Vulnerabilities

Linux Kernel 7.1

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

643CVEs

CVE-2026-64223

wifi: mac80211: consume only present negotiated TTLM maps

Published 2026-07-24 · Analyzed

8.1EPSS 0.004

CVE-2026-53147

thunderbolt: Validate XDomain request packet size before type cast

Published 2026-06-25 · Analyzed

8.1EPSS 0.003

CVE-2026-53254

Bluetooth: RFCOMM: validate skb length in MCC handlers

Published 2026-06-25 · Analyzed

8.1EPSS 0.003

CVE-2026-53178

staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction

Published 2026-06-25 · Modified

8.1EPSS 0.002

CVE-2026-64176

wifi: iwlwifi: mvm: fix driver-set TX rates on old devices

Published 2026-07-19 · Analyzed

8.1EPSS 0.002

CVE-2026-64406

Bluetooth: fix UAF in bt_accept_dequeue()

Published 2026-07-25 · Analyzed

8.0EPSS 0.004

CVE-2026-53357

Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()

Published 2026-07-02 · Analyzed

8.0EPSS 0.004

CVE-2026-53256

Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

Published 2026-06-25 · Analyzed

8.0EPSS 0.002

CVE-2026-46300

net: skbuff: preserve shared-frag marker during coalescing

Published 2026-05-23 · Modified

7.81 PoCEPSS 0.024

CVE-2026-43500

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

Published 2026-05-11 · Modified

7.82 PoCEPSS 0.023

CVE-2026-46333

ptrace: slightly saner 'get_dumpable()' logic

Published 2026-05-15 · Modified

7.8EPSS 0.005

CVE-2026-53264

net/sched: act_api: use RCU with deferred freeing for action lifecycle

Published 2026-06-25 · Modified

7.8EPSS 0.002

CVE-2026-31786

Buffer overflow in drivers/xen/sys-hypervisor.c

Published 2026-04-30 · Analyzed

7.8EPSS 0.002

CVE-2026-53212

netfilter: nft_tunnel: fix use-after-free on object destroy

Published 2026-06-25 · Analyzed

7.8EPSS 0.002

CVE-2026-46243

smb: client: reject userspace cifs.spnego descriptions

Published 2026-06-01 · Modified

7.8EPSS 0.002

CVE-2026-46323

net: gro: don't merge zcopy skbs

Published 2026-06-09 · Modified

7.8EPSS 0.002

CVE-2026-46331

net/sched: fix pedit partial COW leading to page cache corruption

Published 2026-06-16 · Modified

7.8EPSS 0.002

CVE-2026-52923

ipc: limit next_id allocation to the valid ID range

Published 2026-06-24 · Modified

7.8EPSS 0.002

CVE-2026-52969

KVM: Reject wrapped offset in kvm_reset_dirty_gfn()

Published 2026-06-24 · Analyzed

7.8EPSS 0.002

CVE-2026-43494

net/rds: reset op_nents when zerocopy page pin fails

Published 2026-05-21 · Modified

7.8EPSS 0.002

CVE-2026-31787

xen/privcmd: fix double free via VMA splitting

Published 2026-04-30 · Analyzed

7.8EPSS 0.002

CVE-2026-46281

vmalloc: fix buffer overflow in vrealloc_node_align()

Published 2026-06-08 · Analyzed

7.8EPSS 0.002

CVE-2026-46145

RDMA/mana: Validate rx_hash_key_len

Published 2026-05-28 · Modified

7.8EPSS 0.002

CVE-2026-46117

RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

Published 2026-05-28 · Undergoing Analysis

7.8EPSS 0.002

CVE-2026-31716

fs/ntfs3: validate rec->used in journal-replay file record check

Published 2026-05-01 · Modified

7.8EPSS 0.002

CVE-2026-64114

ipv4: raw: reject IP_HDRINCL packets with ihl < 5

Published 2026-07-19 · Analyzed

7.8EPSS 0.002

CVE-2026-52976

drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

Published 2026-06-24 · Modified

7.8EPSS 0.002

CVE-2026-52973

futex: Drop CLONE_THREAD requirement for private default hash alloc

Published 2026-06-24 · Modified

7.8EPSS 0.002

CVE-2026-64044

ovpn: respect peer refcount in CMD_NEW_PEER error path

Published 2026-07-19 · Analyzed

7.8EPSS 0.002

CVE-2026-46189

RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

Published 2026-05-28 · Modified

7.8EPSS 0.002

CVE-2026-64073

irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT

Published 2026-07-19 · Analyzed

7.8EPSS 0.002

CVE-2026-52943

net: skbuff: fix missing zerocopy reference in pskb_carve helpers

Published 2026-06-24 · Modified

7.8EPSS 0.002

CVE-2026-46176

RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

Published 2026-05-28 · Modified

7.8EPSS 0.002

CVE-2026-43502

net/rds: handle zerocopy send cleanup before the message is queued

Published 2026-05-21 · Modified

7.8EPSS 0.002

CVE-2026-52950

drm/xe/dma-buf: fix UAF with retry loop

Published 2026-06-24 · Modified

7.8EPSS 0.002

CVE-2026-52951

drm/xe/dma-buf: handle empty bo and UAF races

Published 2026-06-24 · Analyzed

7.8EPSS 0.002

CVE-2026-46116

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

Published 2026-05-28 · Undergoing Analysis

7.8EPSS 0.002

CVE-2026-52975

bonding: 3ad: implement proper RCU rules for port->aggregator

Published 2026-06-24 · Analyzed

7.8EPSS 0.002

CVE-2026-31696

rxrpc: Fix missing validation of ticket length in non-XDR key preparsing

Published 2026-05-01 · Modified

7.8EPSS 0.002

CVE-2026-52962

ceph: fix a buffer leak in __ceph_setxattr()

Published 2026-06-24 · Analyzed

7.8EPSS 0.002

Linux Kernel 7.1

Security check