CVE-2026-64423.md) | High | ipv4: igmp: remove multicast group from hash table on device destruction | 7.8 | 0.0013 | | | [CVE-2026-74481](https://patchblox.com/security/data/cve/CVE-2026-74481.md) | High | mm/page_reporting: use system_freezable_wq to fix UAF during suspend | 7.8 | 0.0013 | | | [CVE-2026-64411](https://patchblox.com/security/data/cve/CVE-2026-64411.md) | High | netfilter: ebtables: terminate table name before find_table_lock() | 7.1 | 0.0013 | | | [CVE-2026-64412](https://patchblox.com/security/data/cve/CVE-2026-64412.md) | High | netfilter: ebtables: module names must be null-terminated | 7.1 | 0.0013 | | | [CVE-2026-68104](https://patchblox.com/security/data/cve/CVE-2026-68104.md) | High | drm/amdgpu: invoke pm_genpd_remove() before freeing genpd | 7.8 | 0.0013 | | | [CVE-2026-68106](https://patchblox.com/security/data/cve/CVE-2026-68106.md) | High | drm/amdgpu: fix division by zero with invalid uvd dimensions | 7.8 | 0.0013 | | | [CVE-2026-68297](https://patchblox.com/security/data/cve/CVE-2026-68297.md) | High | tipc: fix u16 MTU truncation in media and bearer MTU validation | 7.8 | 0.0013 | | | [CVE-2026-74390](https://patchblox.com/security/data/cve/CVE-2026-74390.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix out-of-bounds write in irdma_cop... | 7.8 | 0.0013 | | | [CVE-2026-74701](https://patchblox.com/security/data/cve/CVE-2026-74701.md) | High | net/openvswitch: check Ethernet header length in key_extract() | 7.8 | 0.0013 | | | [CVE-2026-64546](https://patchblox.com/security/data/cve/CVE-2026-64546.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drm_parse_tiled_block(... | 7.1 | 0.0013 | | | [CVE-2026-74443](https://patchblox.com/security/data/cve/CVE-2026-74443.md) | High | drm/vmwgfx: bound DMA command body size against suffix pointer | 8.8 | 0.0013 | | | [CVE-2026-74641](https://patchblox.com/security/data/cve/CVE-2026-74641.md) | High | ALSA: usx2y: bound the hwdep mmap fault offset | 8.8 | 0.0013 | | | [CVE-2026-64330](https://patchblox.com/security/data/cve/CVE-2026-64330.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Validate SVID index in svdm_co... | 7.8 | 0.0013 | | | [CVE-2026-64352](https://patchblox.com/security/data/cve/CVE-2026-64352.md) | High | bpf: Allow LPM map access from sleepable BPF programs | 7.8 | 0.0013 | | | [CVE-2026-64381](https://patchblox.com/security/data/cve/CVE-2026-64381.md) | High | smb: client: Fix next buffer leak in receive_encrypted_standard() | 7.8 | 0.0013 | | | [CVE-2026-74288](https://patchblox.com/security/data/cve/CVE-2026-74288.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: fib_rules: Don't dump dying fib_rule in fib... | 7.8 | 0.0013 | | | [CVE-2026-74312](https://patchblox.com/security/data/cve/CVE-2026-74312.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: validate virtqueue index in mmap and... | 7.8 | 0.0013 | | | [CVE-2026-74330](https://patchblox.com/security/data/cve/CVE-2026-74330.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: configfs: fix lockless traversals of ->s_childre... | 7.8 | 0.0013 | | | [CVE-2026-74444](https://patchblox.com/security/data/cve/CVE-2026-74444.md) | High | drm/vmwgfx: validate DRAW_PRIMITIVES header size before division | 7.8 | 0.0013 | | | [CVE-2026-74453](https://patchblox.com/security/data/cve/CVE-2026-74453.md) | High | drm/vc4: Zero the tile state data array before each BIN job | 7.8 | 0.0013 | | | [CVE-2026-74456](https://patchblox.com/security/data/cve/CVE-2026-74456.md) | High | can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error | 7.8 | 0.0013 | | | [CVE-2026-74470](https://patchblox.com/security/data/cve/CVE-2026-74470.md) | High | scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write | 7.8 | 0.0013 | | | [CVE-2026-74594](https://patchblox.com/security/data/cve/CVE-2026-74594.md) | High | sched/psi: Shut down rtpoll_timer in psi_cgroup_free() | 7.8 | 0.0013 | | | [CVE-2026-74635](https://patchblox.com/security/data/cve/CVE-2026-74635.md) | High | fbdev: bitblit: bound-check glyph index in bit_cursor() | 7.8 | 0.0013 | | | [CVE-2026-74648](https://patchblox.com/security/data/cve/CVE-2026-74648.md) | High | staging: rtl8723bs: validate monitor transmit frame lengths | 7.8 | 0.0013 | | | [CVE-2026-74675](https://patchblox.com/security/data/cve/CVE-2026-74675.md) | High | vt: stabilize tty reference in kbd_keycode with tty_port_tty_get | 7.8 | 0.0013 | | | [CVE-2026-74720](https://patchblox.com/security/data/cve/CVE-2026-74720.md) | High | bpf: Preserve pointer state for commuted arithmetic | 7.8 | 0.0013 | | | [CVE-2026-80540](https://patchblox.com/security/data/cve/CVE-2026-80540.md) | High | drm/amdgpu: Fix UVD decode image min size calculation | 7.8 | 0.0013 | | | [CVE-2026-80541](https://patchblox.com/security/data/cve/CVE-2026-80541.md) | High | drm/amdgpu: validate GEM_CREATE domain combinations | 7.8 | 0.0013 | | | [CVE-2026-80613](https://patchblox.com/security/data/cve/CVE-2026-80613.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: veth: fix NAPI leak in XDP enable error path Du... | 7.8 | 0.0013 | | | [CVE-2026-53393](https://patchblox.com/security/data/cve/CVE-2026-53393.md) | High | nfsd: reset write verifier on deferred writeback errors | 7.0 | 0.0013 | | | [CVE-2026-64371](https://patchblox.com/security/data/cve/CVE-2026-64371.md) | High | proc: protect ptrace_may_access() with exec_update_lock (part 1) | 7.0 | 0.0013 | | | [CVE-2026-74630](https://patchblox.com/security/data/cve/CVE-2026-74630.md) | High | ipv6: prevent in6_dev_get() from resurrecting inet6_dev | 7.8 | 0.0013 | | | [CVE-2026-68320](https://patchblox.com/security/data/cve/CVE-2026-68320.md) | High | sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid | 7.5 | 0.0013 | | | [CVE-2026-64436](https://patchblox.com/security/data/cve/CVE-2026-64436.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: af_key: initialize alg_key_len for IPComp s... | 7.1 | 0.0013 | | | [CVE-2026-64413](https://patchblox.com/security/data/cve/CVE-2026-64413.md) | High | netfilter: ebtables: zero chainstack array | 7.0 | 0.0013 | | | [CVE-2026-64266](https://patchblox.com/security/data/cve/CVE-2026-64266.md) | High | fuse: re-lock request before returning from fuse_ref_folio() | 7.8 | 0.0013 | | | [CVE-2026-72024](https://patchblox.com/security/data/cve/CVE-2026-72024.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list delet... | 7.8 | 0.0013 | | | [CVE-2026-80664](https://patchblox.com/security/data/cve/CVE-2026-80664.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nat: reject unsupported target fam... | 7.3 | 0.0013 | | | [CVE-2026-64189](https://patchblox.com/security/data/cve/CVE-2026-64189.md) | High | netfilter: ipset: fix race between dump and ip_set_list resize | 8.8 | 0.0013 | | | [CVE-2026-74313](https://patchblox.com/security/data/cve/CVE-2026-74313.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduse_lock across IDR lookup in open... | 8.8 | 0.0013 | | | [CVE-2026-74518](https://patchblox.com/security/data/cve/CVE-2026-74518.md) | High | mm/hugetlb: fix list corruption in allocate_file_region_entries() | 8.8 | 0.0013 | | | [CVE-2026-74615](https://patchblox.com/security/data/cve/CVE-2026-74615.md) | High | vxlan: do not arm the ageing timer on a device that is down | 8.8 | 0.0013 | | | [CVE-2026-64340](https://patchblox.com/security/data/cve/CVE-2026-64340.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: USB: legousbtower: fix use-after-free on disconn... | 7.8 | 0.0013 | | | [CVE-2026-64342](https://patchblox.com/security/data/cve/CVE-2026-64342.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect... | 7.8 | 0.0013 | | | [CVE-2026-64343](https://patchblox.com/security/data/cve/CVE-2026-64343.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: USB: ldusb: fix use-after-free on disconnect rac... | 7.8 | 0.0013 | | | [CVE-2026-64344](https://patchblox.com/security/data/cve/CVE-2026-64344.md) | High | linux-6.12: In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect r... | 7.8 | 0.0013 | | | [CVE-2026-64362](https://patchblox.com/security/data/cve/CVE-2026-64362.md) | High | HID: lg-g15: cancel pending work on remove to fix a use-after-free | 7.8 | 0.0013 | | | [CVE-2026-64372](https://patchblox.com/security/data/cve/CVE-2026-64372.md) | High | cpufreq: pcc: fix use-after-free and double free in _OSC evaluation | 7.8 | 0.0013 | | | [CVE-2026-64401](https://patchblox.com/security/data/cve/CVE-2026-64401.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registra... | 7.8 | 0.0013 | | | [CVE-2026-64543](https://patchblox.com/security/data/cve/CVE-2026-64543.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in ti... | 7.8 | 0.0013 | | | [CVE-2026-74359](https://patchblox.com/security/data/cve/CVE-2026-74359.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: configfs_lookup(): don't leave ->s_dentry dangli... | 7.8 | 0.0013 | | | [CVE-2026-74363](https://patchblox.com/security/data/cve/CVE-2026-74363.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode free... | 7.8 | 0.0013 | | | [CVE-2026-74471](https://patchblox.com/security/data/cve/CVE-2026-74471.md) | High | tracing: Check return value of __register_event() in trace_module_add_events() | 7.8 | 0.0013 | | | [CVE-2026-74479](https://patchblox.com/security/data/cve/CVE-2026-74479.md) | High | net: pktgen: fix proc entry use-after-free | 7.8 | 0.0013 | | | [CVE-2026-74482](https://patchblox.com/security/data/cve/CVE-2026-74482.md) | High | mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios | 7.8 | 0.0013 | | | [CVE-2026-74512](https://patchblox.com/security/data/cve/CVE-2026-74512.md) | High | audit: fix potential use-after-free in audit_del_rule() | 7.8 | 0.0013 | | | [CVE-2026-74548](https://patchblox.com/security/data/cve/CVE-2026-74548.md) | High | forcedeth: fix UAF of txrx_stats in nv_remove | 7.8 | 0.0013 | | | [CVE-2026-74609](https://patchblox.com/security/data/cve/CVE-2026-74609.md) | High | tipc: read le->link under the node lock in tipc_node_link_down() | 7.8 | 0.0013 | | | [CVE-2026-74613](https://patchblox.com/security/data/cve/CVE-2026-74613.md) | High | vsock/virtio: avoid refilling the RX queue after teardown | 7.8 | 0.0013 | | | [CVE-2026-74656](https://patchblox.com/security/data/cve/CVE-2026-74656.md) | High | ipv4: fix use-after-free in fib_nhc_update_mtu() | 7.8 | 0.0013 | | | [CVE-2026-74660](https://patchblox.com/security/data/cve/CVE-2026-74660.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: ebt_nflog: pin the NFLOG backend nf_... | 7.8 | 0.0013 | | | [CVE-2026-74726](https://patchblox.com/security/data/cve/CVE-2026-74726.md) | High | bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor | 7.3 | 0.0013 | | | [CVE-2026-74349](https://patchblox.com/security/data/cve/CVE-2026-74349.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject FITRIM ranges shorter than a clust... | 7.1 | 0.0013 | | | [CVE-2026-74485](https://patchblox.com/security/data/cve/CVE-2026-74485.md) | High | binfmt_misc: reject a flag character as the field delimiter | 7.1 | 0.0013 | | | [CVE-2026-64567](https://patchblox.com/security/data/cve/CVE-2026-64567.md) | High | btrfs: reject free space cache with more entries than pages | 7.8 | 0.0013 | | | [CVE-2026-64427](https://patchblox.com/security/data/cve/CVE-2026-64427.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short... | 7.8 | 0.0012 | | | [CVE-2026-80716](https://patchblox.com/security/data/cve/CVE-2026-80716.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink... | 7.8 | 0.0012 | | | [CVE-2026-64496](https://patchblox.com/security/data/cve/CVE-2026-64496.md) | High | iio: event: Fix event FIFO reset race | 7.1 | 0.0012 | | | [CVE-2026-68446](https://patchblox.com/security/data/cve/CVE-2026-68446.md) | High | drm/vmwgfx: Validate vmw_surface_metadata::array_size | 7.8 | 0.0012 | | | [CVE-2026-64576](https://patchblox.com/security/data/cve/CVE-2026-64576.md) | High | nexthop: initialize extack in nh_res_bucket_migrate() | 7.1 | 0.0012 | | | [CVE-2026-80706](https://patchblox.com/security/data/cve/CVE-2026-80706.md) | High | can: softing: fw_parse(): validate firmware record spans | 7.8 | 0.0012 | | | [CVE-2026-80754](https://patchblox.com/security/data/cve/CVE-2026-80754.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter elec... | 7.8 | 0.0012 | | | [CVE-2026-74579](https://patchblox.com/security/data/cve/CVE-2026-74579.md) | High | netfilter: nft_payload: fix mask build for partial field offload | 7.1 | 0.0012 | | | [CVE-2026-64420](https://patchblox.com/security/data/cve/CVE-2026-64420.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until prob... | 7.0 | 0.0012 | | | [CVE-2026-64192](https://patchblox.com/security/data/cve/CVE-2026-64192.md) | High | bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized | 7.8 | 0.0012 | | | [CVE-2026-74564](https://patchblox.com/security/data/cve/CVE-2026-74564.md) | High | netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH | 7.1 | 0.0012 | | | [CVE-2026-74583](https://patchblox.com/security/data/cve/CVE-2026-74583.md) | High | net/sched: cls_route: fix fastmap use-after-free on filter | 8.8 | 0.0012 | | | [CVE-2026-64599](https://patchblox.com/security/data/cve/CVE-2026-64599.md) | High | crypto: amlogic - avoid double cleanup in meson_crypto_probe() | 7.8 | 0.0012 | | | [CVE-2026-74567](https://patchblox.com/security/data/cve/CVE-2026-74567.md) | High | keys: fix out-of-bounds read in keyring_get_key_chunk() | 7.1 | 0.0012 | | | [CVE-2026-64098](https://patchblox.com/security/data/cve/CVE-2026-64098.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 7.8 | 0.0011 | | | [CVE-2026-64375](https://patchblox.com/security/data/cve/CVE-2026-64375.md) | High | proc: protect ptrace_may_access() with exec_update_lock (FD links) | 7.8 | 0.0011 | | | [CVE-2026-74595](https://patchblox.com/security/data/cve/CVE-2026-74595.md) | High | fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() | 7.8 | 0.0009 | | | [CVE-2024-27012](https://patchblox.com/security/data/cve/CVE-2024-27012.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bu... | 5.5 | 0.0027 | | | [CVE-2026-68469](https://patchblox.com/security/data/cve/CVE-2026-68469.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix permanently busy scans after... | 5.5 | 0.0026 | | | [CVE-2026-72441](https://patchblox.com/security/data/cve/CVE-2026-72441.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ieee802154: fix kernel-infoleak in dgram_recvmsg... | 5.5 | 0.0024 | | | [CVE-2026-74331](https://patchblox.com/security/data/cve/CVE-2026-74331.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix recursive lock in device_ca... | 5.5 | 0.0024 | | | [CVE-2026-72245](https://patchblox.com/security/data/cve/CVE-2026-72245.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1x... | 5.5 | 0.0023 | | | [CVE-2026-68187](https://patchblox.com/security/data/cve/CVE-2026-68187.md) | Routine | exec: fix unsigned loop counter wrap in transfer_args_to_stack() | 6.1 | 0.0022 | | | [CVE-2026-68217](https://patchblox.com/security/data/cve/CVE-2026-68217.md) | Routine | media: pwc: Drain fill_buf on start_streaming() failure | 5.5 | 0.0022 | | | [CVE-2026-68226](https://patchblox.com/security/data/cve/CVE-2026-68226.md) | Routine | media: cx23885: add ioremap return check and cleanup | 5.5 | 0.0022 | | | [CVE-2026-68227](https://patchblox.com/security/data/cve/CVE-2026-68227.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: fix devres lifetime USB drivers... | 5.5 | 0.0022 | | | [CVE-2026-68405](https://patchblox.com/security/data/cve/CVE-2026-68405.md) | Routine | wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock | 5.5 | 0.0022 | | | [CVE-2026-68475](https://patchblox.com/security/data/cve/CVE-2026-68475.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: reset: sunxi: fix memory region leak on ioremap... | 5.5 | 0.0022 | | | [CVE-2026-72004](https://patchblox.com/security/data/cve/CVE-2026-72004.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211_reg... | 5.5 | 0.0022 | | | [CVE-2026-72010](https://patchblox.com/security/data/cve/CVE-2026-72010.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: rebind mm mempolicy to effective_... | 5.5 | 0.0022 | | | [CVE-2026-72039](https://patchblox.com/security/data/cve/CVE-2026-72039.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix potential memory leak in bnx2x_alloc_... | 5.5 | 0.0022 | | | [CVE-2026-72056](https://patchblox.com/security/data/cve/CVE-2026-72056.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net: ena: clean up XDP TX queues when regular TX... | 5.5 | 0.0022 | | | [CVE-2026-72063](https://patchblox.com/security/data/cve/CVE-2026-72063.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: gpio: tegra: do not call pinctrl for GPIO direct... | 5.5 | 0.0022 | | | [CVE-2026-72068](https://patchblox.com/security/data/cve/CVE-2026-72068.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Use u64 multiplication in upda... | 5.5 | 0.0022 | | | [CVE-2026-72070](https://patchblox.com/security/data/cve/CVE-2026-72070.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: wifi: libertas_tf: fix use-after-free in lbtf_fr... | 5.5 | 0.0022 | | | [CVE-2026-72087](https://patchblox.com/security/data/cve/CVE-2026-72087.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfc_sli4_driver_... | 5.5 | 0.0022 | | | [CVE-2026-72088](https://patchblox.com/security/data/cve/CVE-2026-72088.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 res... | 5.5 | 0.0022 | | | [CVE-2026-72159](https://patchblox.com/security/data/cve/CVE-2026-72159.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject non-inline dinodes with i_size and... | 5.5 | 0.0022 | | | [CVE-2026-72182](https://patchblox.com/security/data/cve/CVE-2026-72182.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount lea... | 5.5 | 0.0022 | | | [CVE-2026-72223](https://patchblox.com/security/data/cve/CVE-2026-72223.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arena sub-allocations on discov... | 5.5 | 0.0022 | | | [CVE-2026-72224](https://patchblox.com/security/data/cve/CVE-2026-72224.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arenas on btt_init() error path... | 5.5 | 0.0022 | | | [CVE-2026-72228](https://patchblox.com/security/data/cve/CVE-2026-72228.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: fix primary_if leak on failed... | 5.5 | 0.0022 | | | [CVE-2026-72229](https://patchblox.com/security/data/cve/CVE-2026-72229.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: batman-adv: clean untagged VLAN on netdev regist... | 5.5 | 0.0022 | | | [CVE-2026-72230](https://patchblox.com/security/data/cve/CVE-2026-72230.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: free unfragmentable packet Th... | 5.5 | 0.0022 | | | [CVE-2026-72240](https://patchblox.com/security/data/cve/CVE-2026-72240.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix reference leak on failed device... | 5.5 | 0.0022 | | | [CVE-2026-72241](https://patchblox.com/security/data/cve/CVE-2026-72241.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The... | 5.5 | 0.0022 | | | [CVE-2026-72265](https://patchblox.com/security/data/cve/CVE-2026-72265.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: fbdev: nvidia: fix potential memory leak in nvid... | 5.5 | 0.0022 | | | [CVE-2026-72272](https://patchblox.com/security/data/cve/CVE-2026-72272.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: fbdev: radeon: fix potential memory leak in rade... | 5.5 | 0.0022 | | | [CVE-2026-72326](https://patchblox.com/security/data/cve/CVE-2026-72326.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that und... | 5.5 | 0.0022 | | | [CVE-2026-72349](https://patchblox.com/security/data/cve/CVE-2026-72349.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_rateest: fix u64 truncation in xt_... | 5.5 | 0.0022 | | | [CVE-2026-72396](https://patchblox.com/security/data/cve/CVE-2026-72396.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized st... | 5.5 | 0.0022 | | | [CVE-2026-72447](https://patchblox.com/security/data/cve/CVE-2026-72447.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in... | 5.5 | 0.0022 | | | [CVE-2026-72481](https://patchblox.com/security/data/cve/CVE-2026-72481.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel... | 5.5 | 0.0022 | | | [CVE-2026-74320](https://patchblox.com/security/data/cve/CVE-2026-74320.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: fbdev: sm501fb: Fix buffer errors in OF binding... | 5.5 | 0.0022 | | | [CVE-2026-74339](https://patchblox.com/security/data/cve/CVE-2026-74339.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read... | 5.5 | 0.0022 | | | [CVE-2026-74348](https://patchblox.com/security/data/cve/CVE-2026-74348.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: require a ref for locking_state debug... | 5.5 | 0.0022 | | | [CVE-2026-74351](https://patchblox.com/security/data/cve/CVE-2026-74351.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ocfs2: rebase copied fsdlm LVB pointers in locki... | 5.5 | 0.0022 | | | [CVE-2026-74395](https://patchblox.com/security/data/cve/CVE-2026-74395.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL... | 5.5 | 0.0022 | | | [CVE-2026-74416](https://patchblox.com/security/data/cve/CVE-2026-74416.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeon_ring_resto... | 5.5 | 0.0022 | | | [CVE-2026-80605](https://patchblox.com/security/data/cve/CVE-2026-80605.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference i... | 5.5 | 0.0022 | | | [CVE-2026-80644](https://patchblox.com/security/data/cve/CVE-2026-80644.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUG_ON an invalid journal dinode [... | 5.5 | 0.0022 | | | [CVE-2026-80652](https://patchblox.com/security/data/cve/CVE-2026-80652.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as qu... | 5.5 | 0.0022 | | | [CVE-2026-80659](https://patchblox.com/security/data/cve/CVE-2026-80659.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmd_mutex is unlo... | 5.5 | 0.0022 | | | [CVE-2026-72316](https://patchblox.com/security/data/cve/CVE-2026-72316.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: dm era: fix NULL pointer dereference in metadata... | 4.7 | 0.0022 | | | [CVE-2026-72073](https://patchblox.com/security/data/cve/CVE-2026-72073.md) | Routine | mmc: vub300: fix use-after-free on probe failure | 6.3 | 0.0022 | | | [CVE-2026-72428](https://patchblox.com/security/data/cve/CVE-2026-72428.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack slot index in nospec checks chec... | 5.5 | 0.0022 | | | [CVE-2026-68184](https://patchblox.com/security/data/cve/CVE-2026-68184.md) | Routine | cdrom: fix stack out-of-bounds read in CDROMVOLCTRL | 5.5 | 0.0022 | | | [CVE-2026-68197](https://patchblox.com/security/data/cve/CVE-2026-68197.md) | Routine | wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper | 5.5 | 0.0022 | | | [CVE-2026-68250](https://patchblox.com/security/data/cve/CVE-2026-68250.md) | Routine | drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() | 5.5 | 0.0022 | | | [CVE-2026-68304](https://patchblox.com/security/data/cve/CVE-2026-68304.md) | Routine | wifi: brcmfmac: fix 802.1X-SHA256 call trace warning | 5.5 | 0.0022 | | | [CVE-2026-68313](https://patchblox.com/security/data/cve/CVE-2026-68313.md) | Routine | tipc: fix infinite loop in __tipc_nl_compat_dumpit | 5.5 | 0.0022 | | | [CVE-2026-68344](https://patchblox.com/security/data/cve/CVE-2026-68344.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that co... | 5.5 | 0.0022 | | | [CVE-2026-68410](https://patchblox.com/security/data/cve/CVE-2026-68410.md) | Routine | wifi: libertas: fix memory leak in helper_firmware_cb() | 5.5 | 0.0022 | | | [CVE-2026-72015](https://patchblox.com/security/data/cve/CVE-2026-72015.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix double-add of pseudo-locked regi... | 5.5 | 0.0022 | | | [CVE-2026-72096](https://patchblox.com/security/data/cve/CVE-2026-72096.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: dm-verity: make error counter atomic The error... | 5.5 | 0.0022 | | | [CVE-2026-72117](https://patchblox.com/security/data/cve/CVE-2026-72117.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rx_stamp/rx_ifindex i... | 5.5 | 0.0022 | | | [CVE-2026-72118](https://patchblox.com/security/data/cve/CVE-2026-72118.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN... | 5.5 | 0.0022 | | | [CVE-2026-72138](https://patchblox.com/security/data/cve/CVE-2026-72138.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: fix error handling in ioctl When gn... | 5.5 | 0.0022 | | | [CVE-2026-72142](https://patchblox.com/security/data/cve/CVE-2026-72142.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of... | 5.5 | 0.0022 | | | [CVE-2026-72152](https://patchblox.com/security/data/cve/CVE-2026-72152.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_tis_spi: Use wait_woken() in wait_for_t... | 5.5 | 0.0022 | | | [CVE-2026-72155](https://patchblox.com/security/data/cve/CVE-2026-72155.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: swp: Improve locking user experien... | 5.5 | 0.0022 | | | [CVE-2026-72163](https://patchblox.com/security/data/cve/CVE-2026-72163.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL h_transaction deref in ocfs2_ass... | 5.5 | 0.0022 | | | [CVE-2026-72166](https://patchblox.com/security/data/cve/CVE-2026-72166.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/9p: fix infinite loop in p9_client_rpc on fa... | 5.5 | 0.0022 | | | [CVE-2026-72256](https://patchblox.com/security/data/cve/CVE-2026-72256.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_cluster: reject template conntrack... | 5.5 | 0.0022 | | | [CVE-2026-72392](https://patchblox.com/security/data/cve/CVE-2026-72392.md) | Routine | ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump | 5.5 | 0.0022 | | | [CVE-2026-72433](https://patchblox.com/security/data/cve/CVE-2026-72433.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIF... | 5.5 | 0.0022 | | | [CVE-2026-74284](https://patchblox.com/security/data/cve/CVE-2026-74284.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_hfsc: Don't make class passive tw... | 5.5 | 0.0022 | | | [CVE-2026-68205](https://patchblox.com/security/data/cve/CVE-2026-68205.md) | Routine | media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() | 5.5 | 0.0022 | | | [CVE-2026-68422](https://patchblox.com/security/data/cve/CVE-2026-68422.md) | Routine | btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() | 5.5 | 0.0022 | | | [CVE-2026-74265](https://patchblox.com/security/data/cve/CVE-2026-74265.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net: mana: initialize gdma queue id to INVALID_Q... | 5.5 | 0.0022 | | | [CVE-2026-74327](https://patchblox.com/security/data/cve/CVE-2026-74327.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix NULL pointer dereference in is_vm_a... | 5.5 | 0.0022 | | | [CVE-2026-74329](https://patchblox.com/security/data/cve/CVE-2026-74329.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: watchdog: unregister PM notifier on watchdog unr... | 5.5 | 0.0022 | | | [CVE-2026-74399](https://patchblox.com/security/data/cve/CVE-2026-74399.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: evm: terminate and bound the evm_xattrs read buf... | 5.5 | 0.0022 | | | [CVE-2026-72086](https://patchblox.com/security/data/cve/CVE-2026-72086.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the... | 5.5 | 0.0021 | | | [CVE-2026-68190](https://patchblox.com/security/data/cve/CVE-2026-68190.md) | Routine | staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() | 5.5 | 0.0021 | | | [CVE-2026-72305](https://patchblox.com/security/data/cve/CVE-2026-72305.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: VDUSE: avoid leaking information to userspace T... | 5.5 | 0.0021 | | Showing 500 of 588 CVEs; the web page lists them all. --- Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.