Repository navigation
Releases
Releases · armbian/cve
Kernel security fixes 2026-11-11 23:22
Kernel security fixes 2026-11-11 23:22
Changes
- added 6.18: 8 patch(es)
- added 6.12: 8 patch(es)
- added 6.1: 10 patch(es)
6.1 (base 6.1.192, 530 fixes)
| CVE | Upstream | Source | Subject |
|---|---|---|---|
| CVE-2026-99286 | dc6d814562b6 |
stable-queue | xen-netback: Fix XenBus connection failure cleanup |
| CVE-2026-99287 | f96f16592a32 |
stable-queue | xen-netback: Zero out sring pointers on unmap |
| CVE-2026-99284 | 79dc34beb1fd |
stable-queue | net: skbuff: propagate shared-frag marker in skb_zerocopy() |
| CVE-2026-98466 | 3a8c562892b9 |
stable-queue | KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| CVE-2026-99271 | aa118c8f61d5 |
stable-queue | ALSA: line6: Clear prev_fbuf on capture buffer release |
| CVE-2026-99283 | bf80e6802273 |
stable-queue | netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets |
| CVE-2026-98439 | 4fd5bad647bf |
stable-queue | smb/server: cancel async requests when closing connection |
| CVE-2024-26690 | 38cc3c6dcc09 |
stable-queue | Revert "net: stmmac: protect updates of 64-bit statistics counters" |
| CVE-2026-89556 | 9a5ff4568932 |
stable-queue | module: validate string table section types |
| CVE-2026-89534 | 01500306e1d5 |
stable-queue | svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| CVE-2026-93221 | 11a5fe42e181 |
stable-queue | nfsd: convert nfsd_net boolean flags to unsigned long flags word |
| CVE-2026-90036 | 9026932ac8be |
stable-queue | NFSD: Prevent client use-after-free during blocked-lock reaping |
| CVE-2026-89812 | 48dc279c3010 |
stable-queue | drm/amdgpu: force complete the MES ring fences on reset |
| CVE-2026-93241 | 6b0d1083364f |
stable-queue | memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done |
| CVE-2026-97938 | 5a88f78df753 |
stable-queue | reboot: fix cad_pid use-after-free race |
| CVE-2026-99109 | 4aa2c106aef4 |
stable-queue | smb: client: reject SetEA requests that do not fit the request buffer |
| CVE-2026-99122 | ad9a7da3fa39 |
stable-queue | vsock/vmci: validate packet source for connected sockets |
| CVE-2026-99076 | ac76cab50e89 |
stable-queue | ipv6: udp: Create exceptions before socket matching |
| CVE-2026-98229 | 3cf5cdecd99c |
stable-queue | xfrm: save input state data before secpath resets |
| CVE-2026-89793 | 6e2b571b0a54 |
stable-queue | ublk: clear VM_MAYWRITE on read-only ublk char device mmap |
| CVE-2026-93240 | a3417097fb10 |
stable-queue | memcg: make the v1 soft limit knob inert |
| CVE-2026-99087 | 7d4d4f3b668d |
stable-queue | dm-integrity: fix NULL pointer dereference when the 'R' flag is used |
| CVE-2026-97562 | d806d5a85dcb |
stable-queue | smb: client: pin DFS superblock in iterator callback |
| CVE-2026-97929 | 8f5ef203abda |
stable-queue | ALSA: usbusx2y: validate URB actual_length in interrupt callback |
| CVE-2026-97949 | f06c2d26d199 |
stable-queue | configfs: unhash the dentry before dropping the item in rmdir |
| CVE-2026-97619 | 796aa0547557 |
stable-queue | io_uring/rw: end write accounting from ->ki_complete |
| CVE-2026-98254 | b7d7914a9ae3 |
stable-queue | swiotlb: use the adjusted address for the highmem page lookup |
| CVE-2026-98539 | 1abd643f3783 |
stable-queue | fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga |
| CVE-2026-98180 | 01c8d1f385f7 |
stable-queue | drm/msm: RCU-free the scheduler-containing ring and VM objects |
| CVE-2026-97906 | 7812d6dab069 |
stable-queue | bootconfig: Fix integer overflow in initrd size check |
| CVE-2026-97918 | 92383cef6679 |
stable-queue | tracing: Undo the registration when enabling the histogram trigger fails |
| CVE-2026-97933 | ed0aff60f83a |
stable-queue | tracing: Take trace_array reference when opening a tracer options file |
| CVE-2026-98222 | 8697c431e297 |
stable-queue | KEYS: encrypted: fix integer overflow of datablob_len |
| CVE-2026-98175 | c65eae6f61d1 |
stable-queue | smb: client: cancel reconnect work in clean_demultiplex_info() |
| CVE-2026-98174 | 5f270f091256 |
stable-queue | smb: client: fix rlist race and missing initialization |
| CVE-2026-98182 | 2b04d6556964 |
stable-queue | wifi: mac80211: refuse to make a monitor active when it has no queue |
| CVE-2026-98176 | c883d0a132d4 |
stable-queue | drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| CVE-2026-98177 | 8ee521b8b189 |
stable-queue | drm/amdkfd: Avoid integer underflow in EOP ring size calculation. |
| CVE-2026-98179 | 5155002b03b2 |
stable-queue | drm/amdgpu: fix rmmio iounmap skipped on device removal |
| CVE-2026-98506 | a363c62a653c |
stable-queue | mm/hugetlb: do not dissolve gigantic pages without runtime support |
| CVE-2026-98505 | 39c0ceedd545 |
stable-queue | mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() |
| CVE-2026-98449 | 8f6f8a48399f |
stable-queue | smb: client: delete compound mids on send failure before unlock |
| CVE-2026-98452 | d2ff5fb93ea8 |
stable-queue | smb: client: clean up failed cached directory opens |
| CVE-2026-98863 | 10180a277549 |
stable-queue | KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| CVE-2026-98503 | 951840561386 |
stable-queue | packet: use ubuf_info completion for TX_RING packets |
| CVE-2026-98859 | 5acb2dace582 |
stable-queue | HID: multitouch: stop the release timer from being rearmed on remove |
| CVE-2026-98715 | 60d93c27859f |
stable-queue | KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| CVE-2026-98714 | e27fc915c8f5 |
stable-queue | KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| CVE-2026-98720 | 2abb25273c82 |
stable-queue | KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified |
| CVE-2026-98738 | 81a2345f1984 |
stable-queue | Bluetooth: Serialize SMP remote OOB data access |
| CVE-2026-98734 | 848a7a91c7f0 |
stable-queue | Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown |
| CVE-2026-98852 | 5f0764cb1c81 |
stable-queue | net: extend IPv6 exthdr detection of tunneled packets |
| CVE-2026-98685 | 4721587f96cb |
stable-queue | smb: client: discard post-EOF pagecache when extending a file via clone range |
| CVE-2026-98684 | aa994489bd83 |
stable-queue | smb: client: flush and commit data before querying allocated ranges |
| CVE-2026-98683 | 8f8d32c1044f |
stable-queue | smb: client: flush dirty data before zeroing a range |
| CVE-2026-98682 | c9b1194e8ec9 |
stable-queue | smb: client: drain and invalidate before server-side copy/clone |
| CVE-2026-99086 | fc79aeb86a2c |
stable-queue | dm-integrity: validate the superblock on resume |
| CVE-2026-98989 | c640a01a78e4 |
stable-queue | namespace: check a recursive bind mount for mount namespace loops |
| CVE-2026-98786 | 217f64f348c9 |
stable-queue | drm/amd/display: guard dc_sink dereferences in MST mode validation |
| CVE-2026-98978 | f78ddcc87224 |
stable-queue | namespace: never expire a locked mount |
| CVE-2026-99021 | e2151c29cec7 |
stable-queue | regulator: of: fill in supply names in of_regulator_bulk_get_all() |
| CVE-2026-99026 | 489114c9ecae |
stable-queue | net: team: free skb when broadcast has no txable port |
| CVE-2026-99090 | 1a6023edfbb5 |
stable-queue | drm/amdgpu: serialize vblank counter reads against GPU reset |
| CVE-2026-99146 | 7dedc5bb11f9 |
stable-queue | drm/i915/dmc: Add sanity check for DMC load address |
| CVE-2026-99273 | a025c4991a7d |
stable-queue | ksmbd: reserve space for the UTF-16 terminator in stream info |
| CVE-2026-99270 | 97c8a3c1f73d |
stable-queue | tcp: Fix potential UAF in reqsk_timer_handler(). |
| CVE-2026-99274 | f5baa17a0f31 |
stable-queue | smb: client: fix fiemap wild read on empty truncated response |
| CVE-2026-99281 | ffdf678dd166 |
stable-queue | tun: Require CAP_NET_ADMIN to attach to an ownerless device |
| CVE-2026-72315 | 75f5c412fa86 |
stable-queue | smb: client: fix busy dentry warning on unmount after DIO |
| CVE-2026-99288 | 4e2b3ef19e0e |
stable-queue | inet: reject unhashed sockets during established lookups |
| CVE-2026-99272 | 2ec9cdf469dd |
stable-queue | smb: client: validate the data area in SMB2_read() |
| CVE-2024-27023 | 855678ed8534 |
mainline | md: Fix missing release of 'active_io' for flush |
| CVE-2024-41149 | 85672ca9ceea |
mainline | block: avoid to reuse hctx not removed from cpuhp callback list |
| CVE-2026-23451 | b7405dcf7385 |
mainline | bonding: prevent potential infinite loop in bond_header_parse() |
| CVE-2026-72434 | 4a597a87e2e2 |
mainline | netfilter: ipset: make sure gc is properly stopped |
| CVE-2026-93184 | 3359ba93d01a |
mainline | ASoC: fsl_audmix: rework runtime PM handling in probe |
| CVE-2026-68107 | 3b4082fabc67 |
mainline | drm/amdgpu/vcn4: avoid rereading IB param length |
| CVE-2026-68085 | 1b0d946d6f08 |
mainline | Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled |
| CVE-2026-68245 | 04cc4aa3617b |
mainline | drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() |
| CVE-2026-92491 | 2224b622260b |
mainline | firmware: arm_scmi: Roll back partial protocol table registration |
| CVE-2026-80579 | 95e647d2a530 |
mainline | fbdev: clear fb_info->mode before deleting a videomode |
| CVE-2026-90199 | 20fd9f64c005 |
mainline | fs/ntfs3: reject out-of-range evcn in mi_enum_attr() |
| CVE-2026-98161 | c644a2f8fef5 |
mainline | nvdimm: pmem: keep PREFLUSH before data writes |
| CVE-2026-98364 | 9fa903b24b1f |
mainline | xfrm: hold net_device reference under RCU in bundle creation |
| CVE-2026-98355 | 99c24a8968eb |
mainline | RDMA/rtrs: guard against null kobj name |
| CVE-2026-98058 | d05524794240 |
mainline | bpf: Mark syscall helpers as sleepable |
| CVE-2026-98321 | cbdd39ce4253 |
mainline | netfilter: nf_nat: unregister and release hooks on error |
| CVE-... |
Contributors
flags
Assets 6
Kernel security fixes 2026-11-10 21:30
Kernel security fixes 2026-11-10 21:30
Changes
- new-stable 6.18: 6.18.62 → 6.18.63
- added 6.18: 1 patch(es)
- retired 6.18: 1 patch(es) (landed upstream or superseded)
- new-stable 6.12: 6.12.116 → 6.12.117
- added 6.12: 9 patch(es)
- retired 6.12: 45 patch(es) (landed upstream or superseded)
- added 6.1: 4 patch(es)
- new-stable 7.3: 7.3.3 → 7.3.4
6.1 (base 6.1.192, 520 fixes)
| CVE | Upstream | Source | Subject |
|---|---|---|---|
| CVE-2026-99286 | dc6d814562b6 |
stable-queue | xen-netback: Fix XenBus connection failure cleanup |
| CVE-2026-99287 | f96f16592a32 |
stable-queue | xen-netback: Zero out sring pointers on unmap |
| CVE-2026-99284 | 79dc34beb1fd |
stable-queue | net: skbuff: propagate shared-frag marker in skb_zerocopy() |
| CVE-2026-98466 | 3a8c562892b9 |
stable-queue | KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| CVE-2026-99271 | aa118c8f61d5 |
stable-queue | ALSA: line6: Clear prev_fbuf on capture buffer release |
| CVE-2026-99283 | bf80e6802273 |
stable-queue | netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets |
| CVE-2026-98439 | 4fd5bad647bf |
stable-queue | smb/server: cancel async requests when closing connection |
| CVE-2024-26690 | 38cc3c6dcc09 |
stable-queue | Revert "net: stmmac: protect updates of 64-bit statistics counters" |
| CVE-2026-89556 | 9a5ff4568932 |
stable-queue | module: validate string table section types |
| CVE-2026-89534 | 01500306e1d5 |
stable-queue | svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| CVE-2026-93221 | 11a5fe42e181 |
stable-queue | nfsd: convert nfsd_net boolean flags to unsigned long flags word |
| CVE-2026-90036 | 9026932ac8be |
stable-queue | NFSD: Prevent client use-after-free during blocked-lock reaping |
| CVE-2026-89812 | 48dc279c3010 |
stable-queue | drm/amdgpu: force complete the MES ring fences on reset |
| CVE-2026-93241 | 6b0d1083364f |
stable-queue | memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done |
| CVE-2026-97938 | 5a88f78df753 |
stable-queue | reboot: fix cad_pid use-after-free race |
| CVE-2026-99109 | 4aa2c106aef4 |
stable-queue | smb: client: reject SetEA requests that do not fit the request buffer |
| CVE-2026-99122 | ad9a7da3fa39 |
stable-queue | vsock/vmci: validate packet source for connected sockets |
| CVE-2026-99076 | ac76cab50e89 |
stable-queue | ipv6: udp: Create exceptions before socket matching |
| CVE-2026-98229 | 3cf5cdecd99c |
stable-queue | xfrm: save input state data before secpath resets |
| CVE-2026-89793 | 6e2b571b0a54 |
stable-queue | ublk: clear VM_MAYWRITE on read-only ublk char device mmap |
| CVE-2026-93240 | a3417097fb10 |
stable-queue | memcg: make the v1 soft limit knob inert |
| CVE-2026-99087 | 7d4d4f3b668d |
stable-queue | dm-integrity: fix NULL pointer dereference when the 'R' flag is used |
| CVE-2026-97562 | d806d5a85dcb |
stable-queue | smb: client: pin DFS superblock in iterator callback |
| CVE-2026-97929 | 8f5ef203abda |
stable-queue | ALSA: usbusx2y: validate URB actual_length in interrupt callback |
| CVE-2026-97949 | f06c2d26d199 |
stable-queue | configfs: unhash the dentry before dropping the item in rmdir |
| CVE-2026-97619 | 796aa0547557 |
stable-queue | io_uring/rw: end write accounting from ->ki_complete |
| CVE-2026-98254 | b7d7914a9ae3 |
stable-queue | swiotlb: use the adjusted address for the highmem page lookup |
| CVE-2026-98539 | 1abd643f3783 |
stable-queue | fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga |
| CVE-2026-98180 | 01c8d1f385f7 |
stable-queue | drm/msm: RCU-free the scheduler-containing ring and VM objects |
| CVE-2026-97906 | 7812d6dab069 |
stable-queue | bootconfig: Fix integer overflow in initrd size check |
| CVE-2026-97918 | 92383cef6679 |
stable-queue | tracing: Undo the registration when enabling the histogram trigger fails |
| CVE-2026-97933 | ed0aff60f83a |
stable-queue | tracing: Take trace_array reference when opening a tracer options file |
| CVE-2026-98222 | 8697c431e297 |
stable-queue | KEYS: encrypted: fix integer overflow of datablob_len |
| CVE-2026-98175 | c65eae6f61d1 |
stable-queue | smb: client: cancel reconnect work in clean_demultiplex_info() |
| CVE-2026-98174 | 5f270f091256 |
stable-queue | smb: client: fix rlist race and missing initialization |
| CVE-2026-98182 | 2b04d6556964 |
stable-queue | wifi: mac80211: refuse to make a monitor active when it has no queue |
| CVE-2026-98176 | c883d0a132d4 |
stable-queue | drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| CVE-2026-98177 | 8ee521b8b189 |
stable-queue | drm/amdkfd: Avoid integer underflow in EOP ring size calculation. |
| CVE-2026-98179 | 5155002b03b2 |
stable-queue | drm/amdgpu: fix rmmio iounmap skipped on device removal |
| CVE-2026-98506 | a363c62a653c |
stable-queue | mm/hugetlb: do not dissolve gigantic pages without runtime support |
| CVE-2026-98505 | 39c0ceedd545 |
stable-queue | mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() |
| CVE-2026-98449 | 8f6f8a48399f |
stable-queue | smb: client: delete compound mids on send failure before unlock |
| CVE-2026-98452 | d2ff5fb93ea8 |
stable-queue | smb: client: clean up failed cached directory opens |
| CVE-2026-98863 | 10180a277549 |
stable-queue | KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| CVE-2026-98503 | 951840561386 |
stable-queue | packet: use ubuf_info completion for TX_RING packets |
| CVE-2026-98859 | 5acb2dace582 |
stable-queue | HID: multitouch: stop the release timer from being rearmed on remove |
| CVE-2026-98715 | 60d93c27859f |
stable-queue | KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| CVE-2026-98714 | e27fc915c8f5 |
stable-queue | KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| CVE-2026-98720 | 2abb25273c82 |
stable-queue | KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified |
| CVE-2026-98738 | 81a2345f1984 |
stable-queue | Bluetooth: Serialize SMP remote OOB data access |
| CVE-2026-98734 | 848a7a91c7f0 |
stable-queue | Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown |
| CVE-2026-98852 | 5f0764cb1c81 |
stable-queue | net: extend IPv6 exthdr detection of tunneled packets |
| CVE-2026-98685 | 4721587f96cb |
stable-queue | smb: client: discard post-EOF pagecache when extending a file via clone range |
| CVE-2026-98684 | aa994489bd83 |
stable-queue | smb: client: flush and commit data before querying allocated ranges |
| CVE-2026-98683 | 8f8d32c1044f |
stable-queue | smb: client: flush dirty data before zeroing a range |
| CVE-2026-98682 | c9b1194e8ec9 |
stable-queue | smb: client: drain and invalidate before server-side copy/clone |
| CVE-2026-99086 | fc79aeb86a2c |
stable-queue | dm-integrity: validate the superblock on resume |
| CVE-2026-98989 | c640a01a78e4 |
stable-queue | namespace: check a recursive bind mount for mount namespace loops |
| CVE-2026-98786 | 217f64f348c9 |
stable-queue | drm/amd/display: guard dc_sink dereferences in MST mode validation |
| CVE-2026-98978 | f78ddcc87224 |
stable-queue | namespace: never expire a locked mount |
| CVE-2026-99021 | e2151c29cec7 |
stable-queue | regulator: of: fill in supply names in of_regulator_bulk_get_all() |
| CVE-2026-99026 | 489114c9ecae |
stable-queue | net: team: free skb when broadcast has no txable port |
| CVE-2026-99090 | 1a6023edfbb5 |
stable-queue | drm/amdgpu: serialize vblank counter reads against GPU reset |
| CVE-2026-99146 | 7dedc5bb11f9 |
stable-queue | drm/i915/dmc: Add sanity check for DMC load address |
| CVE-2026-99273 | a025c4991a7d |
stable-queue | ksmbd: reserve space for the UTF-16 terminator in stream info |
| CVE-2026-99270 | 97c8a3c1f73d |
stable-queue | tcp: Fix potential UAF in reqsk_timer_handler(). |
| CVE-2026-99274 | f5baa17a0f31 |
stable-queue | smb: client: fix fiemap wild read on empty truncated response |
| CVE-2026-99281 | ffdf678dd166 |
stable-queue | tun: Require CAP_NET_ADMIN to attach to an ownerless device |
| CVE-2026-72315 | 75f5c412fa86 |
stable-queue | smb: client: fix busy dentry warning on unmount after DIO |
| CVE-2026-99288 | 4e2b3ef19e0e |
stable-queue | inet: reject unhashed sockets during established lookups |
| CVE-2026-99272 | 2ec9cdf469dd |
stable-queue | smb: client: validate the data area in SMB2_read() |
| CVE-2024-27023 | 855678ed8534 |
mainline | md: Fix missing release of 'active_io' for flush |
| CVE-2024-41149 | 85672ca9ceea |
mainline | block: avoid to reuse hctx not removed from cpuhp callback list |
| CVE-2026-23451 | b7405dcf7385 |
mainline | bonding: prevent potential infinite loop in bond_header_parse() |
| CVE-2026-72434 | 4a597a87e2e2 |
mainline | netfilter: ipset: make sure gc is properly stopped |
| CVE-2026-93184 | 3359ba93d01a |
mainline | ASoC: fsl_audmix: rework runtime PM handling in probe |
| CVE-2026-80579 | 95e647d2a530 |
mainline | fbdev: clear fb_info->mode before deleting a videomode |
| CVE-2026-98161 | c644a2f8fef5 |
mainline | nvdimm: pmem: keep PREFLUSH before data writes |
| CVE-2026-98364 | 9fa903b24b1f |
mainline | xfrm: hold net_device reference under RCU in bundle creation |
| CVE-2026-98355 | 99c24a8968eb |
mainline | RDMA/rtrs: guard against null kobj name |
| CVE-2026-98058 | d05524794240 |
mainline | bpf: Mark syscall helpers as sleepable |
| CVE-2026-98321 | cbdd39ce4253 |
mainline | netfilter: nf_nat: unregister and release hooks on error |
| CVE-2026-98292 | 8879e3e0a84a |
mainline | Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| CVE-2026-98285 | 2842ce397dd0 |
mainline | net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| CVE-2026-98828 | 93ce8ea70451 |
mainline | wifi: ath9k: reject short WMI command re... |
Contributors
flags
Assets 6
Kernel security fixes 2026-11-09 00:08
Kernel security fixes 2026-11-09 00:08
Changes
- added 6.12: 3 patch(es)
- added 6.1: 2 patch(es)
6.1 (base 6.1.192, 516 fixes)
| CVE | Upstream | Source | Subject |
|---|---|---|---|
| CVE-2026-99284 | 79dc34beb1fd |
stable-queue | net: skbuff: propagate shared-frag marker in skb_zerocopy() |
| CVE-2026-98466 | 3a8c562892b9 |
stable-queue | KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| CVE-2026-99271 | aa118c8f61d5 |
stable-queue | ALSA: line6: Clear prev_fbuf on capture buffer release |
| CVE-2026-99283 | bf80e6802273 |
stable-queue | netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets |
| CVE-2026-98439 | 4fd5bad647bf |
stable-queue | smb/server: cancel async requests when closing connection |
| CVE-2024-26690 | 38cc3c6dcc09 |
stable-queue | Revert "net: stmmac: protect updates of 64-bit statistics counters" |
| CVE-2026-89556 | 9a5ff4568932 |
stable-queue | module: validate string table section types |
| CVE-2026-89534 | 01500306e1d5 |
stable-queue | svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| CVE-2026-93221 | 11a5fe42e181 |
stable-queue | nfsd: convert nfsd_net boolean flags to unsigned long flags word |
| CVE-2026-90036 | 9026932ac8be |
stable-queue | NFSD: Prevent client use-after-free during blocked-lock reaping |
| CVE-2026-89812 | 48dc279c3010 |
stable-queue | drm/amdgpu: force complete the MES ring fences on reset |
| CVE-2026-93241 | 6b0d1083364f |
stable-queue | memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done |
| CVE-2026-97938 | 5a88f78df753 |
stable-queue | reboot: fix cad_pid use-after-free race |
| CVE-2026-99109 | 4aa2c106aef4 |
stable-queue | smb: client: reject SetEA requests that do not fit the request buffer |
| CVE-2026-99122 | ad9a7da3fa39 |
stable-queue | vsock/vmci: validate packet source for connected sockets |
| CVE-2026-99076 | ac76cab50e89 |
stable-queue | ipv6: udp: Create exceptions before socket matching |
| CVE-2026-98229 | 3cf5cdecd99c |
stable-queue | xfrm: save input state data before secpath resets |
| CVE-2026-89793 | 6e2b571b0a54 |
stable-queue | ublk: clear VM_MAYWRITE on read-only ublk char device mmap |
| CVE-2026-93240 | a3417097fb10 |
stable-queue | memcg: make the v1 soft limit knob inert |
| CVE-2026-99087 | 7d4d4f3b668d |
stable-queue | dm-integrity: fix NULL pointer dereference when the 'R' flag is used |
| CVE-2026-97562 | d806d5a85dcb |
stable-queue | smb: client: pin DFS superblock in iterator callback |
| CVE-2026-97929 | 8f5ef203abda |
stable-queue | ALSA: usbusx2y: validate URB actual_length in interrupt callback |
| CVE-2026-97949 | f06c2d26d199 |
stable-queue | configfs: unhash the dentry before dropping the item in rmdir |
| CVE-2026-97619 | 796aa0547557 |
stable-queue | io_uring/rw: end write accounting from ->ki_complete |
| CVE-2026-98254 | b7d7914a9ae3 |
stable-queue | swiotlb: use the adjusted address for the highmem page lookup |
| CVE-2026-98539 | 1abd643f3783 |
stable-queue | fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga |
| CVE-2026-98180 | 01c8d1f385f7 |
stable-queue | drm/msm: RCU-free the scheduler-containing ring and VM objects |
| CVE-2026-97906 | 7812d6dab069 |
stable-queue | bootconfig: Fix integer overflow in initrd size check |
| CVE-2026-97918 | 92383cef6679 |
stable-queue | tracing: Undo the registration when enabling the histogram trigger fails |
| CVE-2026-97933 | ed0aff60f83a |
stable-queue | tracing: Take trace_array reference when opening a tracer options file |
| CVE-2026-98222 | 8697c431e297 |
stable-queue | KEYS: encrypted: fix integer overflow of datablob_len |
| CVE-2026-98175 | c65eae6f61d1 |
stable-queue | smb: client: cancel reconnect work in clean_demultiplex_info() |
| CVE-2026-98174 | 5f270f091256 |
stable-queue | smb: client: fix rlist race and missing initialization |
| CVE-2026-98182 | 2b04d6556964 |
stable-queue | wifi: mac80211: refuse to make a monitor active when it has no queue |
| CVE-2026-98176 | c883d0a132d4 |
stable-queue | drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| CVE-2026-98177 | 8ee521b8b189 |
stable-queue | drm/amdkfd: Avoid integer underflow in EOP ring size calculation. |
| CVE-2026-98179 | 5155002b03b2 |
stable-queue | drm/amdgpu: fix rmmio iounmap skipped on device removal |
| CVE-2026-98506 | a363c62a653c |
stable-queue | mm/hugetlb: do not dissolve gigantic pages without runtime support |
| CVE-2026-98505 | 39c0ceedd545 |
stable-queue | mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() |
| CVE-2026-98449 | 8f6f8a48399f |
stable-queue | smb: client: delete compound mids on send failure before unlock |
| CVE-2026-98452 | d2ff5fb93ea8 |
stable-queue | smb: client: clean up failed cached directory opens |
| CVE-2026-98863 | 10180a277549 |
stable-queue | KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| CVE-2026-98503 | 951840561386 |
stable-queue | packet: use ubuf_info completion for TX_RING packets |
| CVE-2026-98859 | 5acb2dace582 |
stable-queue | HID: multitouch: stop the release timer from being rearmed on remove |
| CVE-2026-98715 | 60d93c27859f |
stable-queue | KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| CVE-2026-98714 | e27fc915c8f5 |
stable-queue | KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| CVE-2026-98720 | 2abb25273c82 |
stable-queue | KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified |
| CVE-2026-98738 | 81a2345f1984 |
stable-queue | Bluetooth: Serialize SMP remote OOB data access |
| CVE-2026-98734 | 848a7a91c7f0 |
stable-queue | Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown |
| CVE-2026-98852 | 5f0764cb1c81 |
stable-queue | net: extend IPv6 exthdr detection of tunneled packets |
| CVE-2026-98685 | 4721587f96cb |
stable-queue | smb: client: discard post-EOF pagecache when extending a file via clone range |
| CVE-2026-98684 | aa994489bd83 |
stable-queue | smb: client: flush and commit data before querying allocated ranges |
| CVE-2026-98683 | 8f8d32c1044f |
stable-queue | smb: client: flush dirty data before zeroing a range |
| CVE-2026-98682 | c9b1194e8ec9 |
stable-queue | smb: client: drain and invalidate before server-side copy/clone |
| CVE-2026-99086 | fc79aeb86a2c |
stable-queue | dm-integrity: validate the superblock on resume |
| CVE-2026-98989 | c640a01a78e4 |
stable-queue | namespace: check a recursive bind mount for mount namespace loops |
| CVE-2026-98786 | 217f64f348c9 |
stable-queue | drm/amd/display: guard dc_sink dereferences in MST mode validation |
| CVE-2026-98978 | f78ddcc87224 |
stable-queue | namespace: never expire a locked mount |
| CVE-2026-99021 | e2151c29cec7 |
stable-queue | regulator: of: fill in supply names in of_regulator_bulk_get_all() |
| CVE-2026-99026 | 489114c9ecae |
stable-queue | net: team: free skb when broadcast has no txable port |
| CVE-2026-99090 | 1a6023edfbb5 |
stable-queue | drm/amdgpu: serialize vblank counter reads against GPU reset |
| CVE-2026-99146 | 7dedc5bb11f9 |
stable-queue | drm/i915/dmc: Add sanity check for DMC load address |
| CVE-2026-99273 | a025c4991a7d |
stable-queue | ksmbd: reserve space for the UTF-16 terminator in stream info |
| CVE-2026-99270 | 97c8a3c1f73d |
stable-queue | tcp: Fix potential UAF in reqsk_timer_handler(). |
| CVE-2026-99274 | f5baa17a0f31 |
stable-queue | smb: client: fix fiemap wild read on empty truncated response |
| CVE-2026-99281 | ffdf678dd166 |
stable-queue | tun: Require CAP_NET_ADMIN to attach to an ownerless device |
| CVE-2026-72315 | 75f5c412fa86 |
stable-queue | smb: client: fix busy dentry warning on unmount after DIO |
| CVE-2024-27023 | 855678ed8534 |
mainline | md: Fix missing release of 'active_io' for flush |
| CVE-2024-41149 | 85672ca9ceea |
mainline | block: avoid to reuse hctx not removed from cpuhp callback list |
| CVE-2026-23451 | b7405dcf7385 |
mainline | bonding: prevent potential infinite loop in bond_header_parse() |
| CVE-2026-72434 | 4a597a87e2e2 |
mainline | netfilter: ipset: make sure gc is properly stopped |
| CVE-2026-93184 | 3359ba93d01a |
mainline | ASoC: fsl_audmix: rework runtime PM handling in probe |
| CVE-2026-80579 | 95e647d2a530 |
mainline | fbdev: clear fb_info->mode before deleting a videomode |
| CVE-2026-98161 | c644a2f8fef5 |
mainline | nvdimm: pmem: keep PREFLUSH before data writes |
| CVE-2026-98364 | 9fa903b24b1f |
mainline | xfrm: hold net_device reference under RCU in bundle creation |
| CVE-2026-98355 | 99c24a8968eb |
mainline | RDMA/rtrs: guard against null kobj name |
| CVE-2026-98058 | d05524794240 |
mainline | bpf: Mark syscall helpers as sleepable |
| CVE-2026-98321 | cbdd39ce4253 |
mainline | netfilter: nf_nat: unregister and release hooks on error |
| CVE-2026-98292 | 8879e3e0a84a |
mainline | Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| CVE-2026-98285 | 2842ce397dd0 |
mainline | net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| CVE-2026-98828 | 93ce8ea70451 |
mainline | wifi: ath9k: reject short WMI command responses |
| CVE-2026-98740 | b62a264163ca |
mainline | EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| CVE-2026-98810 | 6f63e919fe1e |
mainline | wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| CVE-2026-98966 | 184b5ddf82d4 |
mainline | bonding: fix the program leak when XDP is replaced |
| CVE-2026-98980 | 8189ab688f5a |
mainline | namei: don't reveal overmounted entries in refwalk |
| CVE-2024-40965 | 4268254a3948 |
stable-list | i2c: lpi2c: Avoid calling clk_get_rate during transfer |
| CVE-2024-40965 | — |
claude | i2c: lpi2c: lock the peripheral clock rate in probe |
| CVE-2025-39981 | `302... |
Contributors
flags
Assets 6
Kernel security fixes 2026-11-08 02:51
Kernel security fixes 2026-11-08 02:51
Changes
- new-stable 6.18: 6.18.60 → 6.18.62
- added 6.18: 1 patch(es)
- retired 6.18: 21 patch(es) (landed upstream or superseded)
- new-stable 6.12: 6.12.115 → 6.12.116
- added 6.12: 6 patch(es)
- new-stable 6.1: 6.1.191 → 6.1.192
- added 6.1: 7 patch(es)
- new-stable 7.3: 7.3.1 → 7.3.3
- retired 7.3: 7 patch(es) (landed upstream or superseded)
6.1 (base 6.1.192, 514 fixes)
| CVE | Upstream | Source | Subject |
|---|---|---|---|
| CVE-2026-99284 | 79dc34beb1fd |
stable-queue | net: skbuff: propagate shared-frag marker in skb_zerocopy() |
| CVE-2026-98466 | 3a8c562892b9 |
stable-queue | KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| CVE-2026-99271 | aa118c8f61d5 |
stable-queue | ALSA: line6: Clear prev_fbuf on capture buffer release |
| CVE-2026-99283 | bf80e6802273 |
stable-queue | netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets |
| CVE-2026-98439 | 4fd5bad647bf |
stable-queue | smb/server: cancel async requests when closing connection |
| CVE-2024-26690 | 38cc3c6dcc09 |
stable-queue | Revert "net: stmmac: protect updates of 64-bit statistics counters" |
| CVE-2026-89556 | 9a5ff4568932 |
stable-queue | module: validate string table section types |
| CVE-2026-89534 | 01500306e1d5 |
stable-queue | svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| CVE-2026-93221 | 11a5fe42e181 |
stable-queue | nfsd: convert nfsd_net boolean flags to unsigned long flags word |
| CVE-2026-90036 | 9026932ac8be |
stable-queue | NFSD: Prevent client use-after-free during blocked-lock reaping |
| CVE-2026-89812 | 48dc279c3010 |
stable-queue | drm/amdgpu: force complete the MES ring fences on reset |
| CVE-2026-93241 | 6b0d1083364f |
stable-queue | memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done |
| CVE-2026-97938 | 5a88f78df753 |
stable-queue | reboot: fix cad_pid use-after-free race |
| CVE-2026-99109 | 4aa2c106aef4 |
stable-queue | smb: client: reject SetEA requests that do not fit the request buffer |
| CVE-2026-99122 | ad9a7da3fa39 |
stable-queue | vsock/vmci: validate packet source for connected sockets |
| CVE-2026-99076 | ac76cab50e89 |
stable-queue | ipv6: udp: Create exceptions before socket matching |
| CVE-2026-98229 | 3cf5cdecd99c |
stable-queue | xfrm: save input state data before secpath resets |
| CVE-2026-89793 | 6e2b571b0a54 |
stable-queue | ublk: clear VM_MAYWRITE on read-only ublk char device mmap |
| CVE-2026-93240 | a3417097fb10 |
stable-queue | memcg: make the v1 soft limit knob inert |
| CVE-2026-99087 | 7d4d4f3b668d |
stable-queue | dm-integrity: fix NULL pointer dereference when the 'R' flag is used |
| CVE-2026-97562 | d806d5a85dcb |
stable-queue | smb: client: pin DFS superblock in iterator callback |
| CVE-2026-97929 | 8f5ef203abda |
stable-queue | ALSA: usbusx2y: validate URB actual_length in interrupt callback |
| CVE-2026-97949 | f06c2d26d199 |
stable-queue | configfs: unhash the dentry before dropping the item in rmdir |
| CVE-2026-97619 | 796aa0547557 |
stable-queue | io_uring/rw: end write accounting from ->ki_complete |
| CVE-2026-98254 | b7d7914a9ae3 |
stable-queue | swiotlb: use the adjusted address for the highmem page lookup |
| CVE-2026-98539 | 1abd643f3783 |
stable-queue | fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga |
| CVE-2026-98180 | 01c8d1f385f7 |
stable-queue | drm/msm: RCU-free the scheduler-containing ring and VM objects |
| CVE-2026-97906 | 7812d6dab069 |
stable-queue | bootconfig: Fix integer overflow in initrd size check |
| CVE-2026-97918 | 92383cef6679 |
stable-queue | tracing: Undo the registration when enabling the histogram trigger fails |
| CVE-2026-97933 | ed0aff60f83a |
stable-queue | tracing: Take trace_array reference when opening a tracer options file |
| CVE-2026-98222 | 8697c431e297 |
stable-queue | KEYS: encrypted: fix integer overflow of datablob_len |
| CVE-2026-98175 | c65eae6f61d1 |
stable-queue | smb: client: cancel reconnect work in clean_demultiplex_info() |
| CVE-2026-98174 | 5f270f091256 |
stable-queue | smb: client: fix rlist race and missing initialization |
| CVE-2026-98182 | 2b04d6556964 |
stable-queue | wifi: mac80211: refuse to make a monitor active when it has no queue |
| CVE-2026-98176 | c883d0a132d4 |
stable-queue | drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| CVE-2026-98177 | 8ee521b8b189 |
stable-queue | drm/amdkfd: Avoid integer underflow in EOP ring size calculation. |
| CVE-2026-98179 | 5155002b03b2 |
stable-queue | drm/amdgpu: fix rmmio iounmap skipped on device removal |
| CVE-2026-98506 | a363c62a653c |
stable-queue | mm/hugetlb: do not dissolve gigantic pages without runtime support |
| CVE-2026-98505 | 39c0ceedd545 |
stable-queue | mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() |
| CVE-2026-98449 | 8f6f8a48399f |
stable-queue | smb: client: delete compound mids on send failure before unlock |
| CVE-2026-98452 | d2ff5fb93ea8 |
stable-queue | smb: client: clean up failed cached directory opens |
| CVE-2026-98863 | 10180a277549 |
stable-queue | KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| CVE-2026-98503 | 951840561386 |
stable-queue | packet: use ubuf_info completion for TX_RING packets |
| CVE-2026-98859 | 5acb2dace582 |
stable-queue | HID: multitouch: stop the release timer from being rearmed on remove |
| CVE-2026-98715 | 60d93c27859f |
stable-queue | KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| CVE-2026-98714 | e27fc915c8f5 |
stable-queue | KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| CVE-2026-98720 | 2abb25273c82 |
stable-queue | KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified |
| CVE-2026-98738 | 81a2345f1984 |
stable-queue | Bluetooth: Serialize SMP remote OOB data access |
| CVE-2026-98734 | 848a7a91c7f0 |
stable-queue | Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown |
| CVE-2026-98852 | 5f0764cb1c81 |
stable-queue | net: extend IPv6 exthdr detection of tunneled packets |
| CVE-2026-98685 | 4721587f96cb |
stable-queue | smb: client: discard post-EOF pagecache when extending a file via clone range |
| CVE-2026-98684 | aa994489bd83 |
stable-queue | smb: client: flush and commit data before querying allocated ranges |
| CVE-2026-98683 | 8f8d32c1044f |
stable-queue | smb: client: flush dirty data before zeroing a range |
| CVE-2026-98682 | c9b1194e8ec9 |
stable-queue | smb: client: drain and invalidate before server-side copy/clone |
| CVE-2026-99086 | fc79aeb86a2c |
stable-queue | dm-integrity: validate the superblock on resume |
| CVE-2026-98989 | c640a01a78e4 |
stable-queue | namespace: check a recursive bind mount for mount namespace loops |
| CVE-2026-98786 | 217f64f348c9 |
stable-queue | drm/amd/display: guard dc_sink dereferences in MST mode validation |
| CVE-2026-98978 | f78ddcc87224 |
stable-queue | namespace: never expire a locked mount |
| CVE-2026-99021 | e2151c29cec7 |
stable-queue | regulator: of: fill in supply names in of_regulator_bulk_get_all() |
| CVE-2026-99026 | 489114c9ecae |
stable-queue | net: team: free skb when broadcast has no txable port |
| CVE-2026-99090 | 1a6023edfbb5 |
stable-queue | drm/amdgpu: serialize vblank counter reads against GPU reset |
| CVE-2026-99146 | 7dedc5bb11f9 |
stable-queue | drm/i915/dmc: Add sanity check for DMC load address |
| CVE-2026-99273 | a025c4991a7d |
stable-queue | ksmbd: reserve space for the UTF-16 terminator in stream info |
| CVE-2026-99270 | 97c8a3c1f73d |
stable-queue | tcp: Fix potential UAF in reqsk_timer_handler(). |
| CVE-2026-99274 | f5baa17a0f31 |
stable-queue | smb: client: fix fiemap wild read on empty truncated response |
| CVE-2026-99281 | ffdf678dd166 |
stable-queue | tun: Require CAP_NET_ADMIN to attach to an ownerless device |
| CVE-2026-72315 | 75f5c412fa86 |
stable-queue | smb: client: fix busy dentry warning on unmount after DIO |
| CVE-2024-27023 | 855678ed8534 |
mainline | md: Fix missing release of 'active_io' for flush |
| CVE-2024-41149 | 85672ca9ceea |
mainline | block: avoid to reuse hctx not removed from cpuhp callback list |
| CVE-2026-23451 | b7405dcf7385 |
mainline | bonding: prevent potential infinite loop in bond_header_parse() |
| CVE-2026-72434 | 4a597a87e2e2 |
mainline | netfilter: ipset: make sure gc is properly stopped |
| CVE-2026-93184 | 3359ba93d01a |
mainline | ASoC: fsl_audmix: rework runtime PM handling in probe |
| CVE-2026-80579 | 95e647d2a530 |
mainline | fbdev: clear fb_info->mode before deleting a videomode |
| CVE-2026-98161 | c644a2f8fef5 |
mainline | nvdimm: pmem: keep PREFLUSH before data writes |
| CVE-2026-98364 | 9fa903b24b1f |
mainline | xfrm: hold net_device reference under RCU in bundle creation |
| CVE-2026-98355 | 99c24a8968eb |
mainline | RDMA/rtrs: guard against null kobj name |
| CVE-2026-98058 | d05524794240 |
mainline | bpf: Mark syscall helpers as sleepable |
| CVE-2026-98321 | cbdd39ce4253 |
mainline | netfilter: nf_nat: unregister and release hooks on error |
| CVE-2026-98292 | 8879e3e0a84a |
mainline | Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| CVE-2026-98285 | 2842ce397dd0 |
mainline | net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| CVE-2026-98828 | 93ce8ea70451 |
mainline | wifi: ath9k: reject short WMI command responses |
| CVE-2026-98740 | b62a264163ca |
mainline | EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| CVE-2026-98810 | 6f63e919fe1e |
mainline | wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| CVE-2026-98966 | 184b5ddf82d4 |
mainline | bonding: fix the program leak when XDP is replaced |
| CVE-2026-98980 | `8189ab68... |
Contributors
flags
Assets 6
Kernel security fixes 2026-11-07 17:03
Kernel security fixes 2026-11-07 17:03
Changes
- new-stable 6.18: 6.18.60 → 6.18.62
- added 6.18: 1 patch(es)
- retired 6.18: 21 patch(es) (landed upstream or superseded)
- new-stable 6.12: 6.12.115 → 6.12.116
- added 6.12: 4 patch(es)
- new-stable 6.1: 6.1.191 → 6.1.192
- added 6.1: 5 patch(es)
- new-stable 7.3: 7.3.1 → 7.3.3
- retired 7.3: 7 patch(es) (landed upstream or superseded)
6.1 (base 6.1.192, 512 fixes)
| CVE | Upstream | Source | Subject |
|---|---|---|---|
| CVE-2026-98466 | 3a8c562892b9 |
stable-queue | KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| CVE-2026-99271 | aa118c8f61d5 |
stable-queue | ALSA: line6: Clear prev_fbuf on capture buffer release |
| CVE-2026-98439 | 4fd5bad647bf |
stable-queue | smb/server: cancel async requests when closing connection |
| CVE-2024-26690 | 38cc3c6dcc09 |
stable-queue | Revert "net: stmmac: protect updates of 64-bit statistics counters" |
| CVE-2026-89556 | 9a5ff4568932 |
stable-queue | module: validate string table section types |
| CVE-2026-89534 | 01500306e1d5 |
stable-queue | svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| CVE-2026-93221 | 11a5fe42e181 |
stable-queue | nfsd: convert nfsd_net boolean flags to unsigned long flags word |
| CVE-2026-90036 | 9026932ac8be |
stable-queue | NFSD: Prevent client use-after-free during blocked-lock reaping |
| CVE-2026-89812 | 48dc279c3010 |
stable-queue | drm/amdgpu: force complete the MES ring fences on reset |
| CVE-2026-93241 | 6b0d1083364f |
stable-queue | memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done |
| CVE-2026-97938 | 5a88f78df753 |
stable-queue | reboot: fix cad_pid use-after-free race |
| CVE-2026-99109 | 4aa2c106aef4 |
stable-queue | smb: client: reject SetEA requests that do not fit the request buffer |
| CVE-2026-99122 | ad9a7da3fa39 |
stable-queue | vsock/vmci: validate packet source for connected sockets |
| CVE-2026-99076 | ac76cab50e89 |
stable-queue | ipv6: udp: Create exceptions before socket matching |
| CVE-2026-98229 | 3cf5cdecd99c |
stable-queue | xfrm: save input state data before secpath resets |
| CVE-2026-89793 | 6e2b571b0a54 |
stable-queue | ublk: clear VM_MAYWRITE on read-only ublk char device mmap |
| CVE-2026-93240 | a3417097fb10 |
stable-queue | memcg: make the v1 soft limit knob inert |
| CVE-2026-99087 | 7d4d4f3b668d |
stable-queue | dm-integrity: fix NULL pointer dereference when the 'R' flag is used |
| CVE-2026-97562 | d806d5a85dcb |
stable-queue | smb: client: pin DFS superblock in iterator callback |
| CVE-2026-97929 | 8f5ef203abda |
stable-queue | ALSA: usbusx2y: validate URB actual_length in interrupt callback |
| CVE-2026-97949 | f06c2d26d199 |
stable-queue | configfs: unhash the dentry before dropping the item in rmdir |
| CVE-2026-97619 | 796aa0547557 |
stable-queue | io_uring/rw: end write accounting from ->ki_complete |
| CVE-2026-98254 | b7d7914a9ae3 |
stable-queue | swiotlb: use the adjusted address for the highmem page lookup |
| CVE-2026-98539 | 1abd643f3783 |
stable-queue | fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga |
| CVE-2026-98180 | 01c8d1f385f7 |
stable-queue | drm/msm: RCU-free the scheduler-containing ring and VM objects |
| CVE-2026-97906 | 7812d6dab069 |
stable-queue | bootconfig: Fix integer overflow in initrd size check |
| CVE-2026-97918 | 92383cef6679 |
stable-queue | tracing: Undo the registration when enabling the histogram trigger fails |
| CVE-2026-97933 | ed0aff60f83a |
stable-queue | tracing: Take trace_array reference when opening a tracer options file |
| CVE-2026-98222 | 8697c431e297 |
stable-queue | KEYS: encrypted: fix integer overflow of datablob_len |
| CVE-2026-98175 | c65eae6f61d1 |
stable-queue | smb: client: cancel reconnect work in clean_demultiplex_info() |
| CVE-2026-98174 | 5f270f091256 |
stable-queue | smb: client: fix rlist race and missing initialization |
| CVE-2026-98182 | 2b04d6556964 |
stable-queue | wifi: mac80211: refuse to make a monitor active when it has no queue |
| CVE-2026-98176 | c883d0a132d4 |
stable-queue | drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| CVE-2026-98177 | 8ee521b8b189 |
stable-queue | drm/amdkfd: Avoid integer underflow in EOP ring size calculation. |
| CVE-2026-98179 | 5155002b03b2 |
stable-queue | drm/amdgpu: fix rmmio iounmap skipped on device removal |
| CVE-2026-98506 | a363c62a653c |
stable-queue | mm/hugetlb: do not dissolve gigantic pages without runtime support |
| CVE-2026-98505 | 39c0ceedd545 |
stable-queue | mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() |
| CVE-2026-98449 | 8f6f8a48399f |
stable-queue | smb: client: delete compound mids on send failure before unlock |
| CVE-2026-98452 | d2ff5fb93ea8 |
stable-queue | smb: client: clean up failed cached directory opens |
| CVE-2026-98863 | 10180a277549 |
stable-queue | KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| CVE-2026-98503 | 951840561386 |
stable-queue | packet: use ubuf_info completion for TX_RING packets |
| CVE-2026-98859 | 5acb2dace582 |
stable-queue | HID: multitouch: stop the release timer from being rearmed on remove |
| CVE-2026-98715 | 60d93c27859f |
stable-queue | KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| CVE-2026-98714 | e27fc915c8f5 |
stable-queue | KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| CVE-2026-98720 | 2abb25273c82 |
stable-queue | KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified |
| CVE-2026-98738 | 81a2345f1984 |
stable-queue | Bluetooth: Serialize SMP remote OOB data access |
| CVE-2026-98734 | 848a7a91c7f0 |
stable-queue | Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown |
| CVE-2026-98852 | 5f0764cb1c81 |
stable-queue | net: extend IPv6 exthdr detection of tunneled packets |
| CVE-2026-98685 | 4721587f96cb |
stable-queue | smb: client: discard post-EOF pagecache when extending a file via clone range |
| CVE-2026-98684 | aa994489bd83 |
stable-queue | smb: client: flush and commit data before querying allocated ranges |
| CVE-2026-98683 | 8f8d32c1044f |
stable-queue | smb: client: flush dirty data before zeroing a range |
| CVE-2026-98682 | c9b1194e8ec9 |
stable-queue | smb: client: drain and invalidate before server-side copy/clone |
| CVE-2026-99086 | fc79aeb86a2c |
stable-queue | dm-integrity: validate the superblock on resume |
| CVE-2026-98989 | c640a01a78e4 |
stable-queue | namespace: check a recursive bind mount for mount namespace loops |
| CVE-2026-98786 | 217f64f348c9 |
stable-queue | drm/amd/display: guard dc_sink dereferences in MST mode validation |
| CVE-2026-98978 | f78ddcc87224 |
stable-queue | namespace: never expire a locked mount |
| CVE-2026-99021 | e2151c29cec7 |
stable-queue | regulator: of: fill in supply names in of_regulator_bulk_get_all() |
| CVE-2026-99026 | 489114c9ecae |
stable-queue | net: team: free skb when broadcast has no txable port |
| CVE-2026-99090 | 1a6023edfbb5 |
stable-queue | drm/amdgpu: serialize vblank counter reads against GPU reset |
| CVE-2026-99146 | 7dedc5bb11f9 |
stable-queue | drm/i915/dmc: Add sanity check for DMC load address |
| CVE-2026-99273 | a025c4991a7d |
stable-queue | ksmbd: reserve space for the UTF-16 terminator in stream info |
| CVE-2026-99270 | 97c8a3c1f73d |
stable-queue | tcp: Fix potential UAF in reqsk_timer_handler(). |
| CVE-2026-99274 | f5baa17a0f31 |
stable-queue | smb: client: fix fiemap wild read on empty truncated response |
| CVE-2026-99281 | ffdf678dd166 |
stable-queue | tun: Require CAP_NET_ADMIN to attach to an ownerless device |
| CVE-2026-72315 | 75f5c412fa86 |
stable-queue | smb: client: fix busy dentry warning on unmount after DIO |
| CVE-2024-27023 | 855678ed8534 |
mainline | md: Fix missing release of 'active_io' for flush |
| CVE-2024-41149 | 85672ca9ceea |
mainline | block: avoid to reuse hctx not removed from cpuhp callback list |
| CVE-2026-23451 | b7405dcf7385 |
mainline | bonding: prevent potential infinite loop in bond_header_parse() |
| CVE-2026-72434 | 4a597a87e2e2 |
mainline | netfilter: ipset: make sure gc is properly stopped |
| CVE-2026-93184 | 3359ba93d01a |
mainline | ASoC: fsl_audmix: rework runtime PM handling in probe |
| CVE-2026-80579 | 95e647d2a530 |
mainline | fbdev: clear fb_info->mode before deleting a videomode |
| CVE-2026-98161 | c644a2f8fef5 |
mainline | nvdimm: pmem: keep PREFLUSH before data writes |
| CVE-2026-98364 | 9fa903b24b1f |
mainline | xfrm: hold net_device reference under RCU in bundle creation |
| CVE-2026-98355 | 99c24a8968eb |
mainline | RDMA/rtrs: guard against null kobj name |
| CVE-2026-98058 | d05524794240 |
mainline | bpf: Mark syscall helpers as sleepable |
| CVE-2026-98321 | cbdd39ce4253 |
mainline | netfilter: nf_nat: unregister and release hooks on error |
| CVE-2026-98292 | 8879e3e0a84a |
mainline | Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| CVE-2026-98285 | 2842ce397dd0 |
mainline | net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| CVE-2026-98828 | 93ce8ea70451 |
mainline | wifi: ath9k: reject short WMI command responses |
| CVE-2026-98740 | b62a264163ca |
mainline | EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| CVE-2026-98810 | 6f63e919fe1e |
mainline | wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| CVE-2026-98966 | 184b5ddf82d4 |
mainline | bonding: fix the program leak when XDP is replaced |
| CVE-2026-98980 | 8189ab688f5a |
mainline | namei: don't reveal overmounted entries in refwalk |
| CVE-2024-40965 | 4268254a3948 |
stable-list | i2c: lpi2c: Avoid calling clk_get_rate during transfer |
| CVE-2024-40965 | — |
claude | i2c: lpi2c: lock the perip... |
Contributors
flags
Assets 6
Kernel security fixes 2026-11-04 19:41
Kernel security fixes 2026-11-04 19:41
Changes
- retired 7.3: 6 patch(es) (landed upstream or superseded)
6.1 (base 6.1.191, 507 fixes)
| CVE | Upstream | Source | Subject |
|---|---|---|---|
| CVE-2026-98466 | 3a8c562892b9 |
stable-queue | KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| CVE-2026-98439 | 4fd5bad647bf |
stable-queue | smb/server: cancel async requests when closing connection |
| CVE-2024-26690 | 38cc3c6dcc09 |
stable-queue | Revert "net: stmmac: protect updates of 64-bit statistics counters" |
| CVE-2026-89556 | 9a5ff4568932 |
stable-queue | module: validate string table section types |
| CVE-2026-89534 | 01500306e1d5 |
stable-queue | svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| CVE-2026-93221 | 11a5fe42e181 |
stable-queue | nfsd: convert nfsd_net boolean flags to unsigned long flags word |
| CVE-2026-90036 | 9026932ac8be |
stable-queue | NFSD: Prevent client use-after-free during blocked-lock reaping |
| CVE-2026-89812 | 48dc279c3010 |
stable-queue | drm/amdgpu: force complete the MES ring fences on reset |
| CVE-2026-93241 | 6b0d1083364f |
stable-queue | memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done |
| CVE-2026-97938 | 5a88f78df753 |
stable-queue | reboot: fix cad_pid use-after-free race |
| CVE-2026-99109 | 4aa2c106aef4 |
stable-queue | smb: client: reject SetEA requests that do not fit the request buffer |
| CVE-2026-99122 | ad9a7da3fa39 |
stable-queue | vsock/vmci: validate packet source for connected sockets |
| CVE-2026-99076 | ac76cab50e89 |
stable-queue | ipv6: udp: Create exceptions before socket matching |
| CVE-2026-98229 | 3cf5cdecd99c |
stable-queue | xfrm: save input state data before secpath resets |
| CVE-2026-89793 | 6e2b571b0a54 |
stable-queue | ublk: clear VM_MAYWRITE on read-only ublk char device mmap |
| CVE-2026-93240 | a3417097fb10 |
stable-queue | memcg: make the v1 soft limit knob inert |
| CVE-2026-99087 | 7d4d4f3b668d |
stable-queue | dm-integrity: fix NULL pointer dereference when the 'R' flag is used |
| CVE-2026-97562 | d806d5a85dcb |
stable-queue | smb: client: pin DFS superblock in iterator callback |
| CVE-2026-97929 | 8f5ef203abda |
stable-queue | ALSA: usbusx2y: validate URB actual_length in interrupt callback |
| CVE-2026-97949 | f06c2d26d199 |
stable-queue | configfs: unhash the dentry before dropping the item in rmdir |
| CVE-2026-97619 | 796aa0547557 |
stable-queue | io_uring/rw: end write accounting from ->ki_complete |
| CVE-2026-98254 | b7d7914a9ae3 |
stable-queue | swiotlb: use the adjusted address for the highmem page lookup |
| CVE-2026-98539 | 1abd643f3783 |
stable-queue | fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga |
| CVE-2026-98180 | 01c8d1f385f7 |
stable-queue | drm/msm: RCU-free the scheduler-containing ring and VM objects |
| CVE-2026-97906 | 7812d6dab069 |
stable-queue | bootconfig: Fix integer overflow in initrd size check |
| CVE-2026-97918 | 92383cef6679 |
stable-queue | tracing: Undo the registration when enabling the histogram trigger fails |
| CVE-2026-97933 | ed0aff60f83a |
stable-queue | tracing: Take trace_array reference when opening a tracer options file |
| CVE-2026-98222 | 8697c431e297 |
stable-queue | KEYS: encrypted: fix integer overflow of datablob_len |
| CVE-2026-98175 | c65eae6f61d1 |
stable-queue | smb: client: cancel reconnect work in clean_demultiplex_info() |
| CVE-2026-98174 | 5f270f091256 |
stable-queue | smb: client: fix rlist race and missing initialization |
| CVE-2026-98182 | 2b04d6556964 |
stable-queue | wifi: mac80211: refuse to make a monitor active when it has no queue |
| CVE-2026-98176 | c883d0a132d4 |
stable-queue | drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| CVE-2026-98177 | 8ee521b8b189 |
stable-queue | drm/amdkfd: Avoid integer underflow in EOP ring size calculation. |
| CVE-2026-98179 | 5155002b03b2 |
stable-queue | drm/amdgpu: fix rmmio iounmap skipped on device removal |
| CVE-2026-98506 | a363c62a653c |
stable-queue | mm/hugetlb: do not dissolve gigantic pages without runtime support |
| CVE-2026-98505 | 39c0ceedd545 |
stable-queue | mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() |
| CVE-2026-98449 | 8f6f8a48399f |
stable-queue | smb: client: delete compound mids on send failure before unlock |
| CVE-2026-98452 | d2ff5fb93ea8 |
stable-queue | smb: client: clean up failed cached directory opens |
| CVE-2026-98863 | 10180a277549 |
stable-queue | KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| CVE-2026-98503 | 951840561386 |
stable-queue | packet: use ubuf_info completion for TX_RING packets |
| CVE-2026-98859 | 5acb2dace582 |
stable-queue | HID: multitouch: stop the release timer from being rearmed on remove |
| CVE-2026-98715 | 60d93c27859f |
stable-queue | KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| CVE-2026-98714 | e27fc915c8f5 |
stable-queue | KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| CVE-2026-98720 | 2abb25273c82 |
stable-queue | KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified |
| CVE-2026-98738 | 81a2345f1984 |
stable-queue | Bluetooth: Serialize SMP remote OOB data access |
| CVE-2026-98734 | 848a7a91c7f0 |
stable-queue | Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown |
| CVE-2026-98852 | 5f0764cb1c81 |
stable-queue | net: extend IPv6 exthdr detection of tunneled packets |
| CVE-2026-98685 | 4721587f96cb |
stable-queue | smb: client: discard post-EOF pagecache when extending a file via clone range |
| CVE-2026-98684 | aa994489bd83 |
stable-queue | smb: client: flush and commit data before querying allocated ranges |
| CVE-2026-98683 | 8f8d32c1044f |
stable-queue | smb: client: flush dirty data before zeroing a range |
| CVE-2026-98682 | c9b1194e8ec9 |
stable-queue | smb: client: drain and invalidate before server-side copy/clone |
| CVE-2026-99086 | fc79aeb86a2c |
stable-queue | dm-integrity: validate the superblock on resume |
| CVE-2026-98989 | c640a01a78e4 |
stable-queue | namespace: check a recursive bind mount for mount namespace loops |
| CVE-2026-98786 | 217f64f348c9 |
stable-queue | drm/amd/display: guard dc_sink dereferences in MST mode validation |
| CVE-2026-98978 | f78ddcc87224 |
stable-queue | namespace: never expire a locked mount |
| CVE-2026-99021 | e2151c29cec7 |
stable-queue | regulator: of: fill in supply names in of_regulator_bulk_get_all() |
| CVE-2026-99026 | 489114c9ecae |
stable-queue | net: team: free skb when broadcast has no txable port |
| CVE-2026-99090 | 1a6023edfbb5 |
stable-queue | drm/amdgpu: serialize vblank counter reads against GPU reset |
| CVE-2026-99146 | 7dedc5bb11f9 |
stable-queue | drm/i915/dmc: Add sanity check for DMC load address |
| CVE-2026-99270 | 97c8a3c1f73d |
stable-queue | tcp: Fix potential UAF in reqsk_timer_handler(). |
| CVE-2024-27023 | 855678ed8534 |
mainline | md: Fix missing release of 'active_io' for flush |
| CVE-2024-41149 | 85672ca9ceea |
mainline | block: avoid to reuse hctx not removed from cpuhp callback list |
| CVE-2026-23451 | b7405dcf7385 |
mainline | bonding: prevent potential infinite loop in bond_header_parse() |
| CVE-2026-72434 | 4a597a87e2e2 |
mainline | netfilter: ipset: make sure gc is properly stopped |
| CVE-2026-93184 | 3359ba93d01a |
mainline | ASoC: fsl_audmix: rework runtime PM handling in probe |
| CVE-2026-80579 | 95e647d2a530 |
mainline | fbdev: clear fb_info->mode before deleting a videomode |
| CVE-2026-98161 | c644a2f8fef5 |
mainline | nvdimm: pmem: keep PREFLUSH before data writes |
| CVE-2026-98364 | 9fa903b24b1f |
mainline | xfrm: hold net_device reference under RCU in bundle creation |
| CVE-2026-98355 | 99c24a8968eb |
mainline | RDMA/rtrs: guard against null kobj name |
| CVE-2026-98058 | d05524794240 |
mainline | bpf: Mark syscall helpers as sleepable |
| CVE-2026-98321 | cbdd39ce4253 |
mainline | netfilter: nf_nat: unregister and release hooks on error |
| CVE-2026-98292 | 8879e3e0a84a |
mainline | Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| CVE-2026-98285 | 2842ce397dd0 |
mainline | net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| CVE-2026-98828 | 93ce8ea70451 |
mainline | wifi: ath9k: reject short WMI command responses |
| CVE-2026-98740 | b62a264163ca |
mainline | EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| CVE-2026-98810 | 6f63e919fe1e |
mainline | wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| CVE-2026-98966 | 184b5ddf82d4 |
mainline | bonding: fix the program leak when XDP is replaced |
| CVE-2026-98980 | 8189ab688f5a |
mainline | namei: don't reveal overmounted entries in refwalk |
| CVE-2024-40965 | 4268254a3948 |
stable-list | i2c: lpi2c: Avoid calling clk_get_rate during transfer |
| CVE-2024-40965 | — |
claude | i2c: lpi2c: lock the peripheral clock rate in probe |
| CVE-2025-39981 | 302a1f674c00 |
stable-list | Bluetooth: MGMT: Fix possible UAFs |
| CVE-2025-39981 | e8785404de06 |
claude | Bluetooth: MGMT: fix crash in set_mesh_sync and |
| CVE-2025-39981 | 1b9c17fd0a7f |
claude | Bluetooth: MGMT: Fix memory leak in set_ssp_complete |
| CVE-2025-39981 | 17f89341cb42 |
claude | Bluetooth: MGMT: Fix list corruption and UAF in command |
| CVE-2025-39981 | 5f5fa4cd35f7 |
claude | Bluetooth: MGMT: Fix dangling pointer on |
| CVE-2026-64109 | be309f8eae8b |
stable-list | af_unix: Fix UAF read of tail->len in unix_stream_data_wait() |
| CVE-2026-80670 | afa4363a91a1 |
claude | perf stat: Introduce perf_env__get_cpu_topology() to guard |
| CVE-2026-80670 | 5484b43a0ec8 |
stable-list | perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| CV... |
Contributors
flags
Assets 6
Kernel security fixes 2026-11-04 00:22
Kernel security fixes 2026-11-04 00:22
6.1 (base 6.1.191, 507 fixes)
| CVE | Upstream | Source | Subject |
|---|---|---|---|
| CVE-2026-98466 | 3a8c562892b9 |
stable-queue | KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| CVE-2026-98439 | 4fd5bad647bf |
stable-queue | smb/server: cancel async requests when closing connection |
| CVE-2024-26690 | 38cc3c6dcc09 |
stable-queue | Revert "net: stmmac: protect updates of 64-bit statistics counters" |
| CVE-2026-89556 | 9a5ff4568932 |
stable-queue | module: validate string table section types |
| CVE-2026-89534 | 01500306e1d5 |
stable-queue | svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| CVE-2026-93221 | 11a5fe42e181 |
stable-queue | nfsd: convert nfsd_net boolean flags to unsigned long flags word |
| CVE-2026-90036 | 9026932ac8be |
stable-queue | NFSD: Prevent client use-after-free during blocked-lock reaping |
| CVE-2026-89812 | 48dc279c3010 |
stable-queue | drm/amdgpu: force complete the MES ring fences on reset |
| CVE-2026-93241 | 6b0d1083364f |
stable-queue | memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done |
| CVE-2026-97938 | 5a88f78df753 |
stable-queue | reboot: fix cad_pid use-after-free race |
| CVE-2026-99109 | 4aa2c106aef4 |
stable-queue | smb: client: reject SetEA requests that do not fit the request buffer |
| CVE-2026-99122 | ad9a7da3fa39 |
stable-queue | vsock/vmci: validate packet source for connected sockets |
| CVE-2026-99076 | ac76cab50e89 |
stable-queue | ipv6: udp: Create exceptions before socket matching |
| CVE-2026-98229 | 3cf5cdecd99c |
stable-queue | xfrm: save input state data before secpath resets |
| CVE-2026-89793 | 6e2b571b0a54 |
stable-queue | ublk: clear VM_MAYWRITE on read-only ublk char device mmap |
| CVE-2026-93240 | a3417097fb10 |
stable-queue | memcg: make the v1 soft limit knob inert |
| CVE-2026-99087 | 7d4d4f3b668d |
stable-queue | dm-integrity: fix NULL pointer dereference when the 'R' flag is used |
| CVE-2026-97562 | d806d5a85dcb |
stable-queue | smb: client: pin DFS superblock in iterator callback |
| CVE-2026-97929 | 8f5ef203abda |
stable-queue | ALSA: usbusx2y: validate URB actual_length in interrupt callback |
| CVE-2026-97949 | f06c2d26d199 |
stable-queue | configfs: unhash the dentry before dropping the item in rmdir |
| CVE-2026-97619 | 796aa0547557 |
stable-queue | io_uring/rw: end write accounting from ->ki_complete |
| CVE-2026-98254 | b7d7914a9ae3 |
stable-queue | swiotlb: use the adjusted address for the highmem page lookup |
| CVE-2026-98539 | 1abd643f3783 |
stable-queue | fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga |
| CVE-2026-98180 | 01c8d1f385f7 |
stable-queue | drm/msm: RCU-free the scheduler-containing ring and VM objects |
| CVE-2026-97906 | 7812d6dab069 |
stable-queue | bootconfig: Fix integer overflow in initrd size check |
| CVE-2026-97918 | 92383cef6679 |
stable-queue | tracing: Undo the registration when enabling the histogram trigger fails |
| CVE-2026-97933 | ed0aff60f83a |
stable-queue | tracing: Take trace_array reference when opening a tracer options file |
| CVE-2026-98222 | 8697c431e297 |
stable-queue | KEYS: encrypted: fix integer overflow of datablob_len |
| CVE-2026-98175 | c65eae6f61d1 |
stable-queue | smb: client: cancel reconnect work in clean_demultiplex_info() |
| CVE-2026-98174 | 5f270f091256 |
stable-queue | smb: client: fix rlist race and missing initialization |
| CVE-2026-98182 | 2b04d6556964 |
stable-queue | wifi: mac80211: refuse to make a monitor active when it has no queue |
| CVE-2026-98176 | c883d0a132d4 |
stable-queue | drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| CVE-2026-98177 | 8ee521b8b189 |
stable-queue | drm/amdkfd: Avoid integer underflow in EOP ring size calculation. |
| CVE-2026-98179 | 5155002b03b2 |
stable-queue | drm/amdgpu: fix rmmio iounmap skipped on device removal |
| CVE-2026-98506 | a363c62a653c |
stable-queue | mm/hugetlb: do not dissolve gigantic pages without runtime support |
| CVE-2026-98505 | 39c0ceedd545 |
stable-queue | mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() |
| CVE-2026-98449 | 8f6f8a48399f |
stable-queue | smb: client: delete compound mids on send failure before unlock |
| CVE-2026-98452 | d2ff5fb93ea8 |
stable-queue | smb: client: clean up failed cached directory opens |
| CVE-2026-98863 | 10180a277549 |
stable-queue | KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| CVE-2026-98503 | 951840561386 |
stable-queue | packet: use ubuf_info completion for TX_RING packets |
| CVE-2026-98859 | 5acb2dace582 |
stable-queue | HID: multitouch: stop the release timer from being rearmed on remove |
| CVE-2026-98715 | 60d93c27859f |
stable-queue | KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| CVE-2026-98714 | e27fc915c8f5 |
stable-queue | KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| CVE-2026-98720 | 2abb25273c82 |
stable-queue | KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified |
| CVE-2026-98738 | 81a2345f1984 |
stable-queue | Bluetooth: Serialize SMP remote OOB data access |
| CVE-2026-98734 | 848a7a91c7f0 |
stable-queue | Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown |
| CVE-2026-98852 | 5f0764cb1c81 |
stable-queue | net: extend IPv6 exthdr detection of tunneled packets |
| CVE-2026-98685 | 4721587f96cb |
stable-queue | smb: client: discard post-EOF pagecache when extending a file via clone range |
| CVE-2026-98684 | aa994489bd83 |
stable-queue | smb: client: flush and commit data before querying allocated ranges |
| CVE-2026-98683 | 8f8d32c1044f |
stable-queue | smb: client: flush dirty data before zeroing a range |
| CVE-2026-98682 | c9b1194e8ec9 |
stable-queue | smb: client: drain and invalidate before server-side copy/clone |
| CVE-2026-99086 | fc79aeb86a2c |
stable-queue | dm-integrity: validate the superblock on resume |
| CVE-2026-98989 | c640a01a78e4 |
stable-queue | namespace: check a recursive bind mount for mount namespace loops |
| CVE-2026-98786 | 217f64f348c9 |
stable-queue | drm/amd/display: guard dc_sink dereferences in MST mode validation |
| CVE-2026-98978 | f78ddcc87224 |
stable-queue | namespace: never expire a locked mount |
| CVE-2026-99021 | e2151c29cec7 |
stable-queue | regulator: of: fill in supply names in of_regulator_bulk_get_all() |
| CVE-2026-99026 | 489114c9ecae |
stable-queue | net: team: free skb when broadcast has no txable port |
| CVE-2026-99090 | 1a6023edfbb5 |
stable-queue | drm/amdgpu: serialize vblank counter reads against GPU reset |
| CVE-2026-99146 | 7dedc5bb11f9 |
stable-queue | drm/i915/dmc: Add sanity check for DMC load address |
| CVE-2024-27023 | 855678ed8534 |
mainline | md: Fix missing release of 'active_io' for flush |
| CVE-2024-41149 | 85672ca9ceea |
mainline | block: avoid to reuse hctx not removed from cpuhp callback list |
| CVE-2026-23451 | b7405dcf7385 |
mainline | bonding: prevent potential infinite loop in bond_header_parse() |
| CVE-2026-99270 | 97c8a3c1f73d |
mainline | tcp: Fix potential UAF in reqsk_timer_handler(). |
| CVE-2026-72434 | 4a597a87e2e2 |
mainline | netfilter: ipset: make sure gc is properly stopped |
| CVE-2026-93184 | 3359ba93d01a |
mainline | ASoC: fsl_audmix: rework runtime PM handling in probe |
| CVE-2026-80579 | 95e647d2a530 |
mainline | fbdev: clear fb_info->mode before deleting a videomode |
| CVE-2026-98161 | c644a2f8fef5 |
mainline | nvdimm: pmem: keep PREFLUSH before data writes |
| CVE-2026-98364 | 9fa903b24b1f |
mainline | xfrm: hold net_device reference under RCU in bundle creation |
| CVE-2026-98355 | 99c24a8968eb |
mainline | RDMA/rtrs: guard against null kobj name |
| CVE-2026-98058 | d05524794240 |
mainline | bpf: Mark syscall helpers as sleepable |
| CVE-2026-98321 | cbdd39ce4253 |
mainline | netfilter: nf_nat: unregister and release hooks on error |
| CVE-2026-98292 | 8879e3e0a84a |
mainline | Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| CVE-2026-98285 | 2842ce397dd0 |
mainline | net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| CVE-2026-98828 | 93ce8ea70451 |
mainline | wifi: ath9k: reject short WMI command responses |
| CVE-2026-98740 | b62a264163ca |
mainline | EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| CVE-2026-98810 | 6f63e919fe1e |
mainline | wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| CVE-2026-98966 | 184b5ddf82d4 |
mainline | bonding: fix the program leak when XDP is replaced |
| CVE-2026-98980 | 8189ab688f5a |
mainline | namei: don't reveal overmounted entries in refwalk |
| CVE-2024-40965 | 4268254a3948 |
stable-list | i2c: lpi2c: Avoid calling clk_get_rate during transfer |
| CVE-2024-40965 | — |
claude | i2c: lpi2c: lock the peripheral clock rate in probe |
| CVE-2025-39981 | 302a1f674c00 |
stable-list | Bluetooth: MGMT: Fix possible UAFs |
| CVE-2025-39981 | e8785404de06 |
claude | Bluetooth: MGMT: fix crash in set_mesh_sync and |
| CVE-2025-39981 | 1b9c17fd0a7f |
claude | Bluetooth: MGMT: Fix memory leak in set_ssp_complete |
| CVE-2025-39981 | 17f89341cb42 |
claude | Bluetooth: MGMT: Fix list corruption and UAF in command |
| CVE-2025-39981 | 5f5fa4cd35f7 |
claude | Bluetooth: MGMT: Fix dangling pointer on |
| CVE-2026-64109 | be309f8eae8b |
stable-list | af_unix: Fix UAF read of tail->len in unix_stream_data_wait() |
| CVE-2026-80670 | afa4363a91a1 |
claude | perf stat: Introduce perf_env__get_cpu_topology() to guard |
| CVE-2026-80670 | 5484b43a0ec8 |
stable-list | perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| CVE-2026-80999 | fb58b6a696b3 |
stable-list | net: dsa: realtek: use gpiod_se... |
Contributors
flags
Assets 6
Kernel security fixes 2026-11-03 19:32
Kernel security fixes 2026-11-03 19:32
Changes
- added 6.18: 1 patch(es)
- added 6.12: 1 patch(es)
- added 6.1: 1 patch(es)
- added 7.3: 5 patch(es)
6.1 (base 6.1.191, 507 fixes)
| CVE | Upstream | Source | Subject |
|---|---|---|---|
| CVE-2026-98466 | 3a8c562892b9 |
stable-queue | KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| CVE-2026-98439 | 4fd5bad647bf |
stable-queue | smb/server: cancel async requests when closing connection |
| CVE-2024-26690 | 38cc3c6dcc09 |
stable-queue | Revert "net: stmmac: protect updates of 64-bit statistics counters" |
| CVE-2026-89556 | 9a5ff4568932 |
stable-queue | module: validate string table section types |
| CVE-2026-89534 | 01500306e1d5 |
stable-queue | svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| CVE-2026-93221 | 11a5fe42e181 |
stable-queue | nfsd: convert nfsd_net boolean flags to unsigned long flags word |
| CVE-2026-90036 | 9026932ac8be |
stable-queue | NFSD: Prevent client use-after-free during blocked-lock reaping |
| CVE-2026-89812 | 48dc279c3010 |
stable-queue | drm/amdgpu: force complete the MES ring fences on reset |
| CVE-2026-93241 | 6b0d1083364f |
stable-queue | memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done |
| CVE-2026-97938 | 5a88f78df753 |
stable-queue | reboot: fix cad_pid use-after-free race |
| CVE-2026-99109 | 4aa2c106aef4 |
stable-queue | smb: client: reject SetEA requests that do not fit the request buffer |
| CVE-2026-99122 | ad9a7da3fa39 |
stable-queue | vsock/vmci: validate packet source for connected sockets |
| CVE-2026-99076 | ac76cab50e89 |
stable-queue | ipv6: udp: Create exceptions before socket matching |
| CVE-2026-98229 | 3cf5cdecd99c |
stable-queue | xfrm: save input state data before secpath resets |
| CVE-2026-89793 | 6e2b571b0a54 |
stable-queue | ublk: clear VM_MAYWRITE on read-only ublk char device mmap |
| CVE-2026-93240 | a3417097fb10 |
stable-queue | memcg: make the v1 soft limit knob inert |
| CVE-2026-99087 | 7d4d4f3b668d |
stable-queue | dm-integrity: fix NULL pointer dereference when the 'R' flag is used |
| CVE-2026-97562 | d806d5a85dcb |
stable-queue | smb: client: pin DFS superblock in iterator callback |
| CVE-2026-97929 | 8f5ef203abda |
stable-queue | ALSA: usbusx2y: validate URB actual_length in interrupt callback |
| CVE-2026-97949 | f06c2d26d199 |
stable-queue | configfs: unhash the dentry before dropping the item in rmdir |
| CVE-2026-97619 | 796aa0547557 |
stable-queue | io_uring/rw: end write accounting from ->ki_complete |
| CVE-2026-98254 | b7d7914a9ae3 |
stable-queue | swiotlb: use the adjusted address for the highmem page lookup |
| CVE-2026-98539 | 1abd643f3783 |
stable-queue | fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga |
| CVE-2026-98180 | 01c8d1f385f7 |
stable-queue | drm/msm: RCU-free the scheduler-containing ring and VM objects |
| CVE-2026-97906 | 7812d6dab069 |
stable-queue | bootconfig: Fix integer overflow in initrd size check |
| CVE-2026-97918 | 92383cef6679 |
stable-queue | tracing: Undo the registration when enabling the histogram trigger fails |
| CVE-2026-97933 | ed0aff60f83a |
stable-queue | tracing: Take trace_array reference when opening a tracer options file |
| CVE-2026-98222 | 8697c431e297 |
stable-queue | KEYS: encrypted: fix integer overflow of datablob_len |
| CVE-2026-98175 | c65eae6f61d1 |
stable-queue | smb: client: cancel reconnect work in clean_demultiplex_info() |
| CVE-2026-98174 | 5f270f091256 |
stable-queue | smb: client: fix rlist race and missing initialization |
| CVE-2026-98182 | 2b04d6556964 |
stable-queue | wifi: mac80211: refuse to make a monitor active when it has no queue |
| CVE-2026-98176 | c883d0a132d4 |
stable-queue | drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| CVE-2026-98177 | 8ee521b8b189 |
stable-queue | drm/amdkfd: Avoid integer underflow in EOP ring size calculation. |
| CVE-2026-98179 | 5155002b03b2 |
stable-queue | drm/amdgpu: fix rmmio iounmap skipped on device removal |
| CVE-2026-98506 | a363c62a653c |
stable-queue | mm/hugetlb: do not dissolve gigantic pages without runtime support |
| CVE-2026-98505 | 39c0ceedd545 |
stable-queue | mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() |
| CVE-2026-98449 | 8f6f8a48399f |
stable-queue | smb: client: delete compound mids on send failure before unlock |
| CVE-2026-98452 | d2ff5fb93ea8 |
stable-queue | smb: client: clean up failed cached directory opens |
| CVE-2026-98863 | 10180a277549 |
stable-queue | KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| CVE-2026-98503 | 951840561386 |
stable-queue | packet: use ubuf_info completion for TX_RING packets |
| CVE-2026-98859 | 5acb2dace582 |
stable-queue | HID: multitouch: stop the release timer from being rearmed on remove |
| CVE-2026-98715 | 60d93c27859f |
stable-queue | KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| CVE-2026-98714 | e27fc915c8f5 |
stable-queue | KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| CVE-2026-98720 | 2abb25273c82 |
stable-queue | KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified |
| CVE-2026-98738 | 81a2345f1984 |
stable-queue | Bluetooth: Serialize SMP remote OOB data access |
| CVE-2026-98734 | 848a7a91c7f0 |
stable-queue | Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown |
| CVE-2026-98852 | 5f0764cb1c81 |
stable-queue | net: extend IPv6 exthdr detection of tunneled packets |
| CVE-2026-98685 | 4721587f96cb |
stable-queue | smb: client: discard post-EOF pagecache when extending a file via clone range |
| CVE-2026-98684 | aa994489bd83 |
stable-queue | smb: client: flush and commit data before querying allocated ranges |
| CVE-2026-98683 | 8f8d32c1044f |
stable-queue | smb: client: flush dirty data before zeroing a range |
| CVE-2026-98682 | c9b1194e8ec9 |
stable-queue | smb: client: drain and invalidate before server-side copy/clone |
| CVE-2026-99086 | fc79aeb86a2c |
stable-queue | dm-integrity: validate the superblock on resume |
| CVE-2026-98989 | c640a01a78e4 |
stable-queue | namespace: check a recursive bind mount for mount namespace loops |
| CVE-2026-98786 | 217f64f348c9 |
stable-queue | drm/amd/display: guard dc_sink dereferences in MST mode validation |
| CVE-2026-98978 | f78ddcc87224 |
stable-queue | namespace: never expire a locked mount |
| CVE-2026-99021 | e2151c29cec7 |
stable-queue | regulator: of: fill in supply names in of_regulator_bulk_get_all() |
| CVE-2026-99026 | 489114c9ecae |
stable-queue | net: team: free skb when broadcast has no txable port |
| CVE-2026-99090 | 1a6023edfbb5 |
stable-queue | drm/amdgpu: serialize vblank counter reads against GPU reset |
| CVE-2026-99146 | 7dedc5bb11f9 |
stable-queue | drm/i915/dmc: Add sanity check for DMC load address |
| CVE-2024-27023 | 855678ed8534 |
mainline | md: Fix missing release of 'active_io' for flush |
| CVE-2024-41149 | 85672ca9ceea |
mainline | block: avoid to reuse hctx not removed from cpuhp callback list |
| CVE-2026-23451 | b7405dcf7385 |
mainline | bonding: prevent potential infinite loop in bond_header_parse() |
| CVE-2026-99270 | 97c8a3c1f73d |
mainline | tcp: Fix potential UAF in reqsk_timer_handler(). |
| CVE-2026-72434 | 4a597a87e2e2 |
mainline | netfilter: ipset: make sure gc is properly stopped |
| CVE-2026-93184 | 3359ba93d01a |
mainline | ASoC: fsl_audmix: rework runtime PM handling in probe |
| CVE-2026-80579 | 95e647d2a530 |
mainline | fbdev: clear fb_info->mode before deleting a videomode |
| CVE-2026-98161 | c644a2f8fef5 |
mainline | nvdimm: pmem: keep PREFLUSH before data writes |
| CVE-2026-98364 | 9fa903b24b1f |
mainline | xfrm: hold net_device reference under RCU in bundle creation |
| CVE-2026-98355 | 99c24a8968eb |
mainline | RDMA/rtrs: guard against null kobj name |
| CVE-2026-98058 | d05524794240 |
mainline | bpf: Mark syscall helpers as sleepable |
| CVE-2026-98321 | cbdd39ce4253 |
mainline | netfilter: nf_nat: unregister and release hooks on error |
| CVE-2026-98292 | 8879e3e0a84a |
mainline | Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| CVE-2026-98285 | 2842ce397dd0 |
mainline | net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| CVE-2026-98828 | 93ce8ea70451 |
mainline | wifi: ath9k: reject short WMI command responses |
| CVE-2026-98740 | b62a264163ca |
mainline | EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| CVE-2026-98810 | 6f63e919fe1e |
mainline | wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| CVE-2026-98966 | 184b5ddf82d4 |
mainline | bonding: fix the program leak when XDP is replaced |
| CVE-2026-98980 | 8189ab688f5a |
mainline | namei: don't reveal overmounted entries in refwalk |
| CVE-2024-40965 | 4268254a3948 |
stable-list | i2c: lpi2c: Avoid calling clk_get_rate during transfer |
| CVE-2024-40965 | — |
claude | i2c: lpi2c: lock the peripheral clock rate in probe |
| CVE-2025-39981 | 302a1f674c00 |
stable-list | Bluetooth: MGMT: Fix possible UAFs |
| CVE-2025-39981 | e8785404de06 |
claude | Bluetooth: MGMT: fix crash in set_mesh_sync and |
| CVE-2025-39981 | 1b9c17fd0a7f |
claude | Bluetooth: MGMT: Fix memory leak in set_ssp_complete |
| CVE-2025-39981 | 17f89341cb42 |
claude | Bluetooth: MGMT: Fix list corruption and UAF in command |
| CVE-2025-39981 | 5f5fa4cd35f7 |
claude | Bluetooth: MGMT: Fix dangling pointer on |
| CVE-2026-64109 | be309f8eae8b |
stable-list | af_unix: Fix UAF read of tail->len in unix_stream_data_wait() |
| CVE-2026-80670 | afa4363a91a1 |
claude | perf stat: Introduce perf_env__get_cpu_topology() to guard |
| CVE-2026-80670 | 5484b43a0ec8 |
stable-list | perf tools: Use perf_env__get_cpu_... |
Contributors
flags
Assets 6
Kernel security fixes 2026-11-03 12:03
Kernel security fixes 2026-11-03 12:03
Changes
- added 7.3: 4 patch(es)
6.1 (base 6.1.191, 506 fixes)
| CVE | Upstream | Source | Subject |
|---|---|---|---|
| CVE-2026-98466 | 3a8c562892b9 |
stable-queue | KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| CVE-2026-98439 | 4fd5bad647bf |
stable-queue | smb/server: cancel async requests when closing connection |
| CVE-2024-26690 | 38cc3c6dcc09 |
stable-queue | Revert "net: stmmac: protect updates of 64-bit statistics counters" |
| CVE-2026-89556 | 9a5ff4568932 |
stable-queue | module: validate string table section types |
| CVE-2026-89534 | 01500306e1d5 |
stable-queue | svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| CVE-2026-93221 | 11a5fe42e181 |
stable-queue | nfsd: convert nfsd_net boolean flags to unsigned long flags word |
| CVE-2026-90036 | 9026932ac8be |
stable-queue | NFSD: Prevent client use-after-free during blocked-lock reaping |
| CVE-2026-89812 | 48dc279c3010 |
stable-queue | drm/amdgpu: force complete the MES ring fences on reset |
| CVE-2026-93241 | 6b0d1083364f |
stable-queue | memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done |
| CVE-2026-97938 | 5a88f78df753 |
stable-queue | reboot: fix cad_pid use-after-free race |
| CVE-2026-99109 | 4aa2c106aef4 |
stable-queue | smb: client: reject SetEA requests that do not fit the request buffer |
| CVE-2026-99122 | ad9a7da3fa39 |
stable-queue | vsock/vmci: validate packet source for connected sockets |
| CVE-2026-99076 | ac76cab50e89 |
stable-queue | ipv6: udp: Create exceptions before socket matching |
| CVE-2026-98229 | 3cf5cdecd99c |
stable-queue | xfrm: save input state data before secpath resets |
| CVE-2026-89793 | 6e2b571b0a54 |
stable-queue | ublk: clear VM_MAYWRITE on read-only ublk char device mmap |
| CVE-2026-93240 | a3417097fb10 |
stable-queue | memcg: make the v1 soft limit knob inert |
| CVE-2026-99087 | 7d4d4f3b668d |
stable-queue | dm-integrity: fix NULL pointer dereference when the 'R' flag is used |
| CVE-2026-97562 | d806d5a85dcb |
stable-queue | smb: client: pin DFS superblock in iterator callback |
| CVE-2026-97929 | 8f5ef203abda |
stable-queue | ALSA: usbusx2y: validate URB actual_length in interrupt callback |
| CVE-2026-97949 | f06c2d26d199 |
stable-queue | configfs: unhash the dentry before dropping the item in rmdir |
| CVE-2026-97619 | 796aa0547557 |
stable-queue | io_uring/rw: end write accounting from ->ki_complete |
| CVE-2026-98254 | b7d7914a9ae3 |
stable-queue | swiotlb: use the adjusted address for the highmem page lookup |
| CVE-2026-98539 | 1abd643f3783 |
stable-queue | fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga |
| CVE-2026-98180 | 01c8d1f385f7 |
stable-queue | drm/msm: RCU-free the scheduler-containing ring and VM objects |
| CVE-2026-97906 | 7812d6dab069 |
stable-queue | bootconfig: Fix integer overflow in initrd size check |
| CVE-2026-97918 | 92383cef6679 |
stable-queue | tracing: Undo the registration when enabling the histogram trigger fails |
| CVE-2026-97933 | ed0aff60f83a |
stable-queue | tracing: Take trace_array reference when opening a tracer options file |
| CVE-2026-98222 | 8697c431e297 |
stable-queue | KEYS: encrypted: fix integer overflow of datablob_len |
| CVE-2026-98175 | c65eae6f61d1 |
stable-queue | smb: client: cancel reconnect work in clean_demultiplex_info() |
| CVE-2026-98174 | 5f270f091256 |
stable-queue | smb: client: fix rlist race and missing initialization |
| CVE-2026-98182 | 2b04d6556964 |
stable-queue | wifi: mac80211: refuse to make a monitor active when it has no queue |
| CVE-2026-98176 | c883d0a132d4 |
stable-queue | drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| CVE-2026-98177 | 8ee521b8b189 |
stable-queue | drm/amdkfd: Avoid integer underflow in EOP ring size calculation. |
| CVE-2026-98179 | 5155002b03b2 |
stable-queue | drm/amdgpu: fix rmmio iounmap skipped on device removal |
| CVE-2026-98506 | a363c62a653c |
stable-queue | mm/hugetlb: do not dissolve gigantic pages without runtime support |
| CVE-2026-98505 | 39c0ceedd545 |
stable-queue | mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() |
| CVE-2026-98449 | 8f6f8a48399f |
stable-queue | smb: client: delete compound mids on send failure before unlock |
| CVE-2026-98452 | d2ff5fb93ea8 |
stable-queue | smb: client: clean up failed cached directory opens |
| CVE-2026-98863 | 10180a277549 |
stable-queue | KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| CVE-2026-98503 | 951840561386 |
stable-queue | packet: use ubuf_info completion for TX_RING packets |
| CVE-2026-98859 | 5acb2dace582 |
stable-queue | HID: multitouch: stop the release timer from being rearmed on remove |
| CVE-2026-98715 | 60d93c27859f |
stable-queue | KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| CVE-2026-98714 | e27fc915c8f5 |
stable-queue | KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| CVE-2026-98720 | 2abb25273c82 |
stable-queue | KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified |
| CVE-2026-98738 | 81a2345f1984 |
stable-queue | Bluetooth: Serialize SMP remote OOB data access |
| CVE-2026-98734 | 848a7a91c7f0 |
stable-queue | Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown |
| CVE-2026-98852 | 5f0764cb1c81 |
stable-queue | net: extend IPv6 exthdr detection of tunneled packets |
| CVE-2026-98685 | 4721587f96cb |
stable-queue | smb: client: discard post-EOF pagecache when extending a file via clone range |
| CVE-2026-98684 | aa994489bd83 |
stable-queue | smb: client: flush and commit data before querying allocated ranges |
| CVE-2026-98683 | 8f8d32c1044f |
stable-queue | smb: client: flush dirty data before zeroing a range |
| CVE-2026-98682 | c9b1194e8ec9 |
stable-queue | smb: client: drain and invalidate before server-side copy/clone |
| CVE-2026-99086 | fc79aeb86a2c |
stable-queue | dm-integrity: validate the superblock on resume |
| CVE-2026-98989 | c640a01a78e4 |
stable-queue | namespace: check a recursive bind mount for mount namespace loops |
| CVE-2026-98786 | 217f64f348c9 |
stable-queue | drm/amd/display: guard dc_sink dereferences in MST mode validation |
| CVE-2026-98978 | f78ddcc87224 |
stable-queue | namespace: never expire a locked mount |
| CVE-2026-99021 | e2151c29cec7 |
stable-queue | regulator: of: fill in supply names in of_regulator_bulk_get_all() |
| CVE-2026-99026 | 489114c9ecae |
stable-queue | net: team: free skb when broadcast has no txable port |
| CVE-2026-99090 | 1a6023edfbb5 |
stable-queue | drm/amdgpu: serialize vblank counter reads against GPU reset |
| CVE-2026-99146 | 7dedc5bb11f9 |
stable-queue | drm/i915/dmc: Add sanity check for DMC load address |
| CVE-2024-27023 | 855678ed8534 |
mainline | md: Fix missing release of 'active_io' for flush |
| CVE-2024-41149 | 85672ca9ceea |
mainline | block: avoid to reuse hctx not removed from cpuhp callback list |
| CVE-2026-23451 | b7405dcf7385 |
mainline | bonding: prevent potential infinite loop in bond_header_parse() |
| CVE-2026-72434 | 4a597a87e2e2 |
mainline | netfilter: ipset: make sure gc is properly stopped |
| CVE-2026-93184 | 3359ba93d01a |
mainline | ASoC: fsl_audmix: rework runtime PM handling in probe |
| CVE-2026-80579 | 95e647d2a530 |
mainline | fbdev: clear fb_info->mode before deleting a videomode |
| CVE-2026-98161 | c644a2f8fef5 |
mainline | nvdimm: pmem: keep PREFLUSH before data writes |
| CVE-2026-98364 | 9fa903b24b1f |
mainline | xfrm: hold net_device reference under RCU in bundle creation |
| CVE-2026-98355 | 99c24a8968eb |
mainline | RDMA/rtrs: guard against null kobj name |
| CVE-2026-98058 | d05524794240 |
mainline | bpf: Mark syscall helpers as sleepable |
| CVE-2026-98321 | cbdd39ce4253 |
mainline | netfilter: nf_nat: unregister and release hooks on error |
| CVE-2026-98292 | 8879e3e0a84a |
mainline | Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| CVE-2026-98285 | 2842ce397dd0 |
mainline | net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| CVE-2026-98828 | 93ce8ea70451 |
mainline | wifi: ath9k: reject short WMI command responses |
| CVE-2026-98740 | b62a264163ca |
mainline | EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| CVE-2026-98810 | 6f63e919fe1e |
mainline | wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| CVE-2026-98966 | 184b5ddf82d4 |
mainline | bonding: fix the program leak when XDP is replaced |
| CVE-2026-98980 | 8189ab688f5a |
mainline | namei: don't reveal overmounted entries in refwalk |
| CVE-2024-40965 | 4268254a3948 |
stable-list | i2c: lpi2c: Avoid calling clk_get_rate during transfer |
| CVE-2024-40965 | — |
claude | i2c: lpi2c: lock the peripheral clock rate in probe |
| CVE-2025-39981 | 302a1f674c00 |
stable-list | Bluetooth: MGMT: Fix possible UAFs |
| CVE-2025-39981 | e8785404de06 |
claude | Bluetooth: MGMT: fix crash in set_mesh_sync and |
| CVE-2025-39981 | 1b9c17fd0a7f |
claude | Bluetooth: MGMT: Fix memory leak in set_ssp_complete |
| CVE-2025-39981 | 17f89341cb42 |
claude | Bluetooth: MGMT: Fix list corruption and UAF in command |
| CVE-2025-39981 | 5f5fa4cd35f7 |
claude | Bluetooth: MGMT: Fix dangling pointer on |
| CVE-2026-64109 | be309f8eae8b |
stable-list | af_unix: Fix UAF read of tail->len in unix_stream_data_wait() |
| CVE-2026-80670 | afa4363a91a1 |
claude | perf stat: Introduce perf_env__get_cpu_topology() to guard |
| CVE-2026-80670 | 5484b43a0ec8 |
stable-list | perf tools: Use perf_env__get_cpu_topology() in machine__resolve() |
| CVE-2026-80999 | fb58b6a696b3 |
stable-list | net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO |
| CVE-2026-80999 | — |
... |
Contributors
flags
Assets 6
Kernel security fixes 2026-11-02 23:12
Kernel security fixes 2026-11-02 23:12
Changes
- added 6.18: 1 patch(es)
- retired 6.18: 6 patch(es) (landed upstream or superseded)
- added 6.12: 6 patch(es)
- retired 6.12: 10 patch(es) (landed upstream or superseded)
- added 6.1: 12 patch(es)
- retired 6.1: 10 patch(es) (landed upstream or superseded)
- added 7.3: 4 patch(es)
6.1 (base 6.1.191, 506 fixes)
| CVE | Upstream | Source | Subject |
|---|---|---|---|
| CVE-2026-98466 | 3a8c562892b9 |
stable-queue | KVM: arm64: Transfer the hyp stack pages out of the host stage-2 |
| CVE-2026-98439 | 4fd5bad647bf |
stable-queue | smb/server: cancel async requests when closing connection |
| CVE-2024-26690 | 38cc3c6dcc09 |
stable-queue | Revert "net: stmmac: protect updates of 64-bit statistics counters" |
| CVE-2026-89556 | 9a5ff4568932 |
stable-queue | module: validate string table section types |
| CVE-2026-89534 | 01500306e1d5 |
stable-queue | svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails |
| CVE-2026-93221 | 11a5fe42e181 |
stable-queue | nfsd: convert nfsd_net boolean flags to unsigned long flags word |
| CVE-2026-90036 | 9026932ac8be |
stable-queue | NFSD: Prevent client use-after-free during blocked-lock reaping |
| CVE-2026-89812 | 48dc279c3010 |
stable-queue | drm/amdgpu: force complete the MES ring fences on reset |
| CVE-2026-93241 | 6b0d1083364f |
stable-queue | memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done |
| CVE-2026-97938 | 5a88f78df753 |
stable-queue | reboot: fix cad_pid use-after-free race |
| CVE-2026-99109 | 4aa2c106aef4 |
stable-queue | smb: client: reject SetEA requests that do not fit the request buffer |
| CVE-2026-99122 | ad9a7da3fa39 |
stable-queue | vsock/vmci: validate packet source for connected sockets |
| CVE-2026-99076 | ac76cab50e89 |
stable-queue | ipv6: udp: Create exceptions before socket matching |
| CVE-2026-98229 | 3cf5cdecd99c |
stable-queue | xfrm: save input state data before secpath resets |
| CVE-2026-89793 | 6e2b571b0a54 |
stable-queue | ublk: clear VM_MAYWRITE on read-only ublk char device mmap |
| CVE-2026-93240 | a3417097fb10 |
stable-queue | memcg: make the v1 soft limit knob inert |
| CVE-2026-99087 | 7d4d4f3b668d |
stable-queue | dm-integrity: fix NULL pointer dereference when the 'R' flag is used |
| CVE-2026-97562 | d806d5a85dcb |
stable-queue | smb: client: pin DFS superblock in iterator callback |
| CVE-2026-97929 | 8f5ef203abda |
stable-queue | ALSA: usbusx2y: validate URB actual_length in interrupt callback |
| CVE-2026-97949 | f06c2d26d199 |
stable-queue | configfs: unhash the dentry before dropping the item in rmdir |
| CVE-2026-97619 | 796aa0547557 |
stable-queue | io_uring/rw: end write accounting from ->ki_complete |
| CVE-2026-98254 | b7d7914a9ae3 |
stable-queue | swiotlb: use the adjusted address for the highmem page lookup |
| CVE-2026-98539 | 1abd643f3783 |
stable-queue | fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga |
| CVE-2026-98180 | 01c8d1f385f7 |
stable-queue | drm/msm: RCU-free the scheduler-containing ring and VM objects |
| CVE-2026-97906 | 7812d6dab069 |
stable-queue | bootconfig: Fix integer overflow in initrd size check |
| CVE-2026-97918 | 92383cef6679 |
stable-queue | tracing: Undo the registration when enabling the histogram trigger fails |
| CVE-2026-97933 | ed0aff60f83a |
stable-queue | tracing: Take trace_array reference when opening a tracer options file |
| CVE-2026-98222 | 8697c431e297 |
stable-queue | KEYS: encrypted: fix integer overflow of datablob_len |
| CVE-2026-98175 | c65eae6f61d1 |
stable-queue | smb: client: cancel reconnect work in clean_demultiplex_info() |
| CVE-2026-98174 | 5f270f091256 |
stable-queue | smb: client: fix rlist race and missing initialization |
| CVE-2026-98182 | 2b04d6556964 |
stable-queue | wifi: mac80211: refuse to make a monitor active when it has no queue |
| CVE-2026-98176 | c883d0a132d4 |
stable-queue | drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc |
| CVE-2026-98177 | 8ee521b8b189 |
stable-queue | drm/amdkfd: Avoid integer underflow in EOP ring size calculation. |
| CVE-2026-98179 | 5155002b03b2 |
stable-queue | drm/amdgpu: fix rmmio iounmap skipped on device removal |
| CVE-2026-98506 | a363c62a653c |
stable-queue | mm/hugetlb: do not dissolve gigantic pages without runtime support |
| CVE-2026-98505 | 39c0ceedd545 |
stable-queue | mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() |
| CVE-2026-98449 | 8f6f8a48399f |
stable-queue | smb: client: delete compound mids on send failure before unlock |
| CVE-2026-98452 | d2ff5fb93ea8 |
stable-queue | smb: client: clean up failed cached directory opens |
| CVE-2026-98863 | 10180a277549 |
stable-queue | KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails |
| CVE-2026-98503 | 951840561386 |
stable-queue | packet: use ubuf_info completion for TX_RING packets |
| CVE-2026-98859 | 5acb2dace582 |
stable-queue | HID: multitouch: stop the release timer from being rearmed on remove |
| CVE-2026-98715 | 60d93c27859f |
stable-queue | KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN |
| CVE-2026-98714 | e27fc915c8f5 |
stable-queue | KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded |
| CVE-2026-98720 | 2abb25273c82 |
stable-queue | KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified |
| CVE-2026-98738 | 81a2345f1984 |
stable-queue | Bluetooth: Serialize SMP remote OOB data access |
| CVE-2026-98734 | 848a7a91c7f0 |
stable-queue | Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown |
| CVE-2026-98852 | 5f0764cb1c81 |
stable-queue | net: extend IPv6 exthdr detection of tunneled packets |
| CVE-2026-98685 | 4721587f96cb |
stable-queue | smb: client: discard post-EOF pagecache when extending a file via clone range |
| CVE-2026-98684 | aa994489bd83 |
stable-queue | smb: client: flush and commit data before querying allocated ranges |
| CVE-2026-98683 | 8f8d32c1044f |
stable-queue | smb: client: flush dirty data before zeroing a range |
| CVE-2026-98682 | c9b1194e8ec9 |
stable-queue | smb: client: drain and invalidate before server-side copy/clone |
| CVE-2026-99086 | fc79aeb86a2c |
stable-queue | dm-integrity: validate the superblock on resume |
| CVE-2026-98989 | c640a01a78e4 |
stable-queue | namespace: check a recursive bind mount for mount namespace loops |
| CVE-2026-98786 | 217f64f348c9 |
stable-queue | drm/amd/display: guard dc_sink dereferences in MST mode validation |
| CVE-2026-98978 | f78ddcc87224 |
stable-queue | namespace: never expire a locked mount |
| CVE-2026-99021 | e2151c29cec7 |
stable-queue | regulator: of: fill in supply names in of_regulator_bulk_get_all() |
| CVE-2026-99026 | 489114c9ecae |
stable-queue | net: team: free skb when broadcast has no txable port |
| CVE-2026-99090 | 1a6023edfbb5 |
stable-queue | drm/amdgpu: serialize vblank counter reads against GPU reset |
| CVE-2026-99146 | 7dedc5bb11f9 |
stable-queue | drm/i915/dmc: Add sanity check for DMC load address |
| CVE-2024-27023 | 855678ed8534 |
mainline | md: Fix missing release of 'active_io' for flush |
| CVE-2024-41149 | 85672ca9ceea |
mainline | block: avoid to reuse hctx not removed from cpuhp callback list |
| CVE-2026-23451 | b7405dcf7385 |
mainline | bonding: prevent potential infinite loop in bond_header_parse() |
| CVE-2026-72434 | 4a597a87e2e2 |
mainline | netfilter: ipset: make sure gc is properly stopped |
| CVE-2026-93184 | 3359ba93d01a |
mainline | ASoC: fsl_audmix: rework runtime PM handling in probe |
| CVE-2026-80579 | 95e647d2a530 |
mainline | fbdev: clear fb_info->mode before deleting a videomode |
| CVE-2026-98161 | c644a2f8fef5 |
mainline | nvdimm: pmem: keep PREFLUSH before data writes |
| CVE-2026-98364 | 9fa903b24b1f |
mainline | xfrm: hold net_device reference under RCU in bundle creation |
| CVE-2026-98355 | 99c24a8968eb |
mainline | RDMA/rtrs: guard against null kobj name |
| CVE-2026-98058 | d05524794240 |
mainline | bpf: Mark syscall helpers as sleepable |
| CVE-2026-98321 | cbdd39ce4253 |
mainline | netfilter: nf_nat: unregister and release hooks on error |
| CVE-2026-98292 | 8879e3e0a84a |
mainline | Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access |
| CVE-2026-98285 | 2842ce397dd0 |
mainline | net: bridge: vlan: fix bugs caused by switchdev deletion errors |
| CVE-2026-98828 | 93ce8ea70451 |
mainline | wifi: ath9k: reject short WMI command responses |
| CVE-2026-98740 | b62a264163ca |
mainline | EDAC/altera: Drop __init from ECC setup paths for re-probe safety |
| CVE-2026-98810 | 6f63e919fe1e |
mainline | wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() |
| CVE-2026-98966 | 184b5ddf82d4 |
mainline | bonding: fix the program leak when XDP is replaced |
| CVE-2026-98980 | 8189ab688f5a |
mainline | namei: don't reveal overmounted entries in refwalk |
| CVE-2024-40965 | 4268254a3948 |
stable-list | i2c: lpi2c: Avoid calling clk_get_rate during transfer |
| CVE-2024-40965 | — |
claude | i2c: lpi2c: lock the peripheral clock rate in probe |
| CVE-2025-39981 | 302a1f674c00 |
stable-list | Bluetooth: MGMT: Fix possible UAFs |
| CVE-2025-39981 | e8785404de06 |
claude | Bluetooth: MGMT: fix crash in set_mesh_sync and |
| CVE-2025-39981 | 1b9c17fd0a7f |
claude | Bluetooth: MGMT: Fix memory leak in set_ssp_complete |
| CVE-2025-39981 | 17f89341cb42 |
claude | Bluetooth: MGMT: Fix list corruption and UAF in command |
| CVE-2025-39981 | 5f5fa4cd35f7 |
claude | Bluetooth: MGMT: Fix dangling pointer on |
| CVE-2026-64109 | be309f8eae8b |
stable-list | af_unix: Fix UAF read of tail->len in unix_stream_data_wait() |
| CVE-2026-80670 | afa4363a91a1 |
claude | perf stat: Introduce perf_env__get_cpu_topology() to guard |
| ... |
Contributors
flags