THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
17,016 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-98699 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF mes…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF mesh_fast_tx_cache() stores raw mesh_path pointers. Path deletion flushes the cache and then frees the path with kfree_rcu(), but a lookup that already holds the path can insert a new cache entry after the flush. The cache then points at freed memory. Set MESH_PATH_DELETED before flushing, and skip inserting a cache entry if the path or MPP path is already deleted. Check this under the cache wal…
CVE-2026-98699Read original ↗ (opens in a new tab) - NVD
CVE-2026-98698 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request pa…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload fils_encrypt_assoc_req() accepts a (Re)Association Request frame whose last element is the FILS Session element. crypt_len is then zero and aes_siv_encrypt() is called with an empty plaintext. kmemdup() returns ZERO_SIZE_PTR for a zero-length allocation, so the unconditional sg_init_one() puts an invalid page into the scatterlist. With CONFIG_DEBUG_SG this triggers a kernel BUG in sg_se…
CVE-2026-98698Read original ↗ (opens in a new tab) - NVD
CVE-2026-98697 — In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driver deregistration race O…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driver deregistration race Only free the dynamic ids after having deregistered the driver and removed the "new_id" attribute to avoid leaking any id added by a racing write to the attribute.
CVE-2026-98697Read original ↗ (opens in a new tab) - NVD
CVE-2026-98696 — In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus. When unloading a driver module, the USB driver must be deregistered before the USB serial bus drivers so that I/O is stopped before unbinding the ports to avoid use-after-free in completion handlers accessing port data. Note that the "new_id" attributes must first be removed to prev…
CVE-2026-98696Read original ↗ (opens in a new tab) - NVD
CVE-2026-98695 — In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can ra…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing checks to make sure the port has not been hung up before accessing port driver data or hardware. This specifically avoids dereferencing a NULL-pointer if a device is disconnected during lengthy break signalling. Note that T…
CVE-2026-98695Read original ↗ (opens in a new tab) - NVD
CVE-2026-98694 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when requ…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation (stripped down keeping the relevant parts): BUG: KASAN: slab-use-after-free in tb_cfg_request_sync+0x240/0x250 [thunderbolt] Read of size 24 at addr ffff88811067f290 by task kworker/u40:2/1760 tb_cfg_request_sync+0x240/0x250 [thunderbolt] tb_cfg_read_raw+0x367/0…
CVE-2026-98694Read original ↗ (opens in a new tab) - NVD
CVE-2026-98693 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tb_stop() drops the reference to all DP tunnels but does not deactivate them, thus nothing cancels a dprx_work still in flight (which holds its own tunnel reference) and the tunnel can outlive tb_switch_remove(). The HopID releases in tb_path_free() then operate on freed IDAs and trigger warnings like ida_free called for id=8 which is not allocated. This can be triggered by unbinding th…
CVE-2026-98693Read original ↗ (opens in a new tab) - NVD
CVE-2026-98692 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Make the DP tunnel activation callback mand…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Make the DP tunnel activation callback mandatory tb_tunnel_alloc_dp() takes an optional callback which is run from dprx_work once the DPRX capabilities read has completed. Without that callback tb_dp_dprx_start() reads the capabilities synchronously and never queues the work. It however always takes a tunnel reference which is only dropped by dprx_work itself or by tb_dp_dprx_stop() when cancel_delayed_work() actually canceled that wo…
CVE-2026-98692Read original ↗ (opens in a new tab) - NVD
CVE-2026-98691 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the doma…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tb_stop() only tears down DMA tunnels so a DP tunnel that is still waiting for dprx_work to complete keeps that work queued while the routers are removed and the control channel is stopped. The work only stops once the DPRX timeout has passed and because it requeues itself until then the flush_workqueue() in tb_domain_remove() won't wait for its final run. The callback then runs…
CVE-2026-98691Read original ↗ (opens in a new tab) - NVD
CVE-2026-98690 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is canceled tb_tunnel_one_dp() takes a domain reference which is only dropped once tb_dp_tunnel_active() has run on the work queue. If that work is cancelled that reference is leaked. Since commit f5cc545f5969 ("thunderbolt: Wait for tb_domain_release() to complete when driver is removed") instead of just leaking memory this now also blocks in the completion wait forever when unbinding the driv…
CVE-2026-98690Read original ↗ (opens in a new tab) - NVD
CVE-2026-98689 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX rea…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tb_dp_dprx_work() checks ->dprx_canceled before it takes tb->lock so it misses a tb_dp_dprx_stop() that could not cancel the already running work. It then polls the DPRX capabilities and runs the callback for a tunnel that has already been torn down while the domain is suspending or going away. This can be hit by cancelling the DPRX read from outside the ordered tb->wq: During…
CVE-2026-98689Read original ↗ (opens in a new tab) - NVD
CVE-2026-98688 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tb_remove_work() Th…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tb_remove_work() There is a slight race between tb_remove_work() and tb_domain_remove() which leads to dereferencing a NULL tb->root_switch pointer inside tb_free_unplugged_xdomains(): Thread A Thread B tb_remove_work() tb_domain_remove() mutex_lock(&tb->lock) tb_stop() /* doesn't cancel a running callback */ cancel_delayed_work(&tcm->remove_work) ... tb_switch_remove(tb->root_switch) tb->root_switch = NULL mut…
CVE-2026-98688Read original ↗ (opens in a new tab) - NVD
CVE-2026-98687 — In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties respons…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tb_xdp_properties_request() allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set it to 63. After the fixed response fields are subtracted, the driver treats this as 48 data dwords. Commit 322e93448d90 ("thunderbolt: Clamp XDomain response data copy to allocation size") only bounds the copy agains…
CVE-2026-98687Read original ↗ (opens in a new tab) - NVD
CVE-2026-98686 — In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via zero range smb3_zero_range() removed the pagecache only for the range being zeroed, so when it extends the file the folio straddling the old EOF - which may hold data dirtied past EOF through an mmap - was never dropped and became visible as file content once the file was extended. Lower the discard boundary to the smaller of the zero-range offset and the old EOF.
CVE-2026-98686Read original ↗ (opens in a new tab) - NVD
CVE-2026-98685 — In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via clone range cifs_remap_file_range() discarded the pagecache only for the folios overlapping the destination region, so when a clone extends the file the folio straddling the old EOF - which may hold data dirtied past EOF through an mmap - was never dropped and became visible as file content once the file was extended. Start the discard at the smaller of fstart and the old EOF. i_siz…
CVE-2026-98685Read original ↗ (opens in a new tab) - NVD
CVE-2026-98684 — In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying alloc…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior ranges in smb3_simple_fallocate_range() issues FSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the server reports as an unallocated hole, to force block allocation without changing file contents. This is unsafe against Windows servers. Per the Win32 documentation, FSCTL_QUERY_ALLOCATED_RANGES only re…
CVE-2026-98684Read original ↗ (opens in a new tab) - NVD
CVE-2026-98683 — In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3_zero_range() emulates FALLOC_FL_ZERO_RANGE by invalidating the page cache over the target range with truncate_pagecache_range() and then issuing FSCTL_SET_ZERO_DATA to the server. Dirty data was only flushed conditionally, when the range reached or extended EOF. For a purely interior zero range that does not reach EOF, no flush happened, so a dirty folio overlapping the range could be writt…
CVE-2026-98683Read original ↗ (opens in a new tab) - NVD
CVE-2026-98682 — In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side cop…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifs_file_copychunk_range() and the clone (FICLONE) path of cifs_remap_file_range() do not serialise the destination page cache against the server-side copy the way the other server-side range operations (smb3_zero_range(), smb3_punch_hole(), smb3_collapse_range() and smb3_insert_range()) do. cifs_file_copychunk_range() invalidates the destination range with filemap_invalidate_inode()…
CVE-2026-98682Read original ↗ (opens in a new tab) - NVD
CVE-2026-98681 — In the Linux kernel, the following vulnerability has been resolved: smb: client: split cifsFileInfo bitfields to avoid share…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races The invalidHandle, swapfile, oplock_break_cancelled, offload, and status_file_deleted fields are stored in the same bitfield byte in struct cifsFileInfo, but are updated in different code paths that may run simultaneously, and are protected by different locks. Since bitfield assignments generate byte-level read-modify-write operations, a modification to one flag can overwrite…
CVE-2026-98681Read original ↗ (opens in a new tab) - NVD
CVE-2026-98680 — In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Prevent memory leak and fix s…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Prevent memory leak and fix state The driver allocates memory for samples at buffer enable path. If regmap operation fails in the kx022a_fifo_enable() at the buffer enable path, the allocated memory is never freed. Furthermore, the state information and previous hardware configuration(s) aren't undone, potentially leaving WMI interrupts and buffers enabled, or driver state flags wrong. Free the memory and revert the hard…
CVE-2026-98680Read original ↗ (opens in a new tab) - NVD
CVE-2026-98679 — In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxcjk-1013: reject duplicate event disable T…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxcjk-1013: reject duplicate event disable The IIO core does not filter duplicate writes to the event enable attribute. kxcjk1013_write_event_config() already ignores repeated enable requests, but a repeated disable request still calls kxcjk1013_set_power_state(data, false), dropping a runtime PM reference that was not acquired for this request. This can underflow the runtime PM usage count and trigger a "Runtime PM usage count underfl…
CVE-2026-98679Read original ↗ (opens in a new tab) - NVD
CVE-2026-98678 — In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4030: fix invalid oversampling_ratio validat…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4030: fix invalid oversampling_ratio validation In ad4030_set_avg_frame_len(), the logarithm is calculated before input validation. Passing zero or negative values leads to an undefined result from ilog2(). Validate that the input is strictly positive prior to computing its logarithm.
CVE-2026-98678Read original ↗ (opens in a new tab) - NVD
CVE-2026-98677 — In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix use-after-free on unbind a…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix use-after-free on unbind ad_sd_buffer_postenable() allocates sigma_delta->samples_buf with devm_krealloc() at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources are released in reverse allocation order, which means unbind frees samples_buf before iio_device_unregister() disables the buffers and detaches the trigger pollfunc. The data ready IRQ is still enabled at that point, s…
CVE-2026-98677Read original ↗ (opens in a new tab) - NVD
CVE-2026-98676 — In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL pointer dereference in clkou…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL pointer dereference in clkout registration ade9000_setup_clkout() passes NULL as the register address when registering a divider clock. During clock registration, the common clock framework calls clk_divider_recalc_rate(), which dereferences the address through readl(). As a result, probing an ADE9000 configured as a clock provider with an external input clock crashes. CLKOUT passes CLKIN through without changing its ra…
CVE-2026-98676Read original ↗ (opens in a new tab) - NVD
CVE-2026-98675 — In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: handle Phase C dip events in IRQ1 han…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: handle Phase C dip events in IRQ1 handler ADE9000_ST1_CROSSING_DEPTH is the exclusive upper bound for scanning the STATUS1 event bits, so a value of 25 left out the highest event bit, ADE9000_ST1_DIPC_BIT (bit 25). Phase C dip events were never reported. Bump the value to 26 so bit 25 is scanned.
CVE-2026-98675Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.