THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,399 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-98464 — In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardow…
Critical · CVSS 3.1 9.3 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears next_set before its final uses of the enclosing vCPU. If teardown observes next_set as false while the callback is still running, kvm_riscv_vcpu_timer_cancel() skips hrtimer_cancel() and kvm_destroy_vcpus() can free the vCPU before the callback enters kvm_riscv_vcpu_set_interrupt(). A guest can arm the timer with SBI TIME and request shutdown with SBI le…
CVE-2026-98464Read original ↗ (opens in a new tab) - NVD
CVE-2026-98463 — In the Linux kernel, the following vulnerability has been resolved: sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags schedule_deferred_locked() skips scheduling a deferred action while SCX_RQ_IN_WAKEUP is set and relies on the task_woken_scx() call that follows a wakeup enqueue to run it. enqueue_task_scx() sets the flag from the merged enqueue flags, which include the flags stashed for a remote activation. move_remote_task_to_local_dsq() thus sets SCX_RQ_IN_WAKEUP on the destination rq when the move…
CVE-2026-98463Read original ↗ (opens in a new tab) - NVD
CVE-2026-98462 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix CIS hold ownership on reuse Com…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix CIS hold ownership on reuse Commit 69997d50ec57 ("Bluetooth: ISO: handle bound CIS cleanup via hci_conn") made hci_bind_cis() and hci_connect_cis() return a connection with one hold for the ISO layer. hci_bind_cis() currently takes that hold only after configuring a CIS, so its BT_CONNECTED and matching BT_BOUND paths return a bare lookup result. Its configuration failure path can likewise call hci_conn_drop() before takin…
CVE-2026-98462Read original ↗ (opens in a new tab) - NVD
CVE-2026-98461 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: validate event length before filter…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: validate event length before filtering is_filtered_packet() reads the event code from skb->data[0] without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcode at offsets 3 or 4 without checking that a Command Complete or Command Status event is long enough. hci_send_to_sock() invokes the filter before hci_event_packet() validates the event header. A malformed event sup…
CVE-2026-98461Read original ↗ (opens in a new tab) - NVD
CVE-2026-98460 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: reject out-of-range OCF values The…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submit a reserved OCF that aliases an allowlisted command modulo 128. A conforming controller should reject reserved opcodes. Nevertheless, the security decision must apply to the opcode that will actually be sent, especially…
CVE-2026-98460Read original ↗ (opens in a new tab) - NVD
CVE-2026-98459 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hci_bind_bis(…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hci_bind_bis() hci_conn_link() takes a lifetime reference to its parent with hci_conn_get(), but only takes an operational hold on the child. hci_conn_unlink() later balances both a hold and a reference on the parent. The SCO and CIS paths pass a parent acquired from a connect helper, so it already has a hold. For an additional BIS, hci_bind_bis() obtains the parent from hci_conn_hash_lookup_big(), which…
CVE-2026-98459Read original ↗ (opens in a new tab) - NVD
CVE-2026-98458 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel a…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by iso_conn_free(). There are two cases where iso_chan_add() does not create an association: it returns success when the socket is already attached to the same iso_conn, and it returns -EBUSY when another socket is attached. The hold…
CVE-2026-98458Read original ↗ (opens in a new tab) - NVD
CVE-2026-98457 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control a…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2cap_data_rcv() unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore cause an out-of-bounds read. There is a second short-frame case when CRC16 is enabled. After the control field is pulled, l2cap_check_fcs() subtracts two from skb->len without checking it. If fewer than two bytes rema…
CVE-2026-98457Read original ↗ (opens in a new tab) - NVD
CVE-2026-98456 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read_unconf_index_list() re…
High · CVSS 3.1 7.0 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read_unconf_index_list() read_unconf_index_list() counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hci_dev_list_lock stabilizes list membership, but it does not serialize the per-device flags. During asynchronous controller setup, the worker can set HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller omitted from the allocation co…
CVE-2026-98456Read original ↗ (opens in a new tab) - NVD
CVE-2026-98455 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc->session…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO The RFCOMM_CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if (sk->sk_state != BT_CONNECTED && !rfcomm_pi(sk)->dlc->defer_setup) { err = -ENOTCONN; break; } l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk; dlc->defer_setup is set in rfcomm_sock_init() when rfcomm_connect_ind() creates a child socket for an incoming c…
CVE-2026-98455Read original ↗ (opens in a new tab) - NVD
CVE-2026-98454 — In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2…
High · CVSS 3.1 8.1 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose bytes beyond the current context to a handler. The QFid handler also used a full response-structure cast although it only reads DiskFileId. The SMB2/SMB3 lease parsers made the same layout assumption: they read LeaseState a…
CVE-2026-98454Read original ↗ (opens in a new tab) - NVD
CVE-2026-98453 — In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing f…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2_open() accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2_parse_contexts() rejects malformed context data, SMB2_open() returns without closing the handle, leaving the server-side handle open and num_remote_opens elevated. Close the handle after a post-CREATE context parsing failure so the error path releases the remote resource and b…
CVE-2026-98453Read original ↗ (opens in a new tab) - NVD
CVE-2026-98452 — In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common cleanup can issue SMB2_close(). It also must not treat a response error as a valid CREATE. Validate the CREATE response before using its fields, record the FIDs, and mark the handle open before handling errors from late…
CVE-2026-98452Read original ↗ (opens in a new tab) - NVD
CVE-2026-98451 — In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open() for non-regular inodes…
High · CVSS 3.1 8.8 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open() for non-regular inodes An O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also prevents the VFS from following the symlink. Track whether cifs_do_create() returned an open server handle. For non-regular…
CVE-2026-98451Read original ↗ (opens in a new tab) - NVD
CVE-2026-98450 — In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait er…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compound_send_recv() waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already have opened a remote handle. The earlier mid is then released without invoking handle_cancelled_mid(), leaving the remote handle open because no FID was copied to the caller. Mark completed earlier mids as cancelled when…
CVE-2026-98450Read original ↗ (opens in a new tab) - NVD
CVE-2026-98449 — In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smb_send_rqst() kicks off a reconnect. compound_send_recv() still has those mids on pending_mid_q, but it unlocks the server without removing them first. During reconnect, cifs_abort_connection() walks pending_mid_q and runs each mid callback. With no response yet, those callbacks return credits and drop in_flight. Then compound_send_recv()'s sen…
CVE-2026-98449Read original ↗ (opens in a new tab) - NVD
CVE-2026-98448 — In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM po…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that.
CVE-2026-98448Read original ↗ (opens in a new tab) - NVD
CVE-2026-98447 — In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtref…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory corruption of whatever's beyond the buffers.
CVE-2026-98447Read original ↗ (opens in a new tab) - NVD
CVE-2026-98446 — In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hidden_space go negative in xfs_metafile_…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hidden_space go negative in xfs_metafile_resv_init LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hidden_space subtraction can underflow, causing xfs_dec_fdblocks to subtract a huge amount of space. We never want the target to be less than the used sapce, so fix the logic that adjusts dblocks_avail downwards. Also fix an error in…
CVE-2026-98446Read original ↗ (opens in a new tab) - NVD
CVE-2026-98445 — In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repa…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrep_newbt_add_blocks results in online repair leaking blocks that were previously allocated to write a new btree, but the problem is worse than that -- a limitation of the codebase is that the callers cannot undo the transaction /and/ return the error -- either you undo all changes and commit the transaction, or you error out and the fi…
CVE-2026-98445Read original ↗ (opens in a new tab) - NVD
CVE-2026-98444 — In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer t…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfs_qm_flush_one fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is going to drop the dqflock, so we need to do it ourselves.
CVE-2026-98444Read original ↗ (opens in a new tab) - NVD
CVE-2026-98443 — In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iun…
High · CVSS 3.1 7.8 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlog_recover_iunlink_bucket: 1. We don't null out prev_ip after releasing it, which can lead to UAF problems if the inodegc flush call in the loop fails. at which point I noticed even more bugs: 2. If the inodegc flush inside the loop fails, we also leak @ip. 3. We set prev_agino to agino having already advanced agino, which results in inodes with i_pre…
CVE-2026-98443Read original ↗ (opens in a new tab) - NVD
CVE-2026-98442 — In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix helper UAF due to extensions real…
High · CVSS 3.1 7.8 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: -> nf_ct_helper() -> helper->help() -> nf_ct_expect_related_report() -> nf_ct_expect_insert() -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations) In case the connection is not confirmed yet, more extensions can be added afterwards with *_ext_add() calls reallocating the extension sp…
CVE-2026-98442Read original ↗ (opens in a new tab) - NVD
CVE-2026-98441 — In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: avoid modifying shared unconfirmed ct…
High · CVSS 3.1 7.8 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up processing both again but with different sets of extensions. The series of events: 1. The first clone wants to commit and runs the helpers wiring up the extension pointer into the expectation list. 2. Then it looses the confirmation keeping the entry unconfirmed. 3. Second clone now wants to commit labels or ru…
CVE-2026-98441Read original ↗ (opens in a new tab) - NVD
CVE-2026-98440 — In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures un…
High · CVSS 3.1 7.0 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvm_arch_flush_shadow_all(), which is a Bad Idea(tm). Freeing the page tables is fair game (this is what this callback is for), but freeing the container that could still be referenced by another part of the system is not great. Instead, grow separate destructors that gets called when we tear the VM down for good. From there, we can nuk…
CVE-2026-98440Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.