{"kind": "product", "path": "vulns/ubuntu-26.10/linux", "name": "linux", "product": "linux", "ecosystem": "Ubuntu:26.10", "items": [{"id": "CVE-2026-99999", "noindex": false, "published": "2026-10-15T12:19:22.784Z", "modified": "2026-10-24T14:17:15.740Z", "cvss": 9.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00788, "kev": false, "exploits": ["github-poc", "public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-99999", "title": "ipv4: validate checksum_start before completing checksum", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn't allow such packets in, but as a defence\nin depth measure, let's also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work.", "references": ["https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956", "https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a", "https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-98432", "noindex": false, "published": "2026-10-15T12:08:22.205Z", "modified": "2026-10-24T14:08:46.326Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.00388, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98432", "title": "ipv4: free inet_opt and ireq_opt after an RCU grace period", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the\nchild socket (newinet->inet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt->optlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and", "references": ["https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6", "https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5", "https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-98375", "noindex": false, "published": "2026-10-09T07:10:45.930Z", "modified": "2026-10-21T12:54:59.248Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00186, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98375", "title": "xen/netfront: drop RX packets with a short Ethernet header", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: drop RX packets with a short Ethernet header\n\nhandle_incoming_queue() pulls pull_to bytes into the head before\ncalling eth_type_trans().  pull_to is the length of the first RX slot,\ncapped at RX_COPY_THRESHOLD, and that length comes from the backend.\nNothing checks it against ETH_HLEN.\n\nIf the first slot is shorter than ETH_HLEN and more slots follow, the\nhead ends up shorter than an Ethernet header while skb->len is longer,\nand eth_type_trans() BUG()s in __skb_pull().  If the whole packet is\nshorter than ETH_HLEN, eth_type_trans() reads the header past the end", "references": ["https://git.kernel.org/stable/c/0542d213253eec18785a24b603b28bd385dfe4a5", "https://git.kernel.org/stable/c/236a17caebcff31f75bec5ff4136bde2de944e40", "https://git.kernel.org/stable/c/72d2f54367895d6e236b9857892e2e6b6036e067"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-98174", "noindex": false, "published": "2026-10-06T08:44:18.350Z", "modified": "2026-10-19T09:15:05.758Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.0033, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-98174", "title": "smb: client: fix rlist race and missing initialization", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix rlist race and missing initialization\n\nTCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next\nand ->prev to NULL instead of pointing to itself, making list_empty()\nalways return false and list_add() dereference a NULL ->prev pointer.\n\nAlso, cifs_signal_cifsd_for_reconnect() can be called concurrently\nfrom multiple cifsd threads, allowing the same server's rlist node to\nbe added twice into the local list, corrupting it.", "references": ["https://git.kernel.org/stable/c/b5f924ffbfa976e4b97f17e8132c595b97482c2d", "https://git.kernel.org/stable/c/5a8f82f9c5839389cf4036029dd75a9911049e83", "https://git.kernel.org/stable/c/04082b1833856cb9ed87e0d3d5f04cbf836cf7da"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-93105", "noindex": false, "published": "2026-09-17T16:11:16.442Z", "modified": "2026-10-21T12:51:55.410Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00175, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-93105", "title": "esp: do not unref managed frag pages in esp_ssg_unref()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nesp: do not unref managed frag pages in esp_ssg_unref()\n\nesp_ssg_unref() releases the page references held on the source\nscatterlist after the AEAD operation completes.  It calls\nskb_page_unref() on every frag page for an out-of-place transform\n(req->src != req->dst), and in the error path of esp_output_tail()\n(already_unref == true) on the request's own scatterlist.\n\nThis is wrong when the skb carries managed frags\n(SKBFL_MANAGED_FRAG_REFS).  Managed frags are owned by a zerocopy ubuf\nand the skb does not hold a per-frag page reference; io_uring SEND_ZC\nwith a registered bu", "references": ["https://git.kernel.org/stable/c/201bdf10ae92e7cbd524adf8c0323e2a963d5fd7", "https://git.kernel.org/stable/c/3ec55f0c8a6a543cf660584d1346e11f6311ee59", "https://git.kernel.org/stable/c/1ad6456898f6e6cf58be83bdb607acb1119a9cd1"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-74342", "noindex": false, "published": "2026-08-15T05:58:31.924Z", "modified": "2026-08-17T05:17:34.554Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00198, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-74342", "title": "kernfs: link kn to its parent before the LSM init hook", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernfs: link kn to its parent before the LSM init hook\n\nAfter commit 12e9e3cd03b5 (\"simpe_xattr: use per-sb cache\"),\nkernfs_xattr_set() and kernfs_xattr_get() compute the cache via\nkernfs_root(kn) before any other check.  kernfs_root(kn) walks\nkn->__parent first and falls back to kn->dir.root, both of which are\nNULL on a freshly kmem_cache_zalloc()'d kn. kn->__parent was being set\nin kernfs_new_node() after __kernfs_new_node() returned, and kn->dir.root\nis set even later by kernfs_create_dir_ns() / kernfs_create_empty_dir().\n\nThe LSM kernfs_init_security hook is invoked from", "references": ["https://git.kernel.org/stable/c/319b82e8b46edaf557436ad858e734e583f78ec9", "https://git.kernel.org/stable/c/6cccc49b027c7551ffc1d2532f2ef1922661f3da", "https://nvd.nist.gov/vuln/detail/CVE-2026-74342"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-68086", "noindex": false, "published": "2026-08-10T11:51:40.304Z", "modified": "2026-08-10T11:51:40.304Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.0015, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-68086", "title": "mm/khugepaged: write all dirty file folios when collapsing", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/khugepaged: write all dirty file folios when collapsing\n\n[There is no upstream commit, as this code was removed by upstream\n commit 044925f9b565 (\"mm: fs: remove filemap_nr_thps*() functions and their users\")]\n\nAs-is, khugepaged and writable-file opening exclude each other. A file\ncannot be open writeable and have THPs (because the filesystem is not aware\nof them). khugepaged will never collapse file pages for files that are\nopened writeable. On an open(O_RDWR/O_WRONLY), the page cache for that\nparticular file is dropped. This is fine because nothing could've been\ndirtied", "references": ["https://git.kernel.org/stable/c/2dfe9f5c91d0963058f8a5e46e1c2a908382cc46", "https://nvd.nist.gov/vuln/detail/CVE-2026-68086"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-17523", "noindex": false, "published": "2026-07-27T08:58:58.143Z", "modified": "2026-09-10T13:31:17.266Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00165, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-17523", "title": "can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet\n\nThis patch switches the timer to HRTIMER_MODE_SOFT, which executed the\ntimer callback in softirq context and removes the hrtimer_tasklet.", "references": ["https://git.kernel.org/stable/c/79305a826f872fe446c6fbf8450f515053ef6951", "https://git.kernel.org/stable/c/bf74aa86e111aa3b2fbb25db37e3a3fab71b5b68", "https://nvd.nist.gov/vuln/detail/CVE-2026-17523"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-52913", "noindex": false, "published": "2026-06-24T07:14:11.248Z", "modified": "2026-06-24T07:14:11.248Z", "cvss": 5.5, "cvss_vector": "", "severity": "medium", "epss": 0.00123, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-52913", "title": "batman-adv: v: stop OGMv2 on disabled interface", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: v: stop OGMv2 on disabled interface\n\nWhen a batadv_hard_iface is disabled, its mesh_iface pointer is set to\nNULL. However, batadv_v_ogm_send_meshif() may still dispatch OGMs via\nbatadv_v_ogm_queue_on_if() for interfaces that have since lost their\nmesh_iface association. This results in a NULL pointer dereference when\nbatadv_v_ogm_queue_on_if() unconditionally calls netdev_priv() on the\nnow NULL hard_iface->mesh_iface to retrieve the batadv_priv.\n\nIt is necessary to ensure that the batadv_v_ogm_queue_on_if() checks that\nit is using the same mesh_iface for which ba", "references": ["https://git.kernel.org/stable/c/d7391a2b854a62235539c68e9cbf6fc7910a8e9a", "https://git.kernel.org/stable/c/70c9f6ab0d8f785087fb74fb85464a9a5288bfdb", "https://git.kernel.org/stable/c/040fe8eb34624002071dd21de9824dfe668ce65d"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-46147", "noindex": false, "published": "2026-05-28T09:36:03.892Z", "modified": "2026-06-14T17:58:03.230Z", "cvss": 5.5, "cvss_vector": "", "severity": "medium", "epss": 0.00126, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-46147", "title": "KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()\n\nTwo bugs exist in the vCPU initialisation path:\n\n1. If a check fails after hyp_pin_shared_mem() succeeds, the cleanup\n   path jumps to 'unlock' without calling unpin_host_vcpu() or\n   unpin_host_sve_state(), permanently leaking pin references on the\n   host vCPU and SVE state pages.\n\n   Extract a register_hyp_vcpu() helper that performs the checks and\n   the store. When register_hyp_vcpu() returns an error, call\n   unpin_host_vcpu() and unpin_host_sve_state() inline before falling\n   through to the exis", "references": ["https://git.kernel.org/stable/c/7d3c27b54253cda91dc4d2c1bfc109c490837ab9", "https://git.kernel.org/stable/c/6d69c0ed978f7f0efd053fc98390f25ab77c1aea", "https://git.kernel.org/stable/c/73b9c1e5da84cd69b1a86e374e450817cd051371"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-31787", "noindex": false, "published": "2026-04-30T10:31:28.992Z", "modified": "2026-06-14T17:44:41.402Z", "cvss": 7.8, "cvss_vector": "", "severity": "high", "epss": 0.00183, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-31787", "title": "xen/privcmd: fix double free via VMA splitting", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/privcmd: fix double free via VMA splitting\n\nprivcmd_vm_ops defines .close (privcmd_close), but neither .may_split\nnor .open. When userspace does a partial munmap() on a privcmd mapping,\nthe kernel splits the VMA via __split_vma(). Since may_split is NULL,\nthe split is allowed. vm_area_dup() copies vm_private_data (a pages\narray allocated in alloc_empty_pages()) into the new VMA without any\nfixup, because there is no .open callback.\n\nBoth VMAs now point to the same pages array. When the unmapped portion\nis closed, privcmd_close() calls:\n    - xen_unmap_domain_gfn_range()\n", "references": ["https://git.kernel.org/stable/c/dbf862ce9f009128ab86b234d91413a3e450beb4", "https://git.kernel.org/stable/c/2b985d3a024b9e8c24e21671b34e855569763808", "https://git.kernel.org/stable/c/1576ff3869cbd3620717195f971c85b7d7fd62b5"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-31786", "noindex": false, "published": "2026-04-30T10:31:28.293Z", "modified": "2026-10-19T19:06:08.809Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00197, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-31786", "title": "Buffer overflow in drivers/xen/sys-hypervisor.c", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBuffer overflow in drivers/xen/sys-hypervisor.c\n\nThe build id returned by HYPERVISOR_xen_version(XENVER_build_id) is\nneither NUL terminated nor a string.\n\nThe first causes a buffer overflow as sprintf in buildid_show will\nread and copy till it finds a NUL.\n\n00000000  f4 91 51 f4 dd 38 9e 9d  65 47 52 eb 10 71 db 50  |..Q..8..eGR..q.P|\n00000010  b9 a8 01 42 6f 2e 32                              |...Bo.2|\n00000017\n\nSo use a memcpy instead of sprintf to have the correct value:\n\n00000000  f4 91 51 f4 dd 00 9e 9d  65 47 52 eb 10 71 db 50  |..Q.....eGR..q.P|\n00000010  b9 a8 01 42 ", "references": ["https://git.kernel.org/stable/c/e3af585e1728c917682b6a3de9a69b41fb9194d4", "https://git.kernel.org/stable/c/8288d031a01dbacfde3fc643f7be3d23504de64d", "https://git.kernel.org/stable/c/f458ba102da97fafca106327086fc95f3fc764cb"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-25702", "noindex": false, "published": "2026-03-05T07:00:18.627Z", "modified": "2026-03-05T15:17:39.310Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "severity": "high", "epss": 0.00212, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-25702", "title": "nftables disabled due to incorrect kernel backport", "description": "A Improper Access Control vulnerability in the kernel of SUSE SUSE Linux Enterprise Server 12 SP5 breaks nftables, causing firewall rules applied via nftables to not be effective.This issue affects SUSE Linux Enterprise Server: from 9e6d9d4601768c75fdb0bad3fbbe636e748939c2 before 9c294edb7085fb91650bc12233495a8974c5ff2d.", "references": ["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-25702", "https://nvd.nist.gov/vuln/detail/CVE-2026-25702"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2025-12801", "noindex": false, "published": "2026-03-04T15:25:53.403Z", "modified": "2026-10-16T11:09:25.685Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.0048, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-12801", "title": "Nfs-utils: rpc.mountd in the nfs-utils privilege escalation", "description": "A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the\nprivileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.", "references": ["https://access.redhat.com/errata/RHSA-2026:3938", "https://access.redhat.com/errata/RHSA-2026:3939", "https://access.redhat.com/errata/RHSA-2026:3940"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2025-1272", "noindex": false, "published": "2026-02-18T20:29:15.172Z", "modified": "2026-02-26T16:18:15.279Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00254, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-1272", "title": "Kernel: secure boot does not automatically enable kernel lockdown", "description": "The Linux Kernel lockdown mode for kernel versions starting on 6.12 and above for Fedora Linux has the lockdown mode disabled without any warning. This may allow an attacker to gain access to sensitive information such kernel memory mappings, I/O ports, BPF and kprobes. Additionally unsigned modules can be loaded, leading to execution of untrusted code breaking breaking any Secure Boot protection. This vulnerability affects only Fedora Linux.", "references": ["https://access.redhat.com/errata/RHSA-2025:6966", "https://access.redhat.com/security/cve/CVE-2025-1272", "https://bugzilla.redhat.com/show_bug.cgi?id=2345615"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2023-54190", "noindex": false, "published": "2025-12-30T12:08:58.605Z", "modified": "2026-05-11T19:57:12.488Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00199, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-54190", "title": "leds: led-core: Fix refcount leak in of_led_get()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: led-core: Fix refcount leak in of_led_get()\n\nclass_find_device_by_of_node() calls class_find_device(), it will take\nthe reference, use the put_device() to drop the reference when not need\nanymore.", "references": ["https://git.kernel.org/stable/c/1d6101d9222e1ca8c01b3fa9ebf0dcf7bcd82564", "https://git.kernel.org/stable/c/690efcb5827c3bacbf1de90cd14907b91bf8cb7b", "https://git.kernel.org/stable/c/d880981b82223f9bf128dfdd2424abb0c658f345"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2023-54187", "noindex": false, "published": "2025-12-30T12:08:56.562Z", "modified": "2026-08-05T09:17:54.804Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00155, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-54187", "title": "f2fs: fix potential corruption when moving a directory", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix potential corruption when moving a directory\n\nF2FS has the same issue in ext4_rename causing crash revealed by\nxfstests/generic/707.\n\nSee also commit 0813299c586b (\"ext4: Fix possible corruption when moving a directory\")", "references": ["https://git.kernel.org/stable/c/3e77036246123ff710fa2661dcaa12a45284f09b", "https://git.kernel.org/stable/c/957904f531fd857a92743b11fbc9c9ffdf7f3207", "https://git.kernel.org/stable/c/8f57f3e112cf1d16682b6ff9c31c72f40f7da9c9"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2023-54105", "noindex": false, "published": "2025-12-24T13:06:30.053Z", "modified": "2026-05-11T19:55:34.267Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00208, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-54105", "title": "can: isotp: check CAN address family in isotp_bind()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: check CAN address family in isotp_bind()\n\nAdd missing check to block non-AF_CAN binds.\n\nSyzbot created some code which matched the right sockaddr struct size\nbut used AF_XDP (0x2C) instead of AF_CAN (0x1D) in the address family\nfield:\n\nbind$xdp(r2, &(0x7f0000000540)={0x2c, 0x0, r4, 0x0, r2}, 0x10)\n                                ^^^^\nThis has no funtional impact but the userspace should be notified about\nthe wrong address family field content.", "references": ["https://git.kernel.org/stable/c/de3c02383aa678f6799402ac47fdd89cf4bfcaa9", "https://git.kernel.org/stable/c/2fc6f337257f4f7c21ecff429241f7acaa6df4e8", "https://git.kernel.org/stable/c/9427584c2f153d0677ef3bad6f44028c60d728c4"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2025-40190", "noindex": false, "published": "2025-11-12T21:56:30.914Z", "modified": "2026-08-05T12:08:26.693Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00178, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-40190", "title": "ext4: guard against EA inode refcount underflow in xattr update", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: guard against EA inode refcount underflow in xattr update\n\nsyzkaller found a path where ext4_xattr_inode_update_ref() reads an EA\ninode refcount that is already <= 0 and then applies ref_change (often\n-1). That lets the refcount underflow and we proceed with a bogus value,\ntriggering errors like:\n\n  EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1\n  EXT4-fs warning: ea_inode dec ref err=-117\n\nMake the invariant explicit: if the current refcount is non-positive,\ntreat this as on-disk corruption, emit ext4_error_inode(), and fail the\noperation with -", "references": ["https://git.kernel.org/stable/c/ea39e712c2f5ae148ee5515798ae03523673e002", "https://git.kernel.org/stable/c/1cfb3e4ddbdc8e02e637b8852540bd4718bf4814", "https://git.kernel.org/stable/c/505e69f76ac497e788f4ea0267826ec7266b40c8"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2022-50551", "noindex": false, "published": "2025-10-07T15:21:13.391Z", "modified": "2026-05-11T19:21:36.721Z", "cvss": 7.1, "cvss_vector": "", "severity": "high", "epss": 0.00218, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-50551", "title": "wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()\n\nThis patch fixes a shift-out-of-bounds in brcmfmac that occurs in\nBIT(chiprev) when a 'chiprev' provided by the device is too large.\nIt should also not be equal to or greater than BITS_PER_TYPE(u32)\nas we do bitwise AND with a u32 variable and BIT(chiprev). The patch\nadds a check that makes the function return NULL if that is the case.\nNote that the NULL case is later handled by the bus-specific caller,\nbrcmf_usb_probe_cb() or brcmf_usb_reset_resume(), for example.\n\nFound by a modified version of ", "references": ["https://git.kernel.org/stable/c/1db036d13e10809943c2dce553e2fa7fc9c6cd80", "https://git.kernel.org/stable/c/bc45aa1911bf699b9905f12414e3c1879d6b784f", "https://git.kernel.org/stable/c/4c8fc44c44b97854623c56363c359f711fc0b887"], "fixes": [], "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}]}], "total": 93, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 5, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "linux", "path": "vulns/ubuntu-26.10/linux", "ecosystem": "Ubuntu:26.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 4, "kev": 0}, "lastmod": "2026-10-24T14:17:15.740Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}