THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,968 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-98659 — In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Return error when read fails…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Return error when read fails The data reading function ignores the cached error value, and unconditionally returns 0. Return cached 'ret' -value after stopping the measurement so user knows if read failed and data is garbage.
CVE-2026-98659Read original ↗ (opens in a new tab) - NVD
CVE-2026-98658 — In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length T…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond the copied firmware buffer. A value smaller than the four-byte count field also underflows, producing a very large length. Read the little-endian field with get_unaligned_le32(), as previously proposed by David Lechner. V…
CVE-2026-98658Read original ↗ (opens in a new tab) - NVD
CVE-2026-98657 — In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iio_device left registe…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure pm_runtime_set_active() failing in probe() jumps to error_unreg_buffer, which only calls iio_triggered_buffer_cleanup() -- it does not undo the iio_device_register() that already succeeded a few lines above. probe() then returns the error, the devm-managed indio_dev is freed, but the iio core still has it registered: the sysfs/chardev nodes stay live and point at freed…
CVE-2026-98657Read original ↗ (opens in a new tab) - NVD
CVE-2026-98656 — In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenable_work before freeing trigge…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenable_work before freeing trigger iio_trigger_notify_done_atomic() defers ->reenable() into trig->reenable_work on the system workqueue, and the worker dereferences the owning trigger through container_of(). Nothing cancels this work before iio_trig_release() frees the trigger, so a worker armed by the last in-flight IRQ can outlive the free and touch freed memory. Cancel it at the top of iio_trig_release(), which every fre…
CVE-2026-98656Read original ↗ (opens in a new tab) - NVD
CVE-2026-98655 — In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for text poke events Perf ev…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for text poke events Perf events with exclude_kernel=1 can be opened without kernel perf access. However, exclude_kernel does not suppress text-poke sideband records. Every PERF_RECORD_TEXT_POKE is marked PERF_RECORD_MISC_KERNEL and contains a raw kernel instruction address. An unprivileged task can therefore open and mmap a task-local software event with text_poke=1. Both opening a count-only tracepoint event and confi…
CVE-2026-98655Read original ↗ (opens in a new tab) - NVD
CVE-2026-98653 — In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix _gaccess_shadow_fault() In some circumsta…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix _gaccess_shadow_fault() In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the parent guest gmap. dat_entry_walk() will not find any leaf entry and return with -ENOENT, which will erroneously be propagated all the way to userspace. Fix by manually calling gmap_link() on the memory of the nested guest that is being shadowed if the mapping was not already present.
CVE-2026-98653Read original ↗ (opens in a new tab) - NVD
CVE-2026-98652 — In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Add missing srcu in kvm_s390_set_irq_state()…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Add missing srcu in kvm_s390_set_irq_state() Like kvm_s390_inject_vcpu(), kvm_s390_set_irq_state() also needs the kvm->srcu or the slots lock when performing the Store status operation. Fix by taking kvm->srcu in kvm_s390_set_irq_state().
CVE-2026-98652Read original ↗ (opens in a new tab) - NVD
CVE-2026-98651 — In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in dat_cond_set_…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key() Some callers pass NULL as oldkey. Calling page_cond_set_storage_key() will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the pointer to a dummy local variable to avoid crashes.
CVE-2026-98651Read original ↗ (opens in a new tab) - NVD
CVE-2026-98650 — In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix potential races in dat skey functions Whe…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix potential races in dat skey functions When dat_cond_set_storage_key() finds a large page, it will conditionally set the storage key in absolute memory using large_crste_to_phys() to get the absolute address. There is a race window between dat_entry_walk() and large_crste_to_phys(): the large page could have been split concurrently, and large_crste_to_phys() might be called with a crste that does not designate a large page, leading t…
CVE-2026-98650Read original ↗ (opens in a new tab) - NVD
CVE-2026-98649 — In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix race in _destroy_pages_crste() Use READ_O…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix race in _destroy_pages_crste() Use READ_ONCE() in _destroy_pages_crste() to read the crste, avoid dereferencing the pointer multiple times.
CVE-2026-98649Read original ↗ (opens in a new tab) - NVD
CVE-2026-98648 — In the Linux kernel, the following vulnerability has been resolved: s390/uv: Prevent potential out-of-bounds read When the s…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: s390/uv: Prevent potential out-of-bounds read When the system has more than 85 secrets, the uv_secret_list struct array only holds up to 85 items per page, resulting in an out of bounds read in find_secret_in_page if the targeted secret is in the next page or not stored at all. Fix this by looping over the number of stored secrets which is the per sub-list count of stored secrets and not the overall count.
CVE-2026-98648Read original ↗ (opens in a new tab) - NVD
CVE-2026-98647 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btf_struct_walk() When an acc…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btf_struct_walk() When an access goes past the struct and the last member is a flexible array, btf_struct_walk() folds the offset back into a single element with (off - moff) % t->size, but never checks that the element type has a size. BTF takes an empty struct, so this in program BTF /* event could be empty */ struct event { #ifdef HAVE_TIMESTAMP __u64 ts; #endif }; struct batch { int nr; struct event events[]; }; divi…
CVE-2026-98647Read original ↗ (opens in a new tab) - NVD
CVE-2026-98646 — In the Linux kernel, the following vulnerability has been resolved: tcp: Skip cond_resched() in inet_csk_listen_stop() under…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context bpf_sock_destroy() runs from the tcp iterator, under rcu_read_lock(). If the sock is a listener that still has children in its accept queue, tcp_abort() ends up in inet_csk_listen_stop() and the cond_resched() there trips the debug check: BUG: sleeping function called from invalid context at net/ipv4/inet_connection_sock.c:1523 in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pi…
CVE-2026-98646Read original ↗ (opens in a new tab) - NVD
CVE-2026-98645 — In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teard…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teardown winwing_init_ff() passes the driver's private data, allocated with devm_kzalloc() in winwing_probe(), as the effect context to input_ff_create_memless(). The memoryless force-feedback core takes ownership of that pointer and frees it with kfree() from input_ff_destroy() (ml_ff_destroy()) when the input device is destroyed. Freeing a devm-managed allocation with kfree() is an invalid free,…
CVE-2026-98645Read original ↗ (opens in a new tab) - NVD
CVE-2026-98644 — In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in __htab_map_lookup_and_delete_b…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() __htab_map_lookup_and_delete_batch() has no rescheduling point. The batch count bounds how many entries are copied out, not how many buckets are visited, so one BPF_MAP_LOOKUP_BATCH call can walk the map end to end. The empty-bucket fast path is worse: it stays inside a single rcu_read_lock() / bpf_disable_instrumentation() section for any run of consecutive empty buckets. That holds u…
CVE-2026-98644Read original ↗ (opens in a new tab) - NVD
CVE-2026-98643 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rtt_min in sock_ops A soc…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rtt_min in sock_ops A sockops prog reading skops->rtt_min never checks the sk type: on the tcp_conn_request() path sock_ops->sk is a request_sock (non-full), and the ctx rewrite casts it to a tcp_sock (full) and reads rtt_min past the end of the request_sock, returning dirty adjacent memory. SEC("sockops") int prog(struct bpf_sock_ops *skops) { switch (skops->op) { case BPF_SOCK_OPS_RWND_INIT: leak = skops->rtt_min;…
CVE-2026-98643Read original ↗ (opens in a new tab) - NVD
CVE-2026-98642 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to concurrent consumption of ttrace lis…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk Syzkaller repeatedly triggered UAF splats related to nodes in waiting_for_gp_ttrace within the bpf memalloc: BUG: KASAN: slab-use-after-free in llist_del_first+0x85/0x110 lib/llist.c:61 Read of size 8 at addr ffff8881572cd080 by task syz.4.470/5112 ... llist_del_first+0x85/0x110 lib/llist.c:61 alloc_bulk+0x193/0x460 kernel/bpf/memalloc.c:229 bpf_mem_refill+0x386/0x560 kernel/…
CVE-2026-98642Read original ↗ (opens in a new tab) - NVD
CVE-2026-98641 — In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame pointer for the exception c…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame pointer for the exception callback A program acting as exception boundary saves all callee-saved registers, so build_prologue() takes the exception_cb path and never calls push_callee_regs(). That is the only place find_used_callee_regs() runs, and with it the only place ctx->fp_used is set, so the callback prologue does not emit the mov x25, sp that points BPF_REG_FP at the frame the callback runs on. x25 keeps whatev…
CVE-2026-98641Read original ↗ (opens in a new tab) - NVD
CVE-2026-98640 — In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: Validate PCI BAR size before mapping The a…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: Validate PCI BAR size before mapping The amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and subsequently accesses MMIO registers at offsets up to 0x10958 (e.g., AMD_P2C_MSG3 at 0x1068C). However, the driver never validates that the BAR size is large enough to cover these accesses. If the driver is bound to a device with a smaller BAR 2, this leads to an out-of-bounds memory access and a page fault during the probe function.…
CVE-2026-98640Read original ↗ (opens in a new tab) - NVD
CVE-2026-98639 — In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification (section 15.1.2) requires a nested HFENCE entry to be populated as follows: 1) find an unused entry with Config.Pending == 0 2) update the Page_Number and Page_Count words 3) update the Config word with Config.Pending set __kvm_riscv_nacl_hfence() writes the Config word first, so the SBI implementation (or NACL hardware) can observe a pending entry with pnum/pcount values le…
CVE-2026-98639Read original ↗ (opens in a new tab) - NVD
CVE-2026-98638 — In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Validate the SVE vector length in pkvm_vcpu_…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() pkvm_vcpu_init_sve() clamps only the upper bound of the host-provided sve_max_vl, so an invalid vector length reaches sve_state_size_from_vl() and the WARN_ON() there, which is fatal at EL2. The existing !sve_state_size test rejects such a length, but only after the macro has run. Check sve_vl_valid() before deriving the state size. A valid length cannot yield a zero size, so the !…
CVE-2026-98638Read original ↗ (opens in a new tab) - NVD
CVE-2026-98637 — In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Do not clear VM-wide SVE feature on vCPU ini…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure pkvm_vcpu_init_sve() clears KVM_ARM_VCPU_SVE in kvm->arch.vcpu_features when it fails, but vcpu_has_sve() tests KVM_ARCH_FLAG_GUEST_HAS_SVE, which is left set. Later vCPUs on that VM then skip the SVE setup and register with a NULL sve_state, which the guest's first FP access hands to sve_load_state(). Return the error without touching vcpu_features.
CVE-2026-98637Read original ↗ (opens in a new tab) - NVD
CVE-2026-98636 — In the Linux kernel, the following vulnerability has been resolved: squashfs: Add dictionary size range check to prevent shi…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: squashfs: Add dictionary size range check to prevent shift-out-of-bounds When an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size is 0) is mounted, and performs shift operations using dictionarysize, the shift exponent is -1, causing a shift-out-of-bounds. Detail as below: squashfs_comp_opts(msblk, buffer, length) squashfs_xz_comp_opts() if (comp_opts) n = ffs(opts->dict_size) - 1;<----opts->dict_size=0, n=-1 if (opts->dict_size !=…
CVE-2026-98636Read original ↗ (opens in a new tab) - NVD
CVE-2026-98635 — In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zones_cond out-of-bounds write on zone…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zones_cond out-of-bounds write on zone report blk_revalidate_disk_zones() sizes the zones_cond array from the disk capacity and zone size, but the index used by blk_revalidate_zone_cond() comes from the device-driven report_zones() walk and is never checked against the array size. A device reporting more zones than fit the array makes blk_zone_set_cond() write out of bounds. One way to reach this is a zone count exceeding 32 bits:…
CVE-2026-98635Read original ↗ (opens in a new tab) - NVD
CVE-2026-98634 — In the Linux kernel, the following vulnerability has been resolved: scsi: sd_zbc: Reject disks with too many zones sd_zbc_re…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: scsi: sd_zbc: Reject disks with too many zones sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zones field of struct zoned_disk_info, silently truncating counts that exceed 32 bits. The truncated count is later used to size per-zone resources, while the device may still report more zones than fit. Moreover, sd_zbc_report_zones() counts the reported zones with a signed int zone_id…
CVE-2026-98634Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.