# ELSA-2026-500574: Security update for 19 packages ELSA-2026-500574, released November 7, 2026, fixes 277 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/elsa-2026-500574 - Platform: Linux - Released: Nov 7, 2026 - Priority: Urgent (Closes CVE-2026-98339, rated Critical) - CVEs: 277, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://linux.oracle.com/errata/ELSA-2026-500574.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek](https://patchblox.com/security/data/product/linux/kernel-uek.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek](https://patchblox.com/security/data/product/linux/kernel-uek.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-container](https://patchblox.com/security/data/product/linux/kernel-uek-container.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-container](https://patchblox.com/security/data/product/linux/kernel-uek-container.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-container-debug](https://patchblox.com/security/data/product/linux/kernel-uek-container-debug.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-container-debug](https://patchblox.com/security/data/product/linux/kernel-uek-container-debug.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-core](https://patchblox.com/security/data/product/linux/kernel-uek-core.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-core](https://patchblox.com/security/data/product/linux/kernel-uek-core.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-debug](https://patchblox.com/security/data/product/linux/kernel-uek-debug.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-debug](https://patchblox.com/security/data/product/linux/kernel-uek-debug.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-debug-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-core.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-debug-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-core.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-debug-devel](https://patchblox.com/security/data/product/linux/kernel-uek-debug-devel.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-debug-devel](https://patchblox.com/security/data/product/linux/kernel-uek-debug-devel.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-debug-modules](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-debug-modules](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-devel](https://patchblox.com/security/data/product/linux/kernel-uek-devel.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-devel](https://patchblox.com/security/data/product/linux/kernel-uek-devel.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-doc](https://patchblox.com/security/data/product/linux/kernel-uek-doc.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-doc](https://patchblox.com/security/data/product/linux/kernel-uek-doc.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-modules](https://patchblox.com/security/data/product/linux/kernel-uek-modules.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-modules](https://patchblox.com/security/data/product/linux/kernel-uek-modules.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek64k](https://patchblox.com/security/data/product/linux/kernel-uek64k.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek64k](https://patchblox.com/security/data/product/linux/kernel-uek64k.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek64k-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-core.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek64k-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-core.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek64k-devel](https://patchblox.com/security/data/product/linux/kernel-uek64k-devel.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek64k-devel](https://patchblox.com/security/data/product/linux/kernel-uek64k-devel.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek64k-modules](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek64k-modules](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek64k-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra.md) | ol 8 | 0:5.15.0-326.222.4.el9uek | | [kernel-uek64k-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra.md) | ol 9 | 0:5.15.0-326.222.4.el9uek | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-98339](https://patchblox.com/security/data/cve/CVE-2026-98339.md) | Urgent | wifi: cfg80211: don't filter by BSS type when removing stale entries | 9.8 | 0.0028 | | | [CVE-2026-98348](https://patchblox.com/security/data/cve/CVE-2026-98348.md) | Urgent | wifi: libipw: reject too-short association responses | 9.8 | 0.0025 | | | [CVE-2026-98573](https://patchblox.com/security/data/cve/CVE-2026-98573.md) | Urgent | net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() | 9.4 | 0.0022 | | | [CVE-2026-98621](https://patchblox.com/security/data/cve/CVE-2026-98621.md) | Urgent | net: gue: reject invalid REMCSUM offsets | 9.1 | 0.0022 | | | [CVE-2026-98272](https://patchblox.com/security/data/cve/CVE-2026-98272.md) | Urgent | net: mvpp2: prevent buffer overflow in page_pool allocation | 9.8 | 0.0020 | | | [CVE-2026-98319](https://patchblox.com/security/data/cve/CVE-2026-98319.md) | Urgent | drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr | 9.8 | 0.0018 | | | [CVE-2026-98322](https://patchblox.com/security/data/cve/CVE-2026-98322.md) | Urgent | netfilter: nft_nat: fully initialise new_addr in netmap setup | 9.8 | 0.0018 | | | [CVE-2026-98186](https://patchblox.com/security/data/cve/CVE-2026-98186.md) | Urgent | wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length | 9.8 | 0.0018 | | | [CVE-2026-98187](https://patchblox.com/security/data/cve/CVE-2026-98187.md) | Urgent | wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST | 9.8 | 0.0018 | | | [CVE-2026-98188](https://patchblox.com/security/data/cve/CVE-2026-98188.md) | Urgent | wifi: p54: validate curve data length in the calibration curve converters | 9.8 | 0.0018 | | | [CVE-2026-98191](https://patchblox.com/security/data/cve/CVE-2026-98191.md) | Urgent | wifi: wlcore: release runtime PM ref on regdomain config failure | 9.8 | 0.0018 | | | [CVE-2026-98203](https://patchblox.com/security/data/cve/CVE-2026-98203.md) | Urgent | Input: soc_button_array - check btns_desc->package.count | 9.8 | 0.0018 | | | [CVE-2026-98207](https://patchblox.com/security/data/cve/CVE-2026-98207.md) | Urgent | mmc: spi: reset bytes_xfered before retrying CRC failures | 9.8 | 0.0018 | | | [CVE-2026-98217](https://patchblox.com/security/data/cve/CVE-2026-98217.md) | Urgent | IB/mlx4: Fix use-after-free on pkey sysfs registration failure | 9.8 | 0.0018 | | | [CVE-2026-98233](https://patchblox.com/security/data/cve/CVE-2026-98233.md) | Urgent | net/packet: clear RX owner on VNET header error | 9.8 | 0.0018 | | | [CVE-2026-98255](https://patchblox.com/security/data/cve/CVE-2026-98255.md) | Urgent | tcp: exclude old ACKs from tcp fast path | 9.8 | 0.0018 | | | [CVE-2026-98308](https://patchblox.com/security/data/cve/CVE-2026-98308.md) | Urgent | ALSA: hda: trace PCM open only after assigning a stream | 9.8 | 0.0018 | | | [CVE-2026-98340](https://patchblox.com/security/data/cve/CVE-2026-98340.md) | Urgent | wifi: cfg80211: only group hidden BSSes with beacon entries | 9.8 | 0.0018 | | | [CVE-2026-98345](https://patchblox.com/security/data/cve/CVE-2026-98345.md) | Urgent | wifi: cfg80211: check IP header size in cfg80211_classify8021d() | 9.8 | 0.0018 | | | [CVE-2026-98181](https://patchblox.com/security/data/cve/CVE-2026-98181.md) | Urgent | drm/gud: fix out-of-bounds write in gud_plane_atomic_check() | 9.8 | 0.0017 | | | [CVE-2026-98199](https://patchblox.com/security/data/cve/CVE-2026-98199.md) | Urgent | hwmon: (pmbus/core) increase number of phases and add new mask | 9.8 | 0.0017 | | | [CVE-2026-98221](https://patchblox.com/security/data/cve/CVE-2026-98221.md) | Urgent | KEYS: trusted: Fix tpm2_load_cmd() boundary check | 9.8 | 0.0017 | | | [CVE-2026-98287](https://patchblox.com/security/data/cve/CVE-2026-98287.md) | Urgent | pppoatm: ensure a writable skb header and linear data | 9.8 | 0.0017 | | | [CVE-2026-98363](https://patchblox.com/security/data/cve/CVE-2026-98363.md) | Urgent | firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS | 9.8 | 0.0017 | | | [CVE-2026-98362](https://patchblox.com/security/data/cve/CVE-2026-98362.md) | Urgent | clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate | 9.8 | 0.0017 | | | [CVE-2026-98370](https://patchblox.com/security/data/cve/CVE-2026-98370.md) | Urgent | xfrm: fix compat ALLOCSPI request use-after-free | 9.8 | 0.0017 | | | [CVE-2026-98320](https://patchblox.com/security/data/cve/CVE-2026-98320.md) | Urgent | netfilter: flowtable: hold reference on ct until flow is released | 9.8 | 0.0014 | | | [CVE-2026-98251](https://patchblox.com/security/data/cve/CVE-2026-98251.md) | Urgent | openvswitch: avoid reallocating confirmed conntrack labels | 9.8 | 0.0013 | | | [CVE-2026-98253](https://patchblox.com/security/data/cve/CVE-2026-98253.md) | Urgent | RDMA/ucma: Serialize join and leave on copy_to_user failure | 9.8 | 0.0013 | | | [CVE-2026-68236](https://patchblox.com/security/data/cve/CVE-2026-68236.md) | Urgent | drm/amd/display: set new_stream to NULL after release | 9.8 | 0.0013 | | | [CVE-2026-98252](https://patchblox.com/security/data/cve/CVE-2026-98252.md) | Urgent | RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() | 9.8 | 0.0012 | | | [CVE-2025-21759](https://patchblox.com/security/data/cve/CVE-2025-21759.md) | High | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bu... | 7.8 | 0.0780 | | | [CVE-2026-97524](https://patchblox.com/security/data/cve/CVE-2026-97524.md) | High | mptcp: avoid unneeded actions on subflow reset | 9.8 | 0.0075 | | | [CVE-2026-97523](https://patchblox.com/security/data/cve/CVE-2026-97523.md) | High | mptcp: close race between scheduler and state change | 7.5 | 0.0073 | | | [CVE-2026-98548](https://patchblox.com/security/data/cve/CVE-2026-98548.md) | High | sctp: discard the rest of the packet on a stale-cookie error | 9.8 | 0.0069 | | | [CVE-2026-98550](https://patchblox.com/security/data/cve/CVE-2026-98550.md) | High | tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow | 7.5 | 0.0068 | | | [CVE-2026-98532](https://patchblox.com/security/data/cve/CVE-2026-98532.md) | High | ipv6: do not let ipv6_find_hdr() return an offset past the packet end | 8.1 | 0.0061 | | | [CVE-2026-97573](https://patchblox.com/security/data/cve/CVE-2026-97573.md) | High | bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() | 9.8 | 0.0060 | | | [CVE-2026-74743](https://patchblox.com/security/data/cve/CVE-2026-74743.md) | High | macvlan: inherit needed_headroom and needed_tailroom from lowerdev | 9.8 | 0.0054 | | | [CVE-2026-97417](https://patchblox.com/security/data/cve/CVE-2026-97417.md) | High | netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() | 8.8 | 0.0049 | | | [CVE-2026-98130](https://patchblox.com/security/data/cve/CVE-2026-98130.md) | High | sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START | 8.1 | 0.0045 | | | [CVE-2025-38590](https://patchblox.com/security/data/cve/CVE-2025-38590.md) | High | net/mlx5e: Remove skb secpath if xfrm state is not found | 7.5 | 0.0041 | | | [CVE-2026-98479](https://patchblox.com/security/data/cve/CVE-2026-98479.md) | High | scsi: libiscsi_tcp: Check the data direction of a Data-In PDU | 7.5 | 0.0039 | | | [CVE-2026-98499](https://patchblox.com/security/data/cve/CVE-2026-98499.md) | High | HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() | 8.1 | 0.0039 | | | [CVE-2026-98357](https://patchblox.com/security/data/cve/CVE-2026-98357.md) | High | IB/isert: wait for deferred control PDU completions before releasing the connection | 8.1 | 0.0035 | | | [CVE-2026-98374](https://patchblox.com/security/data/cve/CVE-2026-98374.md) | High | tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() | 8.8 | 0.0029 | | | [CVE-2026-98501](https://patchblox.com/security/data/cve/CVE-2026-98501.md) | High | HID: alps: fix use-after-free on input2 registration failure | 7.1 | 0.0026 | | | [CVE-2026-98349](https://patchblox.com/security/data/cve/CVE-2026-98349.md) | High | wifi: libipw: reject too-short beacon and probe responses | 7.1 | 0.0025 | | | [CVE-2026-98108](https://patchblox.com/security/data/cve/CVE-2026-98108.md) | High | Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan | 8.8 | 0.0024 | | | [CVE-2026-98290](https://patchblox.com/security/data/cve/CVE-2026-98290.md) | High | Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup | 7.5 | 0.0024 | | | [CVE-2025-21751](https://patchblox.com/security/data/cve/CVE-2025-21751.md) | High | linux: linux - security update | 7.8 | 0.0023 | | | [CVE-2026-89796](https://patchblox.com/security/data/cve/CVE-2026-89796.md) | High | mm/damon/core: avoid infinite kdamond_merge_regions() internal loop | 7.8 | 0.0023 | | | [CVE-2026-97508](https://patchblox.com/security/data/cve/CVE-2026-97508.md) | High | thunderbolt: Set tb->root_switch to NULL when domain is stopped | 9.8 | 0.0023 | | | [CVE-2026-98602](https://patchblox.com/security/data/cve/CVE-2026-98602.md) | High | Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough | 8.1 | 0.0022 | | | [CVE-2026-97598](https://patchblox.com/security/data/cve/CVE-2026-97598.md) | High | ipv4: fib: bound automatic table ID allocation | 7.8 | 0.0022 | | | [CVE-2026-97993](https://patchblox.com/security/data/cve/CVE-2026-97993.md) | High | vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx | 7.8 | 0.0022 | | | [CVE-2026-98076](https://patchblox.com/security/data/cve/CVE-2026-98076.md) | High | tracing/probes: Fix use-after-free on field name/type of events with multiple probes | 7.8 | 0.0022 | | | [CVE-2026-97568](https://patchblox.com/security/data/cve/CVE-2026-97568.md) | High | mptcp: syncookies: remember the request backup flag | 7.1 | 0.0022 | | | [CVE-2026-97904](https://patchblox.com/security/data/cve/CVE-2026-97904.md) | High | cpufreq: initialize policy rwsem before sysfs publication | 7.0 | 0.0022 | | | [CVE-2026-98626](https://patchblox.com/security/data/cve/CVE-2026-98626.md) | High | bpf: Restrict CO-RE poisoning to relocatable instructions | 7.1 | 0.0021 | | | [CVE-2026-97604](https://patchblox.com/security/data/cve/CVE-2026-97604.md) | High | fbdev: vfb: defer cleanup until the last reference | 7.1 | 0.0021 | | | [CVE-2025-68190](https://patchblox.com/security/data/cve/CVE-2025-68190.md) | High | drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() | 7.8 | 0.0021 | | | [CVE-2025-38349](https://patchblox.com/security/data/cve/CVE-2025-38349.md) | High | eventpoll: don't decrement ep refcount while still holding the ep mutex | 8.4 | 0.0018 | | | [CVE-2026-98457](https://patchblox.com/security/data/cve/CVE-2026-98457.md) | High | Bluetooth: L2CAP: validate frame length before control and FCS access | 7.1 | 0.0018 | | | [CVE-2026-98900](https://patchblox.com/security/data/cve/CVE-2026-98900.md) | High | xen/gntalloc: validate grant count before allocation | 7.8 | 0.0018 | | | [CVE-2026-98881](https://patchblox.com/security/data/cve/CVE-2026-98881.md) | High | net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() | 7.1 | 0.0018 | | | [CVE-2026-98902](https://patchblox.com/security/data/cve/CVE-2026-98902.md) | High | md/raid5: let stripe batch bm_seq comparison wrap-safe | 7.1 | 0.0018 | | | [CVE-2026-97959](https://patchblox.com/security/data/cve/CVE-2026-97959.md) | High | net/sched: cls_route: free emptied bucket on filter move | 9.1 | 0.0018 | | | [CVE-2026-97995](https://patchblox.com/security/data/cve/CVE-2026-97995.md) | High | virtio_console: do not free control-out buffers on remove | 7.8 | 0.0018 | | | [CVE-2026-98011](https://patchblox.com/security/data/cve/CVE-2026-98011.md) | High | net/sched: hhf: clamp quantum in change and init paths | 7.8 | 0.0018 | | | [CVE-2026-98015](https://patchblox.com/security/data/cve/CVE-2026-98015.md) | High | net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put | 7.8 | 0.0018 | | | [CVE-2026-98074](https://patchblox.com/security/data/cve/CVE-2026-98074.md) | High | bonding: do not clear curr_active_slave prematurely when releasing all slaves | 7.8 | 0.0018 | | | [CVE-2026-98194](https://patchblox.com/security/data/cve/CVE-2026-98194.md) | High | wifi: libertas_tf: fix UAF in lbtf_free_adapter() | 7.8 | 0.0018 | | | [CVE-2026-98342](https://patchblox.com/security/data/cve/CVE-2026-98342.md) | High | dmaengine: wait for RCU readers before releasing dma_device | 7.8 | 0.0018 | | | [CVE-2026-98343](https://patchblox.com/security/data/cve/CVE-2026-98343.md) | High | dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() | 7.8 | 0.0018 | | | [CVE-2026-97951](https://patchblox.com/security/data/cve/CVE-2026-97951.md) | High | scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands | 7.5 | 0.0018 | | | [CVE-2026-98063](https://patchblox.com/security/data/cve/CVE-2026-98063.md) | High | bpf: Fix NULL-ptr-deref in btf_var_show() | 7.1 | 0.0018 | | | [CVE-2026-98064](https://patchblox.com/security/data/cve/CVE-2026-98064.md) | High | bpf: Fix NULL-ptr-deref when showing a void BTF type | 7.1 | 0.0018 | | | [CVE-2026-98201](https://patchblox.com/security/data/cve/CVE-2026-98201.md) | High | Input: zero ff_effect before compat copy in input_ff_effect_from_user | 7.1 | 0.0018 | | | [CVE-2026-98204](https://patchblox.com/security/data/cve/CVE-2026-98204.md) | High | Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() | 7.1 | 0.0018 | | | [CVE-2026-98208](https://patchblox.com/security/data/cve/CVE-2026-98208.md) | High | mmc: sdio_uart: fix xmit_fifo leak when the port table is full | 7.1 | 0.0018 | | | [CVE-2026-98234](https://patchblox.com/security/data/cve/CVE-2026-98234.md) | High | net/sched: hhf: cap hh_flows_limit at change time | 7.1 | 0.0018 | | | [CVE-2026-98460](https://patchblox.com/security/data/cve/CVE-2026-98460.md) | High | Bluetooth: hci_sock: reject out-of-range OCF values | 7.1 | 0.0018 | | | [CVE-2026-98066](https://patchblox.com/security/data/cve/CVE-2026-98066.md) | High | ALSA: caiaq: Fix potential double-free at error path | 7.0 | 0.0018 | | | [CVE-2026-93785](https://patchblox.com/security/data/cve/CVE-2026-93785.md) | High | cifs: validate idmap key payload length | 7.8 | 0.0017 | | | [CVE-2026-93820](https://patchblox.com/security/data/cve/CVE-2026-93820.md) | High | PCI: rockchip: Protect root bus removal with rescan lock | 7.8 | 0.0017 | | | [CVE-2026-93822](https://patchblox.com/security/data/cve/CVE-2026-93822.md) | High | PCI: iproc: Protect root bus removal with rescan lock | 7.8 | 0.0017 | | | [CVE-2026-97441](https://patchblox.com/security/data/cve/CVE-2026-97441.md) | High | ata: ahci: fail probe if BAR too small for claimed ports | 7.8 | 0.0017 | | | [CVE-2026-97492](https://patchblox.com/security/data/cve/CVE-2026-97492.md) | High | wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed | 7.8 | 0.0017 | | | [CVE-2026-97963](https://patchblox.com/security/data/cve/CVE-2026-97963.md) | High | net: stmmac: initialize ptp_lock at probe time | 7.8 | 0.0017 | | | [CVE-2026-98016](https://patchblox.com/security/data/cve/CVE-2026-98016.md) | High | net/mlx5e: Fix use-after-free race in sample_restore_put() | 7.8 | 0.0017 | | | [CVE-2026-93783](https://patchblox.com/security/data/cve/CVE-2026-93783.md) | High | Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame | 7.1 | 0.0017 | | | [CVE-2026-93803](https://patchblox.com/security/data/cve/CVE-2026-93803.md) | High | wifi: libipw: fix key index receive bound checks | 7.1 | 0.0017 | | | [CVE-2026-98014](https://patchblox.com/security/data/cve/CVE-2026-98014.md) | High | net/mlx5: E-Switch, prevent mc_list repopulation during vport disable | 7.1 | 0.0017 | | | [CVE-2026-98075](https://patchblox.com/security/data/cve/CVE-2026-98075.md) | High | bpf: reject BPF_PSEUDO_FUNC reference to the main program | 7.1 | 0.0017 | | | [CVE-2026-98485](https://patchblox.com/security/data/cve/CVE-2026-98485.md) | High | netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read | 7.1 | 0.0017 | | | [CVE-2026-93802](https://patchblox.com/security/data/cve/CVE-2026-93802.md) | High | wifi: rsi: validate beacon length before fixed buffer copy | 7.0 | 0.0017 | | | [CVE-2026-97430](https://patchblox.com/security/data/cve/CVE-2026-97430.md) | High | xhci: Prevent queuing new commands if xhci is inaccessible | 7.0 | 0.0017 | | | [CVE-2026-98088](https://patchblox.com/security/data/cve/CVE-2026-98088.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumask_of_no... | 7.0 | 0.0017 | | | [CVE-2026-97612](https://patchblox.com/security/data/cve/CVE-2026-97612.md) | High | net: mpls: clear inner_protocol when the last label is popped | 7.8 | 0.0017 | | | [CVE-2026-97940](https://patchblox.com/security/data/cve/CVE-2026-97940.md) | High | ipv6: fix fib6 walker UAF on seq stop | 7.8 | 0.0017 | | | [CVE-2026-98491](https://patchblox.com/security/data/cve/CVE-2026-98491.md) | High | net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry | 7.8 | 0.0017 | | | [CVE-2026-98515](https://patchblox.com/security/data/cve/CVE-2026-98515.md) | High | drm/nouveau: fix double-free in nvif_vmm_dtor | 7.8 | 0.0017 | | | [CVE-2026-98889](https://patchblox.com/security/data/cve/CVE-2026-98889.md) | High | wifi: iwlwifi: mvm: fix sched scan IE sizing | 7.8 | 0.0017 | | | [CVE-2026-98899](https://patchblox.com/security/data/cve/CVE-2026-98899.md) | High | netfilter: ipset: mark the rcu locked areas properly | 7.8 | 0.0017 | | | [CVE-2026-97576](https://patchblox.com/security/data/cve/CVE-2026-97576.md) | High | media: v4l2-ctrls: validate HEVC tile counts | 7.8 | 0.0016 | | | [CVE-2026-97611](https://patchblox.com/security/data/cve/CVE-2026-97611.md) | High | net: openvswitch: fix use-after-free of the flow table mask array | 7.8 | 0.0016 | | | [CVE-2026-98383](https://patchblox.com/security/data/cve/CVE-2026-98383.md) | High | bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL | 7.8 | 0.0016 | | | [CVE-2026-98419](https://patchblox.com/security/data/cve/CVE-2026-98419.md) | High | drop_monitor: fix out-of-bounds write in reset_per_cpu_data() | 7.0 | 0.0016 | | | [CVE-2026-98907](https://patchblox.com/security/data/cve/CVE-2026-98907.md) | High | btrfs: protect sb_write_pointer() with invalidate lock | 7.1 | 0.0016 | | | [CVE-2026-99082](https://patchblox.com/security/data/cve/CVE-2026-99082.md) | High | KVM: x86: Use active memslots for the per-vCPU MMIO cache | 8.8 | 0.0016 | | | [CVE-2026-97445](https://patchblox.com/security/data/cve/CVE-2026-97445.md) | High | ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() | 7.7 | 0.0016 | | | [CVE-2026-97608](https://patchblox.com/security/data/cve/CVE-2026-97608.md) | High | netfilter: nf_log: unregister loggers before per-net teardown | 7.8 | 0.0015 | | | [CVE-2026-97931](https://patchblox.com/security/data/cve/CVE-2026-97931.md) | High | ALSA: us122l: Prevent write upgrades for read mappings | 7.8 | 0.0015 | | | [CVE-2026-97957](https://patchblox.com/security/data/cve/CVE-2026-97957.md) | High | net: hinic: fix mailbox segment buffer overflow | 8.8 | 0.0014 | | | [CVE-2026-97450](https://patchblox.com/security/data/cve/CVE-2026-97450.md) | High | ACPICA: validate handler object type in two places | 8.4 | 0.0014 | | | [CVE-2026-97451](https://patchblox.com/security/data/cve/CVE-2026-97451.md) | High | ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) | 8.4 | 0.0014 | | | [CVE-2026-97452](https://patchblox.com/security/data/cve/CVE-2026-97452.md) | High | ACPICA: Prevent adding invalid references | 8.4 | 0.0014 | | | [CVE-2026-97444](https://patchblox.com/security/data/cve/CVE-2026-97444.md) | High | ACPICA: add boundary checks in two places | 7.7 | 0.0014 | | | [CVE-2026-97454](https://patchblox.com/security/data/cve/CVE-2026-97454.md) | High | ACPICA: add boundary checks in acpi_ps_get_next_field() | 7.7 | 0.0014 | | | [CVE-2026-97455](https://patchblox.com/security/data/cve/CVE-2026-97455.md) | High | ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() | 8.4 | 0.0014 | | | [CVE-2026-97448](https://patchblox.com/security/data/cve/CVE-2026-97448.md) | High | ACPICA: Add validation for node in acpi_ns_build_normalized_path() | 7.8 | 0.0014 | | | [CVE-2026-98369](https://patchblox.com/security/data/cve/CVE-2026-98369.md) | High | xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() | 7.8 | 0.0014 | | | [CVE-2026-98080](https://patchblox.com/security/data/cve/CVE-2026-98080.md) | High | btrfs: do not force reloc root creation during qgroup_account_snapshot() | 7.8 | 0.0013 | | | [CVE-2026-93288](https://patchblox.com/security/data/cve/CVE-2026-93288.md) | High | netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state | 8.8 | 0.0013 | | | [CVE-2026-93287](https://patchblox.com/security/data/cve/CVE-2026-93287.md) | High | i2c: smbus: reject oversized block transfers in the common path | 7.8 | 0.0013 | | | [CVE-2026-93798](https://patchblox.com/security/data/cve/CVE-2026-93798.md) | High | btrfs: fix reloc root cleanup in merge_reloc_roots() | 7.8 | 0.0013 | | | [CVE-2026-93813](https://patchblox.com/security/data/cve/CVE-2026-93813.md) | High | btrfs: tree-checker: validate INODE_REF's namelen | 7.8 | 0.0013 | | | [CVE-2026-97421](https://patchblox.com/security/data/cve/CVE-2026-97421.md) | High | RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() | 7.8 | 0.0013 | | | [CVE-2026-98241](https://patchblox.com/security/data/cve/CVE-2026-98241.md) | High | ipv6: xfrm: use full sockets in local error paths | 7.8 | 0.0013 | | | [CVE-2026-74496](https://patchblox.com/security/data/cve/CVE-2026-74496.md) | High | fou: Fix use-after-free in fou_create() | 9.8 | 0.0013 | | | [CVE-2026-98116](https://patchblox.com/security/data/cve/CVE-2026-98116.md) | High | ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF | 7.8 | 0.0013 | | | [CVE-2026-98276](https://patchblox.com/security/data/cve/CVE-2026-98276.md) | High | net: lock the socket in sock_gettstamp() | 7.8 | 0.0013 | | | [CVE-2026-98381](https://patchblox.com/security/data/cve/CVE-2026-98381.md) | High | veth: manage XDP program pointers during channel resize | 7.8 | 0.0013 | | | [CVE-2026-98095](https://patchblox.com/security/data/cve/CVE-2026-98095.md) | High | af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). | 7.1 | 0.0012 | | | [CVE-2026-93782](https://patchblox.com/security/data/cve/CVE-2026-93782.md) | High | vhost-scsi: flush backend after device ioctls | 7.8 | 0.0012 | | | [CVE-2026-97991](https://patchblox.com/security/data/cve/CVE-2026-97991.md) | High | vdpa_sim_blk: reject out-of-range sector starts | 7.8 | 0.0012 | | | [CVE-2026-98027](https://patchblox.com/security/data/cve/CVE-2026-98027.md) | High | net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size | 7.8 | 0.0012 | | | [CVE-2026-98030](https://patchblox.com/security/data/cve/CVE-2026-98030.md) | High | net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size | 7.8 | 0.0012 | | | [CVE-2026-98197](https://patchblox.com/security/data/cve/CVE-2026-98197.md) | High | hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove | 7.1 | 0.0012 | | | [CVE-2026-98098](https://patchblox.com/security/data/cve/CVE-2026-98098.md) | High | tipc: fix NULL deref in tipc_named_node_up() on empty publication list | 7.8 | 0.0012 | | | [CVE-2025-39832](https://patchblox.com/security/data/cve/CVE-2025-39832.md) | High | net/mlx5: Fix lockdep assertion on sync reset unload event | 7.0 | 0.0012 | | | [CVE-2026-98158](https://patchblox.com/security/data/cve/CVE-2026-98158.md) | High | ppp_async: drop the errored frame instead of resetting its headroom | 9.8 | 0.0011 | | | [CVE-2026-98154](https://patchblox.com/security/data/cve/CVE-2026-98154.md) | High | nvme-rdma: fix -EIO cleanup order in queue_rq | 9.8 | 0.0011 | | | [CVE-2026-52988](https://patchblox.com/security/data/cve/CVE-2026-52988.md) | High | netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase | 7.1 | 0.0010 | | | [CVE-2024-41062](https://patchblox.com/security/data/cve/CVE-2024-41062.md) | Routine | bluetooth/l2cap: sync sock recv cb and release | 5.5 | 0.0031 | | | [CVE-2026-98025](https://patchblox.com/security/data/cve/CVE-2026-98025.md) | Routine | net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow | 6.6 | 0.0024 | | | [CVE-2026-23035](https://patchblox.com/security/data/cve/CVE-2026-23035.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Pass netdev to mlx5e_destroy_netdev i... | 5.1 | 0.0024 | | | [CVE-2026-98413](https://patchblox.com/security/data/cve/CVE-2026-98413.md) | Routine | selinux: always fill AVC decision in avc_has_perm_noaudit() | 6.1 | 0.0022 | | | [CVE-2026-98537](https://patchblox.com/security/data/cve/CVE-2026-98537.md) | Routine | workqueue: Fix NULL current_pwq deref in flush dependency check | 4.7 | 0.0022 | | | [CVE-2026-98531](https://patchblox.com/security/data/cve/CVE-2026-98531.md) | Routine | ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST | 4.4 | 0.0022 | | | [CVE-2026-98422](https://patchblox.com/security/data/cve/CVE-2026-98422.md) | Routine | wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown | 3.3 | 0.0022 | | | [CVE-2026-98426](https://patchblox.com/security/data/cve/CVE-2026-98426.md) | Routine | wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path | 3.3 | 0.0022 | | | [CVE-2024-56545](https://patchblox.com/security/data/cve/CVE-2024-56545.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: streamline driver probe to avoid de... | 5.5 | 0.0022 | | | [CVE-2026-98567](https://patchblox.com/security/data/cve/CVE-2026-98567.md) | Routine | net: xps: reject an out of range traffic class | 6.7 | 0.0022 | | | [CVE-2026-98590](https://patchblox.com/security/data/cve/CVE-2026-98590.md) | Routine | bpf: Fix bpf_sock context code generation | 6.3 | 0.0022 | | | [CVE-2026-98407](https://patchblox.com/security/data/cve/CVE-2026-98407.md) | Routine | wifi: rsi: fix heap OOB write on key removal | 6.1 | 0.0022 | | | [CVE-2026-98495](https://patchblox.com/security/data/cve/CVE-2026-98495.md) | Routine | net: arp: terminate device name before lookup | 6.1 | 0.0022 | | | [CVE-2026-98498](https://patchblox.com/security/data/cve/CVE-2026-98498.md) | Routine | net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() | 5.9 | 0.0022 | | | [CVE-2026-98541](https://patchblox.com/security/data/cve/CVE-2026-98541.md) | Routine | fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT | 5.9 | 0.0022 | | | [CVE-2026-98610](https://patchblox.com/security/data/cve/CVE-2026-98610.md) | Routine | net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget | 5.9 | 0.0022 | | | [CVE-2026-97572](https://patchblox.com/security/data/cve/CVE-2026-97572.md) | Routine | bnxt_en: Propagate RX ring init failures in bnxt_init_nic() | 5.5 | 0.0022 | | | [CVE-2026-97905](https://patchblox.com/security/data/cve/CVE-2026-97905.md) | Routine | cpufreq: zero-initialize policy cpumask before sysfs publication | 5.5 | 0.0022 | | | [CVE-2026-98077](https://patchblox.com/security/data/cve/CVE-2026-98077.md) | Routine | netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() | 5.5 | 0.0022 | | | [CVE-2026-98388](https://patchblox.com/security/data/cve/CVE-2026-98388.md) | Routine | exec: do_close_on_exec() before taking exec_update_lock | 5.5 | 0.0022 | | | [CVE-2026-98511](https://patchblox.com/security/data/cve/CVE-2026-98511.md) | Routine | drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() | 5.5 | 0.0022 | | | [CVE-2026-98554](https://patchblox.com/security/data/cve/CVE-2026-98554.md) | Routine | vlan: ensure sufficient headroom in vlan_dev_hard_header() | 5.5 | 0.0022 | | | [CVE-2026-98488](https://patchblox.com/security/data/cve/CVE-2026-98488.md) | Routine | net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read | 5.3 | 0.0022 | | | [CVE-2026-98494](https://patchblox.com/security/data/cve/CVE-2026-98494.md) | Routine | net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read | 5.3 | 0.0022 | | | [CVE-2026-98461](https://patchblox.com/security/data/cve/CVE-2026-98461.md) | Routine | Bluetooth: hci_sock: validate event length before filtering | 5.2 | 0.0022 | | | [CVE-2026-97596](https://patchblox.com/security/data/cve/CVE-2026-97596.md) | Routine | ipvs: reject invalid states in connection template sync records | 4.8 | 0.0022 | | | [CVE-2026-98404](https://patchblox.com/security/data/cve/CVE-2026-98404.md) | Routine | drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() | 4.7 | 0.0022 | | | [CVE-2026-98547](https://patchblox.com/security/data/cve/CVE-2026-98547.md) | Routine | af_packet: fix integer overflow in prb_calc_retire_blk_tmo() | 4.4 | 0.0022 | | | [CVE-2026-98569](https://patchblox.com/security/data/cve/CVE-2026-98569.md) | Routine | ip_gre: Reject enabling collect metadata through changelink | 4.4 | 0.0022 | | | [CVE-2026-98516](https://patchblox.com/security/data/cve/CVE-2026-98516.md) | Routine | drm/nouveau: Fix bridge reference leak in nv1a_ram_new() | 3.3 | 0.0022 | | | [CVE-2026-98553](https://patchblox.com/security/data/cve/CVE-2026-98553.md) | Routine | autofs: fix sbi->pipe file reference leak in autofs_kill_sb() | 3.3 | 0.0022 | | | [CVE-2026-98406](https://patchblox.com/security/data/cve/CVE-2026-98406.md) | Routine | wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver | 2.5 | 0.0022 | | | [CVE-2026-98514](https://patchblox.com/security/data/cve/CVE-2026-98514.md) | Routine | drm/nouveau: Fix gem reference leak in validate_init() | 2.5 | 0.0022 | | | [CVE-2026-98594](https://patchblox.com/security/data/cve/CVE-2026-98594.md) | Routine | tg3: clean up PHYLIB resources on probe failure | 2.3 | 0.0022 | | | [CVE-2026-98536](https://patchblox.com/security/data/cve/CVE-2026-98536.md) | Routine | writeback: report a Tasks-RCU quiescent state per cgwb drain pass | 4.1 | 0.0022 | | | [CVE-2026-98887](https://patchblox.com/security/data/cve/CVE-2026-98887.md) | Routine | wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO | 5.5 | 0.0021 | | | [CVE-2025-40238](https://patchblox.com/security/data/cve/CVE-2025-40238.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix IPsec cleanup over MPV device Whe... | 4.7 | 0.0021 | | | [CVE-2026-98606](https://patchblox.com/security/data/cve/CVE-2026-98606.md) | Routine | drm/virtio: release the GEM object on virtio_gpu_vram_create() errors | 6.5 | 0.0021 | | | [CVE-2026-98588](https://patchblox.com/security/data/cve/CVE-2026-98588.md) | Routine | bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc | 5.7 | 0.0021 | | | [CVE-2026-98625](https://patchblox.com/security/data/cve/CVE-2026-98625.md) | Routine | netfilter: flowtable: publish HW_DEAD after worker is done | 5.7 | 0.0021 | | | [CVE-2026-97601](https://patchblox.com/security/data/cve/CVE-2026-97601.md) | Routine | ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink | 5.5 | 0.0021 | | | [CVE-2026-97923](https://patchblox.com/security/data/cve/CVE-2026-97923.md) | Routine | tracing: Free histogram the var ref when its initialization fails | 5.5 | 0.0021 | | | [CVE-2026-98643](https://patchblox.com/security/data/cve/CVE-2026-98643.md) | Routine | bpf: Fix out-of-bounds read of rtt_min in sock_ops | 4.4 | 0.0021 | | | [CVE-2026-98631](https://patchblox.com/security/data/cve/CVE-2026-98631.md) | Routine | xsk: Use a 32-bit compare in xsk_map_gen_lookup | 6.0 | 0.0021 | | | [CVE-2026-98640](https://patchblox.com/security/data/cve/CVE-2026-98640.md) | Routine | HID: amd_sfh: Validate PCI BAR size before mapping | 5.5 | 0.0021 | | | [CVE-2026-98644](https://patchblox.com/security/data/cve/CVE-2026-98644.md) | Routine | bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() | 4.4 | 0.0021 | | | [CVE-2026-97930](https://patchblox.com/security/data/cve/CVE-2026-97930.md) | Routine | ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf | 2.1 | 0.0021 | | | [CVE-2026-98612](https://patchblox.com/security/data/cve/CVE-2026-98612.md) | Routine | net: usb: catc: bound the RX packet length in catc_rx_done() | 6.1 | 0.0019 | | | [CVE-2025-39830](https://patchblox.com/security/data/cve/CVE-2025-39830.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix memory leak in hws_pool_buddy... | 5.5 | 0.0019 | | | [CVE-2025-39834](https://patchblox.com/security/data/cve/CVE-2025-39834.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix memory leak in hws_action_get... | 5.5 | 0.0019 | | | [CVE-2026-98884](https://patchblox.com/security/data/cve/CVE-2026-98884.md) | Routine | mmc: core: Add validation for host-provided max_segs | 5.5 | 0.0019 | | | [CVE-2026-98886](https://patchblox.com/security/data/cve/CVE-2026-98886.md) | Routine | drm/gma500: return errors from Oaktrail HDMI I2C reads | 5.5 | 0.0019 | | | [CVE-2026-98888](https://patchblox.com/security/data/cve/CVE-2026-98888.md) | Routine | arm64: kprobes: Allow reentering kprobes while single-stepping | 5.5 | 0.0019 | | | [CVE-2026-98890](https://patchblox.com/security/data/cve/CVE-2026-98890.md) | Routine | wifi: libertas: reject short monitor TX frames | 5.5 | 0.0019 | | | [CVE-2026-98909](https://patchblox.com/security/data/cve/CVE-2026-98909.md) | Routine | net: cpsw_new: unregister devlink on port registration failure | 5.5 | 0.0019 | | | [CVE-2026-98896](https://patchblox.com/security/data/cve/CVE-2026-98896.md) | Routine | thunderbolt: Keep the domain reference while processing hotplug | 4.7 | 0.0019 | | | [CVE-2026-98912](https://patchblox.com/security/data/cve/CVE-2026-98912.md) | Routine | ALSA: seq: oss: Reject reads that cannot fit the next event | 4.4 | 0.0019 | | | [CVE-2026-98306](https://patchblox.com/security/data/cve/CVE-2026-98306.md) | Routine | seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation | 6.5 | 0.0018 | | | [CVE-2026-98314](https://patchblox.com/security/data/cve/CVE-2026-98314.md) | Routine | ALSA: pcm: set timer->private_data before registering the PCM timer | 5.5 | 0.0018 | | | [CVE-2026-98877](https://patchblox.com/security/data/cve/CVE-2026-98877.md) | Routine | irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed | 6.5 | 0.0018 | | | [CVE-2026-98873](https://patchblox.com/security/data/cve/CVE-2026-98873.md) | Routine | netfilter: nf_conntrack_expect: zero at allocation time | 6.1 | 0.0018 | | | [CVE-2026-98876](https://patchblox.com/security/data/cve/CVE-2026-98876.md) | Routine | host1x: bus: Fix missing ops null check in error teardown | 5.5 | 0.0018 | | | [CVE-2026-98879](https://patchblox.com/security/data/cve/CVE-2026-98879.md) | Routine | isofs: handle set_blocksize failures | 5.5 | 0.0018 | | | [CVE-2026-98885](https://patchblox.com/security/data/cve/CVE-2026-98885.md) | Routine | ima: return error early if file xattr cannot be changed | 5.5 | 0.0018 | | | [CVE-2026-98898](https://patchblox.com/security/data/cve/CVE-2026-98898.md) | Routine | drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized | 5.5 | 0.0018 | | | [CVE-2026-98891](https://patchblox.com/security/data/cve/CVE-2026-98891.md) | Routine | wifi: mac80211: validate deauth frame length before reason access | 4.3 | 0.0018 | | | [CVE-2026-98006](https://patchblox.com/security/data/cve/CVE-2026-98006.md) | Routine | ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev | 6.6 | 0.0018 | | | [CVE-2026-98600](https://patchblox.com/security/data/cve/CVE-2026-98600.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in r... | 6.5 | 0.0018 | | | [CVE-2026-98010](https://patchblox.com/security/data/cve/CVE-2026-98010.md) | Routine | net/sched: drr: clamp quantum in change class | 6.1 | 0.0018 | | | [CVE-2026-98205](https://patchblox.com/security/data/cve/CVE-2026-98205.md) | Routine | Input: evdev - zero absinfo before partial copy in EVIOCSABS | 6.1 | 0.0018 | | | [CVE-2026-98597](https://patchblox.com/security/data/cve/CVE-2026-98597.md) | Routine | net: usb: sr9700: include receive overhead in the length check | 6.1 | 0.0018 | | | [CVE-2026-98614](https://patchblox.com/security/data/cve/CVE-2026-98614.md) | Routine | sctp: avoid livelock while updating retransmit path | 5.9 | 0.0018 | | | [CVE-2026-97899](https://patchblox.com/security/data/cve/CVE-2026-97899.md) | Routine | drm/i915: Fix memory leak in query_perf_config_list() | 5.5 | 0.0018 | | | [CVE-2026-97958](https://patchblox.com/security/data/cve/CVE-2026-97958.md) | Routine | net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). | 5.5 | 0.0018 | | | [CVE-2026-98009](https://patchblox.com/security/data/cve/CVE-2026-98009.md) | Routine | net/sched: ets: clamp quantum in parse and fallback paths | 5.5 | 0.0018 | | | [CVE-2026-98012](https://patchblox.com/security/data/cve/CVE-2026-98012.md) | Routine | net/sched: sfq: clamp quantum in change path | 5.5 | 0.0018 | | | [CVE-2026-98022](https://patchblox.com/security/data/cve/CVE-2026-98022.md) | Routine | net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations | 5.5 | 0.0018 | | | [CVE-2026-98185](https://patchblox.com/security/data/cve/CVE-2026-98185.md) | Routine | wifi: mwifiex: validate scan response extents | 5.5 | 0.0018 | | | [CVE-2026-98195](https://patchblox.com/security/data/cve/CVE-2026-98195.md) | Routine | wifi: iwlegacy: fix broadcast stations deallocation | 5.5 | 0.0018 | | | [CVE-2026-98202](https://patchblox.com/security/data/cve/CVE-2026-98202.md) | Routine | Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound | 5.5 | 0.0018 | | | [CVE-2026-98262](https://patchblox.com/security/data/cve/CVE-2026-98262.md) | Routine | ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY | 5.5 | 0.0018 | | | [CVE-2026-98299](https://patchblox.com/security/data/cve/CVE-2026-98299.md) | Routine | tcp: do not let tcp_rmem be set below 4096 | 5.5 | 0.0018 | | | [CVE-2026-98300](https://patchblox.com/security/data/cve/CVE-2026-98300.md) | Routine | tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). | 5.5 | 0.0018 | | | [CVE-2026-98344](https://patchblox.com/security/data/cve/CVE-2026-98344.md) | Routine | dmaengine: Fix device kref underflow in dma_chan_put() | 5.5 | 0.0018 | | | [CVE-2026-98380](https://patchblox.com/security/data/cve/CVE-2026-98380.md) | Routine | net/sched: reject IDR error pointers when deleting actions | 5.5 | 0.0018 | | | [CVE-2026-98455](https://patchblox.com/security/data/cve/CVE-2026-98455.md) | Routine | Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO | 5.5 | 0.0018 | | | [CVE-2026-98608](https://patchblox.com/security/data/cve/CVE-2026-98608.md) | Routine | drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() | 5.5 | 0.0018 | | | [CVE-2026-98609](https://patchblox.com/security/data/cve/CVE-2026-98609.md) | Routine | drm/virtio: fix object leak when drm_gem_handle_create() fails | 5.5 | 0.0018 | | | [CVE-2026-98622](https://patchblox.com/security/data/cve/CVE-2026-98622.md) | Routine | net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure | 5.5 | 0.0018 | | | [CVE-2026-98624](https://patchblox.com/security/data/cve/CVE-2026-98624.md) | Routine | netfilter: nfnetlink_queue: hold nfnl mutex in event notifier | 5.5 | 0.0018 | | | [CVE-2026-98489](https://patchblox.com/security/data/cve/CVE-2026-98489.md) | Routine | net: atl1c: fix soft lockup on out-of-range tpd_cons read | 5.3 | 0.0018 | | | [CVE-2026-98623](https://patchblox.com/security/data/cve/CVE-2026-98623.md) | Routine | drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update | 5.1 | 0.0018 | | | [CVE-2026-98196](https://patchblox.com/security/data/cve/CVE-2026-98196.md) | Routine | wifi: brcmsmac: fix UAF in brcms_free_timer() | 4.7 | 0.0018 | | | [CVE-2026-98347](https://patchblox.com/security/data/cve/CVE-2026-98347.md) | Routine | IB/IPoIB: Avoid restoring OPER_UP after multicast flush | 4.7 | 0.0018 | | | [CVE-2026-98636](https://patchblox.com/security/data/cve/CVE-2026-98636.md) | Routine | squashfs: Add dictionary size range check to prevent shift-out-of-bounds | 4.4 | 0.0018 | | | [CVE-2026-23000](https://patchblox.com/security/data/cve/CVE-2026-23000.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix crash on profile change rollback... | 5.5 | 0.0018 | | | [CVE-2026-93789](https://patchblox.com/security/data/cve/CVE-2026-93789.md) | Routine | wifi: iwlwifi: bound aligned TLV advance in FW parser | 6.7 | 0.0017 | | | [CVE-2026-93800](https://patchblox.com/security/data/cve/CVE-2026-93800.md) | Routine | btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() | 6.7 | 0.0017 | | | [CVE-2026-97416](https://patchblox.com/security/data/cve/CVE-2026-97416.md) | Routine | btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() | 6.7 | 0.0017 | | | [CVE-2026-98586](https://patchblox.com/security/data/cve/CVE-2026-98586.md) | Routine | sctp: hold asoc or transport before mod_timer() in timer handlers | 5.9 | 0.0017 | | | [CVE-2026-97456](https://patchblox.com/security/data/cve/CVE-2026-97456.md) | Routine | ACPICA: Fix condition check in acpi_ps_parse_loop() | 5.6 | 0.0017 | | | [CVE-2026-93825](https://patchblox.com/security/data/cve/CVE-2026-93825.md) | Routine | spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() | 5.5 | 0.0017 | | | [CVE-2026-97481](https://patchblox.com/security/data/cve/CVE-2026-97481.md) | Routine | serial: 8250: fix possible ISR soft lockup | 5.5 | 0.0017 | | | [CVE-2026-97483](https://patchblox.com/security/data/cve/CVE-2026-97483.md) | Routine | usb: core: hcd: fix possible deadlock in rh control transfers | 5.5 | 0.0017 | | | [CVE-2026-98031](https://patchblox.com/security/data/cve/CVE-2026-98031.md) | Routine | nexthop: Initialize extack in remove_nh_grp_entry() | 5.5 | 0.0017 | | | [CVE-2026-98647](https://patchblox.com/security/data/cve/CVE-2026-98647.md) | Routine | bpf: Fix divide-by-zero in btf_struct_walk() | 5.5 | 0.0017 | | | [CVE-2026-93805](https://patchblox.com/security/data/cve/CVE-2026-93805.md) | Routine | wifi: cfg80211: validate rx/tx MLME callback frame lengths before access | 5.4 | 0.0017 | | | [CVE-2026-97453](https://patchblox.com/security/data/cve/CVE-2026-97453.md) | Routine | ACPICA: validate byte_count in acpi_ps_get_next_package_length() | 5.1 | 0.0017 | | | [CVE-2026-97484](https://patchblox.com/security/data/cve/CVE-2026-97484.md) | Routine | usbip: vhci_hcd: fix NULL deref in status_show_vhci | 5.1 | 0.0017 | | | [CVE-2026-93808](https://patchblox.com/security/data/cve/CVE-2026-93808.md) | Routine | ALSA: usb-audio: caiaq: validate EP1 reply lengths | 4.9 | 0.0017 | | | [CVE-2026-93795](https://patchblox.com/security/data/cve/CVE-2026-93795.md) | Routine | blk-cgroup: fix leaks and online flag on radix_tree_insert failure | 4.7 | 0.0017 | | | [CVE-2026-97440](https://patchblox.com/security/data/cve/CVE-2026-97440.md) | Routine | net: qrtr: fix node refcount leak on ctrl packet alloc failure | 4.7 | 0.0017 | | | [CVE-2026-97446](https://patchblox.com/security/data/cve/CVE-2026-97446.md) | Routine | ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() | 4.7 | 0.0017 | | | [CVE-2026-93784](https://patchblox.com/security/data/cve/CVE-2026-93784.md) | Routine | wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() | 4.4 | 0.0017 | | | [CVE-2026-97420](https://patchblox.com/security/data/cve/CVE-2026-97420.md) | Routine | bpf: NUL-terminate replaced sysctl value | 4.4 | 0.0017 | | | [CVE-2026-97472](https://patchblox.com/security/data/cve/CVE-2026-97472.md) | Routine | ipv6: addrconf: fix temp address generation after prefix deprecation | 4.4 | 0.0017 | | | [CVE-2026-93797](https://patchblox.com/security/data/cve/CVE-2026-93797.md) | Routine | wifi: iwlwifi: mvm: fix an off-by-1 boundary check | 4.3 | 0.0017 | | | [CVE-2026-97408](https://patchblox.com/security/data/cve/CVE-2026-97408.md) | Routine | Bluetooth: L2CAP: validate connectionless PSM length | 4.3 | 0.0017 | | | [CVE-2026-97449](https://patchblox.com/security/data/cve/CVE-2026-97449.md) | Routine | ACPICA: Add package limit checks in parser functions | 4.0 | 0.0017 | | | [CVE-2026-93807](https://patchblox.com/security/data/cve/CVE-2026-93807.md) | Routine | wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers | 3.4 | 0.0017 | | | [CVE-2026-98607](https://patchblox.com/security/data/cve/CVE-2026-98607.md) | Routine | drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() | 3.3 | 0.0017 | | | [CVE-2026-98379](https://patchblox.com/security/data/cve/CVE-2026-98379.md) | Routine | netfilter: ip6t_rpfilter: reject routes without inet6_dev | 5.5 | 0.0017 | | | [CVE-2026-98354](https://patchblox.com/security/data/cve/CVE-2026-98354.md) | Routine | RDMA/mad: Fix receive buffer leak when PKey enforcement fails | 5.5 | 0.0017 | | | [CVE-2026-98358](https://patchblox.com/security/data/cve/CVE-2026-98358.md) | Routine | IB/iser: reject a remote invalidation of an unregistered direction | 5.5 | 0.0017 | | | [CVE-2026-97507](https://patchblox.com/security/data/cve/CVE-2026-97507.md) | Routine | media: dm1105: fix missing error check for dma_alloc_coherent | 6.3 | 0.0016 | | | [CVE-2026-97510](https://patchblox.com/security/data/cve/CVE-2026-97510.md) | Routine | thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() | 4.4 | 0.0016 | | | [CVE-2025-39947](https://patchblox.com/security/data/cve/CVE-2025-39947.md) | Routine | net/mlx5e: Harden uplink netdev access against device unbind | 5.5 | 0.0015 | | | [CVE-2026-98090](https://patchblox.com/security/data/cve/CVE-2026-98090.md) | Routine | btrfs: restore active device pointers after failed sprout | 6.7 | 0.0012 | | | [CVE-2026-98091](https://patchblox.com/security/data/cve/CVE-2026-98091.md) | Routine | btrfs: detach failed sprout device from transaction update list | 6.7 | 0.0012 | | | [CVE-2026-98157](https://patchblox.com/security/data/cve/CVE-2026-98157.md) | Routine | EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation | 5.5 | 0.0012 | | | [CVE-2026-43467](https://patchblox.com/security/data/cve/CVE-2026-43467.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix crash when moving to switchdev mod... | 5.5 | 0.0011 | | | [CVE-2026-98123](https://patchblox.com/security/data/cve/CVE-2026-98123.md) | Routine | sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration | 6.5 | 0.0010 | | --- Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.