# ELSA-2026-500572: Security update for 35 packages ELSA-2026-500572, released November 7, 2026, fixes 301 CVEs across 35 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/elsa-2026-500572 - Platform: Linux - Released: Nov 7, 2026 - Priority: Urgent (Closes CVE-2026-89972, rated Critical) - CVEs: 301, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://linux.oracle.com/errata/ELSA-2026-500572.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [kernel-uek](https://patchblox.com/security/data/product/linux/kernel-uek.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek](https://patchblox.com/security/data/product/linux/kernel-uek.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-core](https://patchblox.com/security/data/product/linux/kernel-uek-core.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-core](https://patchblox.com/security/data/product/linux/kernel-uek-core.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug](https://patchblox.com/security/data/product/linux/kernel-uek-debug.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug](https://patchblox.com/security/data/product/linux/kernel-uek-debug.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-core.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-core.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-devel](https://patchblox.com/security/data/product/linux/kernel-uek-debug-devel.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-devel](https://patchblox.com/security/data/product/linux/kernel-uek-debug-devel.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-core.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-core.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules-deprecated](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-deprecated.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules-deprecated](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-deprecated.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules-desktop](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-desktop.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules-desktop](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-desktop.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules-extra-netfilter](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra-netfilter.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules-extra-netfilter](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra-netfilter.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules-usb](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-usb.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules-usb](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-usb.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules-wireless](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-wireless.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-debug-modules-wireless](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-wireless.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-devel](https://patchblox.com/security/data/product/linux/kernel-uek-devel.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-devel](https://patchblox.com/security/data/product/linux/kernel-uek-devel.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-doc](https://patchblox.com/security/data/product/linux/kernel-uek-doc.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-doc](https://patchblox.com/security/data/product/linux/kernel-uek-doc.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules](https://patchblox.com/security/data/product/linux/kernel-uek-modules.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules](https://patchblox.com/security/data/product/linux/kernel-uek-modules.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules-core](https://patchblox.com/security/data/product/linux/kernel-uek-modules-core.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules-core](https://patchblox.com/security/data/product/linux/kernel-uek-modules-core.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules-deprecated](https://patchblox.com/security/data/product/linux/kernel-uek-modules-deprecated.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules-deprecated](https://patchblox.com/security/data/product/linux/kernel-uek-modules-deprecated.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules-desktop](https://patchblox.com/security/data/product/linux/kernel-uek-modules-desktop.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules-desktop](https://patchblox.com/security/data/product/linux/kernel-uek-modules-desktop.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules-extra-netfilter](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra-netfilter.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules-extra-netfilter](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra-netfilter.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules-usb](https://patchblox.com/security/data/product/linux/kernel-uek-modules-usb.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules-usb](https://patchblox.com/security/data/product/linux/kernel-uek-modules-usb.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules-wireless](https://patchblox.com/security/data/product/linux/kernel-uek-modules-wireless.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-modules-wireless](https://patchblox.com/security/data/product/linux/kernel-uek-modules-wireless.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-tools](https://patchblox.com/security/data/product/linux/kernel-uek-tools.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek-tools](https://patchblox.com/security/data/product/linux/kernel-uek-tools.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k](https://patchblox.com/security/data/product/linux/kernel-uek64k.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k](https://patchblox.com/security/data/product/linux/kernel-uek64k.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-core.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-core.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-devel](https://patchblox.com/security/data/product/linux/kernel-uek64k-devel.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-devel](https://patchblox.com/security/data/product/linux/kernel-uek64k-devel.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-core.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-core.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules-deprecated](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-deprecated.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules-deprecated](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-deprecated.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules-desktop](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-desktop.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules-desktop](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-desktop.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules-extra-netfilter](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra-netfilter.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules-extra-netfilter](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra-netfilter.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules-usb](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-usb.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules-usb](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-usb.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules-wireless](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-wireless.md) | ol 10 | 0:6.12.0-208.112.5.el9uek | | [kernel-uek64k-modules-wireless](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-wireless.md) | ol 9 | 0:6.12.0-208.112.5.el9uek | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-89972](https://patchblox.com/security/data/cve/CVE-2026-89972.md) | Urgent | nvme: add missing SRCU grace period in error path | 9.8 | 0.0071 | | | [CVE-2026-98171](https://patchblox.com/security/data/cve/CVE-2026-98171.md) | Urgent | smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs | 9.8 | 0.0054 | | | [CVE-2026-98365](https://patchblox.com/security/data/cve/CVE-2026-98365.md) | Urgent | RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access | 9.8 | 0.0038 | | | [CVE-2026-98174](https://patchblox.com/security/data/cve/CVE-2026-98174.md) | Urgent | smb: client: fix rlist race and missing initialization | 9.8 | 0.0033 | | | [CVE-2026-98339](https://patchblox.com/security/data/cve/CVE-2026-98339.md) | Urgent | wifi: cfg80211: don't filter by BSS type when removing stale entries | 9.8 | 0.0028 | | | [CVE-2026-98348](https://patchblox.com/security/data/cve/CVE-2026-98348.md) | Urgent | wifi: libipw: reject too-short association responses | 9.8 | 0.0025 | | | [CVE-2026-98167](https://patchblox.com/security/data/cve/CVE-2026-98167.md) | Urgent | smb: client: fix server->total_read for compound encrypted PDUs | 9.8 | 0.0022 | | | [CVE-2026-98170](https://patchblox.com/security/data/cve/CVE-2026-98170.md) | Urgent | smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() | 9.8 | 0.0022 | | | [CVE-2026-98214](https://patchblox.com/security/data/cve/CVE-2026-98214.md) | Urgent | selinux: recheck intermediate backing files on mprotect() | 9.8 | 0.0022 | | | [CVE-2026-98573](https://patchblox.com/security/data/cve/CVE-2026-98573.md) | Urgent | net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() | 9.4 | 0.0022 | | | [CVE-2026-98621](https://patchblox.com/security/data/cve/CVE-2026-98621.md) | Urgent | net: gue: reject invalid REMCSUM offsets | 9.1 | 0.0022 | | | [CVE-2026-98168](https://patchblox.com/security/data/cve/CVE-2026-98168.md) | Urgent | smb: client: fix reparse buffer bounds in cifs_query_reparse_point() | 9.8 | 0.0021 | | | [CVE-2026-98211](https://patchblox.com/security/data/cve/CVE-2026-98211.md) | Urgent | mmc: mmci: Fix use-after-free in busy-timeout work | 9.8 | 0.0021 | | | [CVE-2026-98215](https://patchblox.com/security/data/cve/CVE-2026-98215.md) | Urgent | selinux: preserve user SID across nested backing files | 9.8 | 0.0021 | | | [CVE-2026-98272](https://patchblox.com/security/data/cve/CVE-2026-98272.md) | Urgent | net: mvpp2: prevent buffer overflow in page_pool allocation | 9.8 | 0.0020 | | | [CVE-2026-98319](https://patchblox.com/security/data/cve/CVE-2026-98319.md) | Urgent | drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr | 9.8 | 0.0018 | | | [CVE-2026-98322](https://patchblox.com/security/data/cve/CVE-2026-98322.md) | Urgent | netfilter: nft_nat: fully initialise new_addr in netmap setup | 9.8 | 0.0018 | | | [CVE-2026-98301](https://patchblox.com/security/data/cve/CVE-2026-98301.md) | Urgent | net: bridge: mst: move switchdev call outside rcu | 9.8 | 0.0018 | | | [CVE-2026-98303](https://patchblox.com/security/data/cve/CVE-2026-98303.md) | Urgent | ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup | 9.8 | 0.0018 | | | [CVE-2026-98326](https://patchblox.com/security/data/cve/CVE-2026-98326.md) | Urgent | wifi: mac80211: mesh: release the channel if start fails | 9.8 | 0.0018 | | | [CVE-2026-98328](https://patchblox.com/security/data/cve/CVE-2026-98328.md) | Urgent | wifi: mac80211: add HE 6 GHz capability in the scan elems len | 9.8 | 0.0018 | | | [CVE-2026-98172](https://patchblox.com/security/data/cve/CVE-2026-98172.md) | Urgent | smb: client: fix smbd_connection leak on cifs_get_tcp_session() error | 9.8 | 0.0018 | | | [CVE-2026-98186](https://patchblox.com/security/data/cve/CVE-2026-98186.md) | Urgent | wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length | 9.8 | 0.0018 | | | [CVE-2026-98187](https://patchblox.com/security/data/cve/CVE-2026-98187.md) | Urgent | wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST | 9.8 | 0.0018 | | | [CVE-2026-98188](https://patchblox.com/security/data/cve/CVE-2026-98188.md) | Urgent | wifi: p54: validate curve data length in the calibration curve converters | 9.8 | 0.0018 | | | [CVE-2026-98191](https://patchblox.com/security/data/cve/CVE-2026-98191.md) | Urgent | wifi: wlcore: release runtime PM ref on regdomain config failure | 9.8 | 0.0018 | | | [CVE-2026-98192](https://patchblox.com/security/data/cve/CVE-2026-98192.md) | Urgent | wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown | 9.8 | 0.0018 | | | [CVE-2026-98193](https://patchblox.com/security/data/cve/CVE-2026-98193.md) | Urgent | wifi: libipw: reject TKIP frames without a full MIC | 9.8 | 0.0018 | | | [CVE-2026-98203](https://patchblox.com/security/data/cve/CVE-2026-98203.md) | Urgent | Input: soc_button_array - check btns_desc->package.count | 9.8 | 0.0018 | | | [CVE-2026-98207](https://patchblox.com/security/data/cve/CVE-2026-98207.md) | Urgent | mmc: spi: reset bytes_xfered before retrying CRC failures | 9.8 | 0.0018 | | | [CVE-2026-98217](https://patchblox.com/security/data/cve/CVE-2026-98217.md) | Urgent | IB/mlx4: Fix use-after-free on pkey sysfs registration failure | 9.8 | 0.0018 | | | [CVE-2026-98233](https://patchblox.com/security/data/cve/CVE-2026-98233.md) | Urgent | net/packet: clear RX owner on VNET header error | 9.8 | 0.0018 | | | [CVE-2026-98255](https://patchblox.com/security/data/cve/CVE-2026-98255.md) | Urgent | tcp: exclude old ACKs from tcp fast path | 9.8 | 0.0018 | | | [CVE-2026-98308](https://patchblox.com/security/data/cve/CVE-2026-98308.md) | Urgent | ALSA: hda: trace PCM open only after assigning a stream | 9.8 | 0.0018 | | | [CVE-2026-98340](https://patchblox.com/security/data/cve/CVE-2026-98340.md) | Urgent | wifi: cfg80211: only group hidden BSSes with beacon entries | 9.8 | 0.0018 | | | [CVE-2026-98345](https://patchblox.com/security/data/cve/CVE-2026-98345.md) | Urgent | wifi: cfg80211: check IP header size in cfg80211_classify8021d() | 9.8 | 0.0018 | | | [CVE-2026-98327](https://patchblox.com/security/data/cve/CVE-2026-98327.md) | Urgent | wifi: mac80211: mesh: reset the CSA state when leaving | 9.8 | 0.0018 | | | [CVE-2026-98335](https://patchblox.com/security/data/cve/CVE-2026-98335.md) | Urgent | wifi: mac80211: abort chanswitch when leaving a mesh | 9.8 | 0.0018 | | | [CVE-2026-98336](https://patchblox.com/security/data/cve/CVE-2026-98336.md) | Urgent | wifi: mac80211: don't offload TC setup on AP_VLAN interfaces | 9.8 | 0.0018 | | | [CVE-2026-98337](https://patchblox.com/security/data/cve/CVE-2026-98337.md) | Urgent | wifi: mac80211: don't start a ROC while scanning | 9.8 | 0.0018 | | | [CVE-2026-98181](https://patchblox.com/security/data/cve/CVE-2026-98181.md) | Urgent | drm/gud: fix out-of-bounds write in gud_plane_atomic_check() | 9.8 | 0.0017 | | | [CVE-2026-98199](https://patchblox.com/security/data/cve/CVE-2026-98199.md) | Urgent | hwmon: (pmbus/core) increase number of phases and add new mask | 9.8 | 0.0017 | | | [CVE-2026-98221](https://patchblox.com/security/data/cve/CVE-2026-98221.md) | Urgent | KEYS: trusted: Fix tpm2_load_cmd() boundary check | 9.8 | 0.0017 | | | [CVE-2026-98238](https://patchblox.com/security/data/cve/CVE-2026-98238.md) | Urgent | net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() | 9.8 | 0.0017 | | | [CVE-2026-98249](https://patchblox.com/security/data/cve/CVE-2026-98249.md) | Urgent | arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc | 9.8 | 0.0017 | | | [CVE-2026-98287](https://patchblox.com/security/data/cve/CVE-2026-98287.md) | Urgent | pppoatm: ensure a writable skb header and linear data | 9.8 | 0.0017 | | | [CVE-2026-98316](https://patchblox.com/security/data/cve/CVE-2026-98316.md) | Urgent | ALSA: bcd2000: Fix race between rawmidi and disconnect | 9.8 | 0.0017 | | | [CVE-2026-98363](https://patchblox.com/security/data/cve/CVE-2026-98363.md) | Urgent | firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS | 9.8 | 0.0017 | | | [CVE-2026-98179](https://patchblox.com/security/data/cve/CVE-2026-98179.md) | Urgent | drm/amdgpu: fix rmmio iounmap skipped on device removal | 9.8 | 0.0017 | | | [CVE-2026-98222](https://patchblox.com/security/data/cve/CVE-2026-98222.md) | Urgent | KEYS: encrypted: fix integer overflow of datablob_len | 9.8 | 0.0017 | | | [CVE-2026-98232](https://patchblox.com/security/data/cve/CVE-2026-98232.md) | Urgent | scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() | 9.8 | 0.0017 | | | [CVE-2026-98263](https://patchblox.com/security/data/cve/CVE-2026-98263.md) | Urgent | ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type | 9.8 | 0.0017 | | | [CVE-2026-98269](https://patchblox.com/security/data/cve/CVE-2026-98269.md) | Urgent | btrfs: abort transaction on failure to update inode for hole punching and reflinking | 9.8 | 0.0017 | | | [CVE-2026-98270](https://patchblox.com/security/data/cve/CVE-2026-98270.md) | Urgent | drm/amdgpu: check ras and obj before dereference | 9.8 | 0.0017 | | | [CVE-2026-98295](https://patchblox.com/security/data/cve/CVE-2026-98295.md) | Urgent | Bluetooth: coredump: Quiesce dump work on unregister | 9.8 | 0.0017 | | | [CVE-2026-98329](https://patchblox.com/security/data/cve/CVE-2026-98329.md) | Urgent | wifi: mac80211: don't allow injecting frames wider than the chanctx | 9.8 | 0.0017 | | | [CVE-2026-98362](https://patchblox.com/security/data/cve/CVE-2026-98362.md) | Urgent | clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate | 9.8 | 0.0017 | | | [CVE-2026-98370](https://patchblox.com/security/data/cve/CVE-2026-98370.md) | Urgent | xfrm: fix compat ALLOCSPI request use-after-free | 9.8 | 0.0017 | | | [CVE-2026-98320](https://patchblox.com/security/data/cve/CVE-2026-98320.md) | Urgent | netfilter: flowtable: hold reference on ct until flow is released | 9.8 | 0.0014 | | | [CVE-2026-98331](https://patchblox.com/security/data/cve/CVE-2026-98331.md) | Urgent | wifi: mac80211: unlist vifs when their netdev is unregistered | 9.8 | 0.0013 | | | [CVE-2026-98251](https://patchblox.com/security/data/cve/CVE-2026-98251.md) | Urgent | openvswitch: avoid reallocating confirmed conntrack labels | 9.8 | 0.0013 | | | [CVE-2026-98253](https://patchblox.com/security/data/cve/CVE-2026-98253.md) | Urgent | RDMA/ucma: Serialize join and leave on copy_to_user failure | 9.8 | 0.0013 | | | [CVE-2026-98254](https://patchblox.com/security/data/cve/CVE-2026-98254.md) | Urgent | swiotlb: use the adjusted address for the highmem page lookup | 9.8 | 0.0013 | | | [CVE-2026-98252](https://patchblox.com/security/data/cve/CVE-2026-98252.md) | Urgent | RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() | 9.8 | 0.0012 | | | [CVE-2026-98368](https://patchblox.com/security/data/cve/CVE-2026-98368.md) | Urgent | esp: downgrade zerocopy managed frags before mutating skb frags | 9.8 | 0.0012 | | | [CVE-2026-98490](https://patchblox.com/security/data/cve/CVE-2026-98490.md) | High | net: openvswitch: conntrack: fix helper UAF due to extensions realloc | 9.8 | 0.0070 | | | [CVE-2026-98548](https://patchblox.com/security/data/cve/CVE-2026-98548.md) | High | sctp: discard the rest of the packet on a stale-cookie error | 9.8 | 0.0069 | | | [CVE-2026-98550](https://patchblox.com/security/data/cve/CVE-2026-98550.md) | High | tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow | 7.5 | 0.0068 | | | [CVE-2026-98532](https://patchblox.com/security/data/cve/CVE-2026-98532.md) | High | ipv6: do not let ipv6_find_hdr() return an offset past the packet end | 8.1 | 0.0061 | | | [CVE-2026-89971](https://patchblox.com/security/data/cve/CVE-2026-89971.md) | High | nvme: skip the zoned limits update if the zone info query failed | 7.5 | 0.0061 | | | [CVE-2026-98549](https://patchblox.com/security/data/cve/CVE-2026-98549.md) | High | tcp: prevent collapsing skbs across boundary in rtx queue | 9.1 | 0.0056 | | | [CVE-2026-98169](https://patchblox.com/security/data/cve/CVE-2026-98169.md) | High | smb: client: fix potential OOB read in smb3_enum_snapshots() | 7.1 | 0.0045 | | | [CVE-2026-98239](https://patchblox.com/security/data/cve/CVE-2026-98239.md) | High | net: lan743x: fix RX checksum use-after-free | 8.1 | 0.0044 | | | [CVE-2026-98261](https://patchblox.com/security/data/cve/CVE-2026-98261.md) | High | cifs: Fix server use-after-free in cifs_chan_skip_or_disable() | 8.1 | 0.0041 | | | [CVE-2026-98479](https://patchblox.com/security/data/cve/CVE-2026-98479.md) | High | scsi: libiscsi_tcp: Check the data direction of a Data-In PDU | 7.5 | 0.0039 | | | [CVE-2026-98499](https://patchblox.com/security/data/cve/CVE-2026-98499.md) | High | HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() | 8.1 | 0.0039 | | | [CVE-2026-98454](https://patchblox.com/security/data/cve/CVE-2026-98454.md) | High | smb: client: fix create context out-of-bounds reads | 8.1 | 0.0039 | | | [CVE-2026-98357](https://patchblox.com/security/data/cve/CVE-2026-98357.md) | High | IB/isert: wait for deferred control PDU completions before releasing the connection | 8.1 | 0.0035 | | | [CVE-2025-40326](https://patchblox.com/security/data/cve/CVE-2025-40326.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: Define actions for the new time_deleg FATT... | 7.5 | 0.0035 | | | [CVE-2026-80937](https://patchblox.com/security/data/cve/CVE-2026-80937.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM addr... | 8.8 | 0.0035 | | | [CVE-2026-98173](https://patchblox.com/security/data/cve/CVE-2026-98173.md) | High | smb: client: fix use-after-free of iface in cifs_try_adding_channels() | 7.5 | 0.0035 | | | [CVE-2026-97527](https://patchblox.com/security/data/cve/CVE-2026-97527.md) | High | scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock | 8.8 | 0.0034 | | | [CVE-2026-97528](https://patchblox.com/security/data/cve/CVE-2026-97528.md) | High | scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error | 8.8 | 0.0034 | | | [CVE-2026-98175](https://patchblox.com/security/data/cve/CVE-2026-98175.md) | High | smb: client: cancel reconnect work in clean_demultiplex_info() | 8.1 | 0.0032 | | | [CVE-2026-97531](https://patchblox.com/security/data/cve/CVE-2026-97531.md) | High | scsi: qla2xxx: Skip vport under deletion in report ID acquisition | 7.5 | 0.0030 | | | [CVE-2026-97536](https://patchblox.com/security/data/cve/CVE-2026-97536.md) | High | scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown | 7.8 | 0.0030 | | | [CVE-2026-98374](https://patchblox.com/security/data/cve/CVE-2026-98374.md) | High | tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() | 8.8 | 0.0029 | | | [CVE-2026-98501](https://patchblox.com/security/data/cve/CVE-2026-98501.md) | High | HID: alps: fix use-after-free on input2 registration failure | 7.1 | 0.0026 | | | [CVE-2026-98349](https://patchblox.com/security/data/cve/CVE-2026-98349.md) | High | wifi: libipw: reject too-short beacon and probe responses | 7.1 | 0.0025 | | | [CVE-2026-98290](https://patchblox.com/security/data/cve/CVE-2026-98290.md) | High | Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup | 7.5 | 0.0024 | | | [CVE-2026-89859](https://patchblox.com/security/data/cve/CVE-2026-89859.md) | High | scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak | 7.1 | 0.0023 | | | [CVE-2026-97537](https://patchblox.com/security/data/cve/CVE-2026-97537.md) | High | scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking | 7.8 | 0.0022 | | | [CVE-2026-97529](https://patchblox.com/security/data/cve/CVE-2026-97529.md) | High | scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] | 7.1 | 0.0022 | | | [CVE-2026-97901](https://patchblox.com/security/data/cve/CVE-2026-97901.md) | High | genetlink: pin family module during policy dump | 7.1 | 0.0022 | | | [CVE-2026-98602](https://patchblox.com/security/data/cve/CVE-2026-98602.md) | High | Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough | 8.1 | 0.0022 | | | [CVE-2026-97535](https://patchblox.com/security/data/cve/CVE-2026-97535.md) | High | scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size | 7.8 | 0.0021 | | | [CVE-2026-97559](https://patchblox.com/security/data/cve/CVE-2026-97559.md) | High | smb: client: fail DACL rewrite when the new DACL exceeds 64K | 7.8 | 0.0021 | | | [CVE-2026-97615](https://patchblox.com/security/data/cve/CVE-2026-97615.md) | High | net: bridge: use option bits for CFM/MRP frame handlers | 7.8 | 0.0021 | | | [CVE-2026-97619](https://patchblox.com/security/data/cve/CVE-2026-97619.md) | High | io_uring/rw: end write accounting from ->ki_complete | 7.1 | 0.0021 | | | [CVE-2026-98626](https://patchblox.com/security/data/cve/CVE-2026-98626.md) | High | bpf: Restrict CO-RE poisoning to relocatable instructions | 7.1 | 0.0021 | | | [CVE-2026-98213](https://patchblox.com/security/data/cve/CVE-2026-98213.md) | High | mmc: core: Cancel SDIO IRQ work before freeing host | 7.1 | 0.0021 | | | [CVE-2026-93134](https://patchblox.com/security/data/cve/CVE-2026-93134.md) | High | printk: Fix possible console use-after-free | 7.8 | 0.0021 | | | [CVE-2026-97571](https://patchblox.com/security/data/cve/CVE-2026-97571.md) | High | bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() | 7.8 | 0.0021 | | | [CVE-2026-97603](https://patchblox.com/security/data/cve/CVE-2026-97603.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: idpf: disable DIM work before freeing q_vectors... | 7.8 | 0.0021 | | | [CVE-2026-97918](https://patchblox.com/security/data/cve/CVE-2026-97918.md) | High | tracing: Undo the registration when enabling the histogram trigger fails | 7.8 | 0.0021 | | | [CVE-2026-97933](https://patchblox.com/security/data/cve/CVE-2026-97933.md) | High | tracing: Take trace_array reference when opening a tracer options file | 7.8 | 0.0021 | | | [CVE-2026-97938](https://patchblox.com/security/data/cve/CVE-2026-97938.md) | High | reboot: fix cad_pid use-after-free race | 7.8 | 0.0021 | | | [CVE-2026-97950](https://patchblox.com/security/data/cve/CVE-2026-97950.md) | High | configfs: pin the symlink target's dirent instead of chasing ->ci_dentry | 7.8 | 0.0021 | | | [CVE-2026-98248](https://patchblox.com/security/data/cve/CVE-2026-98248.md) | High | arm64: percpu: Fix LSE operations on {8,16}-bit types | 7.8 | 0.0021 | | | [CVE-2026-98561](https://patchblox.com/security/data/cve/CVE-2026-98561.md) | High | nfp: hold IPsec RX state under the XArray lock | 7.5 | 0.0021 | | | [CVE-2026-97919](https://patchblox.com/security/data/cve/CVE-2026-97919.md) | High | tracing: Take the reference before publishing the named histogram trigger | 7.1 | 0.0021 | | | [CVE-2026-98231](https://patchblox.com/security/data/cve/CVE-2026-98231.md) | High | xfrm: serialize state GC with device state flush | 7.1 | 0.0021 | | | [CVE-2026-89827](https://patchblox.com/security/data/cve/CVE-2026-89827.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid force-completing uninitialized... | 7.0 | 0.0021 | | | [CVE-2026-93244](https://patchblox.com/security/data/cve/CVE-2026-93244.md) | High | drm/sysfb: simpledrm: Improve stride validation | 7.0 | 0.0020 | | | [CVE-2026-81016](https://patchblox.com/security/data/cve/CVE-2026-81016.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and v... | 7.7 | 0.0019 | | | [CVE-2026-98457](https://patchblox.com/security/data/cve/CVE-2026-98457.md) | High | Bluetooth: L2CAP: validate frame length before control and FCS access | 7.1 | 0.0018 | | | [CVE-2026-98194](https://patchblox.com/security/data/cve/CVE-2026-98194.md) | High | wifi: libertas_tf: fix UAF in lbtf_free_adapter() | 7.8 | 0.0018 | | | [CVE-2026-98342](https://patchblox.com/security/data/cve/CVE-2026-98342.md) | High | dmaengine: wait for RCU readers before releasing dma_device | 7.8 | 0.0018 | | | [CVE-2026-98343](https://patchblox.com/security/data/cve/CVE-2026-98343.md) | High | dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() | 7.8 | 0.0018 | | | [CVE-2026-97935](https://patchblox.com/security/data/cve/CVE-2026-97935.md) | High | tracing: Set the trace clock before registering the histogram trigger | 7.1 | 0.0018 | | | [CVE-2026-98201](https://patchblox.com/security/data/cve/CVE-2026-98201.md) | High | Input: zero ff_effect before compat copy in input_ff_effect_from_user | 7.1 | 0.0018 | | | [CVE-2026-98204](https://patchblox.com/security/data/cve/CVE-2026-98204.md) | High | Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() | 7.1 | 0.0018 | | | [CVE-2026-98208](https://patchblox.com/security/data/cve/CVE-2026-98208.md) | High | mmc: sdio_uart: fix xmit_fifo leak when the port table is full | 7.1 | 0.0018 | | | [CVE-2026-98234](https://patchblox.com/security/data/cve/CVE-2026-98234.md) | High | net/sched: hhf: cap hh_flows_limit at change time | 7.1 | 0.0018 | | | [CVE-2026-98460](https://patchblox.com/security/data/cve/CVE-2026-98460.md) | High | Bluetooth: hci_sock: reject out-of-range OCF values | 7.1 | 0.0018 | | | [CVE-2026-72315](https://patchblox.com/security/data/cve/CVE-2026-72315.md) | High | smb: client: fix busy dentry warning on unmount after DIO | 7.8 | 0.0018 | | | [CVE-2026-81015](https://patchblox.com/security/data/cve/CVE-2026-81015.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks... | 7.8 | 0.0018 | | | [CVE-2026-98309](https://patchblox.com/security/data/cve/CVE-2026-98309.md) | High | drm/vc4: Use managed KMS polling to fix UAF on unbind | 7.8 | 0.0018 | | | [CVE-2026-98293](https://patchblox.com/security/data/cve/CVE-2026-98293.md) | High | Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() | 7.1 | 0.0018 | | | [CVE-2026-98245](https://patchblox.com/security/data/cve/CVE-2026-98245.md) | High | btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() | 7.8 | 0.0017 | | | [CVE-2026-98236](https://patchblox.com/security/data/cve/CVE-2026-98236.md) | High | net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value | 7.1 | 0.0017 | | | [CVE-2026-98246](https://patchblox.com/security/data/cve/CVE-2026-98246.md) | High | Bluetooth: hci_sync: Serialize local codec list cleanup | 7.1 | 0.0017 | | | [CVE-2026-98264](https://patchblox.com/security/data/cve/CVE-2026-98264.md) | High | ALSA: virtio: reset device before deleting virtqueues | 7.1 | 0.0017 | | | [CVE-2026-98485](https://patchblox.com/security/data/cve/CVE-2026-98485.md) | High | netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read | 7.1 | 0.0017 | | | [CVE-2026-90002](https://patchblox.com/security/data/cve/CVE-2026-90002.md) | High | ftrace: Take trace_array reference before accessing its ftrace_ops | 7.8 | 0.0017 | | | [CVE-2026-89520](https://patchblox.com/security/data/cve/CVE-2026-89520.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-fl... | 7.8 | 0.0017 | | | [CVE-2026-98491](https://patchblox.com/security/data/cve/CVE-2026-98491.md) | High | net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry | 7.8 | 0.0017 | | | [CVE-2026-98515](https://patchblox.com/security/data/cve/CVE-2026-98515.md) | High | drm/nouveau: fix double-free in nvif_vmm_dtor | 7.8 | 0.0017 | | | [CVE-2026-93196](https://patchblox.com/security/data/cve/CVE-2026-93196.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvdimm: virtio_pmem: refcount requests for token... | 8.4 | 0.0017 | | | [CVE-2026-89500](https://patchblox.com/security/data/cve/CVE-2026-89500.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpu_buffer::free_page a buffer... | 7.8 | 0.0017 | | | [CVE-2026-89503](https://patchblox.com/security/data/cve/CVE-2026-89503.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring_bu... | 7.8 | 0.0017 | | | [CVE-2026-97949](https://patchblox.com/security/data/cve/CVE-2026-97949.md) | High | configfs: unhash the dentry before dropping the item in rmdir | 7.8 | 0.0017 | | | [CVE-2026-98229](https://patchblox.com/security/data/cve/CVE-2026-98229.md) | High | xfrm: save input state data before secpath resets | 7.8 | 0.0017 | | | [CVE-2026-98510](https://patchblox.com/security/data/cve/CVE-2026-98510.md) | High | drm/xe/vm: nuke PTs only after unlinking contested VMAs | 7.8 | 0.0017 | | | [CVE-2026-98267](https://patchblox.com/security/data/cve/CVE-2026-98267.md) | High | 9p: Fix v9fs_issue_write() to update i_size and remote_i_size | n/a | 0.0017 | | | [CVE-2026-98611](https://patchblox.com/security/data/cve/CVE-2026-98611.md) | High | bpf: Check params size before reading reserved fields | n/a | 0.0017 | | | [CVE-2026-98507](https://patchblox.com/security/data/cve/CVE-2026-98507.md) | High | mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish | 7.8 | 0.0017 | | | [CVE-2026-90013](https://patchblox.com/security/data/cve/CVE-2026-90013.md) | High | tracing: Take trace_array reference when opening options file | 7.8 | 0.0016 | | | [CVE-2026-98487](https://patchblox.com/security/data/cve/CVE-2026-98487.md) | High | net: bridge: mdb: restart port group walk after deletion | 7.8 | 0.0016 | | | [CVE-2026-98517](https://patchblox.com/security/data/cve/CVE-2026-98517.md) | High | drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM | 7.8 | 0.0016 | | | [CVE-2026-98383](https://patchblox.com/security/data/cve/CVE-2026-98383.md) | High | bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL | 7.8 | 0.0016 | | | [CVE-2026-98382](https://patchblox.com/security/data/cve/CVE-2026-98382.md) | High | bpf: Reject dev-bound-only programs on other devices | 7.8 | 0.0016 | | | [CVE-2026-98512](https://patchblox.com/security/data/cve/CVE-2026-98512.md) | High | drm/nouveau: RCU-free the scheduler-containing nouveau_sched | 7.1 | 0.0016 | | | [CVE-2026-99082](https://patchblox.com/security/data/cve/CVE-2026-99082.md) | High | KVM: x86: Use active memslots for the per-vCPU MMIO cache | 8.8 | 0.0016 | | | [CVE-2026-97609](https://patchblox.com/security/data/cve/CVE-2026-97609.md) | High | netfilter: cttimeout: prevent UAF during module unload | 7.0 | 0.0015 | | | [CVE-2026-98369](https://patchblox.com/security/data/cve/CVE-2026-98369.md) | High | xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() | 7.8 | 0.0014 | | | [CVE-2026-98441](https://patchblox.com/security/data/cve/CVE-2026-98441.md) | High | net/sched: act_ct: avoid modifying shared unconfirmed ct entry | 8.1 | 0.0013 | | | [CVE-2026-89441](https://patchblox.com/security/data/cve/CVE-2026-89441.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remov... | 7.8 | 0.0013 | | | [CVE-2026-98360](https://patchblox.com/security/data/cve/CVE-2026-98360.md) | High | RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds | 7.1 | 0.0013 | | | [CVE-2026-74347](https://patchblox.com/security/data/cve/CVE-2026-74347.md) | High | netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount | 7.8 | 0.0013 | | | [CVE-2026-98241](https://patchblox.com/security/data/cve/CVE-2026-98241.md) | High | ipv6: xfrm: use full sockets in local error paths | 7.8 | 0.0013 | | | [CVE-2026-98442](https://patchblox.com/security/data/cve/CVE-2026-98442.md) | High | net/sched: act_ct: fix helper UAF due to extensions realloc | 7.8 | 0.0013 | | | [CVE-2026-98276](https://patchblox.com/security/data/cve/CVE-2026-98276.md) | High | net: lock the socket in sock_gettstamp() | 7.8 | 0.0013 | | | [CVE-2026-98456](https://patchblox.com/security/data/cve/CVE-2026-98456.md) | High | Bluetooth: mgmt: fix race in read_unconf_index_list() | 7.0 | 0.0013 | | | [CVE-2026-98381](https://patchblox.com/security/data/cve/CVE-2026-98381.md) | High | veth: manage XDP program pointers during channel resize | 7.8 | 0.0013 | | | [CVE-2026-98216](https://patchblox.com/security/data/cve/CVE-2026-98216.md) | High | IB/hfi1: Fix the PIO_CRED credit-return mmap | 7.1 | 0.0013 | | | [CVE-2026-98197](https://patchblox.com/security/data/cve/CVE-2026-98197.md) | High | hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove | 7.1 | 0.0012 | | | [CVE-2026-98230](https://patchblox.com/security/data/cve/CVE-2026-98230.md) | High | xfrm: use hlist_del_init_rcu for state_cache and state_cache_input | 7.0 | 0.0012 | | | [CVE-2026-98378](https://patchblox.com/security/data/cve/CVE-2026-98378.md) | High | bpf: Skip unsettled links in link iterator | 7.8 | 0.0012 | | | [CVE-2026-98359](https://patchblox.com/security/data/cve/CVE-2026-98359.md) | High | RDMA/core: Reject unregistering netdevs in ib_get_eth_speed | 7.8 | 0.0012 | | | [CVE-2026-98366](https://patchblox.com/security/data/cve/CVE-2026-98366.md) | High | RDMA/rxe: validate access flags before swapping the MR's PD | 7.8 | 0.0012 | | | [CVE-2026-52988](https://patchblox.com/security/data/cve/CVE-2026-52988.md) | High | netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase | 7.1 | 0.0010 | | | [CVE-2026-98405](https://patchblox.com/security/data/cve/CVE-2026-98405.md) | Routine | smb: client: fix missing iov bounds check in parse_posix_sids() | 5.4 | 0.0048 | | | [CVE-2026-97597](https://patchblox.com/security/data/cve/CVE-2026-97597.md) | Routine | ipv6: flowlabel: cap duplicate leases per socket | 5.5 | 0.0022 | | | [CVE-2026-98184](https://patchblox.com/security/data/cve/CVE-2026-98184.md) | Routine | wifi: mwifiex: prevent authentication frame length truncation | 3.3 | 0.0022 | | | [CVE-2026-98537](https://patchblox.com/security/data/cve/CVE-2026-98537.md) | Routine | workqueue: Fix NULL current_pwq deref in flush dependency check | 4.7 | 0.0022 | | | [CVE-2026-98531](https://patchblox.com/security/data/cve/CVE-2026-98531.md) | Routine | ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST | 4.4 | 0.0022 | | | [CVE-2026-97939](https://patchblox.com/security/data/cve/CVE-2026-97939.md) | Routine | ipmr: account multicast table and route memory | 6.5 | 0.0022 | | | [CVE-2026-97532](https://patchblox.com/security/data/cve/CVE-2026-97532.md) | Routine | scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path | 6.2 | 0.0022 | | | [CVE-2026-97906](https://patchblox.com/security/data/cve/CVE-2026-97906.md) | Routine | bootconfig: Fix integer overflow in initrd size check | 5.5 | 0.0022 | | | [CVE-2026-98567](https://patchblox.com/security/data/cve/CVE-2026-98567.md) | Routine | net: xps: reject an out of range traffic class | 6.7 | 0.0022 | | | [CVE-2026-98590](https://patchblox.com/security/data/cve/CVE-2026-98590.md) | Routine | bpf: Fix bpf_sock context code generation | 6.3 | 0.0022 | | | [CVE-2026-98495](https://patchblox.com/security/data/cve/CVE-2026-98495.md) | Routine | net: arp: terminate device name before lookup | 6.1 | 0.0022 | | | [CVE-2026-98498](https://patchblox.com/security/data/cve/CVE-2026-98498.md) | Routine | net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() | 5.9 | 0.0022 | | | [CVE-2026-98541](https://patchblox.com/security/data/cve/CVE-2026-98541.md) | Routine | fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT | 5.9 | 0.0022 | | | [CVE-2026-98610](https://patchblox.com/security/data/cve/CVE-2026-98610.md) | Routine | net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget | 5.9 | 0.0022 | | | [CVE-2026-98511](https://patchblox.com/security/data/cve/CVE-2026-98511.md) | Routine | drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() | 5.5 | 0.0022 | | | [CVE-2026-98554](https://patchblox.com/security/data/cve/CVE-2026-98554.md) | Routine | vlan: ensure sufficient headroom in vlan_dev_hard_header() | 5.5 | 0.0022 | | | [CVE-2026-98488](https://patchblox.com/security/data/cve/CVE-2026-98488.md) | Routine | net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read | 5.3 | 0.0022 | | | [CVE-2026-98494](https://patchblox.com/security/data/cve/CVE-2026-98494.md) | Routine | net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read | 5.3 | 0.0022 | | | [CVE-2026-98461](https://patchblox.com/security/data/cve/CVE-2026-98461.md) | Routine | Bluetooth: hci_sock: validate event length before filtering | 5.2 | 0.0022 | | | [CVE-2026-98547](https://patchblox.com/security/data/cve/CVE-2026-98547.md) | Routine | af_packet: fix integer overflow in prb_calc_retire_blk_tmo() | 4.4 | 0.0022 | | | [CVE-2026-98569](https://patchblox.com/security/data/cve/CVE-2026-98569.md) | Routine | ip_gre: Reject enabling collect metadata through changelink | 4.4 | 0.0022 | | | [CVE-2026-98516](https://patchblox.com/security/data/cve/CVE-2026-98516.md) | Routine | drm/nouveau: Fix bridge reference leak in nv1a_ram_new() | 3.3 | 0.0022 | | | [CVE-2026-98553](https://patchblox.com/security/data/cve/CVE-2026-98553.md) | Routine | autofs: fix sbi->pipe file reference leak in autofs_kill_sb() | 3.3 | 0.0022 | | | [CVE-2026-98514](https://patchblox.com/security/data/cve/CVE-2026-98514.md) | Routine | drm/nouveau: Fix gem reference leak in validate_init() | 2.5 | 0.0022 | | | [CVE-2026-98519](https://patchblox.com/security/data/cve/CVE-2026-98519.md) | Routine | drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() | 2.5 | 0.0022 | | | [CVE-2026-98594](https://patchblox.com/security/data/cve/CVE-2026-98594.md) | Routine | tg3: clean up PHYLIB resources on probe failure | 2.3 | 0.0022 | | | [CVE-2026-98521](https://patchblox.com/security/data/cve/CVE-2026-98521.md) | Routine | drm/i915: fix incorrect RCU teardown order | 6.5 | 0.0022 | | | [CVE-2026-98536](https://patchblox.com/security/data/cve/CVE-2026-98536.md) | Routine | writeback: report a Tasks-RCU quiescent state per cgwb drain pass | 4.1 | 0.0022 | | | [CVE-2026-98538](https://patchblox.com/security/data/cve/CVE-2026-98538.md) | Routine | writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes | 4.1 | 0.0022 | | | [CVE-2026-98428](https://patchblox.com/security/data/cve/CVE-2026-98428.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedded URBs The USB 6... | 3.3 | 0.0022 | | | [CVE-2026-97530](https://patchblox.com/security/data/cve/CVE-2026-97530.md) | Routine | scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature | 5.5 | 0.0021 | | | [CVE-2026-89996](https://patchblox.com/security/data/cve/CVE-2026-89996.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copy_... | 5.3 | 0.0021 | | | [CVE-2026-97566](https://patchblox.com/security/data/cve/CVE-2026-97566.md) | Routine | mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 | 3.3 | 0.0021 | | | [CVE-2026-98606](https://patchblox.com/security/data/cve/CVE-2026-98606.md) | Routine | drm/virtio: release the GEM object on virtio_gpu_vram_create() errors | 6.5 | 0.0021 | | | [CVE-2026-98568](https://patchblox.com/security/data/cve/CVE-2026-98568.md) | Routine | vxlan: use one headroom snapshot for neighbour replies | 6.0 | 0.0021 | | | [CVE-2026-98588](https://patchblox.com/security/data/cve/CVE-2026-98588.md) | Routine | bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc | 5.7 | 0.0021 | | | [CVE-2026-98625](https://patchblox.com/security/data/cve/CVE-2026-98625.md) | Routine | netfilter: flowtable: publish HW_DEAD after worker is done | 5.7 | 0.0021 | | | [CVE-2026-98247](https://patchblox.com/security/data/cve/CVE-2026-98247.md) | Routine | Bluetooth: hci_codec: validate vendor codec count length | 5.5 | 0.0021 | | | [CVE-2026-98643](https://patchblox.com/security/data/cve/CVE-2026-98643.md) | Routine | bpf: Fix out-of-bounds read of rtt_min in sock_ops | 4.4 | 0.0021 | | | [CVE-2026-98502](https://patchblox.com/security/data/cve/CVE-2026-98502.md) | Routine | HID: alps: unregister DualPoint Stick input device on remove | 3.3 | 0.0021 | | | [CVE-2026-98486](https://patchblox.com/security/data/cve/CVE-2026-98486.md) | Routine | net: ena: fix MMIO read buffer leak on probe failure | 2.3 | 0.0021 | | | [CVE-2026-98631](https://patchblox.com/security/data/cve/CVE-2026-98631.md) | Routine | xsk: Use a 32-bit compare in xsk_map_gen_lookup | 6.0 | 0.0021 | | | [CVE-2026-98523](https://patchblox.com/security/data/cve/CVE-2026-98523.md) | Routine | drm/client: fix restore of partially initialized client | 3.3 | 0.0021 | | | [CVE-2026-98528](https://patchblox.com/security/data/cve/CVE-2026-98528.md) | Routine | gpio: cdev: fix kernel stack leak to user-space in error path | 3.3 | 0.0021 | | | [CVE-2026-98545](https://patchblox.com/security/data/cve/CVE-2026-98545.md) | Routine | ata: libata-scsi: bound the ATA passthru sense descriptor writes | 6.8 | 0.0021 | | | [CVE-2026-97934](https://patchblox.com/security/data/cve/CVE-2026-97934.md) | Routine | tracing: Fix memory corruption from a "STACKTRACE" histogram key | 6.7 | 0.0021 | | | [CVE-2026-98544](https://patchblox.com/security/data/cve/CVE-2026-98544.md) | Routine | bna: prevent IOC timer rearm during teardown | 6.4 | 0.0021 | | | [CVE-2026-98468](https://patchblox.com/security/data/cve/CVE-2026-98468.md) | Routine | KVM: arm64: Fix spurious warning for benign stage 2 teardown race | 5.5 | 0.0021 | | | [CVE-2026-98640](https://patchblox.com/security/data/cve/CVE-2026-98640.md) | Routine | HID: amd_sfh: Validate PCI BAR size before mapping | 5.5 | 0.0021 | | | [CVE-2026-98462](https://patchblox.com/security/data/cve/CVE-2026-98462.md) | Routine | Bluetooth: hci_conn: fix CIS hold ownership on reuse | 4.7 | 0.0021 | | | [CVE-2026-97549](https://patchblox.com/security/data/cve/CVE-2026-97549.md) | Routine | xfs: fix under-reservation of blocks when repairing sf directories | 4.4 | 0.0021 | | | [CVE-2026-98644](https://patchblox.com/security/data/cve/CVE-2026-98644.md) | Routine | bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() | 4.4 | 0.0021 | | | [CVE-2026-98484](https://patchblox.com/security/data/cve/CVE-2026-98484.md) | Routine | netfilter: nf_tables: skip expired catchall elements on insert and delete | 3.4 | 0.0021 | | | [CVE-2026-98629](https://patchblox.com/security/data/cve/CVE-2026-98629.md) | Routine | net/sched: cls_u32: fix manual hash table handle IDR aliasing | 3.4 | 0.0021 | | | [CVE-2026-97620](https://patchblox.com/security/data/cve/CVE-2026-97620.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Flush LSC untyped L1 dataport cache afte... | 3.3 | 0.0021 | | | [CVE-2026-98513](https://patchblox.com/security/data/cve/CVE-2026-98513.md) | Routine | drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() | 3.3 | 0.0021 | | | [CVE-2026-98596](https://patchblox.com/security/data/cve/CVE-2026-98596.md) | Routine | ipv6: Fix dst leak for uncached routes. | 3.3 | 0.0021 | | | [CVE-2026-98601](https://patchblox.com/security/data/cve/CVE-2026-98601.md) | Routine | Bluetooth: btintel_pcie: validate device-supplied DMA indices | 3.3 | 0.0021 | | | [CVE-2026-98591](https://patchblox.com/security/data/cve/CVE-2026-98591.md) | Routine | bpf: Fix bounds check for skb-backed dynptrs | 6.7 | 0.0020 | | | [CVE-2026-98503](https://patchblox.com/security/data/cve/CVE-2026-98503.md) | Routine | packet: use ubuf_info completion for TX_RING packets | 6.0 | 0.0020 | | | [CVE-2026-98506](https://patchblox.com/security/data/cve/CVE-2026-98506.md) | Routine | mm/hugetlb: do not dissolve gigantic pages without runtime support | 5.7 | 0.0020 | | | [CVE-2026-98508](https://patchblox.com/security/data/cve/CVE-2026-98508.md) | Routine | drm/virtio: fix NULL pointer dereference on fence allocation failure | 5.5 | 0.0020 | | | [CVE-2026-98565](https://patchblox.com/security/data/cve/CVE-2026-98565.md) | Routine | net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 | 4.4 | 0.0020 | | | [CVE-2026-98509](https://patchblox.com/security/data/cve/CVE-2026-98509.md) | Routine | drm/virtio: fix memory leak of fence event on execbuffer failure | 3.3 | 0.0020 | | | [CVE-2026-98505](https://patchblox.com/security/data/cve/CVE-2026-98505.md) | Routine | mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() | 1.9 | 0.0020 | | | [CVE-2026-90029](https://patchblox.com/security/data/cve/CVE-2026-90029.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: usb: storage: realtek_cr: fix use-after-free on... | 6.8 | 0.0020 | | | [CVE-2026-98612](https://patchblox.com/security/data/cve/CVE-2026-98612.md) | Routine | net: usb: catc: bound the RX packet length in catc_rx_done() | 6.1 | 0.0019 | | | [CVE-2026-98925](https://patchblox.com/security/data/cve/CVE-2026-98925.md) | Routine | bpf, sockmap: Fix self-redirect copied_seq double-counting | 5.5 | 0.0019 | | | [CVE-2026-98306](https://patchblox.com/security/data/cve/CVE-2026-98306.md) | Routine | seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation | 6.5 | 0.0018 | | | [CVE-2026-98314](https://patchblox.com/security/data/cve/CVE-2026-98314.md) | Routine | ALSA: pcm: set timer->private_data before registering the PCM timer | 5.5 | 0.0018 | | | [CVE-2026-98297](https://patchblox.com/security/data/cve/CVE-2026-98297.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix queuing tx_work after w... | 5.5 | 0.0018 | | | [CVE-2026-98600](https://patchblox.com/security/data/cve/CVE-2026-98600.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in r... | 6.5 | 0.0018 | | | [CVE-2026-98205](https://patchblox.com/security/data/cve/CVE-2026-98205.md) | Routine | Input: evdev - zero absinfo before partial copy in EVIOCSABS | 6.1 | 0.0018 | | | [CVE-2026-98597](https://patchblox.com/security/data/cve/CVE-2026-98597.md) | Routine | net: usb: sr9700: include receive overhead in the length check | 6.1 | 0.0018 | | | [CVE-2026-98614](https://patchblox.com/security/data/cve/CVE-2026-98614.md) | Routine | sctp: avoid livelock while updating retransmit path | 5.9 | 0.0018 | | | [CVE-2026-98185](https://patchblox.com/security/data/cve/CVE-2026-98185.md) | Routine | wifi: mwifiex: validate scan response extents | 5.5 | 0.0018 | | | [CVE-2026-98195](https://patchblox.com/security/data/cve/CVE-2026-98195.md) | Routine | wifi: iwlegacy: fix broadcast stations deallocation | 5.5 | 0.0018 | | | [CVE-2026-98202](https://patchblox.com/security/data/cve/CVE-2026-98202.md) | Routine | Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound | 5.5 | 0.0018 | | | [CVE-2026-98262](https://patchblox.com/security/data/cve/CVE-2026-98262.md) | Routine | ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY | 5.5 | 0.0018 | | | [CVE-2026-98299](https://patchblox.com/security/data/cve/CVE-2026-98299.md) | Routine | tcp: do not let tcp_rmem be set below 4096 | 5.5 | 0.0018 | | | [CVE-2026-98300](https://patchblox.com/security/data/cve/CVE-2026-98300.md) | Routine | tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). | 5.5 | 0.0018 | | | [CVE-2026-98344](https://patchblox.com/security/data/cve/CVE-2026-98344.md) | Routine | dmaengine: Fix device kref underflow in dma_chan_put() | 5.5 | 0.0018 | | | [CVE-2026-98380](https://patchblox.com/security/data/cve/CVE-2026-98380.md) | Routine | net/sched: reject IDR error pointers when deleting actions | 5.5 | 0.0018 | | | [CVE-2026-98455](https://patchblox.com/security/data/cve/CVE-2026-98455.md) | Routine | Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO | 5.5 | 0.0018 | | | [CVE-2026-98608](https://patchblox.com/security/data/cve/CVE-2026-98608.md) | Routine | drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() | 5.5 | 0.0018 | | | [CVE-2026-98609](https://patchblox.com/security/data/cve/CVE-2026-98609.md) | Routine | drm/virtio: fix object leak when drm_gem_handle_create() fails | 5.5 | 0.0018 | | | [CVE-2026-98622](https://patchblox.com/security/data/cve/CVE-2026-98622.md) | Routine | net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure | 5.5 | 0.0018 | | | [CVE-2026-98624](https://patchblox.com/security/data/cve/CVE-2026-98624.md) | Routine | netfilter: nfnetlink_queue: hold nfnl mutex in event notifier | 5.5 | 0.0018 | | | [CVE-2026-98489](https://patchblox.com/security/data/cve/CVE-2026-98489.md) | Routine | net: atl1c: fix soft lockup on out-of-range tpd_cons read | 5.3 | 0.0018 | | | [CVE-2026-98623](https://patchblox.com/security/data/cve/CVE-2026-98623.md) | Routine | drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update | 5.1 | 0.0018 | | | [CVE-2026-98196](https://patchblox.com/security/data/cve/CVE-2026-98196.md) | Routine | wifi: brcmsmac: fix UAF in brcms_free_timer() | 4.7 | 0.0018 | | | [CVE-2026-98347](https://patchblox.com/security/data/cve/CVE-2026-98347.md) | Routine | IB/IPoIB: Avoid restoring OPER_UP after multicast flush | 4.7 | 0.0018 | | | [CVE-2026-98636](https://patchblox.com/security/data/cve/CVE-2026-98636.md) | Routine | squashfs: Add dictionary size range check to prevent shift-out-of-bounds | 4.4 | 0.0018 | | | [CVE-2026-93231](https://patchblox.com/security/data/cve/CVE-2026-93231.md) | Routine | lockd: fix swapped arguments in nlmsvc_match_ip() | 3.4 | 0.0018 | | | [CVE-2026-98613](https://patchblox.com/security/data/cve/CVE-2026-98613.md) | Routine | bpf: Bound ownership depth through local kptrs and graph roots | 3.3 | 0.0018 | | | [CVE-2026-98334](https://patchblox.com/security/data/cve/CVE-2026-98334.md) | Routine | wifi: mac80211: reset state when starting AP fails | 5.5 | 0.0018 | | | [CVE-2026-98452](https://patchblox.com/security/data/cve/CVE-2026-98452.md) | Routine | smb: client: clean up failed cached directory opens | 5.5 | 0.0018 | | | [CVE-2026-98448](https://patchblox.com/security/data/cve/CVE-2026-98448.md) | Routine | xfs: release orphanage dir inode if chown fails | 2.3 | 0.0018 | | | [CVE-2026-98586](https://patchblox.com/security/data/cve/CVE-2026-98586.md) | Routine | sctp: hold asoc or transport before mod_timer() in timer handlers | 5.9 | 0.0017 | | | [CVE-2026-98198](https://patchblox.com/security/data/cve/CVE-2026-98198.md) | Routine | hwmon: (pwm-fan) Stop RPM timer before freeing tach data | 5.5 | 0.0017 | | | [CVE-2026-98237](https://patchblox.com/security/data/cve/CVE-2026-98237.md) | Routine | net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain | 5.5 | 0.0017 | | | [CVE-2026-98325](https://patchblox.com/security/data/cve/CVE-2026-98325.md) | Routine | wifi: mac80211: set up the TX info early to fix failure paths | 5.5 | 0.0017 | | | [CVE-2026-98647](https://patchblox.com/security/data/cve/CVE-2026-98647.md) | Routine | bpf: Fix divide-by-zero in btf_struct_walk() | 5.5 | 0.0017 | | | [CVE-2026-98632](https://patchblox.com/security/data/cve/CVE-2026-98632.md) | Routine | Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel | 5.2 | 0.0017 | | | [CVE-2026-98265](https://patchblox.com/security/data/cve/CVE-2026-98265.md) | Routine | ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity | 4.6 | 0.0017 | | | [CVE-2026-98312](https://patchblox.com/security/data/cve/CVE-2026-98312.md) | Routine | ALSA: 6fire: fix OOB write from device-reported iso length | 4.4 | 0.0017 | | | [CVE-2026-98607](https://patchblox.com/security/data/cve/CVE-2026-98607.md) | Routine | drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() | 3.3 | 0.0017 | | | [CVE-2026-98377](https://patchblox.com/security/data/cve/CVE-2026-98377.md) | Routine | vlan: require the MAC header to be present in __vlan_insert_inner_tag() | 5.5 | 0.0017 | | | [CVE-2026-98379](https://patchblox.com/security/data/cve/CVE-2026-98379.md) | Routine | netfilter: ip6t_rpfilter: reject routes without inet6_dev | 5.5 | 0.0017 | | | [CVE-2026-98271](https://patchblox.com/security/data/cve/CVE-2026-98271.md) | Routine | net: skbuff: do not leave stale header offsets after pskb_carve() | 6.1 | 0.0017 | | | [CVE-2026-98634](https://patchblox.com/security/data/cve/CVE-2026-98634.md) | Routine | scsi: sd_zbc: Reject disks with too many zones | 6.1 | 0.0017 | | | [CVE-2026-98182](https://patchblox.com/security/data/cve/CVE-2026-98182.md) | Routine | wifi: mac80211: refuse to make a monitor active when it has no queue | 5.5 | 0.0017 | | | [CVE-2026-98235](https://patchblox.com/security/data/cve/CVE-2026-98235.md) | Routine | net/sched: act_api: release tail references on DELACTION failure | 5.5 | 0.0017 | | | [CVE-2026-98266](https://patchblox.com/security/data/cve/CVE-2026-98266.md) | Routine | ALSA: core: Fix potential UAF after asynchronous card release | 5.5 | 0.0017 | | | [CVE-2026-98307](https://patchblox.com/security/data/cve/CVE-2026-98307.md) | Routine | wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() | 5.5 | 0.0017 | | | [CVE-2026-98646](https://patchblox.com/security/data/cve/CVE-2026-98646.md) | Routine | tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context | 5.5 | 0.0017 | | | [CVE-2026-98459](https://patchblox.com/security/data/cve/CVE-2026-98459.md) | Routine | Bluetooth: ISO: balance the parent hold in hci_bind_bis() | 5.3 | 0.0017 | | | [CVE-2026-98605](https://patchblox.com/security/data/cve/CVE-2026-98605.md) | Routine | drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach | 5.1 | 0.0017 | | | [CVE-2026-98641](https://patchblox.com/security/data/cve/CVE-2026-98641.md) | Routine | bpf, arm64: set up the frame pointer for the exception callback | 5.1 | 0.0017 | | | [CVE-2026-80939](https://patchblox.com/security/data/cve/CVE-2026-80939.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: add .shutdown callback to stop... | 4.4 | 0.0017 | | | [CVE-2026-98477](https://patchblox.com/security/data/cve/CVE-2026-98477.md) | Routine | perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() | 4.4 | 0.0017 | | | [CVE-2026-98291](https://patchblox.com/security/data/cve/CVE-2026-98291.md) | Routine | Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit | 3.3 | 0.0017 | | | [CVE-2026-98346](https://patchblox.com/security/data/cve/CVE-2026-98346.md) | Routine | wifi: cfg80211: don't get the radio mask for netdev-less wdevs | 3.3 | 0.0017 | | | [CVE-2026-98354](https://patchblox.com/security/data/cve/CVE-2026-98354.md) | Routine | RDMA/mad: Fix receive buffer leak when PKey enforcement fails | 5.5 | 0.0017 | | | [CVE-2026-98358](https://patchblox.com/security/data/cve/CVE-2026-98358.md) | Routine | IB/iser: reject a remote invalidation of an unregistered direction | 5.5 | 0.0017 | | | [CVE-2026-98373](https://patchblox.com/security/data/cve/CVE-2026-98373.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: preserve mremap address delta when s... | 5.5 | 0.0016 | | | [CVE-2026-98384](https://patchblox.com/security/data/cve/CVE-2026-98384.md) | Routine | bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() | 3.3 | 0.0016 | | | [CVE-2026-98161](https://patchblox.com/security/data/cve/CVE-2026-98161.md) | Routine | nvdimm: pmem: keep PREFLUSH before data writes | 5.5 | 0.0011 | | | [CVE-2026-97618](https://patchblox.com/security/data/cve/CVE-2026-97618.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/net: don't overconsume buffers when usi... | 4.4 | n/a | | --- Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.