THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,430 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-98511 — In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in no…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() nouveau_bo_pin_locked() checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets -EBUSY but still calls ttm_bo_pin() before returning. Callers treat a failed nouveau_bo_pin() as not having acquired a new pin, so the extra pin count is never decreased by a matching unpin. This triggers the warn…
CVE-2026-98511Read original ↗ (opens in a new tab) - NVD
CVE-2026-98510 — In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs…
High · CVSS 3.1 7.8 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xe_vm_close_and_put(), external-BO VMAs are queued on the contested list for deferred destruction via xe_vma_destroy_unlocked(). However, xe_vm_pt_destroy() was previously invoked before processing contested VMAs, destroying vm->pt_root while those VMAs were still linked to their respective buffer objects (vm_bo->list.gpuva). If a concurrent thread evicts one of those shared buffer objects…
CVE-2026-98510Read original ↗ (opens in a new tab) - NVD
CVE-2026-98509 — In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtio_gpu_execbuffer_ioctl() reserves a DRM event with drm_event_reserve_init() when VIRTGPU_EXECBUF_RING_IDX selects a ring that userspace has enabled polling for. virtio_gpu_init_submit() does this before the BO handles, the command buffer, the syncobj arrays and the in-fence are processed, so every later error path runs with the event already pending, including plain argument val…
CVE-2026-98509Read original ↗ (opens in a new tab) - NVD
CVE-2026-98508 — In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence alloca…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtio_gpu_fence_alloc() can fail due to memory pressure and return NULL, but its caller like virtio_gpu_init_submit() never checks it. Later, virtio_gpu_init_submit() passes the NULL fence to virtio_gpu_fence_event_create(), which unconditionally dereferences it. Found when fuzzing the virtio driver with Syzkaller: Oops: general protection fault, probably for non-canonical addre…
CVE-2026-98508Read original ↗ (opens in a new tab) - NVD
CVE-2026-98507 — In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix missing barrier between anon_vma init and v…
High · CVSS 3.1 7.8 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish On arm64 server, we find that a task trying to grab the anon_vma lock triggers hungtask. INFO: task main:2354726 blocked for more than 120 seconds. Tainted: G E 5.10.0-0021.aarch64 #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:main state:D stack: 0 pid:2354726 ppid:2350673 flags:0x00000a01 Call trace: __switch_to+0x7c/0xbc __schedule+0x…
CVE-2026-98507Read original ↗ (opens in a new tab) - NVD
CVE-2026-98506 — In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve gigantic pages without runti…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve gigantic pages without runtime support dissolve_free_hugetlb_folio() doesn't check hstate_is_gigantic_no_runtime(h) though remove_hugetlb_folio()/ update_and_free_hugetlb_folio() silently bail for such folios, so it frees a still-listed folio and, on vmemmap restore failure, the add_hugetlb_folio() rollback corrupts the free list.
CVE-2026-98506Read original ↗ (opens in a new tab) - NVD
CVE-2026-98505 — In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven pte updates during damon…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() damon_hugetlb_mkold() reads the page table entry into a local variable, unsets the accessed bit in the variable, and updates the page table entry with the updated variable value. If hardware updates the same page table entry in parallel, the hw updates could be lost. For example, hardware-updated dirty bits might be lost. Avoid the parallel updates by clearing the page table…
CVE-2026-98505Read original ↗ (opens in a new tab) - NVD
CVE-2026-98504 — In the Linux kernel, the following vulnerability has been resolved: PCI: of_property: Omit bus properties without a subordin…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: PCI: of_property: Omit bus properties without a subordinate bus A bridge (a device with a Type 1 header) may not have a secondary bus allocated (pdev->subordinate), e.g., if there are no available bus numbers or the bridge secondary/subordinate bus numbers are not writable. The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map() dereference pdev->subordinate without checking it. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this c…
CVE-2026-98504Read original ↗ (opens in a new tab) - NVD
CVE-2026-98503 — In the Linux kernel, the following vulnerability has been resolved: packet: use ubuf_info completion for TX_RING packets tpa…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: packet: use ubuf_info completion for TX_RING packets tpacket_snd sends skbs with frags pointing into its ring slots. Slots are released when skb->destructor is called. A call to skb_orphan calls skb->destructor before the skb is freed. This can cause the slot to be reused while still linked into the skb. Switch to standard zerocopy completion (ubuf_info) so the slot is only released once all references to the payload are freed or copied. Restore s…
CVE-2026-98503Read original ↗ (opens in a new tab) - NVD
CVE-2026-98502 — In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on re…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps_input_configured() allocates a second input device ("DualPoint Stick") with input_allocate_device() and registers it, but the alps_driver struct has no .remove handler and input2 is not tracked in hdev->inputs. The default remove path (hid_hw_stop -> hidinput_disconnect) only iterates hdev->inputs, so input2 is never unregistered and leaks on every device removal. Add a .remove hand…
CVE-2026-98502Read original ↗ (opens in a new tab) - NVD
CVE-2026-98501 — In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration fai…
High · CVSS 3.1 7.1 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alps_input_configured() stores data->input2 before calling input_register_device(). If registration fails, input_free_device() frees the input device but data->input2 still points to the freed memory. alps_input_configured() calls hid_hw_open() before allocating input2, so URBs are already active and raw_event can fire during the failure window. A U1_SP_ABSOLUTE_REPORT_ID report arriving…
CVE-2026-98501Read original ↗ (opens in a new tab) - NVD
CVE-2026-98500 — In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use cancel_delayed_work_sync() in remove o…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use cancel_delayed_work_sync() in remove oxp_hid_remove() uses cancel_delayed_work() for all three delayed work items. cancel_delayed_work() only dequeues a pending work item without waiting for a currently executing callback to finish. If any of the work callbacks (oxp_rgb_queue_fn, oxp_btn_queue_fn, oxp_mcu_init_fn) is running at the time of removal, the callback continues executing concurrently with hid_hw_close() and hid_hw_stop(…
CVE-2026-98500Read original ↗ (opens in a new tab) - NVD
CVE-2026-98499 — In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce…
High · CVSS 3.1 8.1 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an invalid offset to hid_field_extract(), resulting in memory reads at incorrect addresses -- possibly beyond the end of the report. If a field in the HID descriptor lists more usages than its Report Count actually reserves space for, the function's inner 'j' will walk past the end of the field: for (i = 0; i < report->ma…
CVE-2026-98499Read original ↗ (opens in a new tab) - NVD
CVE-2026-98498 — In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_sha…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() When the reverse entry is found but its counter is already being released, refcount_inc_not_zero() fails and the reference taken by mlx5_tc_ct_entry_get() is never dropped before falling through to create_counter. Drop it so the reverse entry is not kept alive forever by a shared counter lookup that did not use it.
CVE-2026-98498Read original ↗ (opens in a new tab) - NVD
CVE-2026-98497 — In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix swapped IPv6 IPsec policy masks IPv6 XFRM…
High · CVSS 3.1 7.5 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix swapped IPv6 IPsec policy masks IPv6 XFRM policies may use different source and destination prefix lengths. mlx5e_ipsec_policy_mask() builds the corresponding masks independently, but setup_fte_addr6() installs each mask in the opposite address field. When the prefix lengths differ, this makes the source match use the destination prefix and the destination match use the source prefix. The resulting hardware rule can both miss traffi…
CVE-2026-98497Read original ↗ (opens in a new tab) - NVD
CVE-2026-98496 — In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdt_work after releasing the WD…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdt_work after releasing the WDT IRQ airoha_npu_remove() calls cancel_work_sync() on each core's wdt_work, but the watchdog IRQ that queues it is requested with devm_request_irq() and is freed only after .remove() returns. airoha_npu_wdt_handler() can therefore schedule_work() again once the cancel has returned. struct airoha_npu, which contains the work, is devm_kzalloc()'d and is freed in that same unwind, so the late wo…
CVE-2026-98496Read original ↗ (opens in a new tab) - NVD
CVE-2026-98495 — In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP io…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arp_dev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to dev_get_by_name_rcu() or __dev_get_by_name(), where strcmp() can read past the end of the stack object when a matching alternative interface name exists. Terminate the field before the lookup to prevent the out-of-bounds read.
CVE-2026-98495Read original ↗ (opens in a new tab) - NVD
CVE-2026-98494 — In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmb_tpd_next_…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read Same issue as atl1c (see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpd_cons read"): the hardware can report an out-of-range cmb_tpd_next_to_clean (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spin forever. Treat it as "nothing new to clean" instead.
CVE-2026-98494Read original ↗ (opens in a new tab) - NVD
CVE-2026-98493 — In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_in…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_init_options() appends the hostname (option 12), vendor-class (option 60) and client-ID (option 61) options into the fixed 312-byte bootp_pkt.exten[] buffer. Only the client-ID branch checked the remaining space; the hostname and vendor-class writes were unbounded. A 64-byte hostname together with the maximum 252-byte dhcpclass= identifier needs 18 + (2 + 64) + (2 + 252) = 338 of the 312 availa…
CVE-2026-98493Read original ↗ (opens in a new tab) - NVD
CVE-2026-98492 — In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dma_alloc_coherent() leak on macb_alloc()…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths Fix 3 leaks in macb_alloc() error paths: - Tx buffer allocated but crossing a 4G boundary: Tx leaked. - Rx buffer allocation fails: Tx leaked. - Rx buffer allocated but crossing a 4G boundary: Tx & Rx leaked. This is because our error handling calls macb_free(bp) which in turn frees the buffers stored in bp->queues[0], but nothing has been stored in there. Fix by storing allocate…
CVE-2026-98492Read original ↗ (opens in a new tab) - NVD
CVE-2026-98491 — In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unco…
High · CVSS 3.1 7.8 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1. The first clone wants to commit and runs the helpers wiring up the extension pointer into the expectation list. 2. Then it looses the confirmation keeping the entry unconfirmed. 3. Second clone now wants to commit labels a…
CVE-2026-98491Read original ↗ (opens in a new tab) - NVD
CVE-2026-98490 — In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to exten…
Critical · CVSS 3.1 9.8 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: -> nf_ct_helper() -> helper->help() -> nf_ct_expect_related_report() -> nf_ct_expect_insert() -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations) In case the connection is not confirmed yet, more extensions can be added afterwards with *_ext_add() calls reallocating the ex…
CVE-2026-98490Read original ↗ (opens in a new tab) - NVD
CVE-2026-98489 — In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpd_cons rea…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpd_cons read The hardware can report an out-of-range tpd_cons (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spin forever. To avoid a soft lockup treat it as "nothing new to clean" instead. Reproduced on two machines, same NIC (Qualcomm Atheros AR8151 v2.0, 4-port), triggered by rebooting a Mikrotik CCR2004 PCIe card that the po…
CVE-2026-98489Read original ↗ (opens in a new tab) - NVD
CVE-2026-98488 — In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hw_next_to_c…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read Same issue as atl1c (see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpd_cons read"): the hardware can report an out-of-range hw_next_to_clean (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spin forever. Treat it as "nothing new to clean" instead.
CVE-2026-98488Read original ↗ (opens in a new tab) - NVD
CVE-2026-98487 — In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion…
High · CVSS 3.1 7.8 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion br_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking mp->ports. br_multicast_del_pg() can re-enter the same MDB entry through br_multicast_sg_del_exclude_ports() and unlink other port groups. If the cursor points into one of those groups, the next iteration dereferences a stale cursor and can leave mp->ports pointing at freed memory. A following RTM_GETMDB exposes the dangling…
CVE-2026-98487Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.