THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
15,732 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-98760 — In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec_partner_desc i…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() tps6598x_connect() passes a stack-allocated typec_partner_desc to typec_register_partner() after initializing only usb_pd, accessory and identity. typec_register_partner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typec_partner_link_device() when a USB devic…
CVE-2026-98760Read original ↗ (opens in a new tab) - NVD
CVE-2026-98759 — In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec_partner_desc i…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work() cd321x_update_work() passes a stack-allocated typec_partner_desc to typec_register_partner() after initializing only usb_pd, accessory and identity. typec_register_partner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typec_partner_link_device() when a USB d…
CVE-2026-98759Read original ↗ (opens in a new tab) - NVD
CVE-2026-98758 — In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on r…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmic_glink client is released by the devres cleanup, which runs after pmic_glink_ucsi_remove() has returned, so its notification callbacks can queue work until then. Work that runs after ucsi_unregister() has been called touches freed state: it dereferences the connector array that ucsi_unregister() freed, or registers and unregisters the instance a second time. Disable both work it…
CVE-2026-98758Read original ↗ (opens in a new tab) - NVD
CVE-2026-98757 — In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3_gadget_exit() cd…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3_gadget_exit() cdns3_gadget_start() arms two works on system_freezable_wq: pending_status_wq for the deferred ep0 status stage and aligned_buf_wq for realigned request buffers. Both handlers use the cdns3_device the works are embedded in, and cdns3_pending_setup_status_handler() also calls the ep0 request completion. cdns3_gadget_exit() does not wait for these works. It frees all endpoints and aligned buffers…
CVE-2026-98757Read original ↗ (opens in a new tab) - NVD
CVE-2026-98756 — In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3_pci_pr…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pci_set_drvdata(), while the second function reuses it via pci_get_drvdata() when pci_is_enabled() reports that the first function has already been probed. When the second function is probed while the first one has been enabled but has not yet set its driver da…
CVE-2026-98756Read original ↗ (opens in a new tab) - NVD
CVE-2026-98755 — In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vcc_send_ctl…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vcc_send_ctl() The stack-allocated struct vio_vcc pkt was partially initialized, leaving the tag.stype_env field uninitialized before being sent via ldc_write(), potentially leaking kernel stack data to the LDC peer.
CVE-2026-98755Read original ↗ (opens in a new tab) - NVD
CVE-2026-98754 — In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vc…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup vcc_cleanup() sets port->tty to NULL without holding port->lock, racing with vcc_event() LDC callbacks that read port->tty under port->lock and then use tty->port. This can cause a use-after-free when the callback dereferences tty->port after cleanup has already destroyed and freed it.
CVE-2026-98754Read original ↗ (opens in a new tab) - NVD
CVE-2026-98753 — In the Linux kernel, the following vulnerability has been resolved: tty: tty_port: restore TTY_IO_ERROR on activation failur…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: tty: tty_port: restore TTY_IO_ERROR on activation failure Make sure to restore the TTY_IO_ERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic due to unclocked accesses or NULL-pointer dereferences when accessing powered down or deregistered ports when a TTY ioctl races with hangup and open. Note that the flag is set again in tty_port_close() but not restor…
CVE-2026-98753Read original ↗ (opens in a new tab) - NVD
CVE-2026-98752 — In the Linux kernel, the following vulnerability has been resolved: tty: port: fix tty_port_tty_vhangup() race Drivers rely…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: tty: port: fix tty_port_tty_vhangup() race Drivers rely on tty_port_tty_vhangup() to synchronously hang up their ports before tearing down resources as part of deregistration (e.g. on physical disconnect). If tty_port_tty_vhangup() races with another hangup it may however return before the port has been shut down. This is in turn can lead to use-after-free and NULL-pointer dereferences in racing ioctls (including a synchronous hangup) and in proce…
CVE-2026-98752Read original ↗ (opens in a new tab) - NVD
CVE-2026-98751 — In the Linux kernel, the following vulnerability has been resolved: tty: abort break signalling on hangup The break ioctls c…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: tty: abort break signalling on hangup The break ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Drivers must handle this race, but TCSBRK and TCSBRKP should still be aborted to avoid calling back into the driver after a user-controlled timeout (possibly even after the tty has been reopened). Note that drivers should disable any break state on shutdown so just return on hangup (cal…
CVE-2026-98751Read original ↗ (opens in a new tab) - NVD
CVE-2026-98750 — In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termio…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being opened (e.g. when CLOCAL is not set). Not all TTY drivers guarantee that the minor number is no longer in use when registering devices however, something which can lead to a use-after-free when closing a TTY (and saving it…
CVE-2026-98750Read original ↗ (opens in a new tab) - NVD
CVE-2026-98749 — In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing por…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100_shutdown() stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core does not call max3100_shutdown() again, so max3100_remove() frees the port while the timer remains armed. max3100_timeout() may then access the freed port and re-arm the timer. Add final timer teardown to max3100_remove() and use timer_shutdown_sync…
CVE-2026-98749Read original ↗ (opens in a new tab) - NVD
CVE-2026-98748 — In the Linux kernel, the following vulnerability has been resolved: serial: 8250_bcm7271: fix use-after-free in brcmuart_rem…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() brcmuart_handle_irq() starts priv->hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuart_hrtimer_func() dereferences priv. brcmuart_remove() cancels the hrtimer before it unregisters the port, so a receive-timeout interrupt that arrives in between re-arms the timer. After devm frees priv, the callback runs on freed…
CVE-2026-98748Read original ↗ (opens in a new tab) - NVD
CVE-2026-98747 — In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serial_cor…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serial_core_unregister_port() port->port_dev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serial_core_port_device_add(). serial_core_unregister_port() passes it straight to serial_core_get_ctrl_dev(), which dereferences it: KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] RIP: serial_core_unregister_port Call Trac…
CVE-2026-98747Read original ↗ (opens in a new tab) - NVD
CVE-2026-98746 — In the Linux kernel, the following vulnerability has been resolved: serial: ma35d1: Fix clock reference leak in ma35d1serial…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() of_clk_get() returns a clock with a reference that has to be released with clk_put(). ma35d1serial_probe() never does that, so the reference is leaked on the probe error paths and also when the port is removed. Release it on the error paths and in ma35d1serial_remove().
CVE-2026-98746Read original ↗ (opens in a new tab) - NVD
CVE-2026-98745 — In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload o…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems When system_supports_sme() is true but system_supports_sve() is false, restoring a specifically crafted SVE signal context can result in the task erroneously having non-streaming SVE state. Subsequent attempts to manipulate the task's FPSIMD/SVE/SME state can result in a variety of problems, including fatal EL1 UNDEFs. In such configurations, the kernel always creates an SV…
CVE-2026-98745Read original ↗ (opens in a new tab) - NVD
CVE-2026-98744 — In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized stream_config-…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized stream_config->type stream_config is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage and is later copied to stream->type by sdw_config_stream(). Zero-initialize stream_config so type defaults to SDW_STREAM_PCM.
CVE-2026-98744Read original ↗ (opens in a new tab) - NVD
CVE-2026-98743 — In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type stream_config is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage and is later copied to stream->type by sdw_config_stream(). Zero-initialize stream_config so type defaults to SDW_STREAM_PCM. While at it, use snd_sdw_params_to_config() helper instead of open-coding the same logic.
CVE-2026-98743Read original ↗ (opens in a new tab) - NVD
CVE-2026-98742 — In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path serializes handler calls with client->ioctl_mutex, but the translated port-info compat path invokes the same handlers through snd_seq_kernel_client_ctl() without taking that mutex. This lets concurrent compat CREATE_PORT requests pass the port-count check before any request reaches the serialized insertion. The computed integer port index can then exceed the address field…
CVE-2026-98742Read original ↗ (opens in a new tab) - NVD
CVE-2026-98741 — In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet s…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detect_usb_format() cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never relates the two endpoints' wMaxPacketSize and bNrChannels. Each playback URB gets a buffer of ua->playback.max_packet_bytes, while the number of bytes written into it is derived from the capture stream: capture_urb_complete() computes frames from the received…
CVE-2026-98741Read original ↗ (opens in a new tab) - NVD
CVE-2026-98740 — In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Drop __init from ECC setup paths for re-pro…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Drop __init from ECC setup paths for re-probe safety Sashiko reports: "Does suppressing sysfs unbinding fully prevent the execution of freed __init memory? If altr_sysmgr_regmap_lookup_by_phandle() returns -EPROBE_DEFER, the probe is deferred until after __init memory is freed." The a10 EDAC .setup callbacks (sdmmc, ethernet, nand, dma, usb, qspi) and their helpers (altr_init_a10_ecc_device_type, altr_init_a10_ecc_block) were marked _…
CVE-2026-98740Read original ↗ (opens in a new tab) - NVD
CVE-2026-98739 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For R…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and __rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the initial tty_port reference. The release path tests the bit separately from the install path setting it, so both can drop that reference. The synchronous hangup does not prevent this race: port->tty is not assigned until tty_port_open(), after installation. The followi…
CVE-2026-98739Read original ↗ (opens in a new tab) - NVD
CVE-2026-98738 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access build_pa…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access build_pairing_cmd() looks up remote OOB data and copies its contents without holding hdev->lock, which serializes the list's writers. After SMP finds an entry, a concurrent management Remove Remote OOB Data command can unlink and free it before SMP reads its present flag or copies its random and confirmation values. Removal can also invalidate an entry while the lookup is still traversing the list. K…
CVE-2026-98738Read original ↗ (opens in a new tab) - NVD
CVE-2026-98737 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix inquiry cache use-after-free Th…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix inquiry cache use-after-free The sync command worker holds hdev->req_lock, but inquiry-cache updates and flushes use hdev->lock. Both hci_acl_create_conn_sync() and hci_stop_discovery_sync() look up entries and read their fields without taking hdev->lock. After either lookup returns, a concurrent HCIINQUIRY ioctl can acquire hdev->lock and flush the cache, freeing the entry. The worker then reads the freed entry while prep…
CVE-2026-98737Read original ↗ (opens in a new tab) - NVD
CVE-2026-98736 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Lock parent access during enhanced…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Lock parent access during enhanced SCO setup Bluetooth: hci_conn: Lock parent access during enhanced SCO setup hci_enhanced_setup_sync() runs on the request workqueue without the hci_dev_lock held by its caller when setup was queued. Its CVSD capability check and find_next_esco_param() dereference conn->parent while the receive workqueue can unlink and release that parent. The following interleaving can cause a use-after-free:…
CVE-2026-98736Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.