Linux Kernel vulnerabilities and fixes
Exploited and high-severity Linux Kernel vulnerabilities tracked by VulnFeed, with CVSS and EPSS scores, affected versions and fixes.
- 8.1CVE-2026-99270tcp: Fix potential UAF in reqsk_timer_handler().Fix availableLinux Linux
1 min read - 7.8CVE-2026-99269sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQsVerify fixLinux Linux
1 min read - 7.8CVE-2026-99264io_uring/net: don't retry recv on uncommitted buffersFix availableLinux Linux
2 min read - 8.1CVE-2026-99246tipc: protect node reset trace dump with node lockVerify fixLinux Linux
2 min read - 7.8CVE-2026-99239Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has connFix availableLinux Linux
2 min read - 7.8CVE-2026-99237tracing: Hold trace_types_lock when resetting last boot data from readersVerify fixLinux Linux
1 min read - 7.8CVE-2026-99238tracing: Hold trace_types_lock when updating modules in persistent instancesVerify fixLinux Linux
1 min read - 7.8CVE-2026-99235tracing: Save the event file instead of the compatible histogramVerify fixLinux Linux
2 min read - 7.8CVE-2026-99236tracing: Reject incomplete event filter expressionsVerify fixLinux Linux
1 min read - 7.8CVE-2026-99233tracing/histograms: Verify event_call identity when updating synth_event refcountVerify fixLinux Linux
1 min read - 7.8CVE-2026-99231io_uring/waitid: own the request before clearing ->headFix availableLinux Linux
2 min read - 7.8CVE-2026-99227io_uring/waitid: prevent cancel reference wrapVerify fixLinux Linux
1 min read - 7.0CVE-2026-99224keys: Protect the type name while describing a keyVerify fixLinux Linux
2 min read - 7.0CVE-2026-99218coredump: hold RCU while releasing parked threadsVerify fixLinux Linux
1 min read - 8.8CVE-2026-99185firewire: core: fix race condition in split transaction handlingVerify fixLinux Linux
1 min read - 7.8CVE-2026-99177KVM: SEV: Fix page dirtying in sev_gmem_post_populate()Verify fixLinux Linux
1 min read - 7.8CVE-2026-99180unicode: free the map after a grace periodVerify fixLinux Linux
2 min read - 7.8CVE-2026-99167net/sched: fix use-after-free in __tcf_action_put()Verify fixLinux Linux
1 min read - 8.8CVE-2026-99170namespace: a mount that copy_tree() leaves out can't take over a lockVerify fixLinux Linux
2 min read - 7.8CVE-2026-99173eventfs: Free the eventfs_inode after an rcu grace period tooFix availableLinux Linux
2 min read - 7.8CVE-2026-99163tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fieldsFix availableLinux Linux
1 min read - 7.8CVE-2026-99164spi: imx: fix slab corruption from undersized DMA bounce buffersVerify fixLinux Linux
2 min read - 7.5CVE-2026-99152scsi: libiscsi: Validate the task named by a management responseVerify fixLinux Linux
2 min read - 9.8CVE-2026-99153scsi: libiscsi: Validate the ITT reflected in a Reject PDUVerify fixLinux Linux
2 min read - 9.8CVE-2026-99154scsi: libiscsi: Reject a negative task index from parse_pdu_ittVerify fixLinux Linux
1 min read - 7.8CVE-2026-99156scsi: st: Fix use-after-free race between st_remove() and st_open()Verify fixLinux Linux
2 min read - 7.1CVE-2026-99142tracing: Check operator stack capacity before pushingVerify fixLinux Linux
1 min read - 7.8CVE-2026-99143tracing: Keep the predicate limit separate from program capacityVerify fixLinux Linux
1 min read - 7.0CVE-2026-99148drm/amdgpu: keep the eviction fence until the last handle is closedVerify fixLinux Linux
2 min read - 7.0CVE-2026-99136dm-crypt: fix a tiny race condition in crypt_dec_pendingFix availableLinux Linux
1 min read - 8.2CVE-2026-99131xfs: fix capability check in xfsVerify fixLinux Linux
1 min read - 7.8CVE-2026-99116net: psp: do not inherit the Rx association on cloneVerify fixLinux Linux
2 min read - 7.8CVE-2026-99117net: bridge: mcast: don't truncate the port group walk on teardownVerify fixLinux Linux
2 min read - 7.3CVE-2026-99122vsock/vmci: validate packet source for connected socketsVerify fixLinux Linux
1 min read - 7.1CVE-2026-99123vsock/virtio: validate packet source for connected socketsVerify fixLinux Linux
2 min read - 7.8CVE-2026-99107ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resizeVerify fixLinux Linux
1 min read - 7.8CVE-2026-99109smb: client: reject SetEA requests that do not fit the request bufferVerify fixLinux Linux
2 min read - 7.0CVE-2026-99110smb: client: fix heap overflow in cifs_do_set_acl()Verify fixLinux Linux
1 min read - 7.1CVE-2026-99112net/sched: cls_flower: validate mask pointer after nla_next()Fix availableLinux Linux
2 min read - 8.4CVE-2026-99216Drivers: hv: Don't reset VMBus connection state on error/exit pathsFix availableLinux Linux
1 min read - 7.8CVE-2026-99213vsock: treat TCP_CLOSING as once-establishedVerify fixLinux Linux
2 min read - 7.0CVE-2026-99212net/rds: don't let the rdma_cm destroy an id RDS still owns on route failureVerify fixLinux Linux
1 min read - 7.8CVE-2026-99203pipe: preserve existing fasync readers on writer setup failureVerify fixLinux Linux
1 min read - 7.8CVE-2026-46300Linux Kernel Missing Initialization of a Variable VulnerabilityExploitedVerify fixLinux Kernel
1 min read - 7.5CVE-2026-99094Bluetooth: btintel_pcie: fix TX descriptor bounds checkVerify fixLinux Linux
1 min read - 7.8CVE-2026-99099x86/CPU/AMD: Fix AMD TLBI Erratum #1718Verify fixLinux Linux
1 min read - 9.8CVE-2026-98432ipv4: free inet_opt and ireq_opt after an RCU grace periodVerify fixLinux Linux
2 min read - 8.8CVE-2026-53266Linux Kernel Out-of-Bounds Write VulnerabilityExploitedFix availableLinux Kernel
1 min read - 7.8CVE-2025-39964Linux Kernel Race Condition VulnerabilityExploitedVerify fixLinux Kernel
1 min read - 9.8CVE-2025-39682Linux Kernel Improper Check for Unusual or Exceptional Conditions VulnerabilityExploitedVerify fixLinux Kernel
1 min read - 7.8CVE-2026-53362Linux Kernel Unspecified VulnerabilityLPEExploitedVerify fixLinux Kernel
1 min read - 7.8CVE-2022-0995Linux Kernel Out-of-Bounds Write VulnerabilityExploitedVerify fixLinux Kernel
1 min read - 7.8CVE-2022-0492Linux Kernel Improper Authentication VulnerabilityLPEExploitedVerify fixLinux Kernel
1 min read