Baitaphish
Security intelligence
SearchLatest briefing
Data & Insights

CVE Explorer

Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Snapshot urn:baitaphish:cve-read-model-snapshot:v3:f2c3f72dcc196f8e7d63aa2d29709ad8b3fea39110eb2d563da5ce9b6fa9da89Released 2026-08-05T02:00:00Z
Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-46248

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: clear stale link mapping of ahvif->links_map When an arvif is initialized in non-AP STA mode but MLO connection preparation fails before the arvif is created (arvif->is_created remains false), the error path attempts to delete all links. However, link deletion only executes when arvif->is_created is true. As a result, ahvif retains a stale entry of arvif that is initialized but not created. When a new arvif is i

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46247

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gfx3d: add parent to parent request map After commit d228ece36345 ("clk: divider: remove round_rate() in favor of determine_rate()") determining GFX3D clock rate crashes, because the passed parent map doesn't provide the expected best_parent_hw clock (with the roundd_rate path before the offending commit the best_parent_hw was ignored). Set the field in parent_req in addition to setting it in the req, fixing the cr

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46246

In the Linux kernel, the following vulnerability has been resolved: power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `extcon` handle, means that the `extcon` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally deallocates in reverse allocation order). This means that during removal, there is a race condition where an interru

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46245

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dc_link NULL handling in HPD init amdgpu_dm_hpd_init() may see connectors without a valid dc_link. The code already checks dc_link for the polling decision, but later unconditionally dereferences it when setting up HPD interrupts. Assign dc_link early and skip connectors where it is NULL. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init() error: we

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46244

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nft_inner module. This vulnerability arises from an incorrect handling of IPv6 inner packet processing, where the transport header offset (inner_thoff) becomes desynchronized from the Layer 4 protocol (l4proto). A remote attacker could exploit this desynchronization to perform transport header forgery, potentially leading to a firewall bypass and allowing unauthorized network access.

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Linux, Linux, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Linux, Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 7
Provider severity
CRITICAL, HIGH
Conflicts
2

CVE-2026-46243

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its pri

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Linux, Linux, Red Hat, Red Hat
Product
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat OpenShift Container Platform 4.14, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4.21, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4.20, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat OpenShift Container Platform 4.12, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4.15, Red Hat Enterprise Linux 10, NVIDIA for RHEL 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10, Red Hat OpenShift Container Platform 4.13, Linux, Linux, Red Hat OpenShift Container Platform 4.16, Red Hat Enterprise Linux 10.0 Extended Update Support
Provider severity
HIGH
Conflicts
3

CVE-2026-46242

In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free()

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
HIGH
Conflicts
1

CVE-2026-46241

In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: fix use-after-free on registration failure Make sure to disable and free the interrupts in case controller registration fails to avoid a potential use-after-free and resource leak. This issue was flagged by Sashiko when reviewing a controller deregistration fix.

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46240

In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix use-after-free in iris_release_internal_buffers() The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") introduced a regression where session_release_buf() may free the buffer. The caller, iris_release_internal_buffers(), continued to access `buffer` after the call, leading to a potential use-after-free. Fix this by setting BUF_ATTR_PENDING_RELEASE before c

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
HIGH
Conflicts
1

CVE-2026-4624

A vulnerability was detected in SourceCodester Online Library Management System 1.0. The impacted element is an unknown function of the file /home.php of the component Parameter Handler. Performing a manipulation of the argument searchField results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.

PUBLISHED
Vendor
SourceCodester
Product
Online Library Management System
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-46239

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl Three control cases (AUTOGAIN, EXPOSURE_AUTO, ANALOGUE_GAIN) directly return without calling pm_runtime_put(), causing runtime PM reference count leaks. Change these cases from 'return' to 'ret = ... break' pattern to ensure pm_runtime_put() is always called before function exit.

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46238

In the Linux kernel, the following vulnerability has been resolved: batman-adv: stop caching unowned originator pointers in BAT IV BAT IV keeps the last-hop neighbor address in each neigh_node, but some paths also cache an originator pointer derived from a temporary lookup. That pointer is not owned by the neigh_node and may no longer refer to a live originator entry after purge handling runs. Stop storing the auxiliary originator pointer in the BAT IV neighbor state. When BAT IV needs the ne

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
HIGH
Conflicts
1

CVE-2026-46236

In the Linux kernel, the following vulnerability has been resolved: media: rc: xbox_remote: heed DMA restrictions The buffer for IO must not be part of the device structure because that violates the DMA coherency rules.

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46235

In the Linux kernel, the following vulnerability has been resolved: media: saa7164: add ioremap return checks and cleanups Add checks for ioremap return values in saa7164_dev_setup(). If ioremap for BAR0 or BAR2 fails, release the already allocated PCI memory regions, remove the device from the global list, decrement the device count, and return -ENODEV. This prevents potential null pointer dereferences and ensures proper cleanup on memory mapping failures.

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46234

In the Linux kernel, the following vulnerability has been resolved: vsock: fix buffer size clamping order In vsock_update_buffer_size(), the buffer size was being clamped to the maximum first, and then to the minimum. If a user sets a minimum buffer size larger than the maximum, the minimum check overrides the maximum check, inverting the constraint. This breaks the intended socket memory boundaries by allowing the vsk->buffer_size to grow beyond the configured vsk->buffer_max_size. Fix this

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46233

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: only purge non-released claims When batadv_bla_purge_claims() goes through the list of claims, it is only traversing the hash list with an rcu_read_lock(). Due to a potential parallel batadv_claim_put(), it can happen that it encounters a claim which was actually in the process of being released+freed by batadv_claim_release(). In this case, backbone_gw is set to NULL before the delayed RCU kfree is started. C

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46232

In the Linux kernel, the following vulnerability has been resolved: HID: playstation: Clamp num_touch_reports A device would never lie about the number of touch reports would it? If it does the loop in dualshock4_parse_report will read off the end of the touch_reports array, up to about 2 KiB for the maximum number of 256 loop iteraions. The data that is read is emitted via evdev if the DS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by clamping the num_touch_reports valu

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
HIGH
Conflicts
1

CVE-2026-46231

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: put backbone reference on failed claim hash insert When batadv_bla_add_claim() fails to insert a new claim into the hash, it leaked a reference to the backbone_gw for which the claim was intended. Call batadv_backbone_gw_put() on the error path to release the reference and avoid leaking the backbone_gw object.

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46230

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg.

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
HIGH
Conflicts
1

CVE-2026-4623

A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship-Management-System up to 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. This affects an unknown function of the file /api/System.php of the component API Module. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no vers

PUBLISHED
Vendor
DefaultFuction
Product
Jeson-Customer-Relationship-Management-System
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-46229

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure KFD VRAM allocations set AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE but not AMDGPU_GEM_CREATE_VRAM_CLEARED, leaving freshly allocated VRAM with stale data from prior use observable by compute kernels. The GEM ioctl path already sets VRAM_CLEARED for all userspace allocations via amdgpu_gem_create_ioctl() and amdgpu_mode_dumb_create(). The KFD path was missing thi

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46228

In the Linux kernel, the following vulnerability has been resolved: spi: ch341: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes). Fix the controller and driver data lifetime so that they are released on driver unbi

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46227

In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entry in @tmp before the loop body runs. The body calls sctp_sendmsg_to_asoc(), which may drop the socket lock inside sctp_wait_for_sndbuf(). While the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the association cached in @tmp,

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Linux, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Linux, Red Hat, Red Hat, Red Hat
Product
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Linux, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Linux, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support
Provider severity
HIGH
Conflicts
2

CVE-2026-46226

In the Linux kernel, the following vulnerability has been resolved: spi: fsl: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like DMA during driver unbind.

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46225

In the Linux kernel, the following vulnerability has been resolved: spi: rspi: fix controller deregistration Make sure to deregister the controller before releasing underlying resources like DMA during driver unbind.

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46224

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure When drm_gpuvm_resv_object_alloc() fails, the pre-allocated storage bo is not freed. Add xe_bo_free(storage) before returning the error. xe_dma_buf_init_obj() calls xe_bo_init_locked(), which frees the bo on error. Therefore, xe_dma_buf_init_obj() must also free the bo on its own error paths. Otherwise, since xe_gem_prime_import() cannot distinguish whether th

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46223

In the Linux kernel, the following vulnerability has been resolved: cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated A chain of commits going back to v7.0 reworked rmdir to satisfy the controller invariant that a subsystem's ->css_offline() must not run while tasks are still doing kernel-side work in the cgroup. [1] d245698d727a ("cgroup: Defer task cgroup unlink until after the task is done switching out") [2] a72f73c4dd9b ("cgroup: Don't expose dead tasks in cgroup") [

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46222

In the Linux kernel, the following vulnerability has been resolved: media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads The pads missed checks for connected devices which may a null dereference when the stream is enabled. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 pc : rkcif_interface_enable_streams+0x48/0xf0 lr : rkcif_interface_enable_streams+0x44/0xf0 Call trace: rkcif_interface_enable_streams+0x48/0xf0 v4l2_subdev_enable_streams+0x26c/

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46221

In the Linux kernel, the following vulnerability has been resolved: EDAC/versalnet: Fix device name memory leak The device name allocated via kzalloc() in init_one_mc() is assigned to dev->init_name but never freed on the normal removal path. device_register() copies init_name and then sets dev->init_name to NULL, so the name pointer becomes unreachable from the device. Thus leaking memory. Use a stack-local char array instead of using kzalloc() for name.

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46220

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission sdma_v4_0_ring_emit_fence() contains two BUG_ON(addr & 0x3) assertions that verify fence writeback addresses are dword-aligned. These assertions can be reached from unprivileged userspace via crafted DRM_IOCTL_AMDGPU_CS submissions, causing a fatal kernel panic in a scheduler worker thread. Replace both BUG_ON() calls with WARN_ON() to log the condition without

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-4622

OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network.

PUBLISHED
Vendor
NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd.
Product
Aterm WG2600HP4, Aterm WX3000HP2, Aterm WG1200CR, Aterm WF1200CR, Aterm GB1200PE, Aterm WG2600HS2, Aterm WG2600HM4, Aterm WX3000HP, Aterm WG2600HS
Provider severity
HIGH
Conflicts
1

CVE-2026-46219

In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: fix use-after-free on unbind The state machine work is scheduled by the interrupt handler and therefore needs to be cancelled after disabling interrupts to avoid a potential use-after-free.

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46218

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Add bounds checking to ib_{get,set}_value The uvd/vce/vcn code accesses the IB at predefined offsets without checking that the IB is large enough. Check the bounds here. The caller is responsible for making sure it can handle arbitrary return values. Also make the idx a uint32_t to prevent overflows causing the condition to fail.

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
HIGH
Conflicts
1

CVE-2026-46216

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status() When media GT is disabled via configfs, there is no allocation for media_gt, which is kept as NULL. In such scenario, intel_hdcp_gsc_check_status() results in a kernel pagefault error due to &gt->uc.gsc being evaluated as an invalid memory address. Fix that by introducing a NULL check on media_gt and bailing out early if so. While at it, also drop the

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46215

In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent gem_close could delete the object and remove one of the handles while leaving the other one dangling, which could subsequently be dereferenced for a use-after-free. To fix this, do the same dance that gem_close itself does. (f6cd7daecff5

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
HIGH
Conflicts
1

CVE-2026-46214

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix accept queue count leak on transport mismatch virtio_transport_recv_listen() calls sk_acceptq_added() before vsock_assign_transport(). If vsock_assign_transport() fails or selects a different transport, the error path returns without calling sk_acceptq_removed(), permanently incrementing sk_ack_backlog. After approximately backlog+1 such failures, sk_acceptq_is_full() returns true, causing the listener to re

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46213

In the Linux kernel, the following vulnerability has been resolved: HID: appletb-kbd: fix UAF in inactivity-timer cleanup path Commit 38224c472a03 ("HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe") added timer_delete_sync(&kbd->inactivity_timer) to both the probe close_hw error path and appletb_kbd_remove(), but the way it was wired in left the inactivity timer reachable during driver tear-down via two distinct windows. Window A -- put_device() before timer_delete_sync():

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46212

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: prevent use-after-free when deleting claims When batadv_bla_del_backbone_claims() removes all claims for a backbone, it does this by dropping the link entry in the hash list. This list entry itself was one of the references which need to be dropped at the same time via batadv_claim_put(). But the batadv_claim_put() must not be done before the last access to the claim object in this function. Otherwise the cla

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
HIGH
Conflicts
1

CVE-2026-46211

In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() msm_ioctl_gem_info_get_metadata() always returns 0 regardless of errors. When copy_to_user() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not. Additionally, kmemdup() can return NULL on allocation failure, but the

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46210

In the Linux kernel, the following vulnerability has been resolved: media: iris: fix use-after-free of fmt_src during MBPF check During concurrency testing, multiple instances can run in parallel, and each instance uses its own inst->lock while the core->lock protects the list of active instances. The race happens because these locks cover different scopes, inst->lock protects only the internals of a single instance, while the Macro Blocks Per Frame (MBPF) checker walks the core list under cor

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
HIGH
Conflicts
1

CVE-2026-4621

Hidden Functionality vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to enable telnet via network.

PUBLISHED
Vendor
NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd., NEC Platforms, Ltd.
Product
Aterm WG1200HP3, Aterm WG1200HS4, Aterm WX3000HP, Aterm WX1500HP, Aterm WG2600HS, Aterm W1200EX(-MS), Aterm WG2600HP4, Aterm GX1200HP, Aterm WG2600HS2, Aterm WG2600HM4, Aterm WG1200DM4, Aterm WG1200CR, Aterm WG1200HS3, Aterm GB1200PE, Aterm GX1200HS4, Aterm WG1800HP4, Aterm WG1200HP4, Aterm WG1900HP2, Aterm WG1900HP, Aterm WF1200CR, Aterm WG1200HP2, Aterm WG1800HP3, Aterm WX3000HP2, Aterm WG1200HS2, Aterm WX3600HP
Provider severity
MEDIUM
Conflicts
1

CVE-2026-46209

In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned int width = mode_cmd->width / (i ? info->hsub : 1); unsigned int height = mode_cmd->height / (i ? info->vsub : 1); However, the ioctl-level framebuffer_check() in drm_framebuffer.c uses drm_format_info_plane_width/height() which r

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
HIGH
Conflicts
1

CVE-2026-46208

In the Linux kernel, the following vulnerability has been resolved: batman-adv: stop tp_meter sessions during mesh teardown TP meter sessions remain linked on bat_priv->tp_list after the netlink request has already finished. When the mesh interface is removed, batadv_mesh_free() currently tears down the mesh without first draining these sessions. A running sender thread or a late incoming tp_meter packet can then keep processing against a mesh instance which is already shutting down. Synchron

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
HIGH
Conflicts
1

CVE-2026-46207

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix empty payload in tap skb for non-linear buffers For non-linear skbs, virtio_transport_build_skb() goes through virtio_transport_copy_nonlinear_skb() to copy the original payload in the new skb to be delivered to the vsockmon tap device. This manually initializes an iov_iter but does not set iov_iter.count. Since the iov_iter is zero-initialized, the copy length is zero and no payload is actually copied to the

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46206

In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject new tp_meter sessions during teardown Prevent tp_meter from starting new sender or receiver sessions after mesh_state has left BATADV_MESH_ACTIVE.

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
HIGH
Conflicts
1

CVE-2026-46205

In the Linux kernel, the following vulnerability has been resolved: staging: media: atomisp: Disallow all private IOCTLs Disallow all private IOCTLs. These aren't quite as safe as one could assume of IOCTL handlers; disable them for now. Instead of removing the code, return in the beginning of the function if cmd is non-zero in order to keep static checkers happy.

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
HIGH
Conflicts
1

CVE-2026-46204

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Rewrite the IB parsing to use amdgpu_ib_get_value() which handles the bounds checks.

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
HIGH
Conflicts
1

CVE-2026-46203

In the Linux kernel, the following vulnerability has been resolved: spi: cadence-quadspi: fix unclocked access on unbind Make sure that the controller is runtime resumed before disabling it during driver unbind to avoid an unclocked register access. This issue was flagged by Sashiko when reviewing a controller deregistration fix.

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46202

In the Linux kernel, the following vulnerability has been resolved: HID: appletb-kbd: run inactivity autodim from workqueues The autodim code in hid-appletb-kbd takes backlight_device->ops_lock via backlight_device_set_brightness() -> mutex_lock() from two different atomic contexts: * appletb_inactivity_timer() is a struct timer_list callback, so it runs in softirq context. Every expiry triggers BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591 C

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
Not asserted
Conflicts
1

CVE-2026-46201

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() When xe_dma_buf_init_obj() fails, the attachment from dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before returning the error. Note: we cannot use goto out_err here because xe_dma_buf_init_obj() already frees bo on failure, and out_err would double-free it. (cherry picked from commit a828eb185aac41800df8eae4b60501ccc0dbbe51)

PUBLISHED
Vendor
Linux, Linux
Product
Linux, Linux
Provider severity
HIGH
Conflicts
1