# OPENSUSE-SU-2026:22091-1: Security update for 13 packages OPENSUSE-SU-2026:22091-1, released November 7, 2026, fixes 401 CVEs across 13 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/opensuse-su-2026-22091-1 - Platform: Linux - Released: Nov 7, 2026 - Priority: Urgent (Closes CVE-2026-89970, rated Critical) - CVEs: 401, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/openSUSE-SU-2026:22091-1 ## Applies to | Product | Release | Fixed in | |---|---|---| | [dtb-aarch64](https://patchblox.com/security/data/product/linux/dtb-aarch64.md) | opensuse-leap 16.0 | 6.12.0-160000.39.1 | | [kernel-64kb](https://patchblox.com/security/data/product/linux/kernel-64kb.md) | opensuse-leap 16.0 | 6.12.0-160000.39.1 | | [kernel-azure](https://patchblox.com/security/data/product/linux/kernel-azure.md) | opensuse-leap 16.0 | 6.12.0-160000.39.1 | | [kernel-default](https://patchblox.com/security/data/product/linux/kernel-default.md) | opensuse-leap 16.0 | 6.12.0-160000.39.1 | | [kernel-default-base](https://patchblox.com/security/data/product/linux/kernel-default-base.md) | opensuse-leap 16.0 | 6.12.0-160000.39.1.160000.2.25 | | [kernel-docs](https://patchblox.com/security/data/product/linux/kernel-docs.md) | opensuse-leap 16.0 | 6.12.0-160000.39.1 | | [kernel-kvmsmall](https://patchblox.com/security/data/product/linux/kernel-kvmsmall.md) | opensuse-leap 16.0 | 6.12.0-160000.39.1 | | [kernel-obs-build](https://patchblox.com/security/data/product/linux/kernel-obs-build.md) | opensuse-leap 16.0 | 6.12.0-160000.39.1 | | [kernel-obs-qa](https://patchblox.com/security/data/product/linux/kernel-obs-qa.md) | opensuse-leap 16.0 | 6.12.0-160000.39.1 | | [kernel-rt](https://patchblox.com/security/data/product/linux/kernel-rt.md) | opensuse-leap 16.0 | 6.12.0-160000.39.1 | | [kernel-source](https://patchblox.com/security/data/product/linux/kernel-source.md) | opensuse-leap 16.0 | 6.12.0-160000.39.1 | | [kernel-syms](https://patchblox.com/security/data/product/linux/kernel-syms.md) | opensuse-leap 16.0 | 6.12.0-160000.39.1 | | [kernel-zfcpdump](https://patchblox.com/security/data/product/linux/kernel-zfcpdump.md) | opensuse-leap 16.0 | 6.12.0-160000.39.1 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-72130](https://patchblox.com/security/data/cve/CVE-2026-72130.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH_RECEIVE buffers n... | 9.8 | 0.0080 | | | [CVE-2026-89970](https://patchblox.com/security/data/cve/CVE-2026-89970.md) | Urgent | nvmet-auth: Synchronize timeout work during SQ teardown | 9.8 | 0.0080 | | | [CVE-2026-90151](https://patchblox.com/security/data/cve/CVE-2026-90151.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client alloc... | 9.8 | 0.0075 | | | [CVE-2026-72299](https://patchblox.com/security/data/cve/CVE-2026-72299.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: tipc: restrict socket queue dumps in enqueue tra... | 9.8 | 0.0075 | | | [CVE-2026-72351](https://patchblox.com/security/data/cve/CVE-2026-72351.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: gue: validate REMCSUM private option length GUE... | 9.8 | 0.0075 | | | [CVE-2026-89688](https://patchblox.com/security/data/cve/CVE-2026-89688.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on s... | 9.8 | 0.0074 | | | [CVE-2026-72322](https://patchblox.com/security/data/cve/CVE-2026-72322.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed wo... | 9.8 | 0.0072 | | | [CVE-2026-72491](https://patchblox.com/security/data/cve/CVE-2026-72491.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: net/9p: fix race condition on rdma->state in tra... | 9.8 | 0.0072 | | | [CVE-2026-68477](https://patchblox.com/security/data/cve/CVE-2026-68477.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport... | 9.8 | 0.0071 | | | [CVE-2026-72129](https://patchblox.com/security/data/cve/CVE-2026-72129.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero of... | 9.8 | 0.0071 | | | [CVE-2026-74267](https://patchblox.com/security/data/cve/CVE-2026-74267.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_codel: Do not call qdisc_tree_red... | 9.8 | 0.0071 | | | [CVE-2026-80976](https://patchblox.com/security/data/cve/CVE-2026-80976.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation deca... | 9.8 | 0.0071 | | | [CVE-2026-89485](https://patchblox.com/security/data/cve/CVE-2026-89485.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file loc... | 9.8 | 0.0071 | | | [CVE-2026-89712](https://patchblox.com/security/data/cve/CVE-2026-89712.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropp... | 9.8 | 0.0071 | | | [CVE-2026-72436](https://patchblox.com/security/data/cve/CVE-2026-72436.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use test_bit() in lockle... | 9.8 | 0.0071 | | | [CVE-2026-89697](https://patchblox.com/security/data/cve/CVE-2026-89697.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SET... | 9.1 | 0.0070 | | | [CVE-2026-89526](https://patchblox.com/security/data/cve/CVE-2026-89526.md) | Urgent | svcrdma: Validate Read chunk positions before reconstruction | 9.8 | 0.0068 | | | [CVE-2026-89713](https://patchblox.com/security/data/cve/CVE-2026-89713.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock... | 9.1 | 0.0067 | | | [CVE-2026-89536](https://patchblox.com/security/data/cve/CVE-2026-89536.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake... | 9.8 | 0.0064 | | | [CVE-2026-72348](https://patchblox.com/security/data/cve/CVE-2026-72348.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extens... | 9.1 | 0.0063 | | | [CVE-2026-89658](https://patchblox.com/security/data/cve/CVE-2026-89658.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4... | 9.8 | 0.0062 | | | [CVE-2026-89660](https://patchblox.com/security/data/cve/CVE-2026-89660.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin... | 9.8 | 0.0062 | | | [CVE-2026-89703](https://patchblox.com/security/data/cve/CVE-2026-89703.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_... | 9.8 | 0.0062 | | | [CVE-2026-80694](https://patchblox.com/security/data/cve/CVE-2026-80694.md) | Urgent | net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller | 9.8 | 0.0060 | | | [CVE-2026-89672](https://patchblox.com/security/data/cve/CVE-2026-89672.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL... | 9.1 | 0.0060 | | | [CVE-2026-53384](https://patchblox.com/security/data/cve/CVE-2026-53384.md) | Urgent | serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails | 9.8 | 0.0052 | | | [CVE-2026-64046](https://patchblox.com/security/data/cve/CVE-2026-64046.md) | Urgent | kernel-uek-debug: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39853924] [5.1... | 9.8 | 0.0051 | | | [CVE-2026-74384](https://patchblox.com/security/data/cve/CVE-2026-74384.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nv... | 9.8 | 0.0051 | | | [CVE-2026-74398](https://patchblox.com/security/data/cve/CVE-2026-74398.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dad_failure when sta... | 9.8 | 0.0051 | | | [CVE-2026-89541](https://patchblox.com/security/data/cve/CVE-2026-89541.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_unwrap_resp_priv length check... | 9.8 | 0.0051 | | | [CVE-2026-89542](https://patchblox.com/security/data/cve/CVE-2026-89542.md) | Urgent | SUNRPC: harden gss_krb5_unwrap_v2 against short tokens | 9.8 | 0.0051 | | | [CVE-2026-89551](https://patchblox.com/security/data/cve/CVE-2026-89551.md) | Urgent | SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow | 9.8 | 0.0051 | | | [CVE-2026-89674](https://patchblox.com/security/data/cve/CVE-2026-89674.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4_ff_enc... | 9.8 | 0.0051 | | | [CVE-2026-90414](https://patchblox.com/security/data/cve/CVE-2026-90414.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject PDUs declaring more data than w... | 9.8 | 0.0051 | | | [CVE-2026-74376](https://patchblox.com/security/data/cve/CVE-2026-74376.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: md/raid10: reset read_slot when reusing r10bio f... | 9.8 | 0.0050 | | | [CVE-2026-89533](https://patchblox.com/security/data/cve/CVE-2026-89533.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read_chunk_ran... | 9.8 | 0.0050 | | | [CVE-2026-89702](https://patchblox.com/security/data/cve/CVE-2026-89702.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: size fh_verify server sockaddr slot by xpt... | 9.8 | 0.0050 | | | [CVE-2026-89479](https://patchblox.com/security/data/cve/CVE-2026-89479.md) | Urgent | sctp: stop processing a packet once its association is deleted | 9.8 | 0.0050 | | | [CVE-2026-68385](https://patchblox.com/security/data/cve/CVE-2026-68385.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: s390/checksum: Fix csum_partial() without vector... | 9.8 | 0.0049 | | | [CVE-2026-93207](https://patchblox.com/security/data/cve/CVE-2026-93207.md) | Urgent | SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry | 9.8 | 0.0047 | | | [CVE-2026-80725](https://patchblox.com/security/data/cve/CVE-2026-80725.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation... | 9.8 | 0.0046 | | | [CVE-2026-64216](https://patchblox.com/security/data/cve/CVE-2026-64216.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfs_unlock_abandon... | 9.8 | 0.0046 | | | [CVE-2026-100075](https://patchblox.com/security/data/cve/CVE-2026-100075.md) | Urgent | RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters | 9.8 | 0.0043 | | | [CVE-2026-63881](https://patchblox.com/security/data/cve/CVE-2026-63881.md) | Urgent | drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger | 9.8 | 0.0019 | | | [CVE-2026-68146](https://patchblox.com/security/data/cve/CVE-2026-68146.md) | Urgent | ftrace: Add global mutex to serialize trace_parser access | 9.8 | 0.0018 | | | [CVE-2026-80686](https://patchblox.com/security/data/cve/CVE-2026-80686.md) | Urgent | mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE | 9.8 | 0.0017 | | | [CVE-2026-63983](https://patchblox.com/security/data/cve/CVE-2026-63983.md) | Urgent | net/sched: fix packet loop on netem when duplicate is on | 9.8 | 0.0017 | | | [CVE-2026-80715](https://patchblox.com/security/data/cve/CVE-2026-80715.md) | Urgent | igc: remove napi_synchronize() in igc_down() | 9.8 | 0.0016 | | | [CVE-2026-64070](https://patchblox.com/security/data/cve/CVE-2026-64070.md) | Urgent | powerpc/hv-gpci: fix preempt count leak in sysfs show paths | 9.8 | 0.0012 | | | [CVE-2026-74469](https://patchblox.com/security/data/cve/CVE-2026-74469.md) | High | sctp: prevent peer transport count overflow | 8.8 | 0.0147 | | | [CVE-2026-63913](https://patchblox.com/security/data/cve/CVE-2026-63913.md) | High | bpftool: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: s... | 8.8 | 0.0097 | | | [CVE-2026-90413](https://patchblox.com/security/data/cve/CVE-2026-90413.md) | High | IB/isert: reject login PDUs declaring more data than was received | 9.1 | 0.0084 | | | [CVE-2026-89968](https://patchblox.com/security/data/cve/CVE-2026-89968.md) | High | nvmet-tcp: reject unsolicited H2CData PDUs | 9.8 | 0.0082 | | | [CVE-2026-72098](https://patchblox.com/security/data/cve/CVE-2026-72098.md) | High | dm-verity: fix buffer overflow in FEC calculation | 9.8 | 0.0079 | | | [CVE-2026-89696](https://patchblox.com/security/data/cve/CVE-2026-89696.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH t... | 7.5 | 0.0075 | | | [CVE-2026-89680](https://patchblox.com/security/data/cve/CVE-2026-89680.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd_file leak on inter-server COPY se... | 7.5 | 0.0074 | | | [CVE-2026-90104](https://patchblox.com/security/data/cve/CVE-2026-90104.md) | High | NFSv4.1: zero referring call lists before decoding | 9.8 | 0.0073 | | | [CVE-2026-89544](https://patchblox.com/security/data/cve/CVE-2026-89544.md) | High | SUNRPC: fix gssx_dec_option_array error path bugs | 9.8 | 0.0072 | | | [CVE-2026-74268](https://patchblox.com/security/data/cve/CVE-2026-74268.md) | High | tcp: clear sock_ops cb flags before force-closing a child socket | 9.8 | 0.0071 | | | [CVE-2026-89482](https://patchblox.com/security/data/cve/CVE-2026-89482.md) | High | nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone | 9.8 | 0.0071 | | | [CVE-2026-89538](https://patchblox.com/security/data/cve/CVE-2026-89538.md) | High | SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field | 9.8 | 0.0071 | | | [CVE-2026-89686](https://patchblox.com/security/data/cve/CVE-2026-89686.md) | High | nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke | 9.8 | 0.0071 | | | [CVE-2026-89511](https://patchblox.com/security/data/cve/CVE-2026-89511.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragme... | 7.5 | 0.0071 | | | [CVE-2026-72247](https://patchblox.com/security/data/cve/CVE-2026-72247.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: fix zone comparison in... | 7.5 | 0.0070 | | | [CVE-2026-89707](https://patchblox.com/security/data/cve/CVE-2026-89707.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow_down() error... | 7.5 | 0.0070 | | | [CVE-2026-90293](https://patchblox.com/security/data/cve/CVE-2026-90293.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers... | 7.5 | 0.0070 | | | [CVE-2026-90294](https://patchblox.com/security/data/cve/CVE-2026-90294.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until t... | 7.5 | 0.0070 | | | [CVE-2026-97557](https://patchblox.com/security/data/cve/CVE-2026-97557.md) | High | smb: client: avoid leaking refcount in cifs_queue_oplock_break() | 7.5 | 0.0070 | | | [CVE-2026-89662](https://patchblox.com/security/data/cve/CVE-2026-89662.md) | High | NFSD: Prevent lock owner use-after-free during client teardown | 9.8 | 0.0069 | | | [CVE-2026-89669](https://patchblox.com/security/data/cve/CVE-2026-89669.md) | High | nfsd: initialize copy-notify stateid before publishing it | 9.8 | 0.0069 | | | [CVE-2026-80980](https://patchblox.com/security/data/cve/CVE-2026-80980.md) | High | net/smc: stop killed, freed and out_of_sync sharing a byte | 9.8 | 0.0068 | | | [CVE-2026-74281](https://patchblox.com/security/data/cve/CVE-2026-74281.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer b... | 7.5 | 0.0068 | | | [CVE-2026-90228](https://patchblox.com/security/data/cve/CVE-2026-90228.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_exe... | 7.5 | 0.0068 | | | [CVE-2026-90149](https://patchblox.com/security/data/cve/CVE-2026-90149.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.... | 7.5 | 0.0067 | | | [CVE-2026-89665](https://patchblox.com/security/data/cve/CVE-2026-89665.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETA... | 8.2 | 0.0062 | | | [CVE-2026-89685](https://patchblox.com/security/data/cve/CVE-2026-89685.md) | High | nfsd: fix clock domain mismatch in clients_still_reclaiming() | 7.5 | 0.0061 | | | [CVE-2026-68376](https://patchblox.com/security/data/cve/CVE-2026-68376.md) | High | sctp: fix auth_hmacs array size in struct sctp_cookie | 8.1 | 0.0061 | | | [CVE-2026-97573](https://patchblox.com/security/data/cve/CVE-2026-97573.md) | High | bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() | 9.8 | 0.0060 | | | [CVE-2026-74480](https://patchblox.com/security/data/cve/CVE-2026-74480.md) | High | net: bridge: stop fast-leave after deleting a port group | 9.8 | 0.0058 | | | [CVE-2026-89547](https://patchblox.com/security/data/cve/CVE-2026-89547.md) | High | SUNRPC: Check svc pool percpu counter allocation | 8.1 | 0.0056 | | | [CVE-2026-89671](https://patchblox.com/security/data/cve/CVE-2026-89671.md) | High | nfsd: gate nfs3 setacl by argp->mask | 9.1 | 0.0055 | | | [CVE-2026-93107](https://patchblox.com/security/data/cve/CVE-2026-93107.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet... | 8.2 | 0.0054 | | | [CVE-2026-74597](https://patchblox.com/security/data/cve/CVE-2026-74597.md) | High | ip6_tunnel: clear skb2->cb[] in ip6ip6_err() | 9.8 | 0.0054 | | | [CVE-2026-89535](https://patchblox.com/security/data/cve/CVE-2026-89535.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma_rn_unregister before rd... | 8.1 | 0.0054 | | | [CVE-2026-89706](https://patchblox.com/security/data/cve/CVE-2026-89706.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY write... | 8.2 | 0.0053 | | | [CVE-2026-89704](https://patchblox.com/security/data/cve/CVE-2026-89704.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async... | 7.5 | 0.0053 | | | [CVE-2026-74473](https://patchblox.com/security/data/cve/CVE-2026-74473.md) | High | vxlan: use pskb_network_may_pull() in route_shortcircuit() | 9.8 | 0.0053 | | | [CVE-2026-74752](https://patchblox.com/security/data/cve/CVE-2026-74752.md) | High | sctp: validate cookie AUTH state before use | 9.8 | 0.0052 | | | [CVE-2026-74662](https://patchblox.com/security/data/cve/CVE-2026-74662.md) | High | inet: frags: publish queues before arming timer | 9.8 | 0.0051 | | | [CVE-2026-68343](https://patchblox.com/security/data/cve/CVE-2026-68343.md) | High | smb: client: validate DFS referral PathConsumed | 9.1 | 0.0051 | | | [CVE-2026-89532](https://patchblox.com/security/data/cve/CVE-2026-89532.md) | High | svcrdma: Fix pcl_for_each_segment for empty chunks | 9.1 | 0.0050 | | | [CVE-2026-89684](https://patchblox.com/security/data/cve/CVE-2026-89684.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_sta... | 9.8 | 0.0050 | | | [CVE-2026-97413](https://patchblox.com/security/data/cve/CVE-2026-97413.md) | High | RDMA/rtrs-srv: Fix integer underflow in process_read and process_write | 9.8 | 0.0050 | | | [CVE-2026-74625](https://patchblox.com/security/data/cve/CVE-2026-74625.md) | High | netfilter: bridge: release template ct on non-IP path | 7.5 | 0.0050 | | | [CVE-2026-89477](https://patchblox.com/security/data/cve/CVE-2026-89477.md) | High | sctp: fix NULL deref on untransmitted RECONF completion | 7.5 | 0.0050 | | | [CVE-2026-89699](https://patchblox.com/security/data/cve/CVE-2026-89699.md) | High | nfsd: validate symlink target length in NFSv4 CREATE | 7.5 | 0.0050 | | | [CVE-2026-74493](https://patchblox.com/security/data/cve/CVE-2026-74493.md) | High | net/smc: fix socket use-after-free during link group termination | 9.8 | 0.0050 | | | [CVE-2026-74586](https://patchblox.com/security/data/cve/CVE-2026-74586.md) | High | sctp: clear new_transport when removing a peer | 9.8 | 0.0050 | | | [CVE-2026-74588](https://patchblox.com/security/data/cve/CVE-2026-74588.md) | High | sctp: keep chunk->transport in step with the list it is queued on | 9.8 | 0.0050 | | | [CVE-2026-74628](https://patchblox.com/security/data/cve/CVE-2026-74628.md) | High | net/x25: fix use-after-free of the socket by its timers | 9.8 | 0.0050 | | | [CVE-2026-74688](https://patchblox.com/security/data/cve/CVE-2026-74688.md) | High | sctp: clear control chunk transport if it is being removed | 9.8 | 0.0050 | | | [CVE-2026-64132](https://patchblox.com/security/data/cve/CVE-2026-64132.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 9.8 | 0.0049 | | | [CVE-2026-89530](https://patchblox.com/security/data/cve/CVE-2026-89530.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the... | 9.8 | 0.0049 | | | [CVE-2026-89550](https://patchblox.com/security/data/cve/CVE-2026-89550.md) | High | SUNRPC: svcauth_gss: enforce krb5 token minimum length | 9.8 | 0.0049 | | | [CVE-2026-74692](https://patchblox.com/security/data/cve/CVE-2026-74692.md) | High | net/smc: fix TOCTOU race between smc_listen_out() and listener close | 7.5 | 0.0049 | | | [CVE-2026-74696](https://patchblox.com/security/data/cve/CVE-2026-74696.md) | High | tcp: fix TFO max_qlen accounting across reuseport migration | 7.5 | 0.0049 | | | [CVE-2026-80631](https://patchblox.com/security/data/cve/CVE-2026-80631.md) | High | btrfs: lzo: reject compressed segment that overflows the compressed input | 7.5 | 0.0048 | | | [CVE-2026-64448](https://patchblox.com/security/data/cve/CVE-2026-64448.md) | High | smb: client: restrict implied bcc[0] exemption to responses without data area | 8.2 | 0.0046 | | | [CVE-2026-89663](https://patchblox.com/security/data/cve/CVE-2026-89663.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before droppin... | 9.8 | 0.0046 | | | [CVE-2026-74490](https://patchblox.com/security/data/cve/CVE-2026-74490.md) | High | tipc: avoid use-after-free in poll trace queue dumps | 8.8 | 0.0046 | | | [CVE-2026-74697](https://patchblox.com/security/data/cve/CVE-2026-74697.md) | High | bnxt_en: Disable EOP for TPA on all chips to prevent data corruption | 8.2 | 0.0045 | | | [CVE-2026-74745](https://patchblox.com/security/data/cve/CVE-2026-74745.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ aff... | 7.5 | 0.0045 | | | [CVE-2026-64414](https://patchblox.com/security/data/cve/CVE-2026-64414.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko repo... | 7.8 | 0.0044 | | | [CVE-2026-74385](https://patchblox.com/security/data/cve/CVE-2026-74385.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmet_tcp_set_q... | 7.5 | 0.0044 | | | [CVE-2026-80844](https://patchblox.com/security/data/cve/CVE-2026-80844.md) | High | xfrm: ah6: validate routing header segments_left | 8.3 | 0.0043 | | | [CVE-2026-89481](https://patchblox.com/security/data/cve/CVE-2026-89481.md) | High | nvme-tcp: fix host memory disclosure on R2T for a read command | 8.8 | 0.0043 | | | [CVE-2026-89480](https://patchblox.com/security/data/cve/CVE-2026-89480.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few... | 8.8 | 0.0043 | | | [CVE-2026-74580](https://patchblox.com/security/data/cve/CVE-2026-74580.md) | High | vhost: reset the vring metadata cache on vring reconfiguration | 8.8 | 0.0041 | | | [CVE-2026-64597](https://patchblox.com/security/data/cve/CVE-2026-64597.md) | High | smb: client: fix double-free in SMB2_close() replay | 9.8 | 0.0036 | | | [CVE-2026-81000](https://patchblox.com/security/data/cve/CVE-2026-81000.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user()... | 8.3 | 0.0036 | | | [CVE-2026-68471](https://patchblox.com/security/data/cve/CVE-2026-68471.md) | High | wifi: ieee80211: validate MLE common info length | 8.8 | 0.0035 | | | [CVE-2026-89569](https://patchblox.com/security/data/cve/CVE-2026-89569.md) | High | Bluetooth: RFCOMM: serialize security confirmation handling | 8.8 | 0.0034 | | | [CVE-2026-74592](https://patchblox.com/security/data/cve/CVE-2026-74592.md) | High | ima: Instantiate file_truncate and path_truncate hooks | 8.1 | 0.0034 | | | [CVE-2026-64235](https://patchblox.com/security/data/cve/CVE-2026-64235.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs i... | 8.1 | 0.0033 | | | [CVE-2026-80585](https://patchblox.com/security/data/cve/CVE-2026-80585.md) | High | mptcp: fastopen: only mark MPTFO subflows with SYN data | 9.4 | 0.0031 | | | [CVE-2026-89534](https://patchblox.com/security/data/cve/CVE-2026-89534.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sc_cm_id when ADDR_CHANGE replace... | 8.8 | 0.0028 | | | [CVE-2026-64598](https://patchblox.com/security/data/cve/CVE-2026-64598.md) | High | smb/client: Fix error code in smb2_aead_req_alloc() | 8.8 | 0.0028 | | | [CVE-2026-74356](https://patchblox.com/security/data/cve/CVE-2026-74356.md) | High | vhost: fix vhost_get_avail_idx for a non empty ring | 7.4 | 0.0025 | | | [CVE-2026-74538](https://patchblox.com/security/data/cve/CVE-2026-74538.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_connect_ind Acce... | 8.8 | 0.0024 | | | [CVE-2026-80789](https://patchblox.com/security/data/cve/CVE-2026-80789.md) | High | nvmet-tcp: bound SGL data length before allocating command buffers | 7.5 | 0.0023 | | | [CVE-2026-93826](https://patchblox.com/security/data/cve/CVE-2026-93826.md) | High | HID: hidpp: fix potential UAF in hidpp_connect_event() | 7.5 | 0.0023 | | | [CVE-2026-90150](https://patchblox.com/security/data/cve/CVE-2026-90150.md) | High | pnfs/blocklayout: Fix device leaks on parse failure | 9.8 | 0.0022 | | | [CVE-2026-89694](https://patchblox.com/security/data/cve/CVE-2026-89694.md) | High | nfsd: check client ownership when cancelling a copy-notify stateid | 8.8 | 0.0022 | | | [CVE-2026-93108](https://patchblox.com/security/data/cve/CVE-2026-93108.md) | High | RDMA/ipoib: Drain RCU callbacks during module teardown | 7.8 | 0.0022 | | | [CVE-2026-89984](https://patchblox.com/security/data/cve/CVE-2026-89984.md) | High | perf/x86/intel: Fix kernel address leakages in LBR stack | 7.1 | 0.0022 | | | [CVE-2026-72218](https://patchblox.com/security/data/cve/CVE-2026-72218.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file refcount leak on cached nlm... | 7.0 | 0.0022 | | | [CVE-2026-72219](https://patchblox.com/security/data/cve/CVE-2026-72219.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file leak when nlm_do_fopen() fa... | 7.0 | 0.0022 | | | [CVE-2026-90097](https://patchblox.com/security/data/cve/CVE-2026-90097.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Skip VMBus module cleanup fo... | n/a | 0.0021 | | | [CVE-2026-90259](https://patchblox.com/security/data/cve/CVE-2026-90259.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in... | n/a | 0.0021 | | | [CVE-2026-93109](https://patchblox.com/security/data/cve/CVE-2026-93109.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module tea... | 7.8 | 0.0021 | | | [CVE-2026-92495](https://patchblox.com/security/data/cve/CVE-2026-92495.md) | High | RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap | 7.8 | 0.0021 | | | [CVE-2026-89451](https://patchblox.com/security/data/cve/CVE-2026-89451.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle->dev before the SVA handle... | 7.8 | 0.0021 | | | [CVE-2026-89502](https://patchblox.com/security/data/cve/CVE-2026-89502.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpu_buffer::free_page with sub... | 7.8 | 0.0021 | | | [CVE-2026-90263](https://patchblox.com/security/data/cve/CVE-2026-90263.md) | High | btrfs: check if root is readonly when setting posix acl | 7.8 | 0.0021 | | | [CVE-2026-97571](https://patchblox.com/security/data/cve/CVE-2026-97571.md) | High | bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() | 7.8 | 0.0021 | | | [CVE-2026-90101](https://patchblox.com/security/data/cve/CVE-2026-90101.md) | High | bnxt_en: Fix call to hardware monitoring event handler | 7.3 | 0.0021 | | | [CVE-2026-80840](https://patchblox.com/security/data/cve/CVE-2026-80840.md) | High | ipv6: seg6: clear IPv4 control block on IPIP decapsulation | 7.8 | 0.0021 | | | [CVE-2026-93264](https://patchblox.com/security/data/cve/CVE-2026-93264.md) | High | RDMA/efa: Fix PBL chunk length computation | 7.8 | 0.0020 | | | [CVE-2026-90426](https://patchblox.com/security/data/cve/CVE-2026-90426.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before... | n/a | 0.0020 | | | [CVE-2026-90430](https://patchblox.com/security/data/cve/CVE-2026-90430.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Publish an LVCMDQ only aft... | n/a | 0.0020 | | | [CVE-2026-68162](https://patchblox.com/security/data/cve/CVE-2026-68162.md) | High | sctp: avoid auth_enable sysctl UAF during netns teardown | 8.8 | 0.0020 | | | [CVE-2026-97947](https://patchblox.com/security/data/cve/CVE-2026-97947.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: x86/amd_node: Fix potential NULL pointer derefer... | n/a | 0.0020 | | | [CVE-2026-80864](https://patchblox.com/security/data/cve/CVE-2026-80864.md) | High | RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp | 9.8 | 0.0020 | | | [CVE-2026-80851](https://patchblox.com/security/data/cve/CVE-2026-80851.md) | High | gtp: serialize PDP context updates | 7.8 | 0.0020 | | | [CVE-2026-89913](https://patchblox.com/security/data/cve/CVE-2026-89913.md) | High | KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables | 8.8 | 0.0019 | | | [CVE-2026-74256](https://patchblox.com/security/data/cve/CVE-2026-74256.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpf_msg_po... | 8.4 | 0.0019 | | | [CVE-2026-89791](https://patchblox.com/security/data/cve/CVE-2026-89791.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap() reviva... | 7.8 | 0.0018 | | | [CVE-2026-80852](https://patchblox.com/security/data/cve/CVE-2026-80852.md) | High | tls: device: fix out-of-bounds write in tls_append_frag() | 7.8 | 0.0018 | | | [CVE-2026-80863](https://patchblox.com/security/data/cve/CVE-2026-80863.md) | High | RDMA/rxe: Fix OOB in free_rd_atomic_resources() | 7.8 | 0.0018 | | | [CVE-2026-89912](https://patchblox.com/security/data/cve/CVE-2026-89912.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL c... | 7.1 | 0.0018 | | | [CVE-2026-80521](https://patchblox.com/security/data/cve/CVE-2026-80521.md) | High | af_unix: Unlink scc_entry in unix_del_edge(). | 7.8 | 0.0018 | | | [CVE-2026-72066](https://patchblox.com/security/data/cve/CVE-2026-72066.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output... | 7.8 | 0.0018 | | | [CVE-2026-80842](https://patchblox.com/security/data/cve/CVE-2026-80842.md) | High | net: bridge: mcast: fix use-after-free of a master VLAN's multicast context | 7.8 | 0.0018 | | | [CVE-2026-90415](https://patchblox.com/security/data/cve/CVE-2026-90415.md) | High | RDMA/cxgb4: free STAG index when TPT entry write fails | 7.1 | 0.0018 | | | [CVE-2026-89510](https://patchblox.com/security/data/cve/CVE-2026-89510.md) | High | RDMA/cxgb4: Cancel reg_work before freeing device on remove | 7.8 | 0.0018 | | | [CVE-2026-90241](https://patchblox.com/security/data/cve/CVE-2026-90241.md) | High | iommu/vt-d: Tear down scalable-mode context on probe failure | 8.2 | 0.0018 | | | [CVE-2026-72352](https://patchblox.com/security/data/cve/CVE-2026-72352.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hid_bpf_get_data() range check hi... | 7.8 | 0.0018 | | | [CVE-2026-64473](https://patchblox.com/security/data/cve/CVE-2026-64473.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing dev... | 7.0 | 0.0018 | | | [CVE-2026-72018](https://patchblox.com/security/data/cve/CVE-2026-72018.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in move... | 7.8 | 0.0017 | | | [CVE-2026-80841](https://patchblox.com/security/data/cve/CVE-2026-80841.md) | High | net/packet: defer vmalloc TX_RING free until skbs finish | 7.8 | 0.0017 | | | [CVE-2026-80836](https://patchblox.com/security/data/cve/CVE-2026-80836.md) | High | crypto: virtio - bound the akcipher result length | 7.5 | 0.0017 | | | [CVE-2026-89710](https://patchblox.com/security/data/cve/CVE-2026-89710.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfs_lay... | 7.5 | 0.0017 | | | [CVE-2026-74391](https://patchblox.com/security/data/cve/CVE-2026-74391.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tracing: Bound synthetic-field strings with seq_... | 7.0 | 0.0017 | | | [CVE-2026-90203](https://patchblox.com/security/data/cve/CVE-2026-90203.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Squashfs: check block offset is not negative If... | 7.1 | 0.0017 | | | [CVE-2026-74283](https://patchblox.com/security/data/cve/CVE-2026-74283.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutato... | 9.8 | 0.0017 | | | [CVE-2026-72102](https://patchblox.com/security/data/cve/CVE-2026-72102.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dm_early_create: fix freeing used table on dm_re... | 8.8 | 0.0017 | | | [CVE-2026-63956](https://patchblox.com/security/data/cve/CVE-2026-63956.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 7.8 | 0.0017 | | | [CVE-2026-72406](https://patchblox.com/security/data/cve/CVE-2026-72406.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup gem_init_o... | 7.8 | 0.0017 | | | [CVE-2026-72435](https://patchblox.com/security/data/cve/CVE-2026-72435.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfree_rcu() and r... | 7.8 | 0.0017 | | | [CVE-2026-90309](https://patchblox.com/security/data/cve/CVE-2026-90309.md) | High | RDMA/erdma: Hold CQ references when processing EQ events | 7.8 | 0.0017 | | | [CVE-2026-90358](https://patchblox.com/security/data/cve/CVE-2026-90358.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit... | 7.8 | 0.0017 | | | [CVE-2026-90388](https://patchblox.com/security/data/cve/CVE-2026-90388.md) | High | iommu/dma: Check atomic pool allocation result directly | 7.8 | 0.0017 | | | [CVE-2026-93037](https://patchblox.com/security/data/cve/CVE-2026-93037.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdma_txinit_ahg() errors s... | 7.8 | 0.0017 | | | [CVE-2026-97940](https://patchblox.com/security/data/cve/CVE-2026-97940.md) | High | ipv6: fix fib6 walker UAF on seq stop | 7.8 | 0.0017 | | | [CVE-2026-72434](https://patchblox.com/security/data/cve/CVE-2026-72434.md) | High | netfilter: ipset: make sure gc is properly stopped | 7.8 | 0.0017 | | | [CVE-2026-74258](https://patchblox.com/security/data/cve/CVE-2026-74258.md) | High | bpf: Guard __get_user acesss with access_ok for uprobe_multi data | 7.8 | 0.0017 | | | [CVE-2026-80779](https://patchblox.com/security/data/cve/CVE-2026-80779.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwsta... | 7.8 | 0.0017 | | | [CVE-2026-89500](https://patchblox.com/security/data/cve/CVE-2026-89500.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpu_buffer::free_page a buffer... | 7.8 | 0.0017 | | | [CVE-2026-89501](https://patchblox.com/security/data/cve/CVE-2026-89501.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpu_buffer::lock when resizing... | 7.8 | 0.0017 | | | [CVE-2026-89503](https://patchblox.com/security/data/cve/CVE-2026-89503.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring_bu... | 7.8 | 0.0017 | | | [CVE-2026-93212](https://patchblox.com/security/data/cve/CVE-2026-93212.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsd_serv deref in nfsd_file_net_dis... | 7.5 | 0.0017 | | | [CVE-2026-90428](https://patchblox.com/security/data/cve/CVE-2026-90428.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR be... | n/a | 0.0017 | | | [CVE-2026-93154](https://patchblox.com/security/data/cve/CVE-2026-93154.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Add refcounting to user ring MRs Pr... | 7.8 | 0.0017 | | | [CVE-2026-90308](https://patchblox.com/security/data/cve/CVE-2026-90308.md) | High | RDMA/erdma: Hold QP references for AE and CM processing | 7.8 | 0.0017 | | | [CVE-2026-64299](https://patchblox.com/security/data/cve/CVE-2026-64299.md) | High | tracing: Prevent out-of-bounds read in glob matching | 7.1 | 0.0017 | | | [CVE-2026-90240](https://patchblox.com/security/data/cve/CVE-2026-90240.md) | High | iommu/vt-d: Flush context cache with correct SID when tearing down aliases | 8.8 | 0.0016 | | | [CVE-2026-72383](https://patchblox.com/security/data/cve/CVE-2026-72383.md) | High | sctp: fix addr_wq_timer race in sctp_free_addr_wq() | 7.8 | 0.0016 | | | [CVE-2026-72404](https://patchblox.com/security/data/cve/CVE-2026-72404.md) | High | tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() | 7.8 | 0.0016 | | | [CVE-2026-81001](https://patchblox.com/security/data/cve/CVE-2026-81001.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in sl_sync() slip_devs... | 7.8 | 0.0016 | | | [CVE-2026-89789](https://patchblox.com/security/data/cve/CVE-2026-89789.md) | High | gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free | 7.8 | 0.0016 | | | [CVE-2026-90003](https://patchblox.com/security/data/cve/CVE-2026-90003.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: futex: Prevent rcuwait use-after-free during req... | 7.8 | 0.0016 | | | [CVE-2026-90142](https://patchblox.com/security/data/cve/CVE-2026-90142.md) | High | virtio_net: Fix resize of the RX ring | 7.8 | 0.0016 | | | [CVE-2026-90177](https://patchblox.com/security/data/cve/CVE-2026-90177.md) | High | bpf: Check pointer type for all atomic RMW paths | 7.8 | 0.0016 | | | [CVE-2026-90292](https://patchblox.com/security/data/cve/CVE-2026-90292.md) | High | RDMA/siw: Fix use-after-free in siw_accept() | 7.8 | 0.0016 | | | [CVE-2026-92525](https://patchblox.com/security/data/cve/CVE-2026-92525.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate num_sge/cur_sge before indexi... | 7.1 | 0.0016 | | | [CVE-2026-89690](https://patchblox.com/security/data/cve/CVE-2026-89690.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_sta... | 8.8 | 0.0016 | | | [CVE-2026-89545](https://patchblox.com/security/data/cve/CVE-2026-89545.md) | High | sunrpc: defer rq_argp and rq_resp free until after RCU grace period | 7.8 | 0.0016 | | | [CVE-2026-89747](https://patchblox.com/security/data/cve/CVE-2026-89747.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in trace_pipe read o... | 7.8 | 0.0016 | | | [CVE-2026-64324](https://patchblox.com/security/data/cve/CVE-2026-64324.md) | High | udf: validate free block extents against the partition length | 7.8 | 0.0016 | | | [CVE-2026-80865](https://patchblox.com/security/data/cve/CVE-2026-80865.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Add missing access_ok call to copy_user_sym... | n/a | 0.0016 | | | [CVE-2026-80880](https://patchblox.com/security/data/cve/CVE-2026-80880.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Properly support implicit ODP rereg_mr... | n/a | 0.0016 | | | [CVE-2026-89705](https://patchblox.com/security/data/cve/CVE-2026-89705.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rq_status_counter to even on all n... | 7.1 | 0.0016 | | | [CVE-2026-90243](https://patchblox.com/security/data/cve/CVE-2026-90243.md) | High | iommu/vt-d: Clear Present bit before tearing down copied context entry | 8.1 | 0.0016 | | | [CVE-2026-74465](https://patchblox.com/security/data/cve/CVE-2026-74465.md) | High | net: openvswitch: fix potential UAF on meter attach failure | 7.8 | 0.0015 | | | [CVE-2026-64009](https://patchblox.com/security/data/cve/CVE-2026-64009.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system | 7.8 | 0.0014 | | | [CVE-2026-97957](https://patchblox.com/security/data/cve/CVE-2026-97957.md) | High | net: hinic: fix mailbox segment buffer overflow | 8.8 | 0.0014 | | | [CVE-2026-89448](https://patchblox.com/security/data/cve/CVE-2026-89448.md) | High | iommu/vt-d: Force requesting ACS when tboot is enabled | 9.3 | 0.0014 | | | [CVE-2026-74492](https://patchblox.com/security/data/cve/CVE-2026-74492.md) | High | netfilter: ipset: do not update comments from kernel-side hash adds | 8.4 | 0.0014 | | | [CVE-2026-93827](https://patchblox.com/security/data/cve/CVE-2026-93827.md) | High | kernel: In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setu... | 9.8 | 0.0014 | | | [CVE-2026-64475](https://patchblox.com/security/data/cve/CVE-2026-64475.md) | High | vfio/pci: Release the VGA arbiter client on register_device() failure | 8.8 | 0.0014 | | | [CVE-2026-74739](https://patchblox.com/security/data/cve/CVE-2026-74739.md) | High | net/sched: cls_u32: skip hash tables in u32_bind_class() | 7.8 | 0.0014 | | | [CVE-2026-89564](https://patchblox.com/security/data/cve/CVE-2026-89564.md) | High | ip: orphan prefetched skbs before multicast forwarding | 7.8 | 0.0014 | | | [CVE-2026-74689](https://patchblox.com/security/data/cve/CVE-2026-74689.md) | High | net/atm: fix slab-out-of-bounds read in vcc_setsockopt() | 7.1 | 0.0014 | | | [CVE-2026-74713](https://patchblox.com/security/data/cve/CVE-2026-74713.md) | High | vhost_iotlb: bound map allocation in add_range | 7.1 | 0.0014 | | | [CVE-2026-68264](https://patchblox.com/security/data/cve/CVE-2026-68264.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Reset current_op in xe_pt_update_ops_... | 8.8 | 0.0014 | | | [CVE-2026-74631](https://patchblox.com/security/data/cve/CVE-2026-74631.md) | High | net: smc: fix splice entry lifetime imbalance in smc_rx_splice | 8.8 | 0.0014 | | | [CVE-2026-74589](https://patchblox.com/security/data/cve/CVE-2026-74589.md) | High | bpf, sockmap: Fix sk_redir use-after-free in send verdict | 8.4 | 0.0014 | | | [CVE-2026-80932](https://patchblox.com/security/data/cve/CVE-2026-80932.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order v... | 8.4 | 0.0014 | | | [CVE-2026-64422](https://patchblox.com/security/data/cve/CVE-2026-64422.md) | High | net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes | 7.1 | 0.0014 | | | [CVE-2026-74601](https://patchblox.com/security/data/cve/CVE-2026-74601.md) | High | ring-buffer: Use current_context for safe per-CPU buffer swap | 7.8 | 0.0014 | | | [CVE-2026-74667](https://patchblox.com/security/data/cve/CVE-2026-74667.md) | High | net/packet: reset the MAC header on the packet-socket transmit path | 7.8 | 0.0014 | | | [CVE-2026-68266](https://patchblox.com/security/data/cve/CVE-2026-68266.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Hold a dma-buf reference for imported BO... | 7.8 | 0.0014 | | | [CVE-2026-64388](https://patchblox.com/security/data/cve/CVE-2026-64388.md) | High | smb/client: fix chown/chgrp with SMB3 POSIX Extensions | 7.8 | 0.0013 | | | [CVE-2026-23352](https://patchblox.com/security/data/cve/CVE-2026-23352.md) | High | x86/efi: defer freeing of boot services memory | 7.1 | 0.0013 | | | [CVE-2026-68451](https://patchblox.com/security/data/cve/CVE-2026-68451.md) | High | s390/zcrypt: Validate length for CCA ECC private key requests | 8.8 | 0.0013 | | | [CVE-2026-80747](https://patchblox.com/security/data/cve/CVE-2026-80747.md) | High | drm/amdkfd: Add bounds check for CRAT subtype length | 8.0 | 0.0013 | | | [CVE-2026-74365](https://patchblox.com/security/data/cve/CVE-2026-74365.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquis... | 7.3 | 0.0013 | | | [CVE-2026-72012](https://patchblox.com/security/data/cve/CVE-2026-72012.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Call synchronize_rcu() when unr... | 7.8 | 0.0013 | | | [CVE-2026-68452](https://patchblox.com/security/data/cve/CVE-2026-68452.md) | High | s390/zcrypt: Validate length for CCA AES cipher key requests | 8.8 | 0.0013 | | | [CVE-2026-68454](https://patchblox.com/security/data/cve/CVE-2026-68454.md) | High | KVM: s390: pci: Fix handling of AIF enable without AISB | 8.8 | 0.0013 | | | [CVE-2026-74701](https://patchblox.com/security/data/cve/CVE-2026-74701.md) | High | net/openvswitch: check Ethernet header length in key_extract() | 7.8 | 0.0013 | | | [CVE-2026-89580](https://patchblox.com/security/data/cve/CVE-2026-89580.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in __bpf_get_stack get_... | 7.8 | 0.0013 | | | [CVE-2026-64154](https://patchblox.com/security/data/cve/CVE-2026-64154.md) | High | drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() | 7.1 | 0.0013 | | | [CVE-2026-74515](https://patchblox.com/security/data/cve/CVE-2026-74515.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Reject adapter interrupt forward... | 8.8 | 0.0013 | | | [CVE-2026-64377](https://patchblox.com/security/data/cve/CVE-2026-64377.md) | High | cpufreq: qcom-cpufreq-hw: Fix possible double free | 7.8 | 0.0013 | | | [CVE-2026-64402](https://patchblox.com/security/data/cve/CVE-2026-64402.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smb_sy... | 7.8 | 0.0013 | | | [CVE-2026-72444](https://patchblox.com/security/data/cve/CVE-2026-72444.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: flow_dissector: check device type before reading... | 7.8 | 0.0013 | | | [CVE-2026-74288](https://patchblox.com/security/data/cve/CVE-2026-74288.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: net: fib_rules: Don't dump dying fib_rule in fib... | 7.8 | 0.0013 | | | [CVE-2026-74330](https://patchblox.com/security/data/cve/CVE-2026-74330.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: configfs: fix lockless traversals of ->s_childre... | 7.8 | 0.0013 | | | [CVE-2026-74440](https://patchblox.com/security/data/cve/CVE-2026-74440.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exe... | 7.8 | 0.0013 | | | [CVE-2026-74449](https://patchblox.com/security/data/cve/CVE-2026-74449.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculate... | 7.8 | 0.0013 | | | [CVE-2026-74467](https://patchblox.com/security/data/cve/CVE-2026-74467.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAP_NET_ADMIN for private ioctl... | 7.8 | 0.0013 | | | [CVE-2026-74590](https://patchblox.com/security/data/cve/CVE-2026-74590.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fsverity: Fix bpf_get_fsverity_digest() dynptr a... | 7.8 | 0.0013 | | | [CVE-2026-74594](https://patchblox.com/security/data/cve/CVE-2026-74594.md) | High | sched/psi: Shut down rtpoll_timer in psi_cgroup_free() | 7.8 | 0.0013 | | | [CVE-2026-74605](https://patchblox.com/security/data/cve/CVE-2026-74605.md) | High | eventfs: Use children field for rcu head and add memory barriers | 7.8 | 0.0013 | | | [CVE-2026-74632](https://patchblox.com/security/data/cve/CVE-2026-74632.md) | High | mm/huge_memory: fix huge_zero_pfn race | 7.8 | 0.0013 | | | [CVE-2026-74663](https://patchblox.com/security/data/cve/CVE-2026-74663.md) | High | net/sched: reject overly deep qdisc hierarchies | 7.8 | 0.0013 | | | [CVE-2026-74666](https://patchblox.com/security/data/cve/CVE-2026-74666.md) | High | packet: synchronize pressure clearing with ring reconfiguration | 7.8 | 0.0013 | | | [CVE-2026-74710](https://patchblox.com/security/data/cve/CVE-2026-74710.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata A... | 7.8 | 0.0013 | | | [CVE-2026-80613](https://patchblox.com/security/data/cve/CVE-2026-80613.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: veth: fix NAPI leak in XDP enable error path Du... | 7.8 | 0.0013 | | | [CVE-2026-80979](https://patchblox.com/security/data/cve/CVE-2026-80979.md) | High | net/smc: unregister the connection before draining the rx tasklet | 7.8 | 0.0013 | | | [CVE-2026-89540](https://patchblox.com/security/data/cve/CVE-2026-89540.md) | High | sunrpc: init gssp_lock before publishing proc entry | 7.8 | 0.0013 | | | [CVE-2026-97421](https://patchblox.com/security/data/cve/CVE-2026-97421.md) | High | RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() | 7.8 | 0.0013 | | | [CVE-2026-68400](https://patchblox.com/security/data/cve/CVE-2026-68400.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix Endpoint Memory Access De... | 7.8 | 0.0013 | | | [CVE-2026-74630](https://patchblox.com/security/data/cve/CVE-2026-74630.md) | High | ipv6: prevent in6_dev_get() from resurrecting inet6_dev | 7.8 | 0.0013 | | | [CVE-2026-80664](https://patchblox.com/security/data/cve/CVE-2026-80664.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nat: reject unsupported target fam... | 7.3 | 0.0013 | | | [CVE-2026-64372](https://patchblox.com/security/data/cve/CVE-2026-64372.md) | High | cpufreq: pcc: fix use-after-free and double free in _OSC evaluation | 7.8 | 0.0013 | | | [CVE-2026-74257](https://patchblox.com/security/data/cve/CVE-2026-74257.md) | High | sockmap: Fix use-after-free in udp_bpf_recvmsg() | 7.8 | 0.0013 | | | [CVE-2026-74289](https://patchblox.com/security/data/cve/CVE-2026-74289.md) | High | ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). | 7.8 | 0.0013 | | | [CVE-2026-74359](https://patchblox.com/security/data/cve/CVE-2026-74359.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: configfs_lookup(): don't leave ->s_dentry dangli... | 7.8 | 0.0013 | | | [CVE-2026-74450](https://patchblox.com/security/data/cve/CVE-2026-74450.md) | High | drm/amd/pm: fix pptable use-after-free | 7.8 | 0.0013 | | | [CVE-2026-74471](https://patchblox.com/security/data/cve/CVE-2026-74471.md) | High | tracing: Check return value of __register_event() in trace_module_add_events() | 7.8 | 0.0013 | | | [CVE-2026-74609](https://patchblox.com/security/data/cve/CVE-2026-74609.md) | High | tipc: read le->link under the node lock in tipc_node_link_down() | 7.8 | 0.0013 | | | [CVE-2026-74637](https://patchblox.com/security/data/cve/CVE-2026-74637.md) | High | perf/core: Fix group leader use-after-free after sibling detach | 7.8 | 0.0013 | | | [CVE-2026-74660](https://patchblox.com/security/data/cve/CVE-2026-74660.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: ebt_nflog: pin the NFLOG backend nf_... | 7.8 | 0.0013 | | | [CVE-2026-74700](https://patchblox.com/security/data/cve/CVE-2026-74700.md) | High | net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers | 7.8 | 0.0013 | | | [CVE-2026-89508](https://patchblox.com/security/data/cve/CVE-2026-89508.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_set_ib_path(... | 7.8 | 0.0013 | | | [CVE-2026-89548](https://patchblox.com/security/data/cve/CVE-2026-89548.md) | High | SUNRPC: always drain cache_cleaner before destroying a cache_detail | 7.8 | 0.0013 | | | [CVE-2026-74726](https://patchblox.com/security/data/cve/CVE-2026-74726.md) | High | bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor | 7.3 | 0.0013 | | | [CVE-2026-74485](https://patchblox.com/security/data/cve/CVE-2026-74485.md) | High | binfmt_misc: reject a flag character as the field delimiter | 7.1 | 0.0013 | | | [CVE-2026-74603](https://patchblox.com/security/data/cve/CVE-2026-74603.md) | High | ptp: ocp: Fix board ID over-read | 7.1 | 0.0013 | | | [CVE-2026-89691](https://patchblox.com/security/data/cve/CVE-2026-89691.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to pre... | 8.1 | 0.0013 | | | [CVE-2026-64580](https://patchblox.com/security/data/cve/CVE-2026-64580.md) | High | xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() | 7.8 | 0.0013 | | | [CVE-2026-68290](https://patchblox.com/security/data/cve/CVE-2026-68290.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down... | 7.8 | 0.0013 | | | [CVE-2026-74606](https://patchblox.com/security/data/cve/CVE-2026-74606.md) | High | eventfs: Fix use-after-free in eventfs_remove_rec() | 7.8 | 0.0013 | | | [CVE-2026-74634](https://patchblox.com/security/data/cve/CVE-2026-74634.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when re... | 7.8 | 0.0013 | | | [CVE-2026-74725](https://patchblox.com/security/data/cve/CVE-2026-74725.md) | High | enic: fix tx_hang_reset use-after-free on device removal | 7.8 | 0.0013 | | | [CVE-2026-93782](https://patchblox.com/security/data/cve/CVE-2026-93782.md) | High | vhost-scsi: flush backend after device ioctls | 7.8 | 0.0012 | | | [CVE-2026-98030](https://patchblox.com/security/data/cve/CVE-2026-98030.md) | High | net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size | 7.8 | 0.0012 | | | [CVE-2026-93810](https://patchblox.com/security/data/cve/CVE-2026-93810.md) | High | cachefiles: Fix double fput | 7.8 | 0.0012 | | | [CVE-2026-98029](https://patchblox.com/security/data/cve/CVE-2026-98029.md) | High | eth: nfp: bound the ntuple rule dump by the caller's buffer size | 7.8 | 0.0012 | | | [CVE-2026-97520](https://patchblox.com/security/data/cve/CVE-2026-97520.md) | High | gfs2: move quota_init qc iterator increment | 7.1 | 0.0012 | | | [CVE-2026-74579](https://patchblox.com/security/data/cve/CVE-2026-74579.md) | High | netfilter: nft_payload: fix mask build for partial field offload | 7.1 | 0.0012 | | | [CVE-2026-64405](https://patchblox.com/security/data/cve/CVE-2026-64405.md) | High | Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() | 7.1 | 0.0012 | | | [CVE-2026-74564](https://patchblox.com/security/data/cve/CVE-2026-74564.md) | High | netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH | 7.1 | 0.0012 | | | [CVE-2026-68382](https://patchblox.com/security/data/cve/CVE-2026-68382.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown... | 7.8 | 0.0011 | | | [CVE-2026-64418](https://patchblox.com/security/data/cve/CVE-2026-64418.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix shrinker_info teardown race wi... | 8.8 | 0.0010 | | | [CVE-2026-74595](https://patchblox.com/security/data/cve/CVE-2026-74595.md) | High | fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() | 7.8 | 0.0009 | | | [CVE-2026-89603](https://patchblox.com/security/data/cve/CVE-2026-89603.md) | High | kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: s... | 9.8 | n/a | | | [CVE-2025-40136](https://patchblox.com/security/data/cve/CVE-2025-40136.md) | Routine | crypto: hisilicon/qm - request reserved interrupt for virtual function | 5.5 | 0.0025 | | | [CVE-2026-72321](https://patchblox.com/security/data/cve/CVE-2026-72321.md) | Routine | ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() | 3.1 | 0.0022 | | | [CVE-2026-89527](https://patchblox.com/security/data/cve/CVE-2026-89527.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svc_xprt_put to free listener on cr... | n/a | 0.0022 | | | [CVE-2026-72070](https://patchblox.com/security/data/cve/CVE-2026-72070.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: wifi: libertas_tf: fix use-after-free in lbtf_fr... | 5.5 | 0.0022 | | | [CVE-2026-72224](https://patchblox.com/security/data/cve/CVE-2026-72224.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Free arenas on btt_init() error path... | 5.5 | 0.0022 | | | [CVE-2026-72349](https://patchblox.com/security/data/cve/CVE-2026-72349.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_rateest: fix u64 truncation in xt_... | 5.5 | 0.0022 | | | [CVE-2026-72447](https://patchblox.com/security/data/cve/CVE-2026-72447.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in... | 5.5 | 0.0022 | | | [CVE-2026-90417](https://patchblox.com/security/data/cve/CVE-2026-90417.md) | Routine | RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() | 5.5 | 0.0022 | | | [CVE-2026-89673](https://patchblox.com/security/data/cve/CVE-2026-89673.md) | Routine | kernel-64kb: The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security issues we... | 5.3 | 0.0022 | | | [CVE-2026-72166](https://patchblox.com/security/data/cve/CVE-2026-72166.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/9p: fix infinite loop in p9_client_rpc on fa... | 5.5 | 0.0022 | | | [CVE-2026-72256](https://patchblox.com/security/data/cve/CVE-2026-72256.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_cluster: reject template conntrack... | 5.5 | 0.0022 | | | [CVE-2026-72392](https://patchblox.com/security/data/cve/CVE-2026-72392.md) | Routine | ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump | 5.5 | 0.0022 | | | [CVE-2026-72433](https://patchblox.com/security/data/cve/CVE-2026-72433.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIF... | 5.5 | 0.0022 | | | [CVE-2026-89784](https://patchblox.com/security/data/cve/CVE-2026-89784.md) | Routine | SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 | 5.5 | 0.0022 | | | [CVE-2026-90074](https://patchblox.com/security/data/cve/CVE-2026-90074.md) | Routine | net/sched: fq_pie: clamp default quantum to avoid signed overflow | 5.5 | 0.0022 | | | [CVE-2026-90218](https://patchblox.com/security/data/cve/CVE-2026-90218.md) | Routine | RDMA/cma: Fix WARNING in res_to_rt | 5.5 | 0.0022 | | | [CVE-2026-90307](https://patchblox.com/security/data/cve/CVE-2026-90307.md) | Routine | RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ | 5.5 | 0.0022 | | | [CVE-2026-97572](https://patchblox.com/security/data/cve/CVE-2026-97572.md) | Routine | bnxt_en: Propagate RX ring init failures in bnxt_init_nic() | 5.5 | 0.0022 | | | [CVE-2026-72025](https://patchblox.com/security/data/cve/CVE-2026-72025.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with differe... | n/a | 0.0022 | | | [CVE-2026-89780](https://patchblox.com/security/data/cve/CVE-2026-89780.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb->dev on deaggr... | n/a | 0.0022 | | | [CVE-2026-74735](https://patchblox.com/security/data/cve/CVE-2026-74735.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: l2tp: fix tunnel and session refcount leak on se... | 4.4 | 0.0022 | | | [CVE-2026-74386](https://patchblox.com/security/data/cve/CVE-2026-74386.md) | Routine | nvmet-tcp: fix page fragment cache leak in error path | 5.9 | 0.0021 | | | [CVE-2026-80847](https://patchblox.com/security/data/cve/CVE-2026-80847.md) | Routine | tcp: clamp route advmss to TCP_MIN_MSS | 5.5 | 0.0021 | | | [CVE-2026-90265](https://patchblox.com/security/data/cve/CVE-2026-90265.md) | Routine | btrfs: defrag: fix deadlock between defrag and delalloc space reservation | 5.5 | 0.0021 | | | [CVE-2026-97605](https://patchblox.com/security/data/cve/CVE-2026-97605.md) | Routine | erofs: preserve LZMA decoders on resize failure | 5.5 | 0.0021 | | | [CVE-2026-72413](https://patchblox.com/security/data/cve/CVE-2026-72413.md) | Routine | sctp: fix err_chunk memory leaks in INIT handling | 5.9 | 0.0021 | | | [CVE-2026-72237](https://patchblox.com/security/data/cve/CVE-2026-72237.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/brs: Fix kernel address leakage A... | 5.5 | 0.0021 | | | [CVE-2026-89539](https://patchblox.com/security/data/cve/CVE-2026-89539.md) | Routine | SUNRPC: reject duplicate CREDS_VALUE options | 4.4 | 0.0021 | | | [CVE-2026-72147](https://patchblox.com/security/data/cve/CVE-2026-72147.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma-pcie: Reject devices without... | n/a | 0.0021 | | | [CVE-2026-97934](https://patchblox.com/security/data/cve/CVE-2026-97934.md) | Routine | tracing: Fix memory corruption from a "STACKTRACE" histogram key | 6.7 | 0.0021 | | | [CVE-2026-89531](https://patchblox.com/security/data/cve/CVE-2026-89531.md) | Routine | svcrdma: Reject connection when transport allocation fails | 5.9 | 0.0021 | | | [CVE-2026-89798](https://patchblox.com/security/data/cve/CVE-2026-89798.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rn_done before publishing the notif... | 5.5 | 0.0021 | | | [CVE-2026-90182](https://patchblox.com/security/data/cve/CVE-2026-90182.md) | Routine | blk-iocost: clear delay state when freeing policy data | 5.5 | 0.0021 | | | [CVE-2026-89453](https://patchblox.com/security/data/cve/CVE-2026-89453.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR fau... | 4.4 | 0.0021 | | | [CVE-2026-97902](https://patchblox.com/security/data/cve/CVE-2026-97902.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: fs: don't return -EINVAL for successful nested t... | 3.4 | 0.0021 | | | [CVE-2026-68312](https://patchblox.com/security/data/cve/CVE-2026-68312.md) | Routine | cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths | 3.3 | 0.0021 | | | [CVE-2026-89698](https://patchblox.com/security/data/cve/CVE-2026-89698.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsd_genl_rqstp address fields to so... | 3.3 | 0.0021 | | | [CVE-2026-97545](https://patchblox.com/security/data/cve/CVE-2026-97545.md) | Routine | xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails | 3.0 | 0.0021 | | | [CVE-2026-80984](https://patchblox.com/security/data/cve/CVE-2026-80984.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer... | n/a | 0.0021 | | | [CVE-2026-90183](https://patchblox.com/security/data/cve/CVE-2026-90183.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing po... | n/a | 0.0021 | | | [CVE-2026-97574](https://patchblox.com/security/data/cve/CVE-2026-97574.md) | Routine | bnxt_en: Don't free the live ring's TPA state on queue restart failure | n/a | 0.0021 | | | [CVE-2026-97552](https://patchblox.com/security/data/cve/CVE-2026-97552.md) | Routine | xfs: initialise error in xfs_defer_finish_one() | 4.4 | 0.0020 | | | [CVE-2026-97543](https://patchblox.com/security/data/cve/CVE-2026-97543.md) | Routine | xfs: destroy seen inode bitmap when we fail to add a dirpath | 2.3 | 0.0020 | | | [CVE-2026-97544](https://patchblox.com/security/data/cve/CVE-2026-97544.md) | Routine | xfs: don't leak dqacct if rhashtable insertion fails | 2.3 | 0.0020 | | | [CVE-2026-97546](https://patchblox.com/security/data/cve/CVE-2026-97546.md) | Routine | xfs: don't spin forever on zero-length dirents when salvaging them | 2.3 | 0.0020 | | | [CVE-2026-90065](https://patchblox.com/security/data/cve/CVE-2026-90065.md) | Routine | net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure | n/a | 0.0020 | | | [CVE-2026-72128](https://patchblox.com/security/data/cve/CVE-2026-72128.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet: fix refcount leak in nvmet_sq_create() I... | n/a | 0.0020 | | | [CVE-2026-80846](https://patchblox.com/security/data/cve/CVE-2026-80846.md) | Routine | xfrm: drop ESP-in-TCP packets with no ingress device | 5.9 | 0.0020 | | | [CVE-2026-80848](https://patchblox.com/security/data/cve/CVE-2026-80848.md) | Routine | xfrm: espintcp: fix UAF during close | 5.9 | 0.0020 | | | [CVE-2026-80793](https://patchblox.com/security/data/cve/CVE-2026-80793.md) | Routine | ipv4: reject undersized MTUs in ip_do_fragment() | 5.5 | 0.0020 | | | [CVE-2026-63838](https://patchblox.com/security/data/cve/CVE-2026-63838.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ASoC: rsnd: Fix potential out-of-bounds access o... | n/a | 0.0019 | | | [CVE-2026-89525](https://patchblox.com/security/data/cve/CVE-2026-89525.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count... | 6.7 | 0.0018 | | | [CVE-2026-68367](https://patchblox.com/security/data/cve/CVE-2026-68367.md) | Routine | usb: gadget: f_tcm: synchronize delayed set_alt with teardown | 5.5 | 0.0018 | | | [CVE-2026-64476](https://patchblox.com/security/data/cve/CVE-2026-64476.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Latch disable_idle_d3 per device When... | 5.5 | 0.0018 | | | [CVE-2026-93110](https://patchblox.com/security/data/cve/CVE-2026-93110.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Wait for RCU callbacks before unloadi... | 6.4 | 0.0018 | | | [CVE-2026-74487](https://patchblox.com/security/data/cve/CVE-2026-74487.md) | Routine | binfmt_misc: restore write access when removing an entry | 5.5 | 0.0018 | | | [CVE-2026-74671](https://patchblox.com/security/data/cve/CVE-2026-74671.md) | Routine | ima: fix out-of-bounds read in xattr_verify() | 5.5 | 0.0018 | | | [CVE-2026-80679](https://patchblox.com/security/data/cve/CVE-2026-80679.md) | Routine | s390/dasd: Fix potential NULL pointer dereference | 5.5 | 0.0018 | | | [CVE-2026-93160](https://patchblox.com/security/data/cve/CVE-2026-93160.md) | Routine | crypto: atmel-ecc - reject hardware ECDH without a public key | 5.5 | 0.0018 | | | [CVE-2026-74694](https://patchblox.com/security/data/cve/CVE-2026-74694.md) | Routine | net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length | 4.4 | 0.0018 | | | [CVE-2026-80983](https://patchblox.com/security/data/cve/CVE-2026-80983.md) | Routine | net/smc: fix socket refcount leak in smc_switch_conns() | 2.5 | 0.0018 | | | [CVE-2026-64474](https://patchblox.com/security/data/cve/CVE-2026-64474.md) | Routine | vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc | 5.5 | 0.0018 | | | [CVE-2026-89683](https://patchblox.com/security/data/cve/CVE-2026-89683.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export fileh... | 6.5 | 0.0018 | | | [CVE-2026-64457](https://patchblox.com/security/data/cve/CVE-2026-64457.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: virtio_pci: fix vq info pointer lookup via wrong... | 5.5 | 0.0018 | | | [CVE-2026-97477](https://patchblox.com/security/data/cve/CVE-2026-97477.md) | Routine | RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() | 3.6 | 0.0017 | | | [CVE-2026-93800](https://patchblox.com/security/data/cve/CVE-2026-93800.md) | Routine | btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() | 6.7 | 0.0017 | | | [CVE-2026-74290](https://patchblox.com/security/data/cve/CVE-2026-74290.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flow: Dont expose folded kernel p... | 5.5 | 0.0017 | | | [CVE-2026-74600](https://patchblox.com/security/data/cve/CVE-2026-74600.md) | Routine | mm/page_table_check: skip special zero mappings | 5.5 | 0.0017 | | | [CVE-2026-74636](https://patchblox.com/security/data/cve/CVE-2026-74636.md) | Routine | tracing: Fix race between update_event_fields and, event_define_fields | 5.5 | 0.0017 | | | [CVE-2026-92523](https://patchblox.com/security/data/cve/CVE-2026-92523.md) | Routine | RDMA/nldev: validate dynamic counter attribute length | 5.5 | 0.0017 | | | [CVE-2026-93825](https://patchblox.com/security/data/cve/CVE-2026-93825.md) | Routine | spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() | 5.5 | 0.0017 | | | [CVE-2026-89644](https://patchblox.com/security/data/cve/CVE-2026-89644.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O w... | 3.3 | 0.0017 | | | [CVE-2026-74659](https://patchblox.com/security/data/cve/CVE-2026-74659.md) | Routine | net: bridge: mrp: fix uninitialised bytes on the wire | 2.3 | 0.0017 | | | [CVE-2026-74389](https://patchblox.com/security/data/cve/CVE-2026-74389.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix log flood after cmd_mbox failure... | n/a | 0.0017 | | | [CVE-2026-93829](https://patchblox.com/security/data/cve/CVE-2026-93829.md) | Routine | smb: client: fix races in cifsd thread creation | 6.7 | 0.0017 | | | [CVE-2026-93814](https://patchblox.com/security/data/cve/CVE-2026-93814.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: spi: core: Abort active target transfer on contr... | 6.4 | 0.0017 | | | [CVE-2026-74483](https://patchblox.com/security/data/cve/CVE-2026-74483.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't leak the user namespace when... | 5.5 | 0.0017 | | | [CVE-2026-74484](https://patchblox.com/security/data/cve/CVE-2026-74484.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't let an 'F' entry pin its own... | 5.5 | 0.0017 | | | [CVE-2026-74602](https://patchblox.com/security/data/cve/CVE-2026-74602.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Initialise reader page order in rb_... | 5.5 | 0.0017 | | | [CVE-2026-74718](https://patchblox.com/security/data/cve/CVE-2026-74718.md) | Routine | devlink: fix net namespace reference leak in reload | 5.5 | 0.0017 | | | [CVE-2026-98003](https://patchblox.com/security/data/cve/CVE-2026-98003.md) | Routine | iommu/amd: Do not reallocate GA log buffers on resume | 5.5 | 0.0017 | | | [CVE-2026-98028](https://patchblox.com/security/data/cve/CVE-2026-98028.md) | Routine | eth: nfp: drop the replaced rule from the list when reprogramming fails | 5.3 | 0.0017 | | | [CVE-2026-93794](https://patchblox.com/security/data/cve/CVE-2026-93794.md) | Routine | smb/client: flush dirty data before punching a hole | 3.3 | 0.0017 | | | [CVE-2026-74638](https://patchblox.com/security/data/cve/CVE-2026-74638.md) | Routine | drm/v3d: Serialize the scheduler timeout handlers | 4.7 | 0.0017 | | | [CVE-2026-80895](https://patchblox.com/security/data/cve/CVE-2026-80895.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: mshv: Order pt_vp_array publish against irqfd as... | n/a | 0.0017 | | | [CVE-2026-68441](https://patchblox.com/security/data/cve/CVE-2026-68441.md) | Routine | net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains | 4.4 | 0.0017 | | | [CVE-2026-80756](https://patchblox.com/security/data/cve/CVE-2026-80756.md) | Routine | selinux: do not cancel a policy conversion that never started | 4.4 | 0.0017 | | | [CVE-2026-64594](https://patchblox.com/security/data/cve/CVE-2026-64594.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: initialize reset_work at allo... | n/a | 0.0017 | | | [CVE-2026-64297](https://patchblox.com/security/data/cve/CVE-2026-64297.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of module... | 5.5 | 0.0016 | | | [CVE-2026-43272](https://patchblox.com/security/data/cve/CVE-2026-43272.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix possible dereference of uniniti... | 5.5 | 0.0016 | | | [CVE-2026-97521](https://patchblox.com/security/data/cve/CVE-2026-97521.md) | Routine | gfs2: fix quota init duplicate scan | 4.4 | 0.0016 | | | [CVE-2026-46196](https://patchblox.com/security/data/cve/CVE-2026-46196.md) | Routine | tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() | 5.5 | 0.0013 | | | [CVE-2026-43210](https://patchblox.com/security/data/cve/CVE-2026-43210.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: tracing: ring-buffer: Fix to check event length... | 6.1 | 0.0013 | | | [CVE-2026-45836](https://patchblox.com/security/data/cve/CVE-2026-45836.md) | Routine | Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() | 5.5 | 0.0013 | | | [CVE-2026-53377](https://patchblox.com/security/data/cve/CVE-2026-53377.md) | Routine | drm/msm: always recover the gpu | 5.5 | 0.0013 | | | [CVE-2026-64205](https://patchblox.com/security/data/cve/CVE-2026-64205.md) | Routine | i2c: i801: fix hardware state machine corruption in error path | 5.5 | 0.0013 | | | [CVE-2026-98091](https://patchblox.com/security/data/cve/CVE-2026-98091.md) | Routine | btrfs: detach failed sprout device from transaction update list | 6.7 | 0.0012 | | | [CVE-2026-46044](https://patchblox.com/security/data/cve/CVE-2026-46044.md) | Routine | kernel-uek-modules-extra: [5.15.0-323.211.3.3] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39853924] [5.1... | 5.5 | 0.0012 | | | [CVE-2026-43409](https://patchblox.com/security/data/cve/CVE-2026-43409.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: kprobes: avoid crash when rmmod/insmod after ftr... | 5.5 | 0.0012 | | | [CVE-2026-46272](https://patchblox.com/security/data/cve/CVE-2026-46272.md) | Routine | coresight: tmc-etr: Fix race condition between sysfs and perf mode | 4.7 | 0.0012 | | | [CVE-2026-64173](https://patchblox.com/security/data/cve/CVE-2026-64173.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: tracing: Do not call map->ops->elt_free() if elt... | 5.5 | 0.0011 | | | [CVE-2026-23199](https://patchblox.com/security/data/cve/CVE-2026-23199.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: procfs: avoid fetching build ID while holding VM... | 5.5 | 0.0010 | | --- Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.