THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,408 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-98581 — In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfc_…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() nfc_llcp_recv_dm() handles DM(NOBOUND)/DM(REJ) for a socket that is still linked on local->connecting_sockets: it looks the socket up with nfc_llcp_connecting_sock_get(), sets sk->sk_state = LLCP_CLOSED and returns, without taking the socket lock and without unlinking the socket from the connecting_sockets list. llcp_sock_release() selects the list to unlink from by sk_state: a…
CVE-2026-98581Read original ↗ (opens in a new tab) - NVD
CVE-2026-98580 — In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in accept_queue lifecycle…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in accept_queue lifecycle In nfc_llcp_socket_release(), sockets and listener accept queues are walked under the local sockets rwlock and bh_lock_sock(). However, bh_lock_sock() does not synchronise against process-context lock_sock() held by nfc_llcp_accept_dequeue() during accept(). Because socket_release() does not check sock_owned_by_user(), both paths can concurrently unlink and release the same child socket, resu…
CVE-2026-98580Read original ↗ (opens in a new tab) - NVD
CVE-2026-98579 — In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send f…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfc_genl_llc_sdreq() builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths (nested-attr parse failure, TLV alloc ENOMEM, nfc_llcp_send_snl_sdreq() failure) all skip freeing what was already queued. Route them through a new free_list label, mirroring the SDRES path in the same file which already does this. Harmless on the success path too -- send_snl_sdreq() d…
CVE-2026-98579Read original ↗ (opens in a new tab) - NVD
CVE-2026-98578 — In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The IS…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data[1] as the DSFID. Require the prefix and at least two remaining bytes before copying the UID data and reading the DSFID.
CVE-2026-98578Read original ↗ (opens in a new tab) - NVD
CVE-2026-98577 — In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfc…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() nfc_llcp_wks_sap() compares only service_name_len bytes, so a short service_name like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length match before strncmp().
CVE-2026-98577Read original ↗ (opens in a new tab) - NVD
CVE-2026-98576 — In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging ser…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() pass non-null- terminated strings to pr_debug() using the %s format specifier. The buffers are allocated via kmemdup() or come from netlink attributes and are not guaranteed to be null-terminated, causing __dynamic_pr_debug() to read beyond the allocated region: KASAN: slab-out-of-bounds Read in __dynamic_pr_debug Fix both call site…
CVE-2026-98576Read original ↗ (opens in a new tab) - NVD
CVE-2026-98575 — In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_val…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() frame->ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame->data[]. A malicious or malfunctioning device can set this field to an arbitrary value, causing the driver to read far outside the received buffer. Bound ccid.datalen against the maximum possible ACR122 frame size before using it. This replaces the existing datalen == 0 check, sin…
CVE-2026-98575Read original ↗ (opens in a new tab) - NVD
CVE-2026-98574 — In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: stop Tx NAPI before disabling the queues…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: stop Tx NAPI before disabling the queues bcmgenet_netif_stop() and the Wake-on-LAN branch of bcmgenet_suspend() both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls netif_tx_wake_queue() in between, and nothing stops the queue again, so a transmit can reach the rings after they have been freed. Close is safe because dev_deactivate_many() stops the qdisc first. bcmgenet_suspend() does no…
CVE-2026-98574Read original ↗ (opens in a new tab) - NVD
CVE-2026-98573 — In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound underflow in skb_checksum_se…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() skb_maybe_pull_tail() subtracts skb_headlen(skb) from the unsigned max argument and passes the result to __pskb_pull_tail() as a signed int. The function does not ensure that max is at least skb_headlen(skb). This can happen while parsing IPv6 extension headers when an skb already has a linear area larger than MAX_IPV6_HDR_LEN. Once the parser needs data beyond the linear area, max…
CVE-2026-98573Read original ↗ (opens in a new tab) - NVD
CVE-2026-98572 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix immediate JMP JEQ/JNE on MIPS32 An addu instruc…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix immediate JMP JEQ/JNE on MIPS32 An addu instruction was emitted instead of addiu, causing the immediate value 1 to be interpreted as register $at. This made the comparison result invalid when the immediate operand was negative. Note that $at is mapped to BPF_REG_AX, which is used for constant blinding. Fix the instruction to use the immediate form. Found with test_bpf on MIPS32r1 emulated by QEMU.
CVE-2026-98572Read original ↗ (opens in a new tab) - NVD
CVE-2026-98571 — In the Linux kernel, the following vulnerability has been resolved: net: stmmac: clear stale buf->page after recycling on sk…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: clear stale buf->page after recycling on skb build failure In stmmac_rx(), when napi_build_skb() fails the descriptor page is recycled back to the page pool with page_pool_recycle_direct(), but buf->page is left pointing at the recycled page, unlike every other consumption site in the function which clears the pointer after handing the page away. With the stale pointer stmmac_rx_refill() skips the replacement allocation and programs t…
CVE-2026-98571Read original ↗ (opens in a new tab) - NVD
CVE-2026-98570 — In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dst_dev_overh…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dst_dev_overhead() The seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as the length they are about to push plus dst_dev_overhead(), then push the new headers and rebuild the mac header below them with skb_mac_header_rebuild(). That rebuild needs skb->mac_len of headroom, but dst_dev_overhead() leaves LL_RESERVED_SPACE() of the egress device, 16 bytes for plain Ethernet. Where the mac head…
CVE-2026-98570Read original ↗ (opens in a new tab) - NVD
CVE-2026-98569 — In the Linux kernel, the following vulnerability has been resolved: ip_gre: Reject enabling collect metadata through changel…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: ip_gre: Reject enabling collect metadata through changelink ipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Converting a non-metadata device can therefore replace the metadata receive entry for another device of the same type in the same netns. Deleting either device then clears the shared entry, breaking metadata receive lookup for the…
CVE-2026-98569Read original ↗ (opens in a new tab) - NVD
CVE-2026-98568 — In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies v…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then samples it again to reserve headroom. A concurrent vxlan_changelink() can update needed_headroom between the two reads, creating a TOCTOU race. The second value can exceed the allocation and make the Ethernet header write out of bounds. The race is reproducible on the unpatched kernel. It occurred when vxlan_na_create…
CVE-2026-98568Read original ↗ (opens in a new tab) - NVD
CVE-2026-98567 — In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev->num_tc are valid in dev->tc_to_txq[], and dev->prio_tc_map[] may only name classes below it. netdev_set_num_tc() lowers dev->num_tc without touching either array. netdev_txq_to_tc() walks all TC_MAX_QUEUE slots and netdev_get_prio_tc_map() returns the entry as it stands, so a leftover entry is handed out as a traffic class >= dev->num_tc. Taking that class from netdev_txq_t…
CVE-2026-98567Read original ↗ (opens in a new tab) - NVD
CVE-2026-98566 — In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the count to those protocol arrays. Clamp the count to the request capacity, which is shared by the response layout, and use that count consistently for reconstruction and response publication. Keep the firmware recovery excha…
CVE-2026-98566Read original ↗ (opens in a new tab) - NVD
CVE-2026-98565 — In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT75…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 The core and io supplies are only requested for ID_MT7530: both the devm_regulator_get() in probe and the regulator_enable() in mt7530_setup() are guarded by the switch id, but mt7530_remove() disables them unconditionally. On an MT7621 or an MT7531 both pointers are still NULL from devm_kzalloc(), so rmmod or a sysfs unbind calls regulator_disable() on NULL.
CVE-2026-98565Read original ↗ (opens in a new tab) - NVD
CVE-2026-98564 — In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq mt7530_remove_common() disposes the per-PHY interrupt mappings from .remove, but the regmap-irq chip that owns the domain is devm-registered, so its parent interrupt is only freed once .remove has returned. The switch's own regmap-irq thread can therefore still dispatch on a mapping that is already gone: irq_find_mapping() returns 0, irq_to_desc() returns NULL and handle_nested_irq() lock…
CVE-2026-98564Read original ↗ (opens in a new tab) - NVD
CVE-2026-98563 — In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fa…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fail phylink_bringup_phy() stores the PHY in pl->phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phy_eee_rx_clock_stop() can fail with a real MDIO error. The callers unwind with phy_detach(), which knows nothing about pl->phydev, so a pointer to a PHY that is no longer attached outlives the failed connect. What that costs depends on how the caller got here. phyli…
CVE-2026-98563Read original ↗ (opens in a new tab) - NVD
CVE-2026-98562 — In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx timestamp handling wx->ptp_t…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx timestamp handling wx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary worker and the timestamp cleanup paths. The WX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from submitting timestamp requests, but does not serialize the worker against cleanup. As a result, wx_ptp_clear_tx_timestamp() can free an skb after wx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may then pass the freed…
CVE-2026-98562Read original ↗ (opens in a new tab) - NVD
CVE-2026-98561 — In the Linux kernel, the following vulnerability has been resolved: nfp: hold IPsec RX state under the XArray lock nfp_net_i…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: nfp: hold IPsec RX state under the XArray lock nfp_net_ipsec_rx() drops the XArray lock before taking a reference to the xfrm_state it found. The delete path can erase the entry and drop the last state reference in that interval. RX can then try to increment a zero refcount after the state has been queued for destruction. The driver queues firmware invalidation asynchronously; the delete path does not wait for the command to complete or drain pend…
CVE-2026-98561Read original ↗ (opens in a new tab) - NVD
CVE-2026-98560 — In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport i…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with __rds_conn_create() computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the loopback transport instead. That substitution is what an RDS/TCP socket sending to a local address gets, and after it the path init loop still runs for the TCP transport's RDS_MPATH_WORKERS paths and allocates an order…
CVE-2026-98560Read original ↗ (opens in a new tab) - NVD
CVE-2026-98559 — In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list traversal in smcr_port_err(…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list traversal in smcr_port_err() smcr_port_err() traverses smc_lgr_list.list without holding smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched() to free an lgr while it is still being dereferenced. Hold smc_lgr_list.lock across the traversal. Update smc_ib_gid_check() to call smcr_port_err() after releasing the lock.
CVE-2026-98559Read original ↗ (opens in a new tab) - NVD
CVE-2026-98558 — In the Linux kernel, the following vulnerability has been resolved: net: flush skb_defer_nodes in dev_cpu_dead() When a CPU…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: flush skb_defer_nodes in dev_cpu_dead() When a CPU goes offline, dev_cpu_dead() drains its softnet queues (completion_queue, output_queue, poll_list, process_queue, and input_pkt_queue), but leaves net_hotdata.skb_defer_nodes untouched. If oldcpu goes offline while holding pending skbs in its skb_defer_nodes lists (e.g. below the sysctl_skb_defer_max >> 1 IPI threshold, or if the IPI races with CPU teardown), those skbs remain stranded until…
CVE-2026-98558Read original ↗ (opens in a new tab) - NVD
CVE-2026-98557 — In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gve_can_send_tso() f…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO gve_can_send_tso() computes how many buffers each segment of a GSO packet would span, and for this it needs the length of the headers that the device replicates in front of every segment. It unconditionally uses skb_tcp_all_headers(), which reads the doff field of the TCP header. SKB_GSO_UDP_L4 packets have no TCP header: tcp_hdrlen() then reads one byte of the UDP payload, and hea…
CVE-2026-98557Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.