Thu, May 21 · 01:16 PM CDTCVE-2026-43501
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, then pulls the old header and pushes the new one plus the IPv6
CVECVE-2026-43501
SeverityCRITICAL
TypeUPDATED
PublishedThu, May 21 · 01:16 PM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-45898
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removing work_list The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()") changed the work submission logic to unconditionally call queue_work() with the expectation that queue_work() would have no eff
CVECVE-2026-45898
SeverityCRITICAL
TypeUPDATED
PublishedWed, May 27 · 02:17 PM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-45972
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF and double free in smb2_open_file() Zero out @err_iov and @err_buftype before retrying SMB2_open() to prevent an UAF bug if @data != NULL, otherwise a double free.
CVECVE-2026-45972
SeverityCRITICAL
TypeUPDATED
PublishedWed, May 27 · 02:17 PM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-45988
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet gets a temporary failure during processing, it may end up in a partially decrypted state - and then get requeued for a retry. Fix this by just discarding the packet; we will send another
CVECVE-2026-45988
SeverityCRITICAL
TypeUPDATED
PublishedWed, May 27 · 02:17 PM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46039
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: rxgk: Fix potential integer overflow in length check Fix potential integer overflow in rxgk_extract_token() when checking the length of the ticket. Rather than rounding up the value to be tested (which might overflow), round down the size of the availa
CVECVE-2026-46039
SeverityCRITICAL
TypeUPDATED
PublishedWed, May 27 · 02:17 PM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46115
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: block: add pgmap check to biovec_phys_mergeable biovec_phys_mergeable() is used by the request merge, DMA mapping, and integrity merge paths to decide if two physically contiguous bvec segments can be coalesced into one. It currently has no check for w
CVECVE-2026-46115
SeverityCRITICAL
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46135
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing against target-side queue teardown. If an NVMe/
CVECVE-2026-46135
SeverityCRITICAL
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46137
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: fix potential data-race This mptcp_pm_add_timer() helper is executed as a timer callback in softirq context. To avoid any data races, the socket lock needs to be held with bh_lock_sock(). If the socket is in use, retry again so
CVECVE-2026-46137
SeverityCRITICAL
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46195
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parse_sec_desc(), build_sec_desc(), and the chown path in id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd before proving a DACL header fits inside the returned securit
CVECVE-2026-46195
SeverityCRITICAL
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46043
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used. However, payload_size() subtracts both the attacker-control
CVECVE-2026-46043
SeverityCRITICAL
TypeUPDATED
PublishedWed, May 27 · 02:17 PM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46119
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix slab-out-of-bounds access in auth message processing If a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY contains a positive value in its result field, it is treated as an error code by ceph_handle_auth_reply() and returned to
CVECVE-2026-46119
SeverityCRITICAL
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46155
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits
CVECVE-2026-46155
SeverityCRITICAL
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46185
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in symlink_data() Since smb2_check_message() returns success without length validation for the symlink error response, in symlink_data() it is possible for iov->iov_len to be smaller than sizeof(struct smb2_err_rsp).
CVECVE-2026-46185
SeverityCRITICAL
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-43495
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler t7xx_port_enum_msg_handler() uses the modem-supplied port_count field as a loop bound over port_msg->data[] without checking that the message buffer contains suff
CVECVE-2026-43495
SeverityHIGH
TypeUPDATED
PublishedThu, May 21 · 01:16 PM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-43503
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving frags from source to destination. __
CVECVE-2026-43503
SeverityHIGH
TypeUPDATED
PublishedSat, May 23 · 12:17 PM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-45945
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix race condition during PASID entry replacement The Intel VT-d PASID table entry is 512 bits (64 bytes). When replacing an active PASID entry (e.g., during domain replacement), the current implementation calculates a new entry on the stac
CVECVE-2026-45945
SeverityHIGH
TypeUPDATED
PublishedWed, May 27 · 02:17 PM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46056
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise the connection can be freed concurrently. Extend the
CVECVE-2026-46056
SeverityHIGH
TypeUPDATED
PublishedWed, May 27 · 02:17 PM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46113
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest page tables are modified between VM entries (
CVECVE-2026-46113
SeverityHIGH
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46125
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the station since it's related to the link of the vif being r
CVECVE-2026-46125
SeverityHIGH
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46152
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent callers then share one instance and can overwrite each other's
CVECVE-2026-46152
SeverityHIGH
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46166
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-after-free error.
CVECVE-2026-46166
SeverityHIGH
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46174
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Make sure resources are not improperly shared in the op cache and cause instruction corruption this way.
CVECVE-2026-46174
SeverityHIGH
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46198
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix integer overflow on buff_pos Fixing an integer overflow present in batadv_iv_ogm_send_to_if. The size check is done using the int type in batadv_iv_ogm_aggr_packet whereas the buff_pos variable uses the s16 type. This could lead to an o
CVECVE-2026-46198
SeverityHIGH
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-45843
8.2/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: slip: bound decode() reads against the compressed packet length slhc_uncompress() parses a VJ-compressed TCP header by advancing a pointer through the packet via decode() and pull16(). Neither helper bounds-checks against isize, and decode() masks its
CVECVE-2026-45843
SeverityHIGH
TypeUPDATED
PublishedWed, May 27 · 11:16 AM CDT
ModifiedSat, May 30 · 11:17 AM CDT
CVE-2026-46037
8.2/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: validate reply type before using icmp_pointers Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type. That value is outside the range covered by icmp_pointers[], which only describes the traditional ICMP types up to NR_ICM
CVECVE-2026-46037
SeverityHIGH
TypeUPDATED
PublishedWed, May 27 · 02:17 PM CDT
ModifiedSat, May 30 · 11:17 AM CDT
