# SUSE-SU-2026:5091-1: Security update for 10 packages SUSE-SU-2026:5091-1, released November 7, 2026, fixes 1,077 CVEs across 10 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/suse-su-2026-5091-1 - Platform: Linux - Released: Nov 7, 2026 - Priority: Urgent (Closes CVE-2026-74280, rated Critical) - CVEs: 1,077, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:5091-1 ## Applies to | Product | Release | Fixed in | |---|---|---| | [kernel-64kb](https://patchblox.com/security/data/product/linux/kernel-64kb.md) | sles 15.7 | 6.4.0-150700.53.90.1 | | [kernel-azure](https://patchblox.com/security/data/product/linux/kernel-azure.md) | sles 15.7 | 6.4.0-150700.53.90.1 | | [kernel-default](https://patchblox.com/security/data/product/linux/kernel-default.md) | sles 15.7 | 6.4.0-150700.53.90.1 | | [kernel-default-base](https://patchblox.com/security/data/product/linux/kernel-default-base.md) | sles 15.7 | 6.4.0-150700.53.90.1.150700.17.51.1 | | [kernel-docs](https://patchblox.com/security/data/product/linux/kernel-docs.md) | sles 15.7 | 6.4.0-150700.53.90.1 | | [kernel-livepatch-SLE15-SP7_Update_24](https://patchblox.com/security/data/product/linux/kernel-livepatch-sle15-sp7-update-24.md) | sles 15.7 | 1-150700.15.3.1 | | [kernel-obs-build](https://patchblox.com/security/data/product/linux/kernel-obs-build.md) | sles 15.7 | 6.4.0-150700.53.90.1 | | [kernel-source](https://patchblox.com/security/data/product/linux/kernel-source.md) | sles 15.7 | 6.4.0-150700.53.90.1 | | [kernel-syms](https://patchblox.com/security/data/product/linux/kernel-syms.md) | sles 15.7 | 6.4.0-150700.53.90.1 | | [kernel-zfcpdump](https://patchblox.com/security/data/product/linux/kernel-zfcpdump.md) | sles 15.7 | 6.4.0-150700.53.90.1 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-74280](https://patchblox.com/security/data/cve/CVE-2026-74280.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using... | 10.0 | 0.0076 | | | [CVE-2026-80600](https://patchblox.com/security/data/cve/CVE-2026-80600.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only afte... | 9.8 | 0.0073 | | | [CVE-2026-89847](https://patchblox.com/security/data/cve/CVE-2026-89847.md) | Urgent | scsi: qla2xxx: Avoid double completion in async IOCB timeout | 9.8 | 0.0069 | | | [CVE-2026-89654](https://patchblox.com/security/data/cve/CVE-2026-89654.md) | Urgent | kernel-64kb: ceph: fix UAF in check_new_map() on session freed during unlock (bsc#1280415). | 9.8 | 0.0064 | | | [CVE-2026-89637](https://patchblox.com/security/data/cve/CVE-2026-89637.md) | Urgent | kernel-64kb: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 (bsc#1280492). | 9.8 | 0.0060 | | | [CVE-2026-80637](https://patchblox.com/security/data/cve/CVE-2026-80637.md) | Urgent | netfilter: synproxy: fix unaligned memory access in timestamp adjustment | 9.8 | 0.0059 | | | [CVE-2026-64535](https://patchblox.com/security/data/cve/CVE-2026-64535.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch... | 9.8 | 0.0055 | | | [CVE-2026-72064](https://patchblox.com/security/data/cve/CVE-2026-72064.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA... | 9.8 | 0.0050 | | | [CVE-2026-90042](https://patchblox.com/security/data/cve/CVE-2026-90042.md) | Urgent | ceph: properly decrypt filenames in vmalloc() buffers | 9.8 | 0.0050 | | | [CVE-2026-52989](https://patchblox.com/security/data/cve/CVE-2026-52989.md) | Urgent | nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers | 9.8 | 0.0036 | | | [CVE-2026-64534](https://patchblox.com/security/data/cve/CVE-2026-64534.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_un... | 9.8 | 0.0032 | | | [CVE-2026-98339](https://patchblox.com/security/data/cve/CVE-2026-98339.md) | Urgent | wifi: cfg80211: don't filter by BSS type when removing stale entries | 9.8 | 0.0028 | | | [CVE-2026-98348](https://patchblox.com/security/data/cve/CVE-2026-98348.md) | Urgent | wifi: libipw: reject too-short association responses | 9.8 | 0.0025 | | | [CVE-2026-98209](https://patchblox.com/security/data/cve/CVE-2026-98209.md) | Urgent | mmc: sdhci-of-aspeed: Remove children before releasing SDC resources | 9.8 | 0.0022 | | | [CVE-2026-80698](https://patchblox.com/security/data/cve/CVE-2026-80698.md) | Urgent | dmaengine: idxd: fix double free of wq, engine, and group structs | 9.8 | 0.0022 | | | [CVE-2026-98212](https://patchblox.com/security/data/cve/CVE-2026-98212.md) | Urgent | mmc: hsq: Fix use-after-free in retry work | 9.8 | 0.0021 | | | [CVE-2026-98298](https://patchblox.com/security/data/cve/CVE-2026-98298.md) | Urgent | dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() | 9.8 | 0.0018 | | | [CVE-2026-98319](https://patchblox.com/security/data/cve/CVE-2026-98319.md) | Urgent | drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr | 9.8 | 0.0018 | | | [CVE-2026-98326](https://patchblox.com/security/data/cve/CVE-2026-98326.md) | Urgent | wifi: mac80211: mesh: release the channel if start fails | 9.8 | 0.0018 | | | [CVE-2026-98328](https://patchblox.com/security/data/cve/CVE-2026-98328.md) | Urgent | wifi: mac80211: add HE 6 GHz capability in the scan elems len | 9.8 | 0.0018 | | | [CVE-2025-71073](https://patchblox.com/security/data/cve/CVE-2025-71073.md) | Urgent | Input: lkkbd - disable pending work before freeing device | 9.8 | 0.0018 | | | [CVE-2026-98186](https://patchblox.com/security/data/cve/CVE-2026-98186.md) | Urgent | wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length | 9.8 | 0.0018 | | | [CVE-2026-98187](https://patchblox.com/security/data/cve/CVE-2026-98187.md) | Urgent | wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST | 9.8 | 0.0018 | | | [CVE-2026-98188](https://patchblox.com/security/data/cve/CVE-2026-98188.md) | Urgent | wifi: p54: validate curve data length in the calibration curve converters | 9.8 | 0.0018 | | | [CVE-2026-98191](https://patchblox.com/security/data/cve/CVE-2026-98191.md) | Urgent | wifi: wlcore: release runtime PM ref on regdomain config failure | 9.8 | 0.0018 | | | [CVE-2026-98203](https://patchblox.com/security/data/cve/CVE-2026-98203.md) | Urgent | Input: soc_button_array - check btns_desc->package.count | 9.8 | 0.0018 | | | [CVE-2026-98207](https://patchblox.com/security/data/cve/CVE-2026-98207.md) | Urgent | mmc: spi: reset bytes_xfered before retrying CRC failures | 9.8 | 0.0018 | | | [CVE-2026-98308](https://patchblox.com/security/data/cve/CVE-2026-98308.md) | Urgent | ALSA: hda: trace PCM open only after assigning a stream | 9.8 | 0.0018 | | | [CVE-2026-98340](https://patchblox.com/security/data/cve/CVE-2026-98340.md) | Urgent | wifi: cfg80211: only group hidden BSSes with beacon entries | 9.8 | 0.0018 | | | [CVE-2026-98345](https://patchblox.com/security/data/cve/CVE-2026-98345.md) | Urgent | wifi: cfg80211: check IP header size in cfg80211_classify8021d() | 9.8 | 0.0018 | | | [CVE-2026-98327](https://patchblox.com/security/data/cve/CVE-2026-98327.md) | Urgent | wifi: mac80211: mesh: reset the CSA state when leaving | 9.8 | 0.0018 | | | [CVE-2026-98335](https://patchblox.com/security/data/cve/CVE-2026-98335.md) | Urgent | wifi: mac80211: abort chanswitch when leaving a mesh | 9.8 | 0.0018 | | | [CVE-2026-98336](https://patchblox.com/security/data/cve/CVE-2026-98336.md) | Urgent | wifi: mac80211: don't offload TC setup on AP_VLAN interfaces | 9.8 | 0.0018 | | | [CVE-2026-98337](https://patchblox.com/security/data/cve/CVE-2026-98337.md) | Urgent | wifi: mac80211: don't start a ROC while scanning | 9.8 | 0.0018 | | | [CVE-2026-98181](https://patchblox.com/security/data/cve/CVE-2026-98181.md) | Urgent | drm/gud: fix out-of-bounds write in gud_plane_atomic_check() | 9.8 | 0.0017 | | | [CVE-2026-98221](https://patchblox.com/security/data/cve/CVE-2026-98221.md) | Urgent | KEYS: trusted: Fix tpm2_load_cmd() boundary check | 9.8 | 0.0017 | | | [CVE-2026-98238](https://patchblox.com/security/data/cve/CVE-2026-98238.md) | Urgent | net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() | 9.8 | 0.0017 | | | [CVE-2026-98249](https://patchblox.com/security/data/cve/CVE-2026-98249.md) | Urgent | arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc | 9.8 | 0.0017 | | | [CVE-2026-98316](https://patchblox.com/security/data/cve/CVE-2026-98316.md) | Urgent | ALSA: bcd2000: Fix race between rawmidi and disconnect | 9.8 | 0.0017 | | | [CVE-2026-98363](https://patchblox.com/security/data/cve/CVE-2026-98363.md) | Urgent | firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS | 9.8 | 0.0017 | | | [CVE-2026-98206](https://patchblox.com/security/data/cve/CVE-2026-98206.md) | Urgent | Input: cyttsp5 - clamp the HID report size before memcpy | 9.8 | 0.0017 | | | [CVE-2026-98222](https://patchblox.com/security/data/cve/CVE-2026-98222.md) | Urgent | KEYS: encrypted: fix integer overflow of datablob_len | 9.8 | 0.0017 | | | [CVE-2026-98263](https://patchblox.com/security/data/cve/CVE-2026-98263.md) | Urgent | ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type | 9.8 | 0.0017 | | | [CVE-2026-98270](https://patchblox.com/security/data/cve/CVE-2026-98270.md) | Urgent | drm/amdgpu: check ras and obj before dereference | 9.8 | 0.0017 | | | [CVE-2026-98295](https://patchblox.com/security/data/cve/CVE-2026-98295.md) | Urgent | Bluetooth: coredump: Quiesce dump work on unregister | 9.8 | 0.0017 | | | [CVE-2026-98329](https://patchblox.com/security/data/cve/CVE-2026-98329.md) | Urgent | wifi: mac80211: don't allow injecting frames wider than the chanctx | 9.8 | 0.0017 | | | [CVE-2026-98351](https://patchblox.com/security/data/cve/CVE-2026-98351.md) | Urgent | wifi: virt_wifi: free skb when disconnected | 9.8 | 0.0017 | | | [CVE-2026-98292](https://patchblox.com/security/data/cve/CVE-2026-98292.md) | Urgent | Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access | 9.8 | 0.0016 | | | [CVE-2026-98332](https://patchblox.com/security/data/cve/CVE-2026-98332.md) | Urgent | wifi: mac80211: only operate on TDLS peers in the TDLS code | 9.8 | 0.0016 | | | [CVE-2026-98353](https://patchblox.com/security/data/cve/CVE-2026-98353.md) | Urgent | RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables | 9.8 | 0.0015 | | | [CVE-2026-98311](https://patchblox.com/security/data/cve/CVE-2026-98311.md) | Urgent | wifi: virt_wifi: don't transfer operstate before register | 9.8 | 0.0014 | | | [CVE-2026-98331](https://patchblox.com/security/data/cve/CVE-2026-98331.md) | Urgent | wifi: mac80211: unlist vifs when their netdev is unregistered | 9.8 | 0.0013 | | | [CVE-2026-98368](https://patchblox.com/security/data/cve/CVE-2026-98368.md) | Urgent | esp: downgrade zerocopy managed frags before mutating skb frags | 9.8 | 0.0012 | | | [CVE-2026-98432](https://patchblox.com/security/data/cve/CVE-2026-98432.md) | High | ipv4: free inet_opt and ireq_opt after an RCU grace period | 9.8 | 0.0076 | | | [CVE-2026-74279](https://patchblox.com/security/data/cve/CVE-2026-74279.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 10.0 | 0.0076 | | | [CVE-2026-72226](https://patchblox.com/security/data/cve/CVE-2026-72226.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0076 | | | [CVE-2026-80609](https://patchblox.com/security/data/cve/CVE-2026-80609.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0074 | | | [CVE-2026-72234](https://patchblox.com/security/data/cve/CVE-2026-72234.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0073 | | | [CVE-2026-89537](https://patchblox.com/security/data/cve/CVE-2026-89537.md) | High | SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 | 9.1 | 0.0073 | | | [CVE-2026-72065](https://patchblox.com/security/data/cve/CVE-2026-72065.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0073 | | | [CVE-2026-89494](https://patchblox.com/security/data/cve/CVE-2026-89494.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0071 | | | [CVE-2026-89495](https://patchblox.com/security/data/cve/CVE-2026-89495.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0071 | | | [CVE-2026-89655](https://patchblox.com/security/data/cve/CVE-2026-89655.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0071 | | | [CVE-2026-89846](https://patchblox.com/security/data/cve/CVE-2026-89846.md) | High | kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] | 9.1 | 0.0071 | | | [CVE-2026-89786](https://patchblox.com/security/data/cve/CVE-2026-89786.md) | High | ext4: fix out-of-bounds read in ext4_read_inline_dir() | 9.1 | 0.0070 | | | [CVE-2026-72253](https://patchblox.com/security/data/cve/CVE-2026-72253.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.5 | 0.0070 | | | [CVE-2026-89669](https://patchblox.com/security/data/cve/CVE-2026-89669.md) | High | nfsd: initialize copy-notify stateid before publishing it | 9.8 | 0.0069 | | | [CVE-2026-72465](https://patchblox.com/security/data/cve/CVE-2026-72465.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.5 | 0.0068 | | | [CVE-2026-89863](https://patchblox.com/security/data/cve/CVE-2026-89863.md) | High | scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check | 7.5 | 0.0068 | | | [CVE-2026-89649](https://patchblox.com/security/data/cve/CVE-2026-89649.md) | High | ceph: bound xattr value length in __build_xattrs() | 9.1 | 0.0068 | | | [CVE-2026-72231](https://patchblox.com/security/data/cve/CVE-2026-72231.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.5 | 0.0068 | | | [CVE-2026-72464](https://patchblox.com/security/data/cve/CVE-2026-72464.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.5 | 0.0068 | | | [CVE-2026-72149](https://patchblox.com/security/data/cve/CVE-2026-72149.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra: Fix burst size calculation Cu... | 7.5 | 0.0065 | | | [CVE-2026-89857](https://patchblox.com/security/data/cve/CVE-2026-89857.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0062 | | | [CVE-2026-89657](https://patchblox.com/security/data/cve/CVE-2026-89657.md) | High | libceph: validate OSD extent maps before cursor advance | 7.5 | 0.0061 | | | [CVE-2026-89861](https://patchblox.com/security/data/cve/CVE-2026-89861.md) | High | scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() | 9.8 | 0.0059 | | | [CVE-2026-89848](https://patchblox.com/security/data/cve/CVE-2026-89848.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.1 | 0.0059 | | | [CVE-2026-72318](https://patchblox.com/security/data/cve/CVE-2026-72318.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.4 | 0.0059 | | | [CVE-2026-74746](https://patchblox.com/security/data/cve/CVE-2026-74746.md) | High | netfilter: flowtable: publish GC-visible tuple last | 9.8 | 0.0054 | | | [CVE-2026-74341](https://patchblox.com/security/data/cve/CVE-2026-74341.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.8 | 0.0053 | | | [CVE-2026-89706](https://patchblox.com/security/data/cve/CVE-2026-89706.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.2 | 0.0053 | | | [CVE-2026-68388](https://patchblox.com/security/data/cve/CVE-2026-68388.md) | High | smb/client: handle overlapping allocated ranges in fallocate | 9.8 | 0.0051 | | | [CVE-2026-89656](https://patchblox.com/security/data/cve/CVE-2026-89656.md) | High | libceph: reject buckets with mismatched CRUSH ids | 9.8 | 0.0051 | | | [CVE-2026-74287](https://patchblox.com/security/data/cve/CVE-2026-74287.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.1 | 0.0051 | | | [CVE-2026-89684](https://patchblox.com/security/data/cve/CVE-2026-89684.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0050 | | | [CVE-2026-93228](https://patchblox.com/security/data/cve/CVE-2026-93228.md) | High | svcrdma: Reject Write/Reply chunks with segcount 0 | 9.1 | 0.0050 | | | [CVE-2026-64430](https://patchblox.com/security/data/cve/CVE-2026-64430.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pci_irq_vector() from ha... | 7.5 | 0.0049 | | | [CVE-2026-74624](https://patchblox.com/security/data/cve/CVE-2026-74624.md) | High | netfilter: nf_conntrack: defer invalid log until after unlock | 7.5 | 0.0048 | | | [CVE-2026-74678](https://patchblox.com/security/data/cve/CVE-2026-74678.md) | High | net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() | 7.5 | 0.0048 | | | [CVE-2026-23112](https://patchblox.com/security/data/cve/CVE-2026-23112.md) | High | kernel-64kb: Security update for the Linux Kernel | 9.8 | 0.0048 | | | [CVE-2026-46155](https://patchblox.com/security/data/cve/CVE-2026-46155.md) | High | kernel-64kb: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720). | 9.1 | 0.0048 | | | [CVE-2026-90018](https://patchblox.com/security/data/cve/CVE-2026-90018.md) | High | staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() | 8.8 | 0.0045 | | | [CVE-2026-64380](https://patchblox.com/security/data/cve/CVE-2026-64380.md) | High | smb: client: harden POSIX SID length parsing | 8.2 | 0.0044 | | | [CVE-2026-97570](https://patchblox.com/security/data/cve/CVE-2026-97570.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.1 | 0.0044 | | | [CVE-2026-74340](https://patchblox.com/security/data/cve/CVE-2026-74340.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.1 | 0.0042 | | | [CVE-2026-74410](https://patchblox.com/security/data/cve/CVE-2026-74410.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.1 | 0.0042 | | | [CVE-2026-80599](https://patchblox.com/security/data/cve/CVE-2026-80599.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.1 | 0.0042 | | | [CVE-2026-90223](https://patchblox.com/security/data/cve/CVE-2026-90223.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.1 | 0.0041 | | | [CVE-2026-74408](https://patchblox.com/security/data/cve/CVE-2026-74408.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.8 | 0.0041 | | | [CVE-2026-74300](https://patchblox.com/security/data/cve/CVE-2026-74300.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.8 | 0.0040 | | | [CVE-2026-80635](https://patchblox.com/security/data/cve/CVE-2026-80635.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger B... | 8.8 | 0.0040 | | | [CVE-2026-89774](https://patchblox.com/security/data/cve/CVE-2026-89774.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_rea... | 8.8 | 0.0040 | | | [CVE-2026-80601](https://patchblox.com/security/data/cve/CVE-2026-80601.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.8 | 0.0040 | | | [CVE-2026-72029](https://patchblox.com/security/data/cve/CVE-2026-72029.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.8 | 0.0040 | | | [CVE-2026-74411](https://patchblox.com/security/data/cve/CVE-2026-74411.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.8 | 0.0040 | | | [CVE-2026-46135](https://patchblox.com/security/data/cve/CVE-2026-46135.md) | High | nvmet-tcp: fix race between ICReq handling and queue teardown | 9.8 | 0.0040 | | | [CVE-2026-72334](https://patchblox.com/security/data/cve/CVE-2026-72334.md) | High | kernel-uek64k-modules-core: Bluetooth: ISO: fix malformed ISO_END/CONT handling (Pauli Virtanen) [Orabug: 39885808] | 8.8 | 0.0040 | | | [CVE-2026-98499](https://patchblox.com/security/data/cve/CVE-2026-98499.md) | High | HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() | 8.1 | 0.0039 | | | [CVE-2026-89999](https://patchblox.com/security/data/cve/CVE-2026-89999.md) | High | HID: wacom: validate report length in wacom_intuos_pro2_bt_irq | 8.1 | 0.0037 | | | [CVE-2026-80914](https://patchblox.com/security/data/cve/CVE-2026-80914.md) | High | Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready | 8.8 | 0.0037 | | | [CVE-2026-89849](https://patchblox.com/security/data/cve/CVE-2026-89849.md) | High | scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path | 8.8 | 0.0036 | | | [CVE-2026-90092](https://patchblox.com/security/data/cve/CVE-2026-90092.md) | High | Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN | 8.0 | 0.0036 | | | [CVE-2026-90372](https://patchblox.com/security/data/cve/CVE-2026-90372.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.1 | 0.0036 | | | [CVE-2026-90017](https://patchblox.com/security/data/cve/CVE-2026-90017.md) | High | staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() | 7.1 | 0.0036 | | | [CVE-2026-90224](https://patchblox.com/security/data/cve/CVE-2026-90224.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.5 | 0.0036 | | | [CVE-2026-89729](https://patchblox.com/security/data/cve/CVE-2026-89729.md) | High | HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature | 8.8 | 0.0036 | | | [CVE-2026-89626](https://patchblox.com/security/data/cve/CVE-2026-89626.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.8 | 0.0035 | | | [CVE-2026-89951](https://patchblox.com/security/data/cve/CVE-2026-89951.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.8 | 0.0035 | | | [CVE-2026-90000](https://patchblox.com/security/data/cve/CVE-2026-90000.md) | High | HID: rmi: fix OOB access with undersized RMI reports | 8.8 | 0.0035 | | | [CVE-2026-31708](https://patchblox.com/security/data/cve/CVE-2026-31708.md) | High | smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path | 8.1 | 0.0035 | | | [CVE-2026-80989](https://patchblox.com/security/data/cve/CVE-2026-80989.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0035 | | | [CVE-2026-80937](https://patchblox.com/security/data/cve/CVE-2026-80937.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.8 | 0.0035 | | | [CVE-2026-89860](https://patchblox.com/security/data/cve/CVE-2026-89860.md) | High | scsi: qla2xxx: Initialize NVMe abort_work once at submission | 8.8 | 0.0035 | | | [CVE-2026-31709](https://patchblox.com/security/data/cve/CVE-2026-31709.md) | High | smb: client: validate the whole DACL before rewriting it in cifsacl | 8.8 | 0.0035 | | | [CVE-2026-72233](https://patchblox.com/security/data/cve/CVE-2026-72233.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.8 | 0.0034 | | | [CVE-2026-97527](https://patchblox.com/security/data/cve/CVE-2026-97527.md) | High | scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock | 8.8 | 0.0034 | | | [CVE-2026-97528](https://patchblox.com/security/data/cve/CVE-2026-97528.md) | High | scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error | 8.8 | 0.0034 | | | [CVE-2026-90357](https://patchblox.com/security/data/cve/CVE-2026-90357.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.8 | 0.0034 | | | [CVE-2026-72148](https://patchblox.com/security/data/cve/CVE-2026-72148.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Add spinlock to protect DONE... | 8.8 | 0.0034 | | | [CVE-2026-89844](https://patchblox.com/security/data/cve/CVE-2026-89844.md) | High | scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition | 8.8 | 0.0034 | | | [CVE-2026-64435](https://patchblox.com/security/data/cve/CVE-2026-64435.md) | High | audit: Fix data races of skb_queue_len() readers on audit_queue | 8.2 | 0.0033 | | | [CVE-2026-80707](https://patchblox.com/security/data/cve/CVE-2026-80707.md) | High | can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer | 7.5 | 0.0033 | | | [CVE-2026-80717](https://patchblox.com/security/data/cve/CVE-2026-80717.md) | High | sctp: validate Adaptation Indication parameter length | 7.5 | 0.0033 | | | [CVE-2026-43350](https://patchblox.com/security/data/cve/CVE-2026-43350.md) | High | kernel-64kb: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985). | 7.6 | 0.0032 | | | [CVE-2026-93189](https://patchblox.com/security/data/cve/CVE-2026-93189.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0032 | | | [CVE-2026-89897](https://patchblox.com/security/data/cve/CVE-2026-89897.md) | High | media: cec: Serialize exclusive follower delivery | 7.8 | 0.0031 | | | [CVE-2026-97531](https://patchblox.com/security/data/cve/CVE-2026-97531.md) | High | scsi: qla2xxx: Skip vport under deletion in report ID acquisition | 7.5 | 0.0030 | | | [CVE-2026-97536](https://patchblox.com/security/data/cve/CVE-2026-97536.md) | High | scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown | 7.8 | 0.0030 | | | [CVE-2026-98374](https://patchblox.com/security/data/cve/CVE-2026-98374.md) | High | tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() | 8.8 | 0.0029 | | | [CVE-2026-74649](https://patchblox.com/security/data/cve/CVE-2026-74649.md) | High | staging: rtl8723bs: fix missing shared-key auth challenge length check | 8.8 | 0.0029 | | | [CVE-2023-7356](https://patchblox.com/security/data/cve/CVE-2023-7356.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.8 | 0.0029 | | | [CVE-2024-49974](https://patchblox.com/security/data/cve/CVE-2024-49974.md) | High | kernel-64kb: NFSD: Force all NFSv4.2 COPY requests to be synchronous (bsc#1232383). | 7.5 | 0.0028 | | | [CVE-2026-74651](https://patchblox.com/security/data/cve/CVE-2026-74651.md) | High | staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() | 8.1 | 0.0027 | | | [CVE-2026-89524](https://patchblox.com/security/data/cve/CVE-2026-89524.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.1 | 0.0027 | | | [CVE-2026-89583](https://patchblox.com/security/data/cve/CVE-2026-89583.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0027 | | | [CVE-2026-74508](https://patchblox.com/security/data/cve/CVE-2026-74508.md) | High | Bluetooth: HIDP: reject frames without a transaction header | 8.8 | 0.0026 | | | [CVE-2026-89725](https://patchblox.com/security/data/cve/CVE-2026-89725.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.8 | 0.0026 | | | [CVE-2026-98501](https://patchblox.com/security/data/cve/CVE-2026-98501.md) | High | HID: alps: fix use-after-free on input2 registration failure | 7.1 | 0.0026 | | | [CVE-2026-64441](https://patchblox.com/security/data/cve/CVE-2026-64441.md) | High | staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() | 8.8 | 0.0026 | | | [CVE-2026-64434](https://patchblox.com/security/data/cve/CVE-2026-64434.md) | High | Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref | 8.8 | 0.0026 | | | [CVE-2026-74691](https://patchblox.com/security/data/cve/CVE-2026-74691.md) | High | net: thunderbolt: Tear down DMA paths before stopping the rings | 8.8 | 0.0026 | | | [CVE-2026-80692](https://patchblox.com/security/data/cve/CVE-2026-80692.md) | High | Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks | 8.8 | 0.0026 | | | [CVE-2026-93793](https://patchblox.com/security/data/cve/CVE-2026-93793.md) | High | wifi: iwlwifi: mvm: validate TX_CMD response layout | 8.8 | 0.0026 | | | [CVE-2026-74531](https://patchblox.com/security/data/cve/CVE-2026-74531.md) | High | Bluetooth: hci_conn: hold conn reference in abort_conn_sync() | 8.8 | 0.0025 | | | [CVE-2026-93790](https://patchblox.com/security/data/cve/CVE-2026-93790.md) | High | wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif | 8.8 | 0.0025 | | | [CVE-2026-97442](https://patchblox.com/security/data/cve/CVE-2026-97442.md) | High | wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi | 8.8 | 0.0025 | | | [CVE-2026-98349](https://patchblox.com/security/data/cve/CVE-2026-98349.md) | High | wifi: libipw: reject too-short beacon and probe responses | 7.1 | 0.0025 | | | [CVE-2026-98108](https://patchblox.com/security/data/cve/CVE-2026-98108.md) | High | Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan | 8.8 | 0.0024 | | | [CVE-2026-74507](https://patchblox.com/security/data/cve/CVE-2026-74507.md) | High | Bluetooth: HIDP: validate numbered report payloads | 7.1 | 0.0024 | | | [CVE-2026-93799](https://patchblox.com/security/data/cve/CVE-2026-93799.md) | High | wifi: iwlwifi: mvm: validate sta_id in BA window status notif | 8.8 | 0.0024 | | | [CVE-2026-97509](https://patchblox.com/security/data/cve/CVE-2026-97509.md) | High | thunderbolt: Keep XDomain reference during the lifetime of a service | 8.8 | 0.0024 | | | [CVE-2026-98290](https://patchblox.com/security/data/cve/CVE-2026-98290.md) | High | Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup | 7.5 | 0.0024 | | | [CVE-2026-80798](https://patchblox.com/security/data/cve/CVE-2026-80798.md) | High | nfc: llcp: reject PDUs shorter than the LLCP header | 8.1 | 0.0023 | | | [CVE-2026-80800](https://patchblox.com/security/data/cve/CVE-2026-80800.md) | High | nfc: llcp: bound the connect_sn TLV walk to the skb | 8.1 | 0.0023 | | | [CVE-2026-89859](https://patchblox.com/security/data/cve/CVE-2026-89859.md) | High | scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak | 7.1 | 0.0023 | | | [CVE-2026-93242](https://patchblox.com/security/data/cve/CVE-2026-93242.md) | High | scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() | 8.8 | 0.0023 | | | [CVE-2026-64507](https://patchblox.com/security/data/cve/CVE-2026-64507.md) | High | x86/bugs: Enable IBPB flush on BPF JIT allocation | 7.8 | 0.0023 | | | [CVE-2026-99094](https://patchblox.com/security/data/cve/CVE-2026-99094.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.5 | 0.0023 | | | [CVE-2026-97508](https://patchblox.com/security/data/cve/CVE-2026-97508.md) | High | thunderbolt: Set tb->root_switch to NULL when domain is stopped | 9.8 | 0.0023 | | | [CVE-2026-93141](https://patchblox.com/security/data/cve/CVE-2026-93141.md) | High | usb: gadget: r8a66597: avoid double free of ep0_req in probe error path | 7.8 | 0.0022 | | | [CVE-2026-97537](https://patchblox.com/security/data/cve/CVE-2026-97537.md) | High | scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking | 7.8 | 0.0022 | | | [CVE-2026-97529](https://patchblox.com/security/data/cve/CVE-2026-97529.md) | High | scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] | 7.1 | 0.0022 | | | [CVE-2026-89952](https://patchblox.com/security/data/cve/CVE-2026-89952.md) | High | mtd: rawnand: validate ONFI extended parameter page sections | 8.1 | 0.0022 | | | [CVE-2026-98602](https://patchblox.com/security/data/cve/CVE-2026-98602.md) | High | Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough | 8.1 | 0.0022 | | | [CVE-2026-68186](https://patchblox.com/security/data/cve/CVE-2026-68186.md) | High | binfmt_misc: set have_execfd only once the interpreter is opened | 7.8 | 0.0022 | | | [CVE-2026-89853](https://patchblox.com/security/data/cve/CVE-2026-89853.md) | High | scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump | 7.8 | 0.0022 | | | [CVE-2026-89864](https://patchblox.com/security/data/cve/CVE-2026-89864.md) | High | scsi: qla2xxx: Bound i2c->length in I2C bsg handlers | 7.8 | 0.0022 | | | [CVE-2026-90284](https://patchblox.com/security/data/cve/CVE-2026-90284.md) | High | firmware_loader: do not queue completed sysfs fallback requests | 7.8 | 0.0022 | | | [CVE-2026-90334](https://patchblox.com/security/data/cve/CVE-2026-90334.md) | High | tty: clear cdev pointer after cdev_add() failure | 7.8 | 0.0022 | | | [CVE-2026-92496](https://patchblox.com/security/data/cve/CVE-2026-92496.md) | High | wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() | 7.8 | 0.0022 | | | [CVE-2026-89843](https://patchblox.com/security/data/cve/CVE-2026-89843.md) | High | scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak | 7.1 | 0.0022 | | | [CVE-2026-89845](https://patchblox.com/security/data/cve/CVE-2026-89845.md) | High | scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() | 7.1 | 0.0022 | | | [CVE-2026-89852](https://patchblox.com/security/data/cve/CVE-2026-89852.md) | High | scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() | 7.1 | 0.0022 | | | [CVE-2026-89858](https://patchblox.com/security/data/cve/CVE-2026-89858.md) | High | scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() | 7.1 | 0.0022 | | | [CVE-2026-89878](https://patchblox.com/security/data/cve/CVE-2026-89878.md) | High | media: s2255: check firmware size before reading trailing marker | 7.1 | 0.0022 | | | [CVE-2026-89891](https://patchblox.com/security/data/cve/CVE-2026-89891.md) | High | media: em28xx: fix use-after-free of dev_next->devlist on disconnect | 7.1 | 0.0022 | | | [CVE-2026-89892](https://patchblox.com/security/data/cve/CVE-2026-89892.md) | High | media: em28xx: defer audio-only extension registration | 7.1 | 0.0022 | | | [CVE-2026-89948](https://patchblox.com/security/data/cve/CVE-2026-89948.md) | High | batman-adv: bla: fix freeing of claims on meshif deletion | 7.1 | 0.0022 | | | [CVE-2026-90126](https://patchblox.com/security/data/cve/CVE-2026-90126.md) | High | rtc: pcf8563: fix clock provider leak on unbind | 7.1 | 0.0022 | | | [CVE-2026-90362](https://patchblox.com/security/data/cve/CVE-2026-90362.md) | High | drm/msm/dsi: Drop dev_pm_opp_set_rate(0) | 7.1 | 0.0022 | | | [CVE-2026-98581](https://patchblox.com/security/data/cve/CVE-2026-98581.md) | High | nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() | 7.1 | 0.0022 | | | [CVE-2026-89461](https://patchblox.com/security/data/cve/CVE-2026-89461.md) | High | power: supply: max17040: synchronize work cancellation on suspend | 7.0 | 0.0022 | | | [CVE-2026-89876](https://patchblox.com/security/data/cve/CVE-2026-89876.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.0 | 0.0022 | | | [CVE-2026-89945](https://patchblox.com/security/data/cve/CVE-2026-89945.md) | High | ASoC: cs35l34: drain threaded IRQ before runtime suspend | 7.0 | 0.0022 | | | [CVE-2026-74271](https://patchblox.com/security/data/cve/CVE-2026-74271.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.0 | 0.0022 | | | [CVE-2026-72274](https://patchblox.com/security/data/cve/CVE-2026-72274.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fbdev: hecubafb: fix potential memory leak in he... | n/a | 0.0022 | | | [CVE-2026-72275](https://patchblox.com/security/data/cve/CVE-2026-72275.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fbdev: broadsheetfb: fix potential memory leak i... | n/a | 0.0022 | | | [CVE-2026-72276](https://patchblox.com/security/data/cve/CVE-2026-72276.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: fbdev: metronomefb: fix potential memory leak in... | n/a | 0.0022 | | | [CVE-2026-72290](https://patchblox.com/security/data/cve/CVE-2026-72290.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix GISC refcount leak on AIF en... | n/a | 0.0022 | | | [CVE-2026-80602](https://patchblox.com/security/data/cve/CVE-2026-80602.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A... | n/a | 0.0022 | | | [CVE-2026-90335](https://patchblox.com/security/data/cve/CVE-2026-90335.md) | High | kernel-64kb: Security update for the Linux Kernel | n/a | 0.0022 | | | [CVE-2026-90336](https://patchblox.com/security/data/cve/CVE-2026-90336.md) | High | kernel-64kb: Security update for the Linux Kernel | n/a | 0.0022 | | | [CVE-2026-93063](https://patchblox.com/security/data/cve/CVE-2026-93063.md) | High | wifi: iwlwifi: mei: check SAP message length before reading it | 8.4 | 0.0021 | | | [CVE-2026-97535](https://patchblox.com/security/data/cve/CVE-2026-97535.md) | High | scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size | 7.8 | 0.0021 | | | [CVE-2026-89787](https://patchblox.com/security/data/cve/CVE-2026-89787.md) | High | ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() | 7.8 | 0.0021 | | | [CVE-2026-90253](https://patchblox.com/security/data/cve/CVE-2026-90253.md) | High | Bluetooth: MGMT: free the mesh send cancel command when it is cancelled | 7.8 | 0.0021 | | | [CVE-2026-97540](https://patchblox.com/security/data/cve/CVE-2026-97540.md) | High | net: usb: pegasus: don't rely on id table pointer arithmetic | 7.8 | 0.0021 | | | [CVE-2026-89817](https://patchblox.com/security/data/cve/CVE-2026-89817.md) | High | drm/gud: NUL-terminate TV mode names read from the device | 7.1 | 0.0021 | | | [CVE-2026-89939](https://patchblox.com/security/data/cve/CVE-2026-89939.md) | High | iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable | 7.1 | 0.0021 | | | [CVE-2026-90394](https://patchblox.com/security/data/cve/CVE-2026-90394.md) | High | power: supply: sc2731_charger: cancel work on remove | 7.1 | 0.0021 | | | [CVE-2026-93062](https://patchblox.com/security/data/cve/CVE-2026-93062.md) | High | wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments | 7.1 | 0.0021 | | | [CVE-2026-97539](https://patchblox.com/security/data/cve/CVE-2026-97539.md) | High | usb: xusbatm: don't rely on id table pointer arithmetic | 7.1 | 0.0021 | | | [CVE-2026-97604](https://patchblox.com/security/data/cve/CVE-2026-97604.md) | High | fbdev: vfb: defer cleanup until the last reference | 7.1 | 0.0021 | | | [CVE-2026-98213](https://patchblox.com/security/data/cve/CVE-2026-98213.md) | High | mmc: core: Cancel SDIO IRQ work before freeing host | 7.1 | 0.0021 | | | [CVE-2026-89983](https://patchblox.com/security/data/cve/CVE-2026-89983.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.0 | 0.0021 | | | [CVE-2026-93161](https://patchblox.com/security/data/cve/CVE-2026-93161.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.0 | 0.0021 | | | [CVE-2026-93185](https://patchblox.com/security/data/cve/CVE-2026-93185.md) | High | ASoC: rt700-sdw: always drain jack work on remove | 7.0 | 0.0021 | | | [CVE-2026-90222](https://patchblox.com/security/data/cve/CVE-2026-90222.md) | High | nfc: pn533: hold a reference to the request skb during send_frame | 7.8 | 0.0021 | | | [CVE-2026-97582](https://patchblox.com/security/data/cve/CVE-2026-97582.md) | High | hwmon: (gpio-fan) Fix use-after-free in alarm work | 7.8 | 0.0021 | | | [CVE-2026-90226](https://patchblox.com/security/data/cve/CVE-2026-90226.md) | High | nfc: llcp: avoid userspace overflow on invalid optlen | 7.1 | 0.0021 | | | [CVE-2026-90298](https://patchblox.com/security/data/cve/CVE-2026-90298.md) | High | drm/sun4i: tcon: Drop TCON TOP device reference | 7.1 | 0.0021 | | | [CVE-2026-90319](https://patchblox.com/security/data/cve/CVE-2026-90319.md) | High | rapidio: clear mport->net when rio_add_net() fails | 7.1 | 0.0021 | | | [CVE-2026-72361](https://patchblox.com/security/data/cve/CVE-2026-72361.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.0 | 0.0021 | | | [CVE-2026-72443](https://patchblox.com/security/data/cve/CVE-2026-72443.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.0 | 0.0021 | | | [CVE-2026-89842](https://patchblox.com/security/data/cve/CVE-2026-89842.md) | High | scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started | 8.1 | 0.0021 | | | [CVE-2026-90385](https://patchblox.com/security/data/cve/CVE-2026-90385.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0021 | | | [CVE-2026-89874](https://patchblox.com/security/data/cve/CVE-2026-89874.md) | High | media: v4l2-async: avoid deleting unlinked ASC entry on link error | 7.1 | 0.0021 | | | [CVE-2026-89944](https://patchblox.com/security/data/cve/CVE-2026-89944.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.0 | 0.0021 | | | [CVE-2026-90404](https://patchblox.com/security/data/cve/CVE-2026-90404.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.0 | 0.0021 | | | [CVE-2026-92506](https://patchblox.com/security/data/cve/CVE-2026-92506.md) | High | firmware: arm_scmi: Fix requested device removal race | 7.8 | 0.0021 | | | [CVE-2026-93117](https://patchblox.com/security/data/cve/CVE-2026-93117.md) | High | usb: fix UAF when probe runs concurrent to dyn ID removal | 7.8 | 0.0021 | | | [CVE-2026-97581](https://patchblox.com/security/data/cve/CVE-2026-97581.md) | High | media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity | 7.8 | 0.0021 | | | [CVE-2026-93086](https://patchblox.com/security/data/cve/CVE-2026-93086.md) | High | firmware: arm_scmi: Avoid IDR updates while cleaning channels | 7.1 | 0.0021 | | | [CVE-2026-97599](https://patchblox.com/security/data/cve/CVE-2026-97599.md) | High | ieee802154: hwsim: serialize pib updates to fix double-free | 7.1 | 0.0021 | | | [CVE-2026-90352](https://patchblox.com/security/data/cve/CVE-2026-90352.md) | High | wifi: mt76: mt7915: release hif2 reference on probe IRQ failure | 7.0 | 0.0021 | | | [CVE-2026-89802](https://patchblox.com/security/data/cve/CVE-2026-89802.md) | High | drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op | 7.8 | 0.0020 | | | [CVE-2026-90373](https://patchblox.com/security/data/cve/CVE-2026-90373.md) | High | wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear | 7.8 | 0.0020 | | | [CVE-2026-93271](https://patchblox.com/security/data/cve/CVE-2026-93271.md) | High | wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate | 7.5 | 0.0020 | | | [CVE-2026-90031](https://patchblox.com/security/data/cve/CVE-2026-90031.md) | High | usb-storage: ene_ub6250: fix race between scan work and probe | 7.1 | 0.0020 | | | [CVE-2026-90033](https://patchblox.com/security/data/cve/CVE-2026-90033.md) | High | ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() | 7.1 | 0.0020 | | | [CVE-2026-90374](https://patchblox.com/security/data/cve/CVE-2026-90374.md) | High | wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] | 7.1 | 0.0020 | | | [CVE-2026-93188](https://patchblox.com/security/data/cve/CVE-2026-93188.md) | High | HID: roccat: bound device-supplied profile index | 7.1 | 0.0020 | | | [CVE-2026-93162](https://patchblox.com/security/data/cve/CVE-2026-93162.md) | High | crypto: qat - cancel work on re-enable SR-IOV timeout | 7.8 | 0.0020 | | | [CVE-2026-93156](https://patchblox.com/security/data/cve/CVE-2026-93156.md) | High | crypto: rk3288 - fail ahash requests on HASH idle timeout | 7.1 | 0.0020 | | | [CVE-2026-97907](https://patchblox.com/security/data/cve/CVE-2026-97907.md) | High | Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 | 7.1 | 0.0020 | | | [CVE-2026-98737](https://patchblox.com/security/data/cve/CVE-2026-98737.md) | High | Bluetooth: hci_sync: Fix inquiry cache use-after-free | 7.1 | 0.0020 | | | [CVE-2026-74439](https://patchblox.com/security/data/cve/CVE-2026-74439.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.3 | 0.0020 | | | [CVE-2026-80593](https://patchblox.com/security/data/cve/CVE-2026-80593.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.4 | 0.0020 | | | [CVE-2026-80824](https://patchblox.com/security/data/cve/CVE-2026-80824.md) | High | usb: usbfs: fix use-after-free of usb_device in usbdev_release() | 8.8 | 0.0020 | | | [CVE-2026-80803](https://patchblox.com/security/data/cve/CVE-2026-80803.md) | High | nfc: digital: clamp SENSF_RES length to the destination buffer | 8.1 | 0.0020 | | | [CVE-2026-80823](https://patchblox.com/security/data/cve/CVE-2026-80823.md) | High | nfc: st21nfca: validate ATR_REQ length against the received frame | 8.1 | 0.0020 | | | [CVE-2026-80819](https://patchblox.com/security/data/cve/CVE-2026-80819.md) | High | Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept | 7.8 | 0.0020 | | | [CVE-2026-80767](https://patchblox.com/security/data/cve/CVE-2026-80767.md) | High | HID: sensor: custom: Fix use-after-free in enable_sensor | 7.0 | 0.0020 | | | [CVE-2026-80808](https://patchblox.com/security/data/cve/CVE-2026-80808.md) | High | ext4: stop retrying saturated xattr cache entries | 7.0 | 0.0020 | | | [CVE-2026-72483](https://patchblox.com/security/data/cve/CVE-2026-72483.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in m... | 7.8 | 0.0019 | | | [CVE-2026-72284](https://patchblox.com/security/data/cve/CVE-2026-72284.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.1 | 0.0019 | | | [CVE-2026-72489](https://patchblox.com/security/data/cve/CVE-2026-72489.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec_rx_com... | 8.4 | 0.0019 | | | [CVE-2026-64508](https://patchblox.com/security/data/cve/CVE-2026-64508.md) | High | bpf: Support for hardening against JIT spraying | 7.8 | 0.0019 | | | [CVE-2026-74404](https://patchblox.com/security/data/cve/CVE-2026-74404.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0019 | | | [CVE-2026-89862](https://patchblox.com/security/data/cve/CVE-2026-89862.md) | High | scsi: qla2xxx: Fix BSG job leak on validate flash image error path | 7.1 | 0.0019 | | | [CVE-2026-80967](https://patchblox.com/security/data/cve/CVE-2026-80967.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.4 | 0.0019 | | | [CVE-2026-90399](https://patchblox.com/security/data/cve/CVE-2026-90399.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.4 | 0.0019 | | | [CVE-2026-90035](https://patchblox.com/security/data/cve/CVE-2026-90035.md) | High | drm/amd/display: fix division by zero in get_estimated_bw() | 7.5 | 0.0019 | | | [CVE-2026-81017](https://patchblox.com/security/data/cve/CVE-2026-81017.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.4 | 0.0019 | | | [CVE-2026-89856](https://patchblox.com/security/data/cve/CVE-2026-89856.md) | High | scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation | 8.4 | 0.0019 | | | [CVE-2026-89877](https://patchblox.com/security/data/cve/CVE-2026-89877.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.4 | 0.0019 | | | [CVE-2026-89980](https://patchblox.com/security/data/cve/CVE-2026-89980.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.4 | 0.0019 | | | [CVE-2026-97425](https://patchblox.com/security/data/cve/CVE-2026-97425.md) | High | drm/amdgpu: fix buffer overflow during vBIOS update | 7.8 | 0.0019 | | | [CVE-2026-97427](https://patchblox.com/security/data/cve/CVE-2026-97427.md) | High | drm/amd/pm: bound pp_dpm_set_pp_table() memcpy | 7.8 | 0.0019 | | | [CVE-2026-93165](https://patchblox.com/security/data/cve/CVE-2026-93165.md) | High | platform/chrome: sensorhub: Fix memory overread in ring handler | 7.7 | 0.0019 | | | [CVE-2026-98457](https://patchblox.com/security/data/cve/CVE-2026-98457.md) | High | Bluetooth: L2CAP: validate frame length before control and FCS access | 7.1 | 0.0018 | | | [CVE-2026-72133](https://patchblox.com/security/data/cve/CVE-2026-72133.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: Fix completion initialization ord... | 8.4 | 0.0018 | | | [CVE-2026-90407](https://patchblox.com/security/data/cve/CVE-2026-90407.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.7 | 0.0018 | | | [CVE-2026-89927](https://patchblox.com/security/data/cve/CVE-2026-89927.md) | High | KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock | 7.8 | 0.0018 | | | [CVE-2026-90137](https://patchblox.com/security/data/cve/CVE-2026-90137.md) | High | kernel-uek64k-modules-core: platform/x86: hp-bioscfg: fix password encoding bounds check (Guangshuo Li) [Orabug: 40041618] | 7.7 | 0.0018 | | | [CVE-2026-98190](https://patchblox.com/security/data/cve/CVE-2026-98190.md) | High | wifi: wilc1000: fix out-of-bounds read in P2P public action frames | 8.2 | 0.0018 | | | [CVE-2026-72302](https://patchblox.com/security/data/cve/CVE-2026-72302.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0018 | | | [CVE-2026-80965](https://patchblox.com/security/data/cve/CVE-2026-80965.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0018 | | | [CVE-2026-93067](https://patchblox.com/security/data/cve/CVE-2026-93067.md) | High | drm/bridge: tc358767: clamp the reported AUX read size to the request | 7.8 | 0.0018 | | | [CVE-2026-98342](https://patchblox.com/security/data/cve/CVE-2026-98342.md) | High | dmaengine: wait for RCU readers before releasing dma_device | 7.8 | 0.0018 | | | [CVE-2026-98343](https://patchblox.com/security/data/cve/CVE-2026-98343.md) | High | dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() | 7.8 | 0.0018 | | | [CVE-2026-98735](https://patchblox.com/security/data/cve/CVE-2026-98735.md) | High | Bluetooth: hci_core: Serialize ACL scheduling with channel deletion | 7.5 | 0.0018 | | | [CVE-2025-38237](https://patchblox.com/security/data/cve/CVE-2025-38237.md) | High | media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() | 7.1 | 0.0018 | | | [CVE-2026-98189](https://patchblox.com/security/data/cve/CVE-2026-98189.md) | High | wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() | 7.1 | 0.0018 | | | [CVE-2026-98201](https://patchblox.com/security/data/cve/CVE-2026-98201.md) | High | Input: zero ff_effect before compat copy in input_ff_effect_from_user | 7.1 | 0.0018 | | | [CVE-2026-98204](https://patchblox.com/security/data/cve/CVE-2026-98204.md) | High | Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() | 7.1 | 0.0018 | | | [CVE-2026-98208](https://patchblox.com/security/data/cve/CVE-2026-98208.md) | High | mmc: sdio_uart: fix xmit_fifo leak when the port table is full | 7.1 | 0.0018 | | | [CVE-2026-98210](https://patchblox.com/security/data/cve/CVE-2026-98210.md) | High | mmc: mxcmmc: cancel data work and watchdog on remove | 7.1 | 0.0018 | | | [CVE-2026-98460](https://patchblox.com/security/data/cve/CVE-2026-98460.md) | High | Bluetooth: hci_sock: reject out-of-range OCF values | 7.1 | 0.0018 | | | [CVE-2026-74498](https://patchblox.com/security/data/cve/CVE-2026-74498.md) | High | ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set | 7.0 | 0.0018 | | | [CVE-2026-74499](https://patchblox.com/security/data/cve/CVE-2026-74499.md) | High | ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() | 7.0 | 0.0018 | | | [CVE-2026-74682](https://patchblox.com/security/data/cve/CVE-2026-74682.md) | High | ALSA: usb-audio: fix OOB write on Type II inbound URBs | 7.0 | 0.0018 | | | [CVE-2026-92521](https://patchblox.com/security/data/cve/CVE-2026-92521.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.0 | 0.0018 | | | [CVE-2026-98066](https://patchblox.com/security/data/cve/CVE-2026-98066.md) | High | ALSA: caiaq: Fix potential double-free at error path | 7.0 | 0.0018 | | | [CVE-2026-93056](https://patchblox.com/security/data/cve/CVE-2026-93056.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | n/a | 0.0018 | | | [CVE-2026-98933](https://patchblox.com/security/data/cve/CVE-2026-98933.md) | High | kernel-64kb: Security update for the Linux Kernel | n/a | 0.0018 | | | [CVE-2026-72111](https://patchblox.com/security/data/cve/CVE-2026-72111.md) | High | kernel-uek64k-modules-core: bpf: Reset register bounds before narrowing retval range in check_mem_access() (Tristan Madani) | 8.8 | 0.0018 | | | [CVE-2026-74380](https://patchblox.com/security/data/cve/CVE-2026-74380.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.8 | 0.0018 | | | [CVE-2026-90286](https://patchblox.com/security/data/cve/CVE-2026-90286.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.8 | 0.0018 | | | [CVE-2026-98687](https://patchblox.com/security/data/cve/CVE-2026-98687.md) | High | thunderbolt: Reject oversized XDomain properties responses | 8.1 | 0.0018 | | | [CVE-2026-72314](https://patchblox.com/security/data/cve/CVE-2026-72314.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0018 | | | [CVE-2026-72480](https://patchblox.com/security/data/cve/CVE-2026-72480.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-ams: fix out-of-bounds channel... | 7.8 | 0.0018 | | | [CVE-2026-74293](https://patchblox.com/security/data/cve/CVE-2026-74293.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl: fsl_audmix: Validate written enum val... | 7.8 | 0.0018 | | | [CVE-2026-74417](https://patchblox.com/security/data/cve/CVE-2026-74417.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0018 | | | [CVE-2026-80649](https://patchblox.com/security/data/cve/CVE-2026-80649.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix OOB in scmi_power_name_g... | 7.8 | 0.0018 | | | [CVE-2026-80677](https://patchblox.com/security/data/cve/CVE-2026-80677.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0018 | | | [CVE-2026-90093](https://patchblox.com/security/data/cve/CVE-2026-90093.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0018 | | | [CVE-2026-90225](https://patchblox.com/security/data/cve/CVE-2026-90225.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0018 | | | [CVE-2026-93122](https://patchblox.com/security/data/cve/CVE-2026-93122.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0018 | | | [CVE-2026-93170](https://patchblox.com/security/data/cve/CVE-2026-93170.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0018 | | | [CVE-2026-52968](https://patchblox.com/security/data/cve/CVE-2026-52968.md) | High | KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic | 7.1 | 0.0018 | | | [CVE-2026-98706](https://patchblox.com/security/data/cve/CVE-2026-98706.md) | High | wifi: mac80211: drain PS delivery work during station teardown | 7.1 | 0.0018 | | | [CVE-2026-72286](https://patchblox.com/security/data/cve/CVE-2026-72286.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.8 | 0.0018 | | | [CVE-2026-72452](https://patchblox.com/security/data/cve/CVE-2026-72452.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0018 | | | [CVE-2026-89825](https://patchblox.com/security/data/cve/CVE-2026-89825.md) | High | drm/panthor: fix firmware control interface bounds checks | 7.8 | 0.0018 | | | [CVE-2026-98309](https://patchblox.com/security/data/cve/CVE-2026-98309.md) | High | drm/vc4: Use managed KMS polling to fix UAF on unbind | 7.8 | 0.0018 | | | [CVE-2026-98293](https://patchblox.com/security/data/cve/CVE-2026-98293.md) | High | Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() | 7.1 | 0.0018 | | | [CVE-2026-72416](https://patchblox.com/security/data/cve/CVE-2026-72416.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.3 | 0.0017 | | | [CVE-2026-98915](https://patchblox.com/security/data/cve/CVE-2026-98915.md) | High | media: video-i2c: use vb2_video_unregister_device on driver removal | 7.1 | 0.0017 | | | [CVE-2026-80539](https://patchblox.com/security/data/cve/CVE-2026-80539.md) | High | drm/amdgpu: disallow multiple FENCE chunks in one submit | 7.8 | 0.0017 | | | [CVE-2026-89598](https://patchblox.com/security/data/cve/CVE-2026-89598.md) | High | fbdev: ssd1307fb: defer I2C transfers from damage callbacks | 7.8 | 0.0017 | | | [CVE-2026-93064](https://patchblox.com/security/data/cve/CVE-2026-93064.md) | High | wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser | 7.8 | 0.0017 | | | [CVE-2026-97492](https://patchblox.com/security/data/cve/CVE-2026-97492.md) | High | wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed | 7.8 | 0.0017 | | | [CVE-2026-93092](https://patchblox.com/security/data/cve/CVE-2026-93092.md) | High | firmware: arm_scmi: Unregister device notifier before IDR teardown | 7.1 | 0.0017 | | | [CVE-2026-93783](https://patchblox.com/security/data/cve/CVE-2026-93783.md) | High | Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame | 7.1 | 0.0017 | | | [CVE-2026-93803](https://patchblox.com/security/data/cve/CVE-2026-93803.md) | High | wifi: libipw: fix key index receive bound checks | 7.1 | 0.0017 | | | [CVE-2026-98236](https://patchblox.com/security/data/cve/CVE-2026-98236.md) | High | net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value | 7.1 | 0.0017 | | | [CVE-2026-98246](https://patchblox.com/security/data/cve/CVE-2026-98246.md) | High | Bluetooth: hci_sync: Serialize local codec list cleanup | 7.1 | 0.0017 | | | [CVE-2026-98264](https://patchblox.com/security/data/cve/CVE-2026-98264.md) | High | ALSA: virtio: reset device before deleting virtqueues | 7.1 | 0.0017 | | | [CVE-2026-74472](https://patchblox.com/security/data/cve/CVE-2026-74472.md) | High | kernel-uek64k-modules-core: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() (Ming Lei) | 7.0 | 0.0017 | | | [CVE-2026-80764](https://patchblox.com/security/data/cve/CVE-2026-80764.md) | High | Bluetooth: hci_event: fix LE list UAF on reset | 7.0 | 0.0017 | | | [CVE-2026-80964](https://patchblox.com/security/data/cve/CVE-2026-80964.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.0 | 0.0017 | | | [CVE-2026-93802](https://patchblox.com/security/data/cve/CVE-2026-93802.md) | High | wifi: rsi: validate beacon length before fixed buffer copy | 7.0 | 0.0017 | | | [CVE-2026-97430](https://patchblox.com/security/data/cve/CVE-2026-97430.md) | High | xhci: Prevent queuing new commands if xhci is inaccessible | 7.0 | 0.0017 | | | [CVE-2026-90025](https://patchblox.com/security/data/cve/CVE-2026-90025.md) | High | usb: typec: ucsi: displayport: Fix OOB altmode array index | 7.7 | 0.0017 | | | [CVE-2026-98736](https://patchblox.com/security/data/cve/CVE-2026-98736.md) | High | Bluetooth: hci_conn: Lock parent access during enhanced SCO setup | 7.1 | 0.0017 | | | [CVE-2026-97447](https://patchblox.com/security/data/cve/CVE-2026-97447.md) | High | kernel-uek64k-modules-core: ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (Kang Chen) [Orabug: 40073657] | 7.0 | 0.0017 | | | [CVE-2026-98733](https://patchblox.com/security/data/cve/CVE-2026-98733.md) | High | Bluetooth: hci_core: Serialize fragmented ISO packet queueing | 7.0 | 0.0017 | | | [CVE-2026-72360](https://patchblox.com/security/data/cve/CVE-2026-72360.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.4 | 0.0017 | | | [CVE-2026-72126](https://patchblox.com/security/data/cve/CVE-2026-72126.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-72335](https://patchblox.com/security/data/cve/CVE-2026-72335.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-72476](https://patchblox.com/security/data/cve/CVE-2026-72476.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-74387](https://patchblox.com/security/data/cve/CVE-2026-74387.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-80622](https://patchblox.com/security/data/cve/CVE-2026-80622.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-90044](https://patchblox.com/security/data/cve/CVE-2026-90044.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0017 | | | [CVE-2026-90045](https://patchblox.com/security/data/cve/CVE-2026-90045.md) | High | USB: gadget: ffs: fix mm lifetime handling | 7.8 | 0.0017 | | | [CVE-2026-89938](https://patchblox.com/security/data/cve/CVE-2026-89938.md) | High | iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF | 7.8 | 0.0017 | | | [CVE-2026-89932](https://patchblox.com/security/data/cve/CVE-2026-89932.md) | High | KVM: nVMX: Always flush vpid02 on first use | 9.8 | 0.0017 | | | [CVE-2026-72261](https://patchblox.com/security/data/cve/CVE-2026-72261.md) | High | kernel: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] | 8.3 | 0.0017 | | | [CVE-2026-89894](https://patchblox.com/security/data/cve/CVE-2026-89894.md) | High | media: cx231xx: reject geometry changes while the VBI queue is busy | 8.1 | 0.0017 | | | [CVE-2026-68479](https://patchblox.com/security/data/cve/CVE-2026-68479.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-72105](https://patchblox.com/security/data/cve/CVE-2026-72105.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-72110](https://patchblox.com/security/data/cve/CVE-2026-72110.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-72120](https://patchblox.com/security/data/cve/CVE-2026-72120.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-72250](https://patchblox.com/security/data/cve/CVE-2026-72250.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-89440](https://patchblox.com/security/data/cve/CVE-2026-89440.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-89597](https://patchblox.com/security/data/cve/CVE-2026-89597.md) | High | fbdev: uvesafb: unregister connector callback on init failure | 7.8 | 0.0017 | | | [CVE-2026-89724](https://patchblox.com/security/data/cve/CVE-2026-89724.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0017 | | | [CVE-2026-89733](https://patchblox.com/security/data/cve/CVE-2026-89733.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0017 | | | [CVE-2026-89741](https://patchblox.com/security/data/cve/CVE-2026-89741.md) | High | Revert "media: v4l2-dev: fix error handling in __video_register_device()" | 7.8 | 0.0017 | | | [CVE-2026-89823](https://patchblox.com/security/data/cve/CVE-2026-89823.md) | High | drm: fix race between partial drm_dev_register() failure and ioctl | 7.8 | 0.0017 | | | [CVE-2026-89870](https://patchblox.com/security/data/cve/CVE-2026-89870.md) | High | media: zoran: Avoid freeing a registered video_device twice | 7.8 | 0.0017 | | | [CVE-2026-89880](https://patchblox.com/security/data/cve/CVE-2026-89880.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-89883](https://patchblox.com/security/data/cve/CVE-2026-89883.md) | High | media: rc: sunxi-cir: Unregister rc device on probe failure | 7.8 | 0.0017 | | | [CVE-2026-89887](https://patchblox.com/security/data/cve/CVE-2026-89887.md) | High | media: i2c: ov7740: fix use-after-destroy in remove | 7.8 | 0.0017 | | | [CVE-2026-89890](https://patchblox.com/security/data/cve/CVE-2026-89890.md) | High | media: go7007: defer the ALSA v4l2 put until card release | 7.8 | 0.0017 | | | [CVE-2026-89893](https://patchblox.com/security/data/cve/CVE-2026-89893.md) | High | media: cx23885: cancel NetUP CI work before teardown | 7.8 | 0.0017 | | | [CVE-2026-89979](https://patchblox.com/security/data/cve/CVE-2026-89979.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-90316](https://patchblox.com/security/data/cve/CVE-2026-90316.md) | High | kernel-uek64k-modules-core: drm/omap: dsi: Do not copy isr table (Andreas Kemnade) [Orabug: 40042210] | 7.8 | 0.0017 | | | [CVE-2026-98515](https://patchblox.com/security/data/cve/CVE-2026-98515.md) | High | drm/nouveau: fix double-free in nvif_vmm_dtor | 7.8 | 0.0017 | | | [CVE-2026-98889](https://patchblox.com/security/data/cve/CVE-2026-98889.md) | High | wifi: iwlwifi: mvm: fix sched scan IE sizing | 7.8 | 0.0017 | | | [CVE-2026-90227](https://patchblox.com/security/data/cve/CVE-2026-90227.md) | High | nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() | 8.8 | 0.0017 | | | [CVE-2026-93190](https://patchblox.com/security/data/cve/CVE-2026-93190.md) | High | platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count | 8.4 | 0.0017 | | | [CVE-2026-80887](https://patchblox.com/security/data/cve/CVE-2026-80887.md) | High | drm/vmwgfx: use check_add_overflow for shader size+offset bound | 8.1 | 0.0017 | | | [CVE-2026-80825](https://patchblox.com/security/data/cve/CVE-2026-80825.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-89442](https://patchblox.com/security/data/cve/CVE-2026-89442.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0017 | | | [CVE-2026-93823](https://patchblox.com/security/data/cve/CVE-2026-93823.md) | High | drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl | 7.8 | 0.0017 | | | [CVE-2026-97494](https://patchblox.com/security/data/cve/CVE-2026-97494.md) | High | drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw | 7.8 | 0.0017 | | | [CVE-2026-98107](https://patchblox.com/security/data/cve/CVE-2026-98107.md) | High | Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect | 7.8 | 0.0017 | | | [CVE-2026-93792](https://patchblox.com/security/data/cve/CVE-2026-93792.md) | High | wifi: iwlwifi: mvm: fix a possible underflow | 7.5 | 0.0017 | | | [CVE-2026-90366](https://patchblox.com/security/data/cve/CVE-2026-90366.md) | High | wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV | 7.1 | 0.0017 | | | [CVE-2026-98044](https://patchblox.com/security/data/cve/CVE-2026-98044.md) | High | bpf: Reject legacy packet loads from callbacks | 7.1 | 0.0017 | | | [CVE-2026-98218](https://patchblox.com/security/data/cve/CVE-2026-98218.md) | High | i2c: atr: fix dangling adapter pointer on add failure | 7.1 | 0.0017 | | | [CVE-2026-98781](https://patchblox.com/security/data/cve/CVE-2026-98781.md) | High | drm/mediatek: Fix pdev reference leak in mtk_drm_bind() | 7.1 | 0.0017 | | | [CVE-2026-98782](https://patchblox.com/security/data/cve/CVE-2026-98782.md) | High | drm/mediatek: Fix ovl adaptor platform device leak | 7.1 | 0.0017 | | | [CVE-2026-74501](https://patchblox.com/security/data/cve/CVE-2026-74501.md) | High | ALSA: usb-audio: fix use-after-free in ump_to_endpoint() | 7.0 | 0.0017 | | | [CVE-2026-74502](https://patchblox.com/security/data/cve/CVE-2026-74502.md) | High | kernel-uek64k-modules-core: ALSA: ump: fix double free of out_cvts on rawmidi error (Baul Lee) | 7.0 | 0.0017 | | | [CVE-2026-74677](https://patchblox.com/security/data/cve/CVE-2026-74677.md) | High | net: usb: ipheth: fix carrier_work UAF on disconnect | 7.0 | 0.0017 | | | [CVE-2026-74292](https://patchblox.com/security/data/cve/CVE-2026-74292.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ASoC: tegra: tegra210_ahub: Validate written enu... | 7.1 | 0.0017 | | | [CVE-2026-74295](https://patchblox.com/security/data/cve/CVE-2026-74295.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.1 | 0.0017 | | | [CVE-2026-53179](https://patchblox.com/security/data/cve/CVE-2026-53179.md) | High | staging: rtl8723bs: fix buffer over-read in rtw_update_protection | 7.1 | 0.0017 | | | [CVE-2026-72089](https://patchblox.com/security/data/cve/CVE-2026-72089.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smalle... | 7.1 | 0.0017 | | | [CVE-2026-80908](https://patchblox.com/security/data/cve/CVE-2026-80908.md) | High | drm/amdgpu: Reject UVD message with dimensions above 4096 | 7.8 | 0.0017 | | | [CVE-2026-80573](https://patchblox.com/security/data/cve/CVE-2026-80573.md) | High | Input: iforce - validate input packet lengths | 7.5 | 0.0017 | | | [CVE-2026-90207](https://patchblox.com/security/data/cve/CVE-2026-90207.md) | High | kernel-uek64k-modules-core: ALSA: seq: midi: Serialize input teardown with event_input (John Keeping) [Orabug: 40041851] | 8.8 | 0.0016 | | | [CVE-2026-72005](https://patchblox.com/security/data/cve/CVE-2026-72005.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0016 | | | [CVE-2026-72165](https://patchblox.com/security/data/cve/CVE-2026-72165.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0016 | | | [CVE-2026-72171](https://patchblox.com/security/data/cve/CVE-2026-72171.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mtd: slram: remove failed entries from the devic... | 7.8 | 0.0016 | | | [CVE-2026-80971](https://patchblox.com/security/data/cve/CVE-2026-80971.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0016 | | | [CVE-2026-81008](https://patchblox.com/security/data/cve/CVE-2026-81008.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0016 | | | [CVE-2026-89622](https://patchblox.com/security/data/cve/CVE-2026-89622.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0016 | | | [CVE-2026-89742](https://patchblox.com/security/data/cve/CVE-2026-89742.md) | High | rapidio: mport_cdev: fix use-after-free in dma_req_free() | 7.8 | 0.0016 | | | [CVE-2026-89803](https://patchblox.com/security/data/cve/CVE-2026-89803.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0016 | | | [CVE-2026-89854](https://patchblox.com/security/data/cve/CVE-2026-89854.md) | High | scsi: qla2xxx: Fix cs84xx use-after-free on host teardown | 7.8 | 0.0016 | | | [CVE-2026-89888](https://patchblox.com/security/data/cve/CVE-2026-89888.md) | High | media: i2c: ov02a10: fix endpoint parsing use-after-free | 7.8 | 0.0016 | | | [CVE-2026-97576](https://patchblox.com/security/data/cve/CVE-2026-97576.md) | High | media: v4l2-ctrls: validate HEVC tile counts | 7.8 | 0.0016 | | | [CVE-2026-98517](https://patchblox.com/security/data/cve/CVE-2026-98517.md) | High | drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM | 7.8 | 0.0016 | | | [CVE-2026-99006](https://patchblox.com/security/data/cve/CVE-2026-99006.md) | High | drm/i915/gem: Prevent overstepping exec array boundary | 7.8 | 0.0016 | | | [CVE-2026-72122](https://patchblox.com/security/data/cve/CVE-2026-72122.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.3 | 0.0016 | | | [CVE-2026-93177](https://patchblox.com/security/data/cve/CVE-2026-93177.md) | High | drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup | 7.3 | 0.0016 | | | [CVE-2026-89608](https://patchblox.com/security/data/cve/CVE-2026-89608.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.1 | 0.0016 | | | [CVE-2026-93178](https://patchblox.com/security/data/cve/CVE-2026-93178.md) | High | drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup | 7.1 | 0.0016 | | | [CVE-2026-72304](https://patchblox.com/security/data/cve/CVE-2026-72304.md) | High | kernel-uek: ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0016 | | | [CVE-2026-89819](https://patchblox.com/security/data/cve/CVE-2026-89819.md) | High | drm/amd/display: validate plane degamma LUT size for private color prop | 7.8 | 0.0016 | | | [CVE-2026-97575](https://patchblox.com/security/data/cve/CVE-2026-97575.md) | High | media: v4l2-ctrls: validate AV1 tile counts | 7.8 | 0.0016 | | | [CVE-2026-97577](https://patchblox.com/security/data/cve/CVE-2026-97577.md) | High | media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity | 7.8 | 0.0016 | | | [CVE-2026-97578](https://patchblox.com/security/data/cve/CVE-2026-97578.md) | High | media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer | 7.8 | 0.0016 | | | [CVE-2026-89443](https://patchblox.com/security/data/cve/CVE-2026-89443.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.1 | 0.0016 | | | [CVE-2026-89818](https://patchblox.com/security/data/cve/CVE-2026-89818.md) | High | drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check | 7.8 | 0.0016 | | | [CVE-2026-89801](https://patchblox.com/security/data/cve/CVE-2026-89801.md) | High | drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE | 7.8 | 0.0016 | | | [CVE-2026-99012](https://patchblox.com/security/data/cve/CVE-2026-99012.md) | High | Bluetooth: ISO: Serialize concurrent connect calls | 7.8 | 0.0016 | | | [CVE-2026-99013](https://patchblox.com/security/data/cve/CVE-2026-99013.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.8 | 0.0016 | | | [CVE-2026-98512](https://patchblox.com/security/data/cve/CVE-2026-98512.md) | High | drm/nouveau: RCU-free the scheduler-containing nouveau_sched | 7.1 | 0.0016 | | | [CVE-2026-68447](https://patchblox.com/security/data/cve/CVE-2026-68447.md) | High | drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size | 7.1 | 0.0016 | | | [CVE-2026-98471](https://patchblox.com/security/data/cve/CVE-2026-98471.md) | High | KVM: SEV: Do cache maintenance on the source VM during intra-host migration | 7.1 | 0.0016 | | | [CVE-2026-80862](https://patchblox.com/security/data/cve/CVE-2026-80862.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 9.8 | 0.0016 | | | [CVE-2026-90030](https://patchblox.com/security/data/cve/CVE-2026-90030.md) | High | usb: dwc3: clear forceRM when issuing EndTransfer | 7.8 | 0.0016 | | | [CVE-2026-90032](https://patchblox.com/security/data/cve/CVE-2026-90032.md) | High | media: usbtv: keep device alive while ALSA card exists | 7.8 | 0.0016 | | | [CVE-2026-80911](https://patchblox.com/security/data/cve/CVE-2026-80911.md) | High | ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() | 7.8 | 0.0016 | | | [CVE-2026-97910](https://patchblox.com/security/data/cve/CVE-2026-97910.md) | High | ASoC: sprd: validate compress buffer sizes against fixed allocations | 7.8 | 0.0016 | | | [CVE-2026-97445](https://patchblox.com/security/data/cve/CVE-2026-97445.md) | High | ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() | 7.7 | 0.0016 | | | [CVE-2026-63809](https://patchblox.com/security/data/cve/CVE-2026-63809.md) | High | bpf: use kvfree() for replaced sysctl write buffer | 7.8 | 0.0015 | | | [CVE-2026-98863](https://patchblox.com/security/data/cve/CVE-2026-98863.md) | High | KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails | 7.8 | 0.0015 | | | [CVE-2026-93262](https://patchblox.com/security/data/cve/CVE-2026-93262.md) | High | md/raid5-ppl: fix use-after-free in ppl_do_flush() | 8.8 | 0.0015 | | | [CVE-2026-97926](https://patchblox.com/security/data/cve/CVE-2026-97926.md) | High | ufs: validate cylinder group metadata before caching it | 7.0 | 0.0015 | | | [CVE-2026-90403](https://patchblox.com/security/data/cve/CVE-2026-90403.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.0 | 0.0015 | | | [CVE-2026-92504](https://patchblox.com/security/data/cve/CVE-2026-92504.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.0 | 0.0015 | | | [CVE-2026-93046](https://patchblox.com/security/data/cve/CVE-2026-93046.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.0 | 0.0015 | | | [CVE-2026-93054](https://patchblox.com/security/data/cve/CVE-2026-93054.md) | High | uio: Fix stale info pointer in failed registration path | 7.0 | 0.0015 | | | [CVE-2026-98041](https://patchblox.com/security/data/cve/CVE-2026-98041.md) | High | bpf: Don't predict JMP32 pointer vs zero comparisons | 7.0 | 0.0015 | | | [CVE-2026-74519](https://patchblox.com/security/data/cve/CVE-2026-74519.md) | High | pinctrl: devicetree: don't free uninitialized dev_name on error path | 7.8 | 0.0015 | | | [CVE-2026-74684](https://patchblox.com/security/data/cve/CVE-2026-74684.md) | High | net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() | 7.1 | 0.0015 | | | [CVE-2026-72049](https://patchblox.com/security/data/cve/CVE-2026-72049.md) | High | bpftool: ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.1 | 0.0014 | | | [CVE-2026-89587](https://patchblox.com/security/data/cve/CVE-2026-89587.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0014 | | | [CVE-2026-80684](https://patchblox.com/security/data/cve/CVE-2026-80684.md) | High | KVM: s390: pci: Fix NULL dereference on AIBV allocation failure | 9.3 | 0.0014 | | | [CVE-2026-74497](https://patchblox.com/security/data/cve/CVE-2026-74497.md) | High | ALSA: usb-audio: Clamp frame size in implicit-feedback mode | 8.4 | 0.0014 | | | [CVE-2026-80678](https://patchblox.com/security/data/cve/CVE-2026-80678.md) | High | i2c: imx: Fix slave registration race and error handling | 8.4 | 0.0014 | | | [CVE-2026-81012](https://patchblox.com/security/data/cve/CVE-2026-81012.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.4 | 0.0014 | | | [CVE-2026-89465](https://patchblox.com/security/data/cve/CVE-2026-89465.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.4 | 0.0014 | | | [CVE-2026-89470](https://patchblox.com/security/data/cve/CVE-2026-89470.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.4 | 0.0014 | | | [CVE-2026-89471](https://patchblox.com/security/data/cve/CVE-2026-89471.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.4 | 0.0014 | | | [CVE-2026-89504](https://patchblox.com/security/data/cve/CVE-2026-89504.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.4 | 0.0014 | | | [CVE-2026-89599](https://patchblox.com/security/data/cve/CVE-2026-89599.md) | High | kernel-64kb: Security update for the Linux Kernel | 8.4 | 0.0014 | | | [CVE-2026-89744](https://patchblox.com/security/data/cve/CVE-2026-89744.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.4 | 0.0014 | | | [CVE-2026-90398](https://patchblox.com/security/data/cve/CVE-2026-90398.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 8.4 | 0.0014 | | | [CVE-2026-97450](https://patchblox.com/security/data/cve/CVE-2026-97450.md) | High | ACPICA: validate handler object type in two places | 8.4 | 0.0014 | | | [CVE-2026-97451](https://patchblox.com/security/data/cve/CVE-2026-97451.md) | High | ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) | 8.4 | 0.0014 | | | [CVE-2026-97452](https://patchblox.com/security/data/cve/CVE-2026-97452.md) | High | ACPICA: Prevent adding invalid references | 8.4 | 0.0014 | | | [CVE-2026-74452](https://patchblox.com/security/data/cve/CVE-2026-74452.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with overs... | 7.8 | 0.0014 | | | [CVE-2026-89466](https://patchblox.com/security/data/cve/CVE-2026-89466.md) | High | kernel-64kb: Security update for the Linux Kernel | 7.7 | 0.0014 | | | [CVE-2026-97428](https://patchblox.com/security/data/cve/CVE-2026-97428.md) | High | drm/amdgpu: harden FRU PIA parsing with bounded helpers | 7.7 | 0.0014 | | | [CVE-2026-97444](https://patchblox.com/security/data/cve/CVE-2026-97444.md) | High | ACPICA: add boundary checks in two places | 7.7 | 0.0014 | | | [CVE-2026-97454](https://patchblox.com/security/data/cve/CVE-2026-97454.md) | High | ACPICA: add boundary checks in acpi_ps_get_next_field() | 7.7 | 0.0014 | | | [CVE-2026-97455](https://patchblox.com/security/data/cve/CVE-2026-97455.md) | High | ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() | 8.4 | 0.0014 | | | [CVE-2026-53059](https://patchblox.com/security/data/cve/CVE-2026-53059.md) | High | dm log: fix out-of-bounds write due to region_count overflow | 7.8 | 0.0014 | | | [CVE-2026-53090](https://patchblox.com/security/data/cve/CVE-2026-53090.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ld_{abs,ind} failure path analysis in s... | 7.8 | 0.0014 | | | [CVE-2026-90353](https://patchblox.com/security/data/cve/CVE-2026-90353.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.0 | 0.0014 | | | [CVE-2026-74748](https://patchblox.com/security/data/cve/CVE-2026-74748.md) | High | netfilter: ipset: fix refcount race between list:set GC and swap | 7.8 | 0.0014 | | | [CVE-2026-74461](https://patchblox.com/security/data/cve/CVE-2026-74461.md) | High | i2c: imx: Cancel hrtimer before clearing slave pointer | 8.4 | 0.0014 | | | [CVE-2026-74604](https://patchblox.com/security/data/cve/CVE-2026-74604.md) | High | Revert "thermal/drivers/hwmon: Cleanup coding style a bit" | 8.4 | 0.0014 | | | [CVE-2026-89469](https://patchblox.com/security/data/cve/CVE-2026-89469.md) | High | power: supply: lp8727: fix use-after-free in lp8727_release_irq() | 8.4 | 0.0014 | | | [CVE-2026-97448](https://patchblox.com/security/data/cve/CVE-2026-97448.md) | High | ACPICA: Add validation for node in acpi_ns_build_normalized_path() | 7.8 | 0.0014 | | | [CVE-2026-92522](https://patchblox.com/security/data/cve/CVE-2026-92522.md) | High | ACPI: processor: validate MADT IOAPIC entry bounds | 7.3 | 0.0014 | | | [CVE-2026-72405](https://patchblox.com/security/data/cve/CVE-2026-72405.md) | High | net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync | 7.8 | 0.0014 | | | [CVE-2026-80570](https://patchblox.com/security/data/cve/CVE-2026-80570.md) | High | Input: synaptics-rmi4 - zero report size on F54 work error | 7.8 | 0.0014 | | | [CVE-2026-89553](https://patchblox.com/security/data/cve/CVE-2026-89553.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0014 | | | [CVE-2026-80568](https://patchblox.com/security/data/cve/CVE-2026-80568.md) | High | Input: synaptics-rmi4 - block s_input when F54 queue is busy | 7.8 | 0.0013 | | | [CVE-2026-80574](https://patchblox.com/security/data/cve/CVE-2026-80574.md) | High | Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet | 8.4 | 0.0013 | | | [CVE-2026-80752](https://patchblox.com/security/data/cve/CVE-2026-80752.md) | High | Input: psxpad-spi - set driver data before use | 8.4 | 0.0013 | | | [CVE-2026-80736](https://patchblox.com/security/data/cve/CVE-2026-80736.md) | High | kernel-uek64k-modules-core: ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 7.8 | 0.0013 | | | [CVE-2026-74549](https://patchblox.com/security/data/cve/CVE-2026-74549.md) | High | hwmon: (nct6775-core) Prevent access to unsupported weight registers | 7.8 | 0.0013 | | | [CVE-2026-80680](https://patchblox.com/security/data/cve/CVE-2026-80680.md) | High | i2c: amd-mp2: Unregister callback on adapter add failure | 7.8 | 0.0013 | | | [CVE-2026-68466](https://patchblox.com/security/data/cve/CVE-2026-68466.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xx_slc: fail DMA transfer on... | 8.8 | 0.0013 | | | [CVE-2026-74641](https://patchblox.com/security/data/cve/CVE-2026-74641.md) | High | ALSA: usx2y: bound the hwdep mmap fault offset | 8.8 | 0.0013 | | | [CVE-2026-74655](https://patchblox.com/security/data/cve/CVE-2026-74655.md) | High | serial: qcom-geni: fix TX DMA buffer flush | 8.8 | 0.0013 | | | [CVE-2026-74753](https://patchblox.com/security/data/cve/CVE-2026-74753.md) | High | perf: Reject exited events as group leaders | 8.8 | 0.0013 | | | [CVE-2026-93817](https://patchblox.com/security/data/cve/CVE-2026-93817.md) | High | perf: Fix addr_filter_ranges lifetime | 8.8 | 0.0013 | | | [CVE-2026-68467](https://patchblox.com/security/data/cve/CVE-2026-68467.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: mtd: mchp23k256: use SPI match data for chip cap... | 7.8 | 0.0013 | | | [CVE-2026-74446](https://patchblox.com/security/data/cve/CVE-2026-74446.md) | High | drm/amdkfd: hold event_mutex while checkpointing CRIU events | 7.8 | 0.0013 | | | [CVE-2026-74447](https://patchblox.com/security/data/cve/CVE-2026-74447.md) | High | kernel-uek64k-modules-core: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (William Palacek) | 7.8 | 0.0013 | | | [CVE-2026-74451](https://patchblox.com/security/data/cve/CVE-2026-74451.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structu... | 7.8 | 0.0013 | | | [CVE-2026-74456](https://patchblox.com/security/data/cve/CVE-2026-74456.md) | High | can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error | 7.8 | 0.0013 | | | [CVE-2026-74635](https://patchblox.com/security/data/cve/CVE-2026-74635.md) | High | fbdev: bitblit: bound-check glyph index in bit_cursor() | 7.8 | 0.0013 | | | [CVE-2026-74646](https://patchblox.com/security/data/cve/CVE-2026-74646.md) | High | misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke | 7.8 | 0.0013 | | | [CVE-2026-74647](https://patchblox.com/security/data/cve/CVE-2026-74647.md) | High | misc: fastrpc: Remove buffer from list prior to unmap operation | 7.8 | 0.0013 | | | [CVE-2026-74648](https://patchblox.com/security/data/cve/CVE-2026-74648.md) | High | staging: rtl8723bs: validate monitor transmit frame lengths | 7.8 | 0.0013 | | | [CVE-2026-74675](https://patchblox.com/security/data/cve/CVE-2026-74675.md) | High | vt: stabilize tty reference in kbd_keycode with tty_port_tty_get | 7.8 | 0.0013 | | | [CVE-2026-74715](https://patchblox.com/security/data/cve/CVE-2026-74715.md) | High | bpf: Fix netns reference imbalance in conntrack kfuncs | 7.8 | 0.0013 | | | [CVE-2026-80541](https://patchblox.com/security/data/cve/CVE-2026-80541.md) | High | drm/amdgpu: validate GEM_CREATE domain combinations | 7.8 | 0.0013 | | | [CVE-2026-80559](https://patchblox.com/security/data/cve/CVE-2026-80559.md) | High | Input: sur40 - fix input device registration ordering | 7.8 | 0.0013 | | Showing 500 of 1,077 CVEs; the web page lists them all. --- Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.