# ELSA-2026-500374: Security update for 35 packages

ELSA-2026-500374, released October 7, 2026, fixes 1,058 CVEs across 35 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/elsa-2026-500374
- Platform: Linux
- Released: Oct 7, 2026
- Priority: Urgent (Closes CVE-2026-89970, rated Critical)
- CVEs: 1,058, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://linux.oracle.com/errata/ELSA-2026-500374.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [kernel-uek](https://patchblox.com/security/data/product/linux/kernel-uek.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek](https://patchblox.com/security/data/product/linux/kernel-uek.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-core](https://patchblox.com/security/data/product/linux/kernel-uek-core.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-core](https://patchblox.com/security/data/product/linux/kernel-uek-core.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug](https://patchblox.com/security/data/product/linux/kernel-uek-debug.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug](https://patchblox.com/security/data/product/linux/kernel-uek-debug.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-core.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-core.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-devel](https://patchblox.com/security/data/product/linux/kernel-uek-debug-devel.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-devel](https://patchblox.com/security/data/product/linux/kernel-uek-debug-devel.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-core.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-core.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules-deprecated](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-deprecated.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules-deprecated](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-deprecated.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules-desktop](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-desktop.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules-desktop](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-desktop.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules-extra-netfilter](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra-netfilter.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules-extra-netfilter](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra-netfilter.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules-usb](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-usb.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules-usb](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-usb.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules-wireless](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-wireless.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-debug-modules-wireless](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-wireless.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-devel](https://patchblox.com/security/data/product/linux/kernel-uek-devel.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-devel](https://patchblox.com/security/data/product/linux/kernel-uek-devel.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-doc](https://patchblox.com/security/data/product/linux/kernel-uek-doc.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-doc](https://patchblox.com/security/data/product/linux/kernel-uek-doc.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules](https://patchblox.com/security/data/product/linux/kernel-uek-modules.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules](https://patchblox.com/security/data/product/linux/kernel-uek-modules.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules-core](https://patchblox.com/security/data/product/linux/kernel-uek-modules-core.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules-core](https://patchblox.com/security/data/product/linux/kernel-uek-modules-core.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules-deprecated](https://patchblox.com/security/data/product/linux/kernel-uek-modules-deprecated.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules-deprecated](https://patchblox.com/security/data/product/linux/kernel-uek-modules-deprecated.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules-desktop](https://patchblox.com/security/data/product/linux/kernel-uek-modules-desktop.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules-desktop](https://patchblox.com/security/data/product/linux/kernel-uek-modules-desktop.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules-extra-netfilter](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra-netfilter.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules-extra-netfilter](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra-netfilter.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules-usb](https://patchblox.com/security/data/product/linux/kernel-uek-modules-usb.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules-usb](https://patchblox.com/security/data/product/linux/kernel-uek-modules-usb.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules-wireless](https://patchblox.com/security/data/product/linux/kernel-uek-modules-wireless.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-modules-wireless](https://patchblox.com/security/data/product/linux/kernel-uek-modules-wireless.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-tools](https://patchblox.com/security/data/product/linux/kernel-uek-tools.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek-tools](https://patchblox.com/security/data/product/linux/kernel-uek-tools.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k](https://patchblox.com/security/data/product/linux/kernel-uek64k.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k](https://patchblox.com/security/data/product/linux/kernel-uek64k.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-core.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-core.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-devel](https://patchblox.com/security/data/product/linux/kernel-uek64k-devel.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-devel](https://patchblox.com/security/data/product/linux/kernel-uek64k-devel.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-core.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-core.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules-deprecated](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-deprecated.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules-deprecated](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-deprecated.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules-desktop](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-desktop.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules-desktop](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-desktop.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules-extra-netfilter](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra-netfilter.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules-extra-netfilter](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra-netfilter.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules-usb](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-usb.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules-usb](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-usb.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules-wireless](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-wireless.md) | ol 10 | 0:6.12.0-207.111.5.1.el9uek |
| [kernel-uek64k-modules-wireless](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-wireless.md) | ol 9 | 0:6.12.0-207.111.5.1.el9uek |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-89970](https://patchblox.com/security/data/cve/CVE-2026-89970.md) | Urgent | nvmet-auth: Synchronize timeout work during SQ teardown | 9.8 | 0.0080 |  |
| [CVE-2026-90151](https://patchblox.com/security/data/cve/CVE-2026-90151.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  NFSv4: remove callback IDR entry on client alloc... | 9.8 | 0.0075 |  |
| [CVE-2026-89688](https://patchblox.com/security/data/cve/CVE-2026-89688.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: drop the stateid, not the stateowner, on s... | 9.8 | 0.0074 |  |
| [CVE-2026-80976](https://patchblox.com/security/data/cve/CVE-2026-80976.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  seg6: reset IP6CB after IPv6 decapsulation  deca... | 9.8 | 0.0071 |  |
| [CVE-2026-89485](https://patchblox.com/security/data/cve/CVE-2026-89485.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  lockd: pin next file across nlm_inspect_file loc... | 9.8 | 0.0071 |  |
| [CVE-2026-89492](https://patchblox.com/security/data/cve/CVE-2026-89492.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  ocfs2: validate directory-index entry counts whe... | 9.8 | 0.0071 |  |
| [CVE-2026-89494](https://patchblox.com/security/data/cve/CVE-2026-89494.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  ocfs2: validate lengths in dlm_mig_lockres_handl... | 9.8 | 0.0071 |  |
| [CVE-2026-89495](https://patchblox.com/security/data/cve/CVE-2026-89495.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  ocfs2: bound namelen in dlm_migrate_request_hand... | 9.8 | 0.0071 |  |
| [CVE-2026-89655](https://patchblox.com/security/data/cve/CVE-2026-89655.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  ceph: fix UAF in __kick_flushing_caps() on cf en... | 9.8 | 0.0071 |  |
| [CVE-2026-89712](https://patchblox.com/security/data/cve/CVE-2026-89712.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  NFSD: restart ssc_expire_umount walk after dropp... | 9.8 | 0.0071 |  |
| [CVE-2026-89783](https://patchblox.com/security/data/cve/CVE-2026-89783.md) | Urgent | xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full | 9.8 | 0.0071 |  |
| [CVE-2026-89969](https://patchblox.com/security/data/cve/CVE-2026-89969.md) | Urgent | nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU | 9.8 | 0.0071 |  |
| [CVE-2026-89846](https://patchblox.com/security/data/cve/CVE-2026-89846.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  scsi: qla2xxx: Bound rsp_info_len to avoid OOB s... | 9.1 | 0.0071 |  |
| [CVE-2026-72137](https://patchblox.com/security/data/cve/CVE-2026-72137.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  xfrm: nat_keepalive: avoid double free on send e... | 9.8 | 0.0071 |  |
| [CVE-2026-89778](https://patchblox.com/security/data/cve/CVE-2026-89778.md) | Urgent | isofs: fix out-of-bounds page array access on empty zisofs block | 9.8 | 0.0070 |  |
| [CVE-2026-89555](https://patchblox.com/security/data/cve/CVE-2026-89555.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  mpls: reload header after pskb_may_pull()  mpls_... | 9.8 | 0.0069 |  |
| [CVE-2026-89847](https://patchblox.com/security/data/cve/CVE-2026-89847.md) | Urgent | scsi: qla2xxx: Avoid double completion in async IOCB timeout | 9.8 | 0.0069 |  |
| [CVE-2026-89634](https://patchblox.com/security/data/cve/CVE-2026-89634.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  smb: client: fix ALIGN() overflow in symlink_dat... | 9.8 | 0.0069 |  |
| [CVE-2026-89526](https://patchblox.com/security/data/cve/CVE-2026-89526.md) | Urgent | svcrdma: Validate Read chunk positions before reconstruction | 9.8 | 0.0068 |  |
| [CVE-2026-68287](https://patchblox.com/security/data/cve/CVE-2026-68287.md) | Urgent | drop_monitor: fix size calculations for 64-bit attributes | 9.8 | 0.0068 |  |
| [CVE-2026-89713](https://patchblox.com/security/data/cve/CVE-2026-89713.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  NFSD: check truncate permission under inode lock... | 9.1 | 0.0067 |  |
| [CVE-2026-89636](https://patchblox.com/security/data/cve/CVE-2026-89636.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  smb: client: clear ce->tgthint in free_tgts()  W... | 9.8 | 0.0066 |  |
| [CVE-2026-89536](https://patchblox.com/security/data/cve/CVE-2026-89536.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  SUNRPC: wait for in-flight client TLS handshake... | 9.8 | 0.0064 |  |
| [CVE-2026-89558](https://patchblox.com/security/data/cve/CVE-2026-89558.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  md/raid10: fix still_degraded being inverted in... | 9.8 | 0.0064 |  |
| [CVE-2026-89651](https://patchblox.com/security/data/cve/CVE-2026-89651.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  ceph: bound MDSCapAuth path and fs_name decode i... | 9.8 | 0.0064 |  |
| [CVE-2026-90012](https://patchblox.com/security/data/cve/CVE-2026-90012.md) | Urgent | spi: Fix DMA mapping ownership on partial map failure | 9.8 | 0.0063 |  |
| [CVE-2026-89857](https://patchblox.com/security/data/cve/CVE-2026-89857.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  scsi: qla2xxx: Hold qpair lock when sending NVMe... | 9.8 | 0.0062 |  |
| [CVE-2026-89658](https://patchblox.com/security/data/cve/CVE-2026-89658.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  NFSD: Prevent client use-after-free during NFSv4... | 9.8 | 0.0062 |  |
| [CVE-2026-89660](https://patchblox.com/security/data/cve/CVE-2026-89660.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  NFSD: Prevent client use-after-free during admin... | 9.8 | 0.0062 |  |
| [CVE-2026-89703](https://patchblox.com/security/data/cve/CVE-2026-89703.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_... | 9.8 | 0.0062 |  |
| [CVE-2026-90110](https://patchblox.com/security/data/cve/CVE-2026-90110.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  inetpeer: randomize RB-tree node comparison usin... | 9.4 | 0.0061 |  |
| [CVE-2026-89990](https://patchblox.com/security/data/cve/CVE-2026-89990.md) | Urgent | ceph: lock mutex in ceph_mds_check_access() | 9.8 | 0.0061 |  |
| [CVE-2026-80557](https://patchblox.com/security/data/cve/CVE-2026-80557.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  libceph: fix OOB read in decode_watchers() via m... | 9.8 | 0.0053 |  |
| [CVE-2026-89478](https://patchblox.com/security/data/cve/CVE-2026-89478.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  sctp: drop a chunk if its transport was removed... | 9.8 | 0.0051 |  |
| [CVE-2026-89541](https://patchblox.com/security/data/cve/CVE-2026-89541.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  SUNRPC: harden gss_unwrap_resp_priv length check... | 9.8 | 0.0051 |  |
| [CVE-2026-89542](https://patchblox.com/security/data/cve/CVE-2026-89542.md) | Urgent | SUNRPC: harden gss_krb5_unwrap_v2 against short tokens | 9.8 | 0.0051 |  |
| [CVE-2026-89551](https://patchblox.com/security/data/cve/CVE-2026-89551.md) | Urgent | SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow | 9.8 | 0.0051 |  |
| [CVE-2026-89652](https://patchblox.com/security/data/cve/CVE-2026-89652.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  ceph: bound copied dentry name length in NFS exp... | 9.8 | 0.0051 |  |
| [CVE-2026-89674](https://patchblox.com/security/data/cve/CVE-2026-89674.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: fix XDR length calculation in nfsd4_ff_enc... | 9.8 | 0.0051 |  |
| [CVE-2026-90037](https://patchblox.com/security/data/cve/CVE-2026-90037.md) | Urgent | NFSD: Prevent client use-after-free during close_lru reaping | 9.8 | 0.0051 |  |
| [CVE-2026-90414](https://patchblox.com/security/data/cve/CVE-2026-90414.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  IB/isert: reject PDUs declaring more data than w... | 9.8 | 0.0051 |  |
| [CVE-2026-89533](https://patchblox.com/security/data/cve/CVE-2026-89533.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  svcrdma: Fix offset arithmetic in read_chunk_ran... | 9.8 | 0.0050 |  |
| [CVE-2026-89653](https://patchblox.com/security/data/cve/CVE-2026-89653.md) | Urgent | ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode | 9.8 | 0.0050 |  |
| [CVE-2026-89702](https://patchblox.com/security/data/cve/CVE-2026-89702.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: size fh_verify server sockaddr slot by xpt... | 9.8 | 0.0050 |  |
| [CVE-2026-90042](https://patchblox.com/security/data/cve/CVE-2026-90042.md) | Urgent | ceph: properly decrypt filenames in vmalloc() buffers | 9.8 | 0.0050 |  |
| [CVE-2026-80945](https://patchblox.com/security/data/cve/CVE-2026-80945.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  crypto: iaa - unmap dst before software fallback... | 9.1 | 0.0050 |  |
| [CVE-2026-80681](https://patchblox.com/security/data/cve/CVE-2026-80681.md) | Urgent | vxlan: re-fetch eth header after route_shortcircuit() | 9.8 | 0.0050 |  |
| [CVE-2026-89479](https://patchblox.com/security/data/cve/CVE-2026-89479.md) | Urgent | sctp: stop processing a packet once its association is deleted | 9.8 | 0.0050 |  |
| [CVE-2026-89676](https://patchblox.com/security/data/cve/CVE-2026-89676.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: fix stale s2s_cp_stateids IDR entry for as... | 9.8 | 0.0049 |  |
| [CVE-2026-90036](https://patchblox.com/security/data/cve/CVE-2026-90036.md) | Urgent | NFSD: Prevent client use-after-free during blocked-lock reaping | 9.8 | 0.0048 |  |
| [CVE-2026-93207](https://patchblox.com/security/data/cve/CVE-2026-93207.md) | Urgent | SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry | 9.8 | 0.0047 |  |
| [CVE-2026-80725](https://patchblox.com/security/data/cve/CVE-2026-80725.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  net: gro: properly validate BIG TCP aggregation... | 9.8 | 0.0046 |  |
| [CVE-2026-64216](https://patchblox.com/security/data/cve/CVE-2026-64216.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved:  netfs: Fix potential UAF in netfs_unlock_abandon... | 9.8 | 0.0046 |  |
| [CVE-2026-100075](https://patchblox.com/security/data/cve/CVE-2026-100075.md) | Urgent | RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters | 9.8 | 0.0043 |  |
| [CVE-2026-68132](https://patchblox.com/security/data/cve/CVE-2026-68132.md) | Urgent | super: fix emergency thaw deadlock on frozen block devices | 9.8 | 0.0018 |  |
| [CVE-2026-80686](https://patchblox.com/security/data/cve/CVE-2026-80686.md) | Urgent | mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE | 9.8 | 0.0017 |  |
| [CVE-2026-80715](https://patchblox.com/security/data/cve/CVE-2026-80715.md) | Urgent | igc: remove napi_synchronize() in igc_down() | 9.8 | 0.0016 |  |
| [CVE-2025-39925](https://patchblox.com/security/data/cve/CVE-2025-39925.md) | Urgent | can: j1939: implement NETDEV_UNREGISTER notification handler | 9.8 | 0.0015 |  |
| [CVE-2026-90011](https://patchblox.com/security/data/cve/CVE-2026-90011.md) | High | scsi: target: iscsi: Reserve a terminator byte for the login payload | 9.8 | 0.0084 |  |
| [CVE-2026-90413](https://patchblox.com/security/data/cve/CVE-2026-90413.md) | High | IB/isert: reject login PDUs declaring more data than was received | 9.1 | 0.0084 |  |
| [CVE-2026-89968](https://patchblox.com/security/data/cve/CVE-2026-89968.md) | High | nvmet-tcp: reject unsolicited H2CData PDUs | 9.8 | 0.0082 |  |
| [CVE-2026-89696](https://patchblox.com/security/data/cve/CVE-2026-89696.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: block non-SAVEFH ops after FOREIGN PUTFH t... | 7.5 | 0.0075 |  |
| [CVE-2026-68159](https://patchblox.com/security/data/cve/CVE-2026-68159.md) | High | libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE | 9.8 | 0.0075 |  |
| [CVE-2026-97524](https://patchblox.com/security/data/cve/CVE-2026-97524.md) | High | mptcp: avoid unneeded actions on subflow reset | 9.8 | 0.0075 |  |
| [CVE-2026-89680](https://patchblox.com/security/data/cve/CVE-2026-89680.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: fix nfsd_file leak on inter-server COPY se... | 7.5 | 0.0074 |  |
| [CVE-2026-97523](https://patchblox.com/security/data/cve/CVE-2026-97523.md) | High | mptcp: close race between scheduler and state change | 7.5 | 0.0073 |  |
| [CVE-2026-89544](https://patchblox.com/security/data/cve/CVE-2026-89544.md) | High | SUNRPC: fix gssx_dec_option_array error path bugs | 9.8 | 0.0072 |  |
| [CVE-2026-89482](https://patchblox.com/security/data/cve/CVE-2026-89482.md) | High | nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone | 9.8 | 0.0071 |  |
| [CVE-2026-89538](https://patchblox.com/security/data/cve/CVE-2026-89538.md) | High | SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field | 9.8 | 0.0071 |  |
| [CVE-2026-89643](https://patchblox.com/security/data/cve/CVE-2026-89643.md) | High | audit: avoid dropping live tree ref on fsnotify rule autoremove | 9.8 | 0.0071 |  |
| [CVE-2026-89686](https://patchblox.com/security/data/cve/CVE-2026-89686.md) | High | nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke | 9.8 | 0.0071 |  |
| [CVE-2026-89549](https://patchblox.com/security/data/cve/CVE-2026-89549.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  sunrpc: route to a populated pool in svc_pool_fo... | 8.1 | 0.0071 |  |
| [CVE-2026-89511](https://patchblox.com/security/data/cve/CVE-2026-89511.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  qede: Fix NULL pointer dereference in TPA fragme... | 7.5 | 0.0071 |  |
| [CVE-2026-89786](https://patchblox.com/security/data/cve/CVE-2026-89786.md) | High | ext4: fix out-of-bounds read in ext4_read_inline_dir() | 9.1 | 0.0070 |  |
| [CVE-2026-89476](https://patchblox.com/security/data/cve/CVE-2026-89476.md) | High | sctp: fix stream->outcnt underflow on duplicate RECONF responses | 7.8 | 0.0070 |  |
| [CVE-2026-89707](https://patchblox.com/security/data/cve/CVE-2026-89707.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: release path refs on follow_down() error... | 7.5 | 0.0070 |  |
| [CVE-2026-90102](https://patchblox.com/security/data/cve/CVE-2026-90102.md) | High | NFSv4/pnfs: key the data server cache on the NFS version | 7.5 | 0.0070 |  |
| [CVE-2026-90103](https://patchblox.com/security/data/cve/CVE-2026-90103.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  NFSv4.2: fix LAYOUTSTATS send buffer exhaustion... | 7.5 | 0.0070 |  |
| [CVE-2026-90293](https://patchblox.com/security/data/cve/CVE-2026-90293.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  IB/isert: post the full-feature receive buffers... | 7.5 | 0.0070 |  |
| [CVE-2026-90294](https://patchblox.com/security/data/cve/CVE-2026-90294.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  IB/isert: delay the final Login Response until t... | 7.5 | 0.0070 |  |
| [CVE-2026-97557](https://patchblox.com/security/data/cve/CVE-2026-97557.md) | High | smb: client: avoid leaking refcount in cifs_queue_oplock_break() | 7.5 | 0.0070 |  |
| [CVE-2026-89662](https://patchblox.com/security/data/cve/CVE-2026-89662.md) | High | NFSD: Prevent lock owner use-after-free during client teardown | 9.8 | 0.0069 |  |
| [CVE-2026-89669](https://patchblox.com/security/data/cve/CVE-2026-89669.md) | High | nfsd: initialize copy-notify stateid before publishing it | 9.8 | 0.0069 |  |
| [CVE-2026-89863](https://patchblox.com/security/data/cve/CVE-2026-89863.md) | High | scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check | 7.5 | 0.0068 |  |
| [CVE-2026-90067](https://patchblox.com/security/data/cve/CVE-2026-90067.md) | High | libceph: validate banner payload length | 7.5 | 0.0068 |  |
| [CVE-2026-90228](https://patchblox.com/security/data/cve/CVE-2026-90228.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nvmet: fix NULL pointer dereference in nvmet_exe... | 7.5 | 0.0068 |  |
| [CVE-2026-93151](https://patchblox.com/security/data/cve/CVE-2026-93151.md) | High | nvmet-rdma: fix response resource leak on queue teardown | 7.5 | 0.0068 |  |
| [CVE-2026-89649](https://patchblox.com/security/data/cve/CVE-2026-89649.md) | High | ceph: bound xattr value length in __build_xattrs() | 9.1 | 0.0068 |  |
| [CVE-2026-89647](https://patchblox.com/security/data/cve/CVE-2026-89647.md) | High | ceph: do not repeat ceph_trim_dentries() if no progress possible | 7.8 | 0.0068 |  |
| [CVE-2026-90235](https://patchblox.com/security/data/cve/CVE-2026-90235.md) | High | sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE | 9.8 | 0.0066 |  |
| [CVE-2026-89493](https://patchblox.com/security/data/cve/CVE-2026-89493.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ocfs2: validate rl_used against rl_count in refc... | 8.8 | 0.0065 |  |
| [CVE-2026-89973](https://patchblox.com/security/data/cve/CVE-2026-89973.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nvme-tcp: check the data direction of a C2HData... | 9.8 | 0.0062 |  |
| [CVE-2026-89586](https://patchblox.com/security/data/cve/CVE-2026-89586.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ata: libata-scsi: fix DSM TRIM for sector sizes... | 8.2 | 0.0062 |  |
| [CVE-2026-89657](https://patchblox.com/security/data/cve/CVE-2026-89657.md) | High | libceph: validate OSD extent maps before cursor advance | 7.5 | 0.0061 |  |
| [CVE-2026-89685](https://patchblox.com/security/data/cve/CVE-2026-89685.md) | High | nfsd: fix clock domain mismatch in clients_still_reclaiming() | 7.5 | 0.0061 |  |
| [CVE-2026-98056](https://patchblox.com/security/data/cve/CVE-2026-98056.md) | High | nvme: remove stale namespaces by NSID range during scan | 7.5 | 0.0061 |  |
| [CVE-2026-97573](https://patchblox.com/security/data/cve/CVE-2026-97573.md) | High | bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() | 9.8 | 0.0060 |  |
| [CVE-2026-89554](https://patchblox.com/security/data/cve/CVE-2026-89554.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  mptcp: fix uninitialized local_id in syncookie M... | 9.8 | 0.0060 |  |
| [CVE-2026-89861](https://patchblox.com/security/data/cve/CVE-2026-89861.md) | High | scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() | 9.8 | 0.0059 |  |
| [CVE-2026-89848](https://patchblox.com/security/data/cve/CVE-2026-89848.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  scsi: qla2xxx: Quiesce response IRQ before freei... | 8.1 | 0.0059 |  |
| [CVE-2026-97555](https://patchblox.com/security/data/cve/CVE-2026-97555.md) | High | smb: client: fix heap overflow in DACL owner/group rewrite | 9.8 | 0.0058 |  |
| [CVE-2026-89483](https://patchblox.com/security/data/cve/CVE-2026-89483.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nvme: zero the discard fallback page  nvme_setup... | 7.5 | 0.0057 |  |
| [CVE-2026-89547](https://patchblox.com/security/data/cve/CVE-2026-89547.md) | High | SUNRPC: Check svc pool percpu counter allocation | 8.1 | 0.0056 |  |
| [CVE-2026-89671](https://patchblox.com/security/data/cve/CVE-2026-89671.md) | High | nfsd: gate nfs3 setacl by argp->mask | 9.1 | 0.0055 |  |
| [CVE-2026-93107](https://patchblox.com/security/data/cve/CVE-2026-93107.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  RDMA/rxe: Avoid reprocessing the current packet... | 8.2 | 0.0054 |  |
| [CVE-2026-89535](https://patchblox.com/security/data/cve/CVE-2026-89535.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  svcrdma: Reorder rpcrdma_rn_unregister before rd... | 8.1 | 0.0054 |  |
| [CVE-2026-89667](https://patchblox.com/security/data/cve/CVE-2026-89667.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: close shrinker/GC/fsnotify vs per-net shut... | 8.1 | 0.0054 |  |
| [CVE-2026-74743](https://patchblox.com/security/data/cve/CVE-2026-74743.md) | High | macvlan: inherit needed_headroom and needed_tailroom from lowerdev | 9.8 | 0.0054 |  |
| [CVE-2026-74746](https://patchblox.com/security/data/cve/CVE-2026-74746.md) | High | netfilter: flowtable: publish GC-visible tuple last | 9.8 | 0.0054 |  |
| [CVE-2026-89706](https://patchblox.com/security/data/cve/CVE-2026-89706.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: Reset write verifier when async COPY write... | 8.2 | 0.0053 |  |
| [CVE-2026-89704](https://patchblox.com/security/data/cve/CVE-2026-89704.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: sample writeback error cursor before async... | 7.5 | 0.0053 |  |
| [CVE-2026-80587](https://patchblox.com/security/data/cve/CVE-2026-80587.md) | High | mptcp: avoid combining some incoming suboptions | 9.8 | 0.0052 |  |
| [CVE-2026-74662](https://patchblox.com/security/data/cve/CVE-2026-74662.md) | High | inet: frags: publish queues before arming timer | 9.8 | 0.0051 |  |
| [CVE-2026-80528](https://patchblox.com/security/data/cve/CVE-2026-80528.md) | High | ceph: avoid fs reclaim while using current->journal_info | 9.8 | 0.0051 |  |
| [CVE-2026-80558](https://patchblox.com/security/data/cve/CVE-2026-80558.md) | High | libceph: Avoid using invalid osd indices from primary_temp | 9.8 | 0.0051 |  |
| [CVE-2026-80561](https://patchblox.com/security/data/cve/CVE-2026-80561.md) | High | libceph: fix multiple unsafe decodes in decode_locker() | 9.8 | 0.0051 |  |
| [CVE-2026-81002](https://patchblox.com/security/data/cve/CVE-2026-81002.md) | High | xdp: fix zero-copy frame layout | 9.8 | 0.0051 |  |
| [CVE-2026-89656](https://patchblox.com/security/data/cve/CVE-2026-89656.md) | High | libceph: reject buckets with mismatched CRUSH ids | 9.8 | 0.0051 |  |
| [CVE-2026-89650](https://patchblox.com/security/data/cve/CVE-2026-89650.md) | High | ceph: bound num_export_targets array for mds info v2/v3 | 9.1 | 0.0051 |  |
| [CVE-2026-74744](https://patchblox.com/security/data/cve/CVE-2026-74744.md) | High | ipvlan: inherit needed_headroom and needed_tailroom from phy_dev | 9.8 | 0.0051 |  |
| [CVE-2026-98096](https://patchblox.com/security/data/cve/CVE-2026-98096.md) | High | ipv6: sr: restore network header before routing and forwarding | 7.8 | 0.0051 |  |
| [CVE-2026-23459](https://patchblox.com/security/data/cve/CVE-2026-23459.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV... | 8.2 | 0.0050 |  |
| [CVE-2026-89532](https://patchblox.com/security/data/cve/CVE-2026-89532.md) | High | svcrdma: Fix pcl_for_each_segment for empty chunks | 9.1 | 0.0050 |  |
| [CVE-2026-89684](https://patchblox.com/security/data/cve/CVE-2026-89684.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: fix cpntf publish race in nfs4_init_cp_sta... | 9.8 | 0.0050 |  |
| [CVE-2026-93228](https://patchblox.com/security/data/cve/CVE-2026-93228.md) | High | svcrdma: Reject Write/Reply chunks with segcount 0 | 9.1 | 0.0050 |  |
| [CVE-2026-80527](https://patchblox.com/security/data/cve/CVE-2026-80527.md) | High | ceph: fix hanging __ceph_get_caps() with stale mds_wanted | 7.8 | 0.0050 |  |
| [CVE-2026-74626](https://patchblox.com/security/data/cve/CVE-2026-74626.md) | High | NTB: ntb_netdev: Preserve RX queue depth on allocation failure | 7.5 | 0.0050 |  |
| [CVE-2026-80987](https://patchblox.com/security/data/cve/CVE-2026-80987.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  NTB: ntb_transport: Reject oversized TX buffers... | 7.5 | 0.0050 |  |
| [CVE-2026-89477](https://patchblox.com/security/data/cve/CVE-2026-89477.md) | High | sctp: fix NULL deref on untransmitted RECONF completion | 7.5 | 0.0050 |  |
| [CVE-2026-89699](https://patchblox.com/security/data/cve/CVE-2026-89699.md) | High | nfsd: validate symlink target length in NFSv4 CREATE | 7.5 | 0.0050 |  |
| [CVE-2026-74628](https://patchblox.com/security/data/cve/CVE-2026-74628.md) | High | net/x25: fix use-after-free of the socket by its timers | 9.8 | 0.0050 |  |
| [CVE-2026-72438](https://patchblox.com/security/data/cve/CVE-2026-72438.md) | High | md/raid10: fix writes_pending and barrier reference leaks on discard failures | 7.5 | 0.0050 |  |
| [CVE-2026-68082](https://patchblox.com/security/data/cve/CVE-2026-68082.md) | High | libceph: fix two unsafe bare decodes in decode_lockers() | 9.8 | 0.0050 |  |
| [CVE-2026-74474](https://patchblox.com/security/data/cve/CVE-2026-74474.md) | High | vxlan: use pskb_network_may_pull() for transmit path header pulls | 9.8 | 0.0049 |  |
| [CVE-2026-89530](https://patchblox.com/security/data/cve/CVE-2026-89530.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the... | 9.8 | 0.0049 |  |
| [CVE-2026-89550](https://patchblox.com/security/data/cve/CVE-2026-89550.md) | High | SUNRPC: svcauth_gss: enforce krb5 token minimum length | 9.8 | 0.0049 |  |
| [CVE-2026-97417](https://patchblox.com/security/data/cve/CVE-2026-97417.md) | High | netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() | 8.8 | 0.0049 |  |
| [CVE-2026-80714](https://patchblox.com/security/data/cve/CVE-2026-80714.md) | High | ipvs: do not propagate one-packet flag to synced conns | 9.8 | 0.0048 |  |
| [CVE-2026-89561](https://patchblox.com/security/data/cve/CVE-2026-89561.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ipv6: rpl: fix NULL dereference of idev in ipv6_... | 7.5 | 0.0048 |  |
| [CVE-2026-89659](https://patchblox.com/security/data/cve/CVE-2026-89659.md) | High | NFSD: Prevent client use-after-free during delegation revoke | 9.8 | 0.0048 |  |
| [CVE-2025-40074](https://patchblox.com/security/data/cve/CVE-2025-40074.md) | High | ipv4: start using dst_dev_rcu() | 9.8 | 0.0046 |  |
| [CVE-2026-74742](https://patchblox.com/security/data/cve/CVE-2026-74742.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  veth: fix queue index used to wake the peer txq... | 7.5 | 0.0046 |  |
| [CVE-2026-92489](https://patchblox.com/security/data/cve/CVE-2026-92489.md) | High | xfrm: Fix skb double-free in xfrm_dev_direct_output() | 9.8 | 0.0046 |  |
| [CVE-2026-90230](https://patchblox.com/security/data/cve/CVE-2026-90230.md) | High | nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate() | 9.1 | 0.0046 |  |
| [CVE-2026-89663](https://patchblox.com/security/data/cve/CVE-2026-89663.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: revoke copy-notify stateids before droppin... | 9.8 | 0.0046 |  |
| [CVE-2026-98130](https://patchblox.com/security/data/cve/CVE-2026-98130.md) | High | sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START | 8.1 | 0.0045 |  |
| [CVE-2026-93224](https://patchblox.com/security/data/cve/CVE-2026-93224.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  svcrdma: Fix unmatched rn_unregister on failed a... | 9.8 | 0.0045 |  |
| [CVE-2026-90141](https://patchblox.com/security/data/cve/CVE-2026-90141.md) | High | ipvs: fix integer overflow in ftp helper port/address parsing | 9.8 | 0.0045 |  |
| [CVE-2026-89708](https://patchblox.com/security/data/cve/CVE-2026-89708.md) | High | nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown | 9.8 | 0.0044 |  |
| [CVE-2026-89711](https://patchblox.com/security/data/cve/CVE-2026-89711.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_... | 8.2 | 0.0044 |  |
| [CVE-2026-80691](https://patchblox.com/security/data/cve/CVE-2026-80691.md) | High | scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE | 7.5 | 0.0044 |  |
| [CVE-2026-89481](https://patchblox.com/security/data/cve/CVE-2026-89481.md) | High | nvme-tcp: fix host memory disclosure on R2T for a read command | 8.8 | 0.0043 |  |
| [CVE-2026-89480](https://patchblox.com/security/data/cve/CVE-2026-89480.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nvme-tcp: reject a read that transferred too few... | 8.8 | 0.0043 |  |
| [CVE-2026-97583](https://patchblox.com/security/data/cve/CVE-2026-97583.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  afs: Clear stale peer app data after address lis... | 9.8 | 0.0041 |  |
| [CVE-2026-97562](https://patchblox.com/security/data/cve/CVE-2026-97562.md) | High | smb: client: pin DFS superblock in iterator callback | 7.8 | 0.0041 |  |
| [CVE-2026-97953](https://patchblox.com/security/data/cve/CVE-2026-97953.md) | High | net: stmmac: fix TX descriptor availability check for TSO traffic | 7.8 | 0.0041 |  |
| [CVE-2026-80586](https://patchblox.com/security/data/cve/CVE-2026-80586.md) | High | mptcp: options: reset DSS fields in case of unexpected size | 9.8 | 0.0040 |  |
| [CVE-2026-72334](https://patchblox.com/security/data/cve/CVE-2026-72334.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: ISO: fix malformed ISO_END/CONT handl... | 8.8 | 0.0040 |  |
| [CVE-2026-80589](https://patchblox.com/security/data/cve/CVE-2026-80589.md) | High | block: stop the timeout timer when releasing a never added disk | 9.8 | 0.0037 |  |
| [CVE-2026-89999](https://patchblox.com/security/data/cve/CVE-2026-89999.md) | High | HID: wacom: validate report length in wacom_intuos_pro2_bt_irq | 8.1 | 0.0037 |  |
| [CVE-2026-64210](https://patchblox.com/security/data/cve/CVE-2026-64210.md) | High | net/mlx5e: xsk: Fix unlocked writing to ICOSQ | 7.5 | 0.0037 |  |
| [CVE-2026-89849](https://patchblox.com/security/data/cve/CVE-2026-89849.md) | High | scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path | 8.8 | 0.0036 |  |
| [CVE-2026-90091](https://patchblox.com/security/data/cve/CVE-2026-90091.md) | High | Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan | 8.0 | 0.0036 |  |
| [CVE-2026-90092](https://patchblox.com/security/data/cve/CVE-2026-90092.md) | High | Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN | 8.0 | 0.0036 |  |
| [CVE-2026-90372](https://patchblox.com/security/data/cve/CVE-2026-90372.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: mt76: mt7915: avoid nss underflow in mt791... | 7.1 | 0.0036 |  |
| [CVE-2025-40210](https://patchblox.com/security/data/cve/CVE-2025-40210.md) | High | Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" | 7.5 | 0.0036 |  |
| [CVE-2026-89729](https://patchblox.com/security/data/cve/CVE-2026-89729.md) | High | HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature | 8.8 | 0.0036 |  |
| [CVE-2026-89626](https://patchblox.com/security/data/cve/CVE-2026-89626.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  HID: sensor: custom: Fix field sysfs group clean... | 8.8 | 0.0035 |  |
| [CVE-2026-89951](https://patchblox.com/security/data/cve/CVE-2026-89951.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  batman-adv: fix stale receive device on merged f... | 8.8 | 0.0035 |  |
| [CVE-2026-90000](https://patchblox.com/security/data/cve/CVE-2026-90000.md) | High | HID: rmi: fix OOB access with undersized RMI reports | 8.8 | 0.0035 |  |
| [CVE-2026-89995](https://patchblox.com/security/data/cve/CVE-2026-89995.md) | High | dma-direct: return struct page from dma_direct_alloc_from_pool() | 8.8 | 0.0035 |  |
| [CVE-2026-80989](https://patchblox.com/security/data/cve/CVE-2026-80989.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net: thunderbolt: Mark the connection down when... | 9.8 | 0.0035 |  |
| [CVE-2026-89860](https://patchblox.com/security/data/cve/CVE-2026-89860.md) | High | scsi: qla2xxx: Initialize NVMe abort_work once at submission | 8.8 | 0.0035 |  |
| [CVE-2026-93787](https://patchblox.com/security/data/cve/CVE-2026-93787.md) | High | smb: client: bound dirent name against end of SMB response in cifs_filldir | 9.8 | 0.0034 |  |
| [CVE-2026-89569](https://patchblox.com/security/data/cve/CVE-2026-89569.md) | High | Bluetooth: RFCOMM: serialize security confirmation handling | 8.8 | 0.0034 |  |
| [CVE-2026-90329](https://patchblox.com/security/data/cve/CVE-2026-90329.md) | High | HID: synchronize input before cleaning up a failed probe | 8.8 | 0.0034 |  |
| [CVE-2026-90357](https://patchblox.com/security/data/cve/CVE-2026-90357.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: mt76: mt7915: unlink TWT flow if the MCU r... | 8.8 | 0.0034 |  |
| [CVE-2026-89844](https://patchblox.com/security/data/cve/CVE-2026-89844.md) | High | scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition | 8.8 | 0.0034 |  |
| [CVE-2026-90255](https://patchblox.com/security/data/cve/CVE-2026-90255.md) | High | Bluetooth: hci_conn: fix the SCO setup context lifetime | 8.8 | 0.0034 |  |
| [CVE-2026-93203](https://patchblox.com/security/data/cve/CVE-2026-93203.md) | High | batman-adv: bla: avoid CRC corruption due to parallel claim add | 7.1 | 0.0034 |  |
| [CVE-2026-80707](https://patchblox.com/security/data/cve/CVE-2026-80707.md) | High | can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer | 7.5 | 0.0033 |  |
| [CVE-2026-80717](https://patchblox.com/security/data/cve/CVE-2026-80717.md) | High | sctp: validate Adaptation Indication parameter length | 7.5 | 0.0033 |  |
| [CVE-2026-93189](https://patchblox.com/security/data/cve/CVE-2026-93189.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  HID: core: quiesce input in hid_hw_stop() to pre... | 9.8 | 0.0032 |  |
| [CVE-2026-90041](https://patchblox.com/security/data/cve/CVE-2026-90041.md) | High | HID: sony: clean up device list on probe failure | 8.8 | 0.0032 |  |
| [CVE-2026-80585](https://patchblox.com/security/data/cve/CVE-2026-80585.md) | High | mptcp: fastopen: only mark MPTFO subflows with SYN data | 9.4 | 0.0031 |  |
| [CVE-2026-90380](https://patchblox.com/security/data/cve/CVE-2026-90380.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: mt76: mt792x: fix use-after-free in mt76_r... | 8.8 | 0.0031 |  |
| [CVE-2026-89897](https://patchblox.com/security/data/cve/CVE-2026-89897.md) | High | media: cec: Serialize exclusive follower delivery | 7.8 | 0.0031 |  |
| [CVE-2026-97595](https://patchblox.com/security/data/cve/CVE-2026-97595.md) | High | mac802154: fix use-after-free of sdata via queued RX frames | 9.8 | 0.0029 |  |
| [CVE-2026-89974](https://patchblox.com/security/data/cve/CVE-2026-89974.md) | High | nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails | 7.8 | 0.0029 |  |
| [CVE-2026-89524](https://patchblox.com/security/data/cve/CVE-2026-89524.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath6kl: clamp assoc request/response lengt... | 8.1 | 0.0027 |  |
| [CVE-2026-89583](https://patchblox.com/security/data/cve/CVE-2026-89583.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: eir: Fix OOB read in eir_get_service_... | 9.8 | 0.0027 |  |
| [CVE-2026-93793](https://patchblox.com/security/data/cve/CVE-2026-93793.md) | High | wifi: iwlwifi: mvm: validate TX_CMD response layout | 8.8 | 0.0026 |  |
| [CVE-2026-93790](https://patchblox.com/security/data/cve/CVE-2026-93790.md) | High | wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif | 8.8 | 0.0025 |  |
| [CVE-2026-93806](https://patchblox.com/security/data/cve/CVE-2026-93806.md) | High | wifi: cfg80211: validate assoc response length before status and IE access | 8.8 | 0.0025 |  |
| [CVE-2026-97409](https://patchblox.com/security/data/cve/CVE-2026-97409.md) | High | nvme-fc: Do not cancel requests in io target before it is initialized | 8.8 | 0.0025 |  |
| [CVE-2026-97442](https://patchblox.com/security/data/cve/CVE-2026-97442.md) | High | wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi | 8.8 | 0.0025 |  |
| [CVE-2026-89645](https://patchblox.com/security/data/cve/CVE-2026-89645.md) | High | btrfs: drop recovered reloc root refs on recovery failure | 7.0 | 0.0025 |  |
| [CVE-2026-98108](https://patchblox.com/security/data/cve/CVE-2026-98108.md) | High | Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan | 8.8 | 0.0024 |  |
| [CVE-2026-93799](https://patchblox.com/security/data/cve/CVE-2026-93799.md) | High | wifi: iwlwifi: mvm: validate sta_id in BA window status notif | 8.8 | 0.0024 |  |
| [CVE-2026-80722](https://patchblox.com/security/data/cve/CVE-2026-80722.md) | High | wifi: mac80211: validate individual TWT params before driver setup | 9.8 | 0.0024 |  |
| [CVE-2026-97509](https://patchblox.com/security/data/cve/CVE-2026-97509.md) | High | thunderbolt: Keep XDomain reference during the lifetime of a service | 8.8 | 0.0024 |  |
| [CVE-2026-80789](https://patchblox.com/security/data/cve/CVE-2026-80789.md) | High | nvmet-tcp: bound SGL data length before allocating command buffers | 7.5 | 0.0023 |  |
| [CVE-2026-93826](https://patchblox.com/security/data/cve/CVE-2026-93826.md) | High | HID: hidpp: fix potential UAF in hidpp_connect_event() | 7.5 | 0.0023 |  |
| [CVE-2026-80914](https://patchblox.com/security/data/cve/CVE-2026-80914.md) | High | Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready | 8.8 | 0.0023 |  |
| [CVE-2026-93242](https://patchblox.com/security/data/cve/CVE-2026-93242.md) | High | scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() | 8.8 | 0.0023 |  |
| [CVE-2026-64507](https://patchblox.com/security/data/cve/CVE-2026-64507.md) | High | x86/bugs: Enable IBPB flush on BPF JIT allocation | 7.8 | 0.0023 |  |
| [CVE-2026-89625](https://patchblox.com/security/data/cve/CVE-2026-89625.md) | High | HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind | 7.8 | 0.0023 |  |
| [CVE-2026-89796](https://patchblox.com/security/data/cve/CVE-2026-89796.md) | High | mm/damon/core: avoid infinite kdamond_merge_regions() internal loop | 7.8 | 0.0023 |  |
| [CVE-2026-90198](https://patchblox.com/security/data/cve/CVE-2026-90198.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ALSA: core: Fix use-after-free in snd_card_do_fr... | 7.8 | 0.0023 |  |
| [CVE-2026-90314](https://patchblox.com/security/data/cve/CVE-2026-90314.md) | High | remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() | 7.1 | 0.0023 |  |
| [CVE-2026-97508](https://patchblox.com/security/data/cve/CVE-2026-97508.md) | High | thunderbolt: Set tb->root_switch to NULL when domain is stopped | 9.8 | 0.0023 |  |
| [CVE-2026-93240](https://patchblox.com/security/data/cve/CVE-2026-93240.md) | High | memcg: make the v1 soft limit knob inert | 7.8 | 0.0023 |  |
| [CVE-2025-40102](https://patchblox.com/security/data/cve/CVE-2025-40102.md) | High | KVM: arm64: Prevent access to vCPU events before init | 7.1 | 0.0022 |  |
| [CVE-2026-90150](https://patchblox.com/security/data/cve/CVE-2026-90150.md) | High | pnfs/blocklayout: Fix device leaks on parse failure | 9.8 | 0.0022 |  |
| [CVE-2026-97616](https://patchblox.com/security/data/cve/CVE-2026-97616.md) | High | net/sched: act_api: release all action references on NEWACTION failure | 7.1 | 0.0022 |  |
| [CVE-2026-89694](https://patchblox.com/security/data/cve/CVE-2026-89694.md) | High | nfsd: check client ownership when cancelling a copy-notify stateid | 8.8 | 0.0022 |  |
| [CVE-2026-89952](https://patchblox.com/security/data/cve/CVE-2026-89952.md) | High | mtd: rawnand: validate ONFI extended parameter page sections | 8.1 | 0.0022 |  |
| [CVE-2026-89853](https://patchblox.com/security/data/cve/CVE-2026-89853.md) | High | scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump | 7.8 | 0.0022 |  |
| [CVE-2026-89864](https://patchblox.com/security/data/cve/CVE-2026-89864.md) | High | scsi: qla2xxx: Bound i2c->length in I2C bsg handlers | 7.8 | 0.0022 |  |
| [CVE-2026-90073](https://patchblox.com/security/data/cve/CVE-2026-90073.md) | High | net/sched: hhf: clamp quantum before hhf_change() to avoid overflow | 7.8 | 0.0022 |  |
| [CVE-2026-90284](https://patchblox.com/security/data/cve/CVE-2026-90284.md) | High | firmware_loader: do not queue completed sysfs fallback requests | 7.8 | 0.0022 |  |
| [CVE-2026-90302](https://patchblox.com/security/data/cve/CVE-2026-90302.md) | High | ocfs2: synchronize heartbeat callbacks with o2net teardown | 7.8 | 0.0022 |  |
| [CVE-2026-90334](https://patchblox.com/security/data/cve/CVE-2026-90334.md) | High | tty: clear cdev pointer after cdev_add() failure | 7.8 | 0.0022 |  |
| [CVE-2026-90431](https://patchblox.com/security/data/cve/CVE-2026-90431.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  remoteproc: Prevent crash handling to race with... | 7.8 | 0.0022 |  |
| [CVE-2026-92496](https://patchblox.com/security/data/cve/CVE-2026-92496.md) | High | wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() | 7.8 | 0.0022 |  |
| [CVE-2026-93051](https://patchblox.com/security/data/cve/CVE-2026-93051.md) | High | misc: ad525x_dpot: use driver core groups for sysfs files | 7.8 | 0.0022 |  |
| [CVE-2026-93108](https://patchblox.com/security/data/cve/CVE-2026-93108.md) | High | RDMA/ipoib: Drain RCU callbacks during module teardown | 7.8 | 0.0022 |  |
| [CVE-2026-93239](https://patchblox.com/security/data/cve/CVE-2026-93239.md) | High | arm64: mm: Fix the lockless page-table walk in show_pte() | 7.8 | 0.0022 |  |
| [CVE-2026-97564](https://patchblox.com/security/data/cve/CVE-2026-97564.md) | High | smb: client: reject userspace cifs.idmap descriptions | 7.8 | 0.0022 |  |
| [CVE-2026-97598](https://patchblox.com/security/data/cve/CVE-2026-97598.md) | High | ipv4: fib: bound automatic table ID allocation | 7.8 | 0.0022 |  |
| [CVE-2026-97993](https://patchblox.com/security/data/cve/CVE-2026-97993.md) | High | vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx | 7.8 | 0.0022 |  |
| [CVE-2026-97998](https://patchblox.com/security/data/cve/CVE-2026-97998.md) | High | netfilter: nfnetlink_log: cope with concurrent instance destruction | 7.8 | 0.0022 |  |
| [CVE-2026-98076](https://patchblox.com/security/data/cve/CVE-2026-98076.md) | High | tracing/probes: Fix use-after-free on field name/type of events with multiple probes | 7.8 | 0.0022 |  |
| [CVE-2026-89843](https://patchblox.com/security/data/cve/CVE-2026-89843.md) | High | scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak | 7.1 | 0.0022 |  |
| [CVE-2026-89845](https://patchblox.com/security/data/cve/CVE-2026-89845.md) | High | scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() | 7.1 | 0.0022 |  |
| [CVE-2026-89852](https://patchblox.com/security/data/cve/CVE-2026-89852.md) | High | scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() | 7.1 | 0.0022 |  |
| [CVE-2026-89858](https://patchblox.com/security/data/cve/CVE-2026-89858.md) | High | scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() | 7.1 | 0.0022 |  |
| [CVE-2026-89878](https://patchblox.com/security/data/cve/CVE-2026-89878.md) | High | media: s2255: check firmware size before reading trailing marker | 7.1 | 0.0022 |  |
| [CVE-2026-89891](https://patchblox.com/security/data/cve/CVE-2026-89891.md) | High | media: em28xx: fix use-after-free of dev_next->devlist on disconnect | 7.1 | 0.0022 |  |
| [CVE-2026-89892](https://patchblox.com/security/data/cve/CVE-2026-89892.md) | High | media: em28xx: defer audio-only extension registration | 7.1 | 0.0022 |  |
| [CVE-2026-89948](https://patchblox.com/security/data/cve/CVE-2026-89948.md) | High | batman-adv: bla: fix freeing of claims on meshif deletion | 7.1 | 0.0022 |  |
| [CVE-2026-89984](https://patchblox.com/security/data/cve/CVE-2026-89984.md) | High | perf/x86/intel: Fix kernel address leakages in LBR stack | 7.1 | 0.0022 |  |
| [CVE-2026-90126](https://patchblox.com/security/data/cve/CVE-2026-90126.md) | High | rtc: pcf8563: fix clock provider leak on unbind | 7.1 | 0.0022 |  |
| [CVE-2026-90318](https://patchblox.com/security/data/cve/CVE-2026-90318.md) | High | fat: release buffer head after rebuilding parent | 7.1 | 0.0022 |  |
| [CVE-2026-90362](https://patchblox.com/security/data/cve/CVE-2026-90362.md) | High | drm/msm/dsi: Drop dev_pm_opp_set_rate(0) | 7.1 | 0.0022 |  |
| [CVE-2026-90411](https://patchblox.com/security/data/cve/CVE-2026-90411.md) | High | nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request | 7.1 | 0.0022 |  |
| [CVE-2026-93145](https://patchblox.com/security/data/cve/CVE-2026-93145.md) | High | clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() | 7.1 | 0.0022 |  |
| [CVE-2026-97568](https://patchblox.com/security/data/cve/CVE-2026-97568.md) | High | mptcp: syncookies: remember the request backup flag | 7.1 | 0.0022 |  |
| [CVE-2026-89461](https://patchblox.com/security/data/cve/CVE-2026-89461.md) | High | power: supply: max17040: synchronize work cancellation on suspend | 7.0 | 0.0022 |  |
| [CVE-2026-89876](https://patchblox.com/security/data/cve/CVE-2026-89876.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  media: tda18250: fix possible integer overflow... | 7.0 | 0.0022 |  |
| [CVE-2026-89945](https://patchblox.com/security/data/cve/CVE-2026-89945.md) | High | ASoC: cs35l34: drain threaded IRQ before runtime suspend | 7.0 | 0.0022 |  |
| [CVE-2026-97904](https://patchblox.com/security/data/cve/CVE-2026-97904.md) | High | cpufreq: initialize policy rwsem before sysfs publication | 7.0 | 0.0022 |  |
| [CVE-2026-89543](https://patchblox.com/security/data/cve/CVE-2026-89543.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  sunrpc: fix use-after-free in __rpc_clnt_handle_... | 7.8 | 0.0021 |  |
| [CVE-2026-90076](https://patchblox.com/security/data/cve/CVE-2026-90076.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net/sched: fq: add overflow bounds to quantum an... | 7.8 | 0.0021 |  |
| [CVE-2026-89484](https://patchblox.com/security/data/cve/CVE-2026-89484.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  lockd: fix NULL dereference on lockowner allocat... | 7.5 | 0.0021 |  |
| [CVE-2026-93163](https://patchblox.com/security/data/cve/CVE-2026-93163.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  hwrng: core - fix rng list on registration error... | 7.0 | 0.0021 |  |
| [CVE-2026-97556](https://patchblox.com/security/data/cve/CVE-2026-97556.md) | High | smb: client: avoid leaking refcount when cifs_sb_tlink() fails | 8.8 | 0.0021 |  |
| [CVE-2026-89787](https://patchblox.com/security/data/cve/CVE-2026-89787.md) | High | ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() | 7.8 | 0.0021 |  |
| [CVE-2026-90063](https://patchblox.com/security/data/cve/CVE-2026-90063.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  virtio-net: Ensure that TCP packets don't overfl... | 7.8 | 0.0021 |  |
| [CVE-2026-90139](https://patchblox.com/security/data/cve/CVE-2026-90139.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  fuse: check for NULL root inode in fuse_fill_sup... | 7.8 | 0.0021 |  |
| [CVE-2026-90140](https://patchblox.com/security/data/cve/CVE-2026-90140.md) | High | cuse: wait for pending RCU callbacks on module exit | 7.8 | 0.0021 |  |
| [CVE-2026-90248](https://patchblox.com/security/data/cve/CVE-2026-90248.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net/sched: cls_api: fix teardown of an adopted p... | 7.8 | 0.0021 |  |
| [CVE-2026-90253](https://patchblox.com/security/data/cve/CVE-2026-90253.md) | High | Bluetooth: MGMT: free the mesh send cancel command when it is cancelled | 7.8 | 0.0021 |  |
| [CVE-2026-93109](https://patchblox.com/security/data/cve/CVE-2026-93109.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  RDMA/mlx5: Drain RCU callbacks during module tea... | 7.8 | 0.0021 |  |
| [CVE-2026-97540](https://patchblox.com/security/data/cve/CVE-2026-97540.md) | High | net: usb: pegasus: don't rely on id table pointer arithmetic | 7.8 | 0.0021 |  |
| [CVE-2026-68286](https://patchblox.com/security/data/cve/CVE-2026-68286.md) | High | drop_monitor: perform u64_stats updates under IRQ-disabled section | 7.1 | 0.0021 |  |
| [CVE-2026-89817](https://patchblox.com/security/data/cve/CVE-2026-89817.md) | High | drm/gud: NUL-terminate TV mode names read from the device | 7.1 | 0.0021 |  |
| [CVE-2026-90313](https://patchblox.com/security/data/cve/CVE-2026-90313.md) | High | bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed | 7.1 | 0.0021 |  |
| [CVE-2026-93062](https://patchblox.com/security/data/cve/CVE-2026-93062.md) | High | wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments | 7.1 | 0.0021 |  |
| [CVE-2026-97539](https://patchblox.com/security/data/cve/CVE-2026-97539.md) | High | usb: xusbatm: don't rely on id table pointer arithmetic | 7.1 | 0.0021 |  |
| [CVE-2026-97604](https://patchblox.com/security/data/cve/CVE-2026-97604.md) | High | fbdev: vfb: defer cleanup until the last reference | 7.1 | 0.0021 |  |
| [CVE-2026-89983](https://patchblox.com/security/data/cve/CVE-2026-89983.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  i2c: core: fix debugfs UAF on adapter removal  i... | 7.0 | 0.0021 |  |
| [CVE-2026-93161](https://patchblox.com/security/data/cve/CVE-2026-93161.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  crypto: qat - clear AES key schedule from stack... | 7.0 | 0.0021 |  |
| [CVE-2026-93185](https://patchblox.com/security/data/cve/CVE-2026-93185.md) | High | ASoC: rt700-sdw: always drain jack work on remove | 7.0 | 0.0021 |  |
| [CVE-2026-92495](https://patchblox.com/security/data/cve/CVE-2026-92495.md) | High | RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap | 7.8 | 0.0021 |  |
| [CVE-2026-80791](https://patchblox.com/security/data/cve/CVE-2026-80791.md) | High | nvmet-auth: zero the AUTH_RECEIVE response buffer | 7.5 | 0.0021 |  |
| [CVE-2026-89842](https://patchblox.com/security/data/cve/CVE-2026-89842.md) | High | scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started | 8.1 | 0.0021 |  |
| [CVE-2026-89451](https://patchblox.com/security/data/cve/CVE-2026-89451.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  iommu/sva: Set handle->dev before the SVA handle... | 7.8 | 0.0021 |  |
| [CVE-2026-89502](https://patchblox.com/security/data/cve/CVE-2026-89502.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ring-buffer: Free cpu_buffer::free_page with sub... | 7.8 | 0.0021 |  |
| [CVE-2026-90115](https://patchblox.com/security/data/cve/CVE-2026-90115.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  xsk: fix NULL pointer dereference in __xsk_rcv()... | 7.8 | 0.0021 |  |
| [CVE-2026-90135](https://patchblox.com/security/data/cve/CVE-2026-90135.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net: add missing ref_tracker_dir_exit() to alloc... | 7.8 | 0.0021 |  |
| [CVE-2026-90184](https://patchblox.com/security/data/cve/CVE-2026-90184.md) | High | null_blk: serialize configfs attribute updates with device setup | 7.8 | 0.0021 |  |
| [CVE-2026-90187](https://patchblox.com/security/data/cve/CVE-2026-90187.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  null_blk: free zones array on device power-off... | 7.8 | 0.0021 |  |
| [CVE-2026-90188](https://patchblox.com/security/data/cve/CVE-2026-90188.md) | High | null_blk: free global tag_set on init error path | 7.8 | 0.0021 |  |
| [CVE-2026-90201](https://patchblox.com/security/data/cve/CVE-2026-90201.md) | High | net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race | 7.8 | 0.0021 |  |
| [CVE-2026-90322](https://patchblox.com/security/data/cve/CVE-2026-90322.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ocfs2/cluster: keep heartbeat local node stable... | 7.8 | 0.0021 |  |
| [CVE-2026-90368](https://patchblox.com/security/data/cve/CVE-2026-90368.md) | High | wifi: mt76: mt7915: unwind state on add_interface failure | 7.8 | 0.0021 |  |
| [CVE-2026-90385](https://patchblox.com/security/data/cve/CVE-2026-90385.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  md/raid1: create serial pool adding rdev to arra... | 7.8 | 0.0021 |  |
| [CVE-2026-93182](https://patchblox.com/security/data/cve/CVE-2026-93182.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  sched/fair: Fix overflow in update_tg_cfs_runnab... | 7.8 | 0.0021 |  |
| [CVE-2026-97617](https://patchblox.com/security/data/cve/CVE-2026-97617.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ring-buffer: Check resize_disabled before publis... | 7.8 | 0.0021 |  |
| [CVE-2026-98104](https://patchblox.com/security/data/cve/CVE-2026-98104.md) | High | net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted | 7.8 | 0.0021 |  |
| [CVE-2026-90101](https://patchblox.com/security/data/cve/CVE-2026-90101.md) | High | bnxt_en: Fix call to hardware monitoring event handler | 7.3 | 0.0021 |  |
| [CVE-2026-89874](https://patchblox.com/security/data/cve/CVE-2026-89874.md) | High | media: v4l2-async: avoid deleting unlinked ASC entry on link error | 7.1 | 0.0021 |  |
| [CVE-2026-89944](https://patchblox.com/security/data/cve/CVE-2026-89944.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ASoC: hdac_hda: Fix hlink refcount leak on compo... | 7.0 | 0.0021 |  |
| [CVE-2026-90404](https://patchblox.com/security/data/cve/CVE-2026-90404.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  platform/chrome: cros_ec_debugfs: Unregister pan... | 7.0 | 0.0021 |  |
| [CVE-2026-93150](https://patchblox.com/security/data/cve/CVE-2026-93150.md) | High | cgroup/cpuset: Make nr_deadline_tasks an atomic_t | 7.0 | 0.0021 |  |
| [CVE-2026-97920](https://patchblox.com/security/data/cve/CVE-2026-97920.md) | High | tracing: Keep the entry count when the histogram stats allocation fails | 7.0 | 0.0021 |  |
| [CVE-2026-80840](https://patchblox.com/security/data/cve/CVE-2026-80840.md) | High | ipv6: seg6: clear IPv4 control block on IPIP decapsulation | 7.8 | 0.0021 |  |
| [CVE-2026-93117](https://patchblox.com/security/data/cve/CVE-2026-93117.md) | High | usb: fix UAF when probe runs concurrent to dyn ID removal | 7.8 | 0.0021 |  |
| [CVE-2026-90352](https://patchblox.com/security/data/cve/CVE-2026-90352.md) | High | wifi: mt76: mt7915: release hif2 reference on probe IRQ failure | 7.0 | 0.0021 |  |
| [CVE-2026-93204](https://patchblox.com/security/data/cve/CVE-2026-93204.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  batman-adv: dat: atomically update mac addresses... | 9.8 | 0.0020 |  |
| [CVE-2026-89802](https://patchblox.com/security/data/cve/CVE-2026-89802.md) | High | drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op | 7.8 | 0.0020 |  |
| [CVE-2026-90373](https://patchblox.com/security/data/cve/CVE-2026-90373.md) | High | wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear | 7.8 | 0.0020 |  |
| [CVE-2026-93264](https://patchblox.com/security/data/cve/CVE-2026-93264.md) | High | RDMA/efa: Fix PBL chunk length computation | 7.8 | 0.0020 |  |
| [CVE-2026-93271](https://patchblox.com/security/data/cve/CVE-2026-93271.md) | High | wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate | 7.5 | 0.0020 |  |
| [CVE-2026-90031](https://patchblox.com/security/data/cve/CVE-2026-90031.md) | High | usb-storage: ene_ub6250: fix race between scan work and probe | 7.1 | 0.0020 |  |
| [CVE-2026-90033](https://patchblox.com/security/data/cve/CVE-2026-90033.md) | High | ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() | 7.1 | 0.0020 |  |
| [CVE-2026-93188](https://patchblox.com/security/data/cve/CVE-2026-93188.md) | High | HID: roccat: bound device-supplied profile index | 7.1 | 0.0020 |  |
| [CVE-2026-97560](https://patchblox.com/security/data/cve/CVE-2026-97560.md) | High | smb: client: fix one-byte OOB read in smb2_parse_native_symlink() | 8.8 | 0.0020 |  |
| [CVE-2026-90279](https://patchblox.com/security/data/cve/CVE-2026-90279.md) | High | md/raid5: round bitmap stripes with sector division | 7.8 | 0.0020 |  |
| [CVE-2026-92484](https://patchblox.com/security/data/cve/CVE-2026-92484.md) | High | cxl/region: Fix use-after-free in find_pos_and_ways() error path | 7.8 | 0.0020 |  |
| [CVE-2026-93097](https://patchblox.com/security/data/cve/CVE-2026-93097.md) | High | cxl/mbox: Break poison list loop on an empty payload | 7.8 | 0.0020 |  |
| [CVE-2026-93162](https://patchblox.com/security/data/cve/CVE-2026-93162.md) | High | crypto: qat - cancel work on re-enable SR-IOV timeout | 7.8 | 0.0020 |  |
| [CVE-2026-97992](https://patchblox.com/security/data/cve/CVE-2026-97992.md) | High | vhost-vdpa: protect config_ctx from being freed under the config callback | 7.8 | 0.0020 |  |
| [CVE-2026-90389](https://patchblox.com/security/data/cve/CVE-2026-90389.md) | High | md: scope memalloc_noio to allocation critical sections | 7.1 | 0.0020 |  |
| [CVE-2026-97907](https://patchblox.com/security/data/cve/CVE-2026-97907.md) | High | Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 | 7.1 | 0.0020 |  |
| [CVE-2026-80864](https://patchblox.com/security/data/cve/CVE-2026-80864.md) | High | RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp | 9.8 | 0.0020 |  |
| [CVE-2026-80824](https://patchblox.com/security/data/cve/CVE-2026-80824.md) | High | usb: usbfs: fix use-after-free of usb_device in usbdev_release() | 8.8 | 0.0020 |  |
| [CVE-2026-80792](https://patchblox.com/security/data/cve/CVE-2026-80792.md) | High | ipv6: fix use-after-free in ip6_finish_output2() | 8.1 | 0.0020 |  |
| [CVE-2026-80790](https://patchblox.com/security/data/cve/CVE-2026-80790.md) | High | nvmet-fc: fix invalid free in LS IOD error path | 7.8 | 0.0020 |  |
| [CVE-2026-80819](https://patchblox.com/security/data/cve/CVE-2026-80819.md) | High | Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept | 7.8 | 0.0020 |  |
| [CVE-2026-80851](https://patchblox.com/security/data/cve/CVE-2026-80851.md) | High | gtp: serialize PDP context updates | 7.8 | 0.0020 |  |
| [CVE-2026-80788](https://patchblox.com/security/data/cve/CVE-2026-80788.md) | High | nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations | 7.5 | 0.0020 |  |
| [CVE-2026-80767](https://patchblox.com/security/data/cve/CVE-2026-80767.md) | High | HID: sensor: custom: Fix use-after-free in enable_sensor | 7.0 | 0.0020 |  |
| [CVE-2026-80808](https://patchblox.com/security/data/cve/CVE-2026-80808.md) | High | ext4: stop retrying saturated xattr cache entries | 7.0 | 0.0020 |  |
| [CVE-2025-38206](https://patchblox.com/security/data/cve/CVE-2025-38206.md) | High | exfat: fix double free in delayed_free | 7.8 | 0.0019 |  |
| [CVE-2026-90039](https://patchblox.com/security/data/cve/CVE-2026-90039.md) | High | NFSD: Guard admin state-revocation walks with NFSD_NET_UP | 7.8 | 0.0019 |  |
| [CVE-2026-89930](https://patchblox.com/security/data/cve/CVE-2026-89930.md) | High | KVM: nVMX: Service local TLB flushes on failed nested VM-Enter | 9.3 | 0.0019 |  |
| [CVE-2026-80967](https://patchblox.com/security/data/cve/CVE-2026-80967.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ALSA: pcxhr: initialize mutexes before requestin... | 8.4 | 0.0019 |  |
| [CVE-2026-90399](https://patchblox.com/security/data/cve/CVE-2026-90399.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath12k: fix stride mismatch in mac_phy_cap... | 8.4 | 0.0019 |  |
| [CVE-2026-90035](https://patchblox.com/security/data/cve/CVE-2026-90035.md) | High | drm/amd/display: fix division by zero in get_estimated_bw() | 7.5 | 0.0019 |  |
| [CVE-2026-81017](https://patchblox.com/security/data/cve/CVE-2026-81017.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  platform/chrome: sensorhub: Bound the EC-reporte... | 8.4 | 0.0019 |  |
| [CVE-2026-89588](https://patchblox.com/security/data/cve/CVE-2026-89588.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ACPI: APEI: GHES: fix ARM section length account... | 8.4 | 0.0019 |  |
| [CVE-2026-89856](https://patchblox.com/security/data/cve/CVE-2026-89856.md) | High | scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation | 8.4 | 0.0019 |  |
| [CVE-2026-89877](https://patchblox.com/security/data/cve/CVE-2026-89877.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  media: saa7164: fix cleanup on resource allocati... | 8.4 | 0.0019 |  |
| [CVE-2026-89947](https://patchblox.com/security/data/cve/CVE-2026-89947.md) | High | clk: meson: align gxbb_32k_clk_sel number of parents with actual count | 8.0 | 0.0019 |  |
| [CVE-2026-97425](https://patchblox.com/security/data/cve/CVE-2026-97425.md) | High | drm/amdgpu: fix buffer overflow during vBIOS update | 7.8 | 0.0019 |  |
| [CVE-2026-97427](https://patchblox.com/security/data/cve/CVE-2026-97427.md) | High | drm/amd/pm: bound pp_dpm_set_pp_table() memcpy | 7.8 | 0.0019 |  |
| [CVE-2026-93165](https://patchblox.com/security/data/cve/CVE-2026-93165.md) | High | platform/chrome: sensorhub: Fix memory overread in ring handler | 7.7 | 0.0019 |  |
| [CVE-2026-80852](https://patchblox.com/security/data/cve/CVE-2026-80852.md) | High | tls: device: fix out-of-bounds write in tls_append_frag() | 7.8 | 0.0018 |  |
| [CVE-2026-80863](https://patchblox.com/security/data/cve/CVE-2026-80863.md) | High | RDMA/rxe: Fix OOB in free_rd_atomic_resources() | 7.8 | 0.0018 |  |
| [CVE-2026-80916](https://patchblox.com/security/data/cve/CVE-2026-80916.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  kcov: fix data corruption and race conditions on... | 7.8 | 0.0018 |  |
| [CVE-2026-90407](https://patchblox.com/security/data/cve/CVE-2026-90407.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath11k: fix overreads in ath11k_wmi_proces... | 7.7 | 0.0018 |  |
| [CVE-2026-89927](https://patchblox.com/security/data/cve/CVE-2026-89927.md) | High | KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock | 7.8 | 0.0018 |  |
| [CVE-2026-90137](https://patchblox.com/security/data/cve/CVE-2026-90137.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  platform/x86: hp-bioscfg: fix password encoding... | 7.7 | 0.0018 |  |
| [CVE-2026-93073](https://patchblox.com/security/data/cve/CVE-2026-93073.md) | High | dax: read holder_ops once in dax_holder_notify_failure() | 7.1 | 0.0018 |  |
| [CVE-2026-68289](https://patchblox.com/security/data/cve/CVE-2026-68289.md) | High | tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() | 7.0 | 0.0018 |  |
| [CVE-2026-80521](https://patchblox.com/security/data/cve/CVE-2026-80521.md) | High | af_unix: Unlink scc_entry in unix_del_edge(). | 7.8 | 0.0018 |  |
| [CVE-2026-89596](https://patchblox.com/security/data/cve/CVE-2026-89596.md) | High | forcedeth: fix off-by-one when saving/restoring non-PCI config space | 7.1 | 0.0018 |  |
| [CVE-2026-89693](https://patchblox.com/security/data/cve/CVE-2026-89693.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: check nfsd4_acl_to_attr() return value in... | 9.8 | 0.0018 |  |
| [CVE-2026-97959](https://patchblox.com/security/data/cve/CVE-2026-97959.md) | High | net/sched: cls_route: free emptied bucket on filter move | 9.1 | 0.0018 |  |
| [CVE-2026-80842](https://patchblox.com/security/data/cve/CVE-2026-80842.md) | High | net: bridge: mcast: fix use-after-free of a master VLAN's multicast context | 7.8 | 0.0018 |  |
| [CVE-2026-80889](https://patchblox.com/security/data/cve/CVE-2026-80889.md) | High | can: isotp: fix timer drain order, wakeup handling and tx_gen ordering | 7.8 | 0.0018 |  |
| [CVE-2026-80965](https://patchblox.com/security/data/cve/CVE-2026-80965.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ALSA: serial-u16550: Check card index validity a... | 7.8 | 0.0018 |  |
| [CVE-2026-80988](https://patchblox.com/security/data/cve/CVE-2026-80988.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  NTB: ntb_transport: Fail TX enqueue when the QP... | 7.8 | 0.0018 |  |
| [CVE-2026-89552](https://patchblox.com/security/data/cve/CVE-2026-89552.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  params: fix charp corruption on allocation failu... | 7.8 | 0.0018 |  |
| [CVE-2026-89582](https://patchblox.com/security/data/cve/CVE-2026-89582.md) | High | bnx2x: fix double free in bnx2x_init_firmware() error path | 7.8 | 0.0018 |  |
| [CVE-2026-93067](https://patchblox.com/security/data/cve/CVE-2026-93067.md) | High | drm/bridge: tc358767: clamp the reported AUX read size to the request | 7.8 | 0.0018 |  |
| [CVE-2026-93219](https://patchblox.com/security/data/cve/CVE-2026-93219.md) | High | clocksource/drivers/timer-sun4i: Advertise a real minimum delta | 7.8 | 0.0018 |  |
| [CVE-2026-97995](https://patchblox.com/security/data/cve/CVE-2026-97995.md) | High | virtio_console: do not free control-out buffers on remove | 7.8 | 0.0018 |  |
| [CVE-2026-98011](https://patchblox.com/security/data/cve/CVE-2026-98011.md) | High | net/sched: hhf: clamp quantum in change and init paths | 7.8 | 0.0018 |  |
| [CVE-2026-98015](https://patchblox.com/security/data/cve/CVE-2026-98015.md) | High | net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put | 7.8 | 0.0018 |  |
| [CVE-2026-98074](https://patchblox.com/security/data/cve/CVE-2026-98074.md) | High | bonding: do not clear curr_active_slave prematurely when releasing all slaves | 7.8 | 0.0018 |  |
| [CVE-2026-97951](https://patchblox.com/security/data/cve/CVE-2026-97951.md) | High | scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands | 7.5 | 0.0018 |  |
| [CVE-2026-90415](https://patchblox.com/security/data/cve/CVE-2026-90415.md) | High | RDMA/cxgb4: free STAG index when TPT entry write fails | 7.1 | 0.0018 |  |
| [CVE-2026-93055](https://patchblox.com/security/data/cve/CVE-2026-93055.md) | High | UDF symlink pathComponent header OOB read | 7.1 | 0.0018 |  |
| [CVE-2026-98063](https://patchblox.com/security/data/cve/CVE-2026-98063.md) | High | bpf: Fix NULL-ptr-deref in btf_var_show() | 7.1 | 0.0018 |  |
| [CVE-2026-98064](https://patchblox.com/security/data/cve/CVE-2026-98064.md) | High | bpf: Fix NULL-ptr-deref when showing a void BTF type | 7.1 | 0.0018 |  |
| [CVE-2026-74672](https://patchblox.com/security/data/cve/CVE-2026-74672.md) | High | mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF | 7.0 | 0.0018 |  |
| [CVE-2026-89719](https://patchblox.com/security/data/cve/CVE-2026-89719.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  zram: fix out-of-bounds access in read_block_sta... | 7.0 | 0.0018 |  |
| [CVE-2026-92521](https://patchblox.com/security/data/cve/CVE-2026-92521.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ACPI: PCI: Clear driver_data on all paths that f... | 7.0 | 0.0018 |  |
| [CVE-2026-98066](https://patchblox.com/security/data/cve/CVE-2026-98066.md) | High | ALSA: caiaq: Fix potential double-free at error path | 7.0 | 0.0018 |  |
| [CVE-2026-93056](https://patchblox.com/security/data/cve/CVE-2026-93056.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: f_uac1_legacy: remove broken string... | n/a | 0.0018 |  |
| [CVE-2026-89510](https://patchblox.com/security/data/cve/CVE-2026-89510.md) | High | RDMA/cxgb4: Cancel reg_work before freeing device on remove | 7.8 | 0.0018 |  |
| [CVE-2026-89602](https://patchblox.com/security/data/cve/CVE-2026-89602.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  erofs: skip sufficiently large global buffers wh... | 7.8 | 0.0018 |  |
| [CVE-2026-93138](https://patchblox.com/security/data/cve/CVE-2026-93138.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  bpf: Fix vmlinux BTF prep race in bpf_get_btf_vm... | 7.8 | 0.0018 |  |
| [CVE-2026-98021](https://patchblox.com/security/data/cve/CVE-2026-98021.md) | High | net: reject oversized tx_queue_len at netlink parse time | 7.8 | 0.0018 |  |
| [CVE-2026-90241](https://patchblox.com/security/data/cve/CVE-2026-90241.md) | High | iommu/vt-d: Tear down scalable-mode context on probe failure | 8.2 | 0.0018 |  |
| [CVE-2026-89799](https://patchblox.com/security/data/cve/CVE-2026-89799.md) | High | bpf: Disable preemption in bpf_get_stackid | 7.8 | 0.0018 |  |
| [CVE-2026-89618](https://patchblox.com/security/data/cve/CVE-2026-89618.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  eventfs: Initialize ei->children and ei->list in... | 7.0 | 0.0018 |  |
| [CVE-2026-89666](https://patchblox.com/security/data/cve/CVE-2026-89666.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: reject out-of-range nseconds in NFSv3 SETA... | 9.8 | 0.0017 |  |
| [CVE-2026-98089](https://patchblox.com/security/data/cve/CVE-2026-98089.md) | High | bonding: alb: fix uninitialized transport header access in alb_determine_nd() | 8.1 | 0.0017 |  |
| [CVE-2026-80539](https://patchblox.com/security/data/cve/CVE-2026-80539.md) | High | drm/amdgpu: disallow multiple FENCE chunks in one submit | 7.8 | 0.0017 |  |
| [CVE-2026-80837](https://patchblox.com/security/data/cve/CVE-2026-80837.md) | High | netfilter: nf_tables: don't queue packet path object notifications | 7.8 | 0.0017 |  |
| [CVE-2026-80841](https://patchblox.com/security/data/cve/CVE-2026-80841.md) | High | net/packet: defer vmalloc TX_RING free until skbs finish | 7.8 | 0.0017 |  |
| [CVE-2026-89598](https://patchblox.com/security/data/cve/CVE-2026-89598.md) | High | fbdev: ssd1307fb: defer I2C transfers from damage callbacks | 7.8 | 0.0017 |  |
| [CVE-2026-90189](https://patchblox.com/security/data/cve/CVE-2026-90189.md) | High | null_blk: register configfs subsystem after creating default devices | 7.8 | 0.0017 |  |
| [CVE-2026-90375](https://patchblox.com/security/data/cve/CVE-2026-90375.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: mt76: fix non-AQL packet accounting for ML... | 7.8 | 0.0017 |  |
| [CVE-2026-92509](https://patchblox.com/security/data/cve/CVE-2026-92509.md) | High | RDMA/core: Fix potential use after free in counter_release() | 7.8 | 0.0017 |  |
| [CVE-2026-92512](https://patchblox.com/security/data/cve/CVE-2026-92512.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  RDMA/core: Fix use after free in ib_query_qp()... | 7.8 | 0.0017 |  |
| [CVE-2026-93064](https://patchblox.com/security/data/cve/CVE-2026-93064.md) | High | wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser | 7.8 | 0.0017 |  |
| [CVE-2026-93785](https://patchblox.com/security/data/cve/CVE-2026-93785.md) | High | cifs: validate idmap key payload length | 7.8 | 0.0017 |  |
| [CVE-2026-93820](https://patchblox.com/security/data/cve/CVE-2026-93820.md) | High | PCI: rockchip: Protect root bus removal with rescan lock | 7.8 | 0.0017 |  |
| [CVE-2026-93822](https://patchblox.com/security/data/cve/CVE-2026-93822.md) | High | PCI: iproc: Protect root bus removal with rescan lock | 7.8 | 0.0017 |  |
| [CVE-2026-97441](https://patchblox.com/security/data/cve/CVE-2026-97441.md) | High | ata: ahci: fail probe if BAR too small for claimed ports | 7.8 | 0.0017 |  |
| [CVE-2026-97492](https://patchblox.com/security/data/cve/CVE-2026-97492.md) | High | wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed | 7.8 | 0.0017 |  |
| [CVE-2026-97963](https://patchblox.com/security/data/cve/CVE-2026-97963.md) | High | net: stmmac: initialize ptp_lock at probe time | 7.8 | 0.0017 |  |
| [CVE-2026-97964](https://patchblox.com/security/data/cve/CVE-2026-97964.md) | High | ppp_synctty: ensure a writeable skb header | 7.8 | 0.0017 |  |
| [CVE-2026-97986](https://patchblox.com/security/data/cve/CVE-2026-97986.md) | High | virtio_input: stop callbacks before unregistering input device | 7.8 | 0.0017 |  |
| [CVE-2026-97987](https://patchblox.com/security/data/cve/CVE-2026-97987.md) | High | virtio_input: reset device if input_register_device() fails | 7.8 | 0.0017 |  |
| [CVE-2026-98016](https://patchblox.com/security/data/cve/CVE-2026-98016.md) | High | net/mlx5e: Fix use-after-free race in sample_restore_put() | 7.8 | 0.0017 |  |
| [CVE-2026-80836](https://patchblox.com/security/data/cve/CVE-2026-80836.md) | High | crypto: virtio - bound the akcipher result length | 7.5 | 0.0017 |  |
| [CVE-2026-89710](https://patchblox.com/security/data/cve/CVE-2026-89710.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  NFSv4.1: fix layout segment leak on the pnfs_lay... | 7.5 | 0.0017 |  |
| [CVE-2026-92477](https://patchblox.com/security/data/cve/CVE-2026-92477.md) | High | scsi: ufs: debugfs: Reserve space for a string terminator | 7.1 | 0.0017 |  |
| [CVE-2026-93783](https://patchblox.com/security/data/cve/CVE-2026-93783.md) | High | Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame | 7.1 | 0.0017 |  |
| [CVE-2026-93803](https://patchblox.com/security/data/cve/CVE-2026-93803.md) | High | wifi: libipw: fix key index receive bound checks | 7.1 | 0.0017 |  |
| [CVE-2026-98014](https://patchblox.com/security/data/cve/CVE-2026-98014.md) | High | net/mlx5: E-Switch, prevent mc_list repopulation during vport disable | 7.1 | 0.0017 |  |
| [CVE-2026-98046](https://patchblox.com/security/data/cve/CVE-2026-98046.md) | High | bpf: Mark bpf_btf_find_by_name_kind() as sleepable | 7.1 | 0.0017 |  |
| [CVE-2026-98075](https://patchblox.com/security/data/cve/CVE-2026-98075.md) | High | bpf: reject BPF_PSEUDO_FUNC reference to the main program | 7.1 | 0.0017 |  |
| [CVE-2026-80764](https://patchblox.com/security/data/cve/CVE-2026-80764.md) | High | Bluetooth: hci_event: fix LE list UAF on reset | 7.0 | 0.0017 |  |
| [CVE-2026-80893](https://patchblox.com/security/data/cve/CVE-2026-80893.md) | High | mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() | 7.0 | 0.0017 |  |
| [CVE-2026-80964](https://patchblox.com/security/data/cve/CVE-2026-80964.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ALSA: virmidi: Check card index validity at prob... | 7.0 | 0.0017 |  |
| [CVE-2026-93205](https://patchblox.com/security/data/cve/CVE-2026-93205.md) | High | iommu/arm-smmu-v3: Manage teardown with devm | 7.0 | 0.0017 |  |
| [CVE-2026-93802](https://patchblox.com/security/data/cve/CVE-2026-93802.md) | High | wifi: rsi: validate beacon length before fixed buffer copy | 7.0 | 0.0017 |  |
| [CVE-2026-97430](https://patchblox.com/security/data/cve/CVE-2026-97430.md) | High | xhci: Prevent queuing new commands if xhci is inaccessible | 7.0 | 0.0017 |  |
| [CVE-2026-98088](https://patchblox.com/security/data/cve/CVE-2026-98088.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  scsi: mpt3sas: Avoid out-of-bounds cpumask_of_no... | 7.0 | 0.0017 |  |
| [CVE-2026-90049](https://patchblox.com/security/data/cve/CVE-2026-90049.md) | High | net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() | 9.3 | 0.0017 |  |
| [CVE-2026-80994](https://patchblox.com/security/data/cve/CVE-2026-80994.md) | High | net: openvswitch: fix flow mask use-after-free on flow deletion | 7.8 | 0.0017 |  |
| [CVE-2026-90025](https://patchblox.com/security/data/cve/CVE-2026-90025.md) | High | usb: typec: ucsi: displayport: Fix OOB altmode array index | 7.7 | 0.0017 |  |
| [CVE-2026-97447](https://patchblox.com/security/data/cve/CVE-2026-97447.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ACPICA: Enhance OEM ID and Table ID validation i... | 7.0 | 0.0017 |  |
| [CVE-2026-90203](https://patchblox.com/security/data/cve/CVE-2026-90203.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  Squashfs: check block offset is not negative  If... | 7.1 | 0.0017 |  |
| [CVE-2026-89472](https://patchblox.com/security/data/cve/CVE-2026-89472.md) | High | power: supply: charger-manager: register regulators before exposing sysfs | 7.8 | 0.0017 |  |
| [CVE-2026-89932](https://patchblox.com/security/data/cve/CVE-2026-89932.md) | High | KVM: nVMX: Always flush vpid02 on first use | 9.8 | 0.0017 |  |
| [CVE-2026-89894](https://patchblox.com/security/data/cve/CVE-2026-89894.md) | High | media: cx231xx: reject geometry changes while the VBI queue is busy | 8.1 | 0.0017 |  |
| [CVE-2026-89440](https://patchblox.com/security/data/cve/CVE-2026-89440.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  mmc: via-sdmmc: stop card-detect handling on pro... | 7.8 | 0.0017 |  |
| [CVE-2026-89557](https://patchblox.com/security/data/cve/CVE-2026-89557.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  md: do overflow check for sb->bblog_shift in sup... | 7.8 | 0.0017 |  |
| [CVE-2026-89559](https://patchblox.com/security/data/cve/CVE-2026-89559.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  libnvdimm/labels: Prevent integer overflow in __... | 7.8 | 0.0017 |  |
| [CVE-2026-89574](https://patchblox.com/security/data/cve/CVE-2026-89574.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  dm array: validate array block headers on read... | 7.8 | 0.0017 |  |
| [CVE-2026-89585](https://patchblox.com/security/data/cve/CVE-2026-89585.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  auxdisplay: charlcd: cancel backlight work on re... | 7.8 | 0.0017 |  |
| [CVE-2026-89607](https://patchblox.com/security/data/cve/CVE-2026-89607.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ecryptfs: reject oversized encrypted_key_size in... | 7.8 | 0.0017 |  |
| [CVE-2026-89741](https://patchblox.com/security/data/cve/CVE-2026-89741.md) | High | Revert "media: v4l2-dev: fix error handling in __video_register_device()" | 7.8 | 0.0017 |  |
| [CVE-2026-89823](https://patchblox.com/security/data/cve/CVE-2026-89823.md) | High | drm: fix race between partial drm_dev_register() failure and ioctl | 7.8 | 0.0017 |  |
| [CVE-2026-89880](https://patchblox.com/security/data/cve/CVE-2026-89880.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  media: rtl2832_sdr: release URBs and stream buff... | 7.8 | 0.0017 |  |
| [CVE-2026-89890](https://patchblox.com/security/data/cve/CVE-2026-89890.md) | High | media: go7007: defer the ALSA v4l2 put until card release | 7.8 | 0.0017 |  |
| [CVE-2026-89893](https://patchblox.com/security/data/cve/CVE-2026-89893.md) | High | media: cx23885: cancel NetUP CI work before teardown | 7.8 | 0.0017 |  |
| [CVE-2026-89965](https://patchblox.com/security/data/cve/CVE-2026-89965.md) | High | nvdimm/btt: reject an arena whose nfree is below the lane count | 7.8 | 0.0017 |  |
| [CVE-2026-89979](https://patchblox.com/security/data/cve/CVE-2026-89979.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ALSA: pcm: Fix race between non-atomic ops and t... | 7.8 | 0.0017 |  |
| [CVE-2026-89988](https://patchblox.com/security/data/cve/CVE-2026-89988.md) | High | kprobes: Protect kprobe_blacklist with RCU | 7.8 | 0.0017 |  |
| [CVE-2026-89998](https://patchblox.com/security/data/cve/CVE-2026-89998.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  dm: fix race when loading and unloading a table... | 7.8 | 0.0017 |  |
| [CVE-2026-90007](https://patchblox.com/security/data/cve/CVE-2026-90007.md) | High | scsi: pm8001: Use rollback index when freeing MSI-X vectors | 7.8 | 0.0017 |  |
| [CVE-2026-90316](https://patchblox.com/security/data/cve/CVE-2026-90316.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  drm/omap: dsi: Do not copy isr table  To be able... | 7.8 | 0.0017 |  |
| [CVE-2026-90358](https://patchblox.com/security/data/cve/CVE-2026-90358.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  bpf, x86: Fix trampoline stack size for 128-bit... | 7.8 | 0.0017 |  |
| [CVE-2026-90388](https://patchblox.com/security/data/cve/CVE-2026-90388.md) | High | iommu/dma: Check atomic pool allocation result directly | 7.8 | 0.0017 |  |
| [CVE-2026-90392](https://patchblox.com/security/data/cve/CVE-2026-90392.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  bpf: Fix potential UAF when reading bpf link inf... | 7.8 | 0.0017 |  |
| [CVE-2026-93037](https://patchblox.com/security/data/cve/CVE-2026-93037.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  RDMA/hfi1: Propagate sdma_txinit_ahg() errors  s... | 7.8 | 0.0017 |  |
| [CVE-2026-97612](https://patchblox.com/security/data/cve/CVE-2026-97612.md) | High | net: mpls: clear inner_protocol when the last label is popped | 7.8 | 0.0017 |  |
| [CVE-2026-97940](https://patchblox.com/security/data/cve/CVE-2026-97940.md) | High | ipv6: fix fib6 walker UAF on seq stop | 7.8 | 0.0017 |  |
| [CVE-2026-97984](https://patchblox.com/security/data/cve/CVE-2026-97984.md) | High | net: ipv6: Fix UDP length overflow with PMTU discover and big MTU | 9.1 | 0.0017 |  |
| [CVE-2026-89929](https://patchblox.com/security/data/cve/CVE-2026-89929.md) | High | KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU | 8.8 | 0.0017 |  |
| [CVE-2026-90227](https://patchblox.com/security/data/cve/CVE-2026-90227.md) | High | nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() | 8.8 | 0.0017 |  |
| [CVE-2026-93190](https://patchblox.com/security/data/cve/CVE-2026-93190.md) | High | platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count | 8.4 | 0.0017 |  |
| [CVE-2026-80887](https://patchblox.com/security/data/cve/CVE-2026-80887.md) | High | drm/vmwgfx: use check_add_overflow for shader size+offset bound | 8.1 | 0.0017 |  |
| [CVE-2026-74258](https://patchblox.com/security/data/cve/CVE-2026-74258.md) | High | bpf: Guard __get_user acesss with access_ok for uprobe_multi data | 7.8 | 0.0017 |  |
| [CVE-2026-80779](https://patchblox.com/security/data/cve/CVE-2026-80779.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  net/ionic: avoid OOB TX partner lookup for hwsta... | 7.8 | 0.0017 |  |
| [CVE-2026-80825](https://patchblox.com/security/data/cve/CVE-2026-80825.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: mt76: mt7925: ensure tx headroom in usb_sd... | 7.8 | 0.0017 |  |
| [CVE-2026-80838](https://patchblox.com/security/data/cve/CVE-2026-80838.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  vxlan: keep the last remote linked during FDB fl... | 7.8 | 0.0017 |  |
| [CVE-2026-80839](https://patchblox.com/security/data/cve/CVE-2026-80839.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  batman-adv: reject unrepresentable multicast TVL... | 7.8 | 0.0017 |  |
| [CVE-2026-89442](https://patchblox.com/security/data/cve/CVE-2026-89442.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  platform/x86: ISST: Validate socket ID in clos_a... | 7.8 | 0.0017 |  |
| [CVE-2026-89501](https://patchblox.com/security/data/cve/CVE-2026-89501.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ring-buffer: Hold cpu_buffer::lock when resizing... | 7.8 | 0.0017 |  |
| [CVE-2026-89793](https://patchblox.com/security/data/cve/CVE-2026-89793.md) | High | ublk: clear VM_MAYWRITE on read-only ublk char device mmap | 7.8 | 0.0017 |  |
| [CVE-2026-93823](https://patchblox.com/security/data/cve/CVE-2026-93823.md) | High | drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl | 7.8 | 0.0017 |  |
| [CVE-2026-97494](https://patchblox.com/security/data/cve/CVE-2026-97494.md) | High | drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw | 7.8 | 0.0017 |  |
| [CVE-2026-97978](https://patchblox.com/security/data/cve/CVE-2026-97978.md) | High | eth: ice: don't dereference pointers from TP_printk() | 7.8 | 0.0017 |  |
| [CVE-2026-98020](https://patchblox.com/security/data/cve/CVE-2026-98020.md) | High | pds_core: fix cmd_regs access racing BAR unmap on reset | 7.8 | 0.0017 |  |
| [CVE-2026-98026](https://patchblox.com/security/data/cve/CVE-2026-98026.md) | High | net: bridge: mcast: properly convert mglist to rcu | 7.8 | 0.0017 |  |
| [CVE-2026-98102](https://patchblox.com/security/data/cve/CVE-2026-98102.md) | High | ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() | 7.8 | 0.0017 |  |
| [CVE-2026-98103](https://patchblox.com/security/data/cve/CVE-2026-98103.md) | High | igmp: convert struct ip_sf_list to RCU | 7.8 | 0.0017 |  |
| [CVE-2026-98107](https://patchblox.com/security/data/cve/CVE-2026-98107.md) | High | Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect | 7.8 | 0.0017 |  |
| [CVE-2026-80774](https://patchblox.com/security/data/cve/CVE-2026-80774.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  HID: asus: fix missing hid_is_usb() check  to_us... | 7.5 | 0.0017 |  |
| [CVE-2026-93212](https://patchblox.com/security/data/cve/CVE-2026-93212.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  nfsd: guard nfsd_serv deref in nfsd_file_net_dis... | 7.5 | 0.0017 |  |
| [CVE-2026-93792](https://patchblox.com/security/data/cve/CVE-2026-93792.md) | High | wifi: iwlwifi: mvm: fix a possible underflow | 7.5 | 0.0017 |  |
| [CVE-2026-68337](https://patchblox.com/security/data/cve/CVE-2026-68337.md) | High | bpf: Reject redirect helpers without a bpf_net_context | 7.3 | 0.0017 |  |
| [CVE-2026-97965](https://patchblox.com/security/data/cve/CVE-2026-97965.md) | High | vxlan: initialize _md in vxlan_xmit_one() | 7.1 | 0.0017 |  |
| [CVE-2026-97412](https://patchblox.com/security/data/cve/CVE-2026-97412.md) | High | pds_core: quiesce DMA before freeing resources | 7.0 | 0.0017 |  |
| [CVE-2026-97996](https://patchblox.com/security/data/cve/CVE-2026-97996.md) | High | virtio: fix use-after-free in unregister_virtio_device() | 7.0 | 0.0017 |  |
| [CVE-2026-98057](https://patchblox.com/security/data/cve/CVE-2026-98057.md) | High | ring-buffer: Add checking nr_subbufs to persistent ring buffer validation | 7.0 | 0.0017 |  |
| [CVE-2026-89579](https://patchblox.com/security/data/cve/CVE-2026-89579.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  bpf: Harden bloom filter sizing and indexing on... | 7.8 | 0.0017 |  |
| [CVE-2026-97410](https://patchblox.com/security/data/cve/CVE-2026-97410.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  netconsole: take target_cleanup_list_lock in dro... | 7.8 | 0.0017 |  |
| [CVE-2026-80908](https://patchblox.com/security/data/cve/CVE-2026-80908.md) | High | drm/amdgpu: Reject UVD message with dimensions above 4096 | 7.8 | 0.0017 |  |
| [CVE-2026-80909](https://patchblox.com/security/data/cve/CVE-2026-80909.md) | High | drm/amdgpu: Reject UVD message with invalid number of h265 refs | 7.8 | 0.0017 |  |
| [CVE-2026-90308](https://patchblox.com/security/data/cve/CVE-2026-90308.md) | High | RDMA/erdma: Hold QP references for AE and CM processing | 7.8 | 0.0017 |  |
| [CVE-2026-80947](https://patchblox.com/security/data/cve/CVE-2026-80947.md) | High | wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop | 9.8 | 0.0016 |  |
| [CVE-2026-89777](https://patchblox.com/security/data/cve/CVE-2026-89777.md) | High | vfio/pci: clear vdev->msi_perm after freeing it on init failure | 8.8 | 0.0016 |  |
| [CVE-2026-90207](https://patchblox.com/security/data/cve/CVE-2026-90207.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ALSA: seq: midi: Serialize input teardown with e... | 8.8 | 0.0016 |  |
| [CVE-2026-80971](https://patchblox.com/security/data/cve/CVE-2026-80971.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  ALSA: bcd2000: clear the URB pointers on disconn... | 7.8 | 0.0016 |  |
| [CVE-2026-81001](https://patchblox.com/security/data/cve/CVE-2026-81001.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  slip: fix use-after-free in sl_sync()  slip_devs... | 7.8 | 0.0016 |  |
| [CVE-2026-81008](https://patchblox.com/security/data/cve/CVE-2026-81008.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  interconnect: Fix use after free in icc_get() an... | 7.8 | 0.0016 |  |
| [CVE-2026-89731](https://patchblox.com/security/data/cve/CVE-2026-89731.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  cxl/ras: Fix cxl_rch_get_aer_info() out-of-bound... | 7.8 | 0.0016 |  |
| [CVE-2026-89746](https://patchblox.com/security/data/cve/CVE-2026-89746.md) | High | tracing: Fix use-after-free with same-name named triggers | 7.8 | 0.0016 |  |
| [CVE-2026-89789](https://patchblox.com/security/data/cve/CVE-2026-89789.md) | High | gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free | 7.8 | 0.0016 |  |
| [CVE-2026-89803](https://patchblox.com/security/data/cve/CVE-2026-89803.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  drm/nouveau: unsubscribe the channel-kill event... | 7.8 | 0.0016 |  |
| [CVE-2026-89854](https://patchblox.com/security/data/cve/CVE-2026-89854.md) | High | scsi: qla2xxx: Fix cs84xx use-after-free on host teardown | 7.8 | 0.0016 |  |
| [CVE-2026-89997](https://patchblox.com/security/data/cve/CVE-2026-89997.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  dm: fix resume-vs-remove race  If the user issue... | 7.8 | 0.0016 |  |
| [CVE-2026-90003](https://patchblox.com/security/data/cve/CVE-2026-90003.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  futex: Prevent rcuwait use-after-free during req... | 7.8 | 0.0016 |  |
| [CVE-2026-90057](https://patchblox.com/security/data/cve/CVE-2026-90057.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  slip: remove slip_hangup() to fix use-after-free... | 7.8 | 0.0016 |  |
| [CVE-2026-90071](https://patchblox.com/security/data/cve/CVE-2026-90071.md) | High | net/sched: sch_teql: restore skb->dev on the slave failure path | 7.8 | 0.0016 |  |
| [CVE-2026-90325](https://patchblox.com/security/data/cve/CVE-2026-90325.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  blk-cgroup: skip dying blkg in blkcg_activate_po... | 7.8 | 0.0016 |  |
| [CVE-2026-90383](https://patchblox.com/security/data/cve/CVE-2026-90383.md) | High | misc: sgi-gru: remove interrupt-context page-table walks | 7.8 | 0.0016 |  |
| [CVE-2026-92507](https://patchblox.com/security/data/cve/CVE-2026-92507.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved:  RDMA/core: Fix potential use after free in ib_de... | 7.8 | 0.0016 |  |
| [CVE-2026-92508](https://patchblox.com/security/data/cve/CVE-2026-92508.md) | High | RDMA/core: Fix potential use after free in ib_free_cq() | 7.8 | 0.0016 |  |

Showing 500 of 1,058 CVEs; the web page lists them all.

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.