By vendor

Linux vulnerabilities

Known CVEs affecting Linux products, prioritized by severity, with SEC.co remediation and detection guidance.

1178 published vulnerabilities · page 6 of 12

• CVE-2026-11667HIGH 7.5

  Google Chrome versions prior to 149.0.7827.103 contain an out-of-bounds read vulnerability in WebRTC processing that could allow an attacker with prior access to the GPU process to corrupt heap memory and potentially execute code. The attack requires user interaction (clicking a malicious link or visiting a crafted webpage) but could lead to serious data theft or system compromise.

• CVE-2026-11694HIGH 7.5

  A use-after-free flaw in Google Chrome's ServiceWorker implementation could allow an attacker who has already compromised the renderer process to run malicious code within the sandbox. The vulnerability requires user interaction (visiting a specially crafted webpage) but poses a direct path to code execution for an attacker with partial system access.

• CVE-2026-1220HIGH 7.5

  A race condition in Google Chrome's V8 JavaScript engine could allow an attacker to trick the browser into confusing data types when processing a malicious webpage. An attacker would need to craft a specific HTML page and convince a user to visit it, but if successful, the vulnerability could lead to information disclosure, data tampering, or application crashes. Chrome versions before 144.0.7559.99 are affected.

• CVE-2026-12445HIGH 7.5

  Google Chrome versions before 149.0.7827.155 contain a use-after-free vulnerability in the Extensions subsystem. An attacker can exploit this by tricking a user into installing a malicious Chrome extension, potentially leading to heap corruption and arbitrary code execution on the victim's machine. The vulnerability requires user interaction (extension installation) but poses significant risk because users may not scrutinize extension permissions closely.

• CVE-2026-12455HIGH 7.5

  A use-after-free memory vulnerability exists in Google Chrome's tab strip component that could allow an attacker to corrupt the browser's heap memory. The attack requires convincing a user to perform specific UI actions (such as interacting with tabs in a particular sequence) while viewing a malicious webpage. If exploited successfully, an attacker could gain the ability to read sensitive data, modify browser behavior, or crash the application. This vulnerability affects Chrome versions prior to 149.0.7827.155 across Windows, macOS, and Linux systems.

• CVE-2026-12462HIGH 7.5

  A use-after-free vulnerability in Chrome's media handling allows an attacker who has already compromised the renderer process to execute arbitrary code within the browser sandbox. The vulnerability requires user interaction (such as opening a malicious HTML page) but poses a serious risk because it enables code execution even when the renderer is already isolated from the system. This vulnerability affects Chrome versions prior to 149.0.7827.155.

• CVE-2026-13029HIGH 7.5

  A use-after-free flaw in Chrome's Web Authentication system allows attackers to corrupt the browser's heap memory. The vulnerability requires both user interaction—tricking someone into installing a malicious Chrome extension—and the extension itself to be crafted specifically to exploit the weakness. If successfully exploited, an attacker could potentially execute arbitrary code within the Chrome process, compromising browsing security and data confidentiality.

• CVE-2026-13824HIGH 7.5

  Google Chrome versions before 150.0.7871.47 contain a security flaw in how it enforces policies for browser extensions. An attacker who has already compromised Chrome's renderer process—the component that executes web content—can exploit insufficient policy checks to escalate their privileges and gain deeper control of the browser. The attack requires user interaction (such as visiting a malicious webpage) but bypasses normal security boundaries once the renderer is compromised.

• CVE-2026-13831HIGH 7.5

  A memory safety vulnerability in Google Chrome's GPU processing component allows an attacker who has already compromised a Chrome renderer process to break out of the sandbox and execute arbitrary code with elevated privileges. The vulnerability stems from improper bounds checking in GPU memory operations, allowing out-of-bounds read and write access. An attacker would need to deliver a malicious HTML page to a user and have that page run within an already-compromised renderer context to exploit this flaw.

• CVE-2026-13855HIGH 7.5

  A use-after-free vulnerability exists in the Ozone subsystem of Google Chrome on Linux. An attacker can exploit this by crafting a malicious webpage that tricks a user into performing specific mouse or keyboard gestures, leading to arbitrary code execution on the affected system. The vulnerability requires user interaction but allows full compromise of the browser process and potentially the underlying system.

• CVE-2026-13891HIGH 7.5

  Google Chrome versions before 150.0.7871.47 contain a vulnerability in how the browser's extension system validates user input. An attacker who has already compromised Chrome's rendering engine can exploit this weakness to escape the browser's sandbox and gain system-level privileges. The attack requires a specially crafted web page and user interaction, but once executed allows the attacker to move from browser context to full machine control.

• CVE-2026-14115HIGH 7.5

  CVE-2026-14115 is a privilege escalation vulnerability in Google Chrome's Cast feature that allows an attacker who has already compromised Chrome's renderer process to gain elevated system privileges through a specially crafted HTML page. While the underlying Chromium defect is rated Low severity by Google's own assessment, the CVSS 3.1 score reflects the potential for complete system compromise (confidentiality, integrity, and availability impact) once an attacker reaches the renderer process. The vulnerability affects Chrome versions before 150.0.7871.47 and impacts Windows, macOS, and Linux users.

• CVE-2026-24264HIGH 7.5

  NVIDIA Triton Inference Server running on Linux has a vulnerability that allows remote attackers to crash the service by sending specially crafted highly compressed data. An attacker needs no credentials or user interaction to trigger this denial-of-service condition, making it a straightforward attack vector. The vulnerability does not enable data theft or system compromise, but availability impact can be significant for organizations relying on Triton for AI inference workloads.

• CVE-2026-34711HIGH 7.5

  A flaw in CAI Content Credentials—a technology for tracking and verifying the authenticity of digital content—allows an attacker to crash applications using affected versions by sending specially crafted input that triggers an integer overflow. No user action is required; the attack can be executed remotely. The vulnerability affects multiple platforms including iOS, macOS, Android, Windows, and Linux systems that implement the c2pa-web or c2pa libraries.

• CVE-2026-45591HIGH 7.5

  CVE-2026-45591 is a denial-of-service vulnerability in ASP.NET Core that allows attackers on a network to exhaust system resources and crash or degrade application availability. An attacker can send specially crafted requests that consume excessive CPU, memory, or other finite resources without needing to authenticate or interact with users. The vulnerability stems from insufficient input validation or rate-limiting in the framework's request-handling pipeline.

• CVE-2026-46110HIGH 7.5

  CVE-2026-46110 is a NULL pointer dereference vulnerability in the Linux kernel's stmmac network driver that can crash a system when memory becomes exhausted during packet reception. The driver manages a circular ring of descriptors to coordinate DMA transfers between the CPU and network hardware. When the driver runs out of memory to allocate new receive buffers, it can incorrectly process already-used descriptors as if they were fresh, leading to a kernel panic. This occurs because the driver doesn't properly distinguish between descriptors that are waiting to be refilled versus those that have already been processed.

• CVE-2026-46114HIGH 7.5

  A memory leak vulnerability exists in the Linux kernel's RDMA over Converged Ethernet (RoCE) driver. An attacker on the network can send specially crafted RDMA ATOMIC_WRITE requests with zero-length payloads to trigger the responder into reading uninitialized kernel memory and inadvertently leaking it back to the attacker. The vulnerability specifically affects how the kernel validates packet lengths before dereferencing memory, allowing 8 bytes of sensitive kernel data (including kernel strings and pointer information) to be extracted per malicious probe.

• CVE-2026-46124HIGH 7.5

  A vulnerability in the Linux kernel's ISO 9660 filesystem (isofs) allows an attacker to read arbitrary blocks from a storage device when the filesystem is exported over NFS. An authenticated attacker can craft a malicious NFS file handle that causes the kernel to interpret unrelated data on the underlying block device as if it were part of the ISO filesystem, leaking that data to the NFS client. While this does not cause memory corruption or system crashes, it exposes sensitive information from adjacent partitions or disk regions. The issue affects systems that export ISO images (typically loop-mounted) over NFS, which is a narrower deployment scenario but still represents a data confidentiality risk.

• CVE-2026-46133HIGH 7.5

  A flaw in the Linux kernel's RDMA/rxe (Soft RoCE) driver allows an unauthenticated attacker to crash the system by sending a specially crafted UDP packet with an invalid opcode. The vulnerability exists in how the driver validates incoming packets before processing checksums. When a packet uses an undefined opcode value, the driver fails to properly validate packet length, leading to an out-of-bounds memory read that triggers a kernel panic. An attacker needs only network access to the RDMA port and can exploit this without authentication, credentials, or any prior connection setup.

• CVE-2026-46177HIGH 7.5

  A flaw in the Linux kernel's IPMI (Intelligent Platform Management Interface) driver can cause a system to become unresponsive or hang indefinitely. The vulnerability occurs when a Baseboard Management Controller (BMC) continuously reports that it has events or messages to deliver without ever indicating it is finished. The driver lacks safeguards to prevent endless polling loops, allowing a misbehaving BMC—whether due to firmware bugs or hardware issues—to starve system resources and degrade performance or availability. The fix introduces fetch limits and scheduling improvements to prevent the driver from getting stuck in these loops.

• CVE-2026-46265HIGH 7.5

  CVE-2026-46265 is a Linux kernel workqueue memory-reclaim configuration bug in the RDMA/hns (Huawei RoCE) driver. When the driver resets during RPC over RDMA operations, a workqueue used for interrupt handling lacks the WQ_MEM_RECLAIM flag, triggering kernel warnings. While the issue itself does not directly compromise confidentiality or integrity, it can cause availability disruptions by crashing the kernel or forcing emergency resets during high-stress memory conditions. This primarily affects systems running Sun RPC over RDMA on Huawei RoCE hardware.

• CVE-2026-46304HIGH 7.5

  A deadlock vulnerability exists in the Linux kernel's NVMe target (nvmet) subsystem. During controller teardown, the code attempts to flush a work item on the same work queue that is currently executing, creating a recursive locking condition. This occurs when releasing NVMe-over-TCP queue resources triggers final controller cleanup. The issue manifests as a kernel warning and can cause the affected work queue to hang, disrupting NVMe target operations on systems hosting virtual NVMe devices or NVMe-over-Fabrics services.

• CVE-2026-46306HIGH 7.5

  A flaw in the Linux kernel's network flow dissector can crash systems when they receive malformed PPPoE (Point-to-Point Protocol over Ethernet) frames with Protocol Field Compression enabled. The kernel incorrectly attempts to process these frames, causing memory alignment violations that trigger kernel exceptions on affected CPU architectures like MIPS. An attacker can send a specially crafted PPPoE packet to any ethernet interface with RPS (Receive Packet Steering) enabled—even if no active PPPoE session exists—to crash the system.

• CVE-2026-52922HIGH 7.5

  A bug in the Linux kernel's batman-adv networking module can crash systems when memory allocation fails during DHT (Distributed Hash Table) forwarding operations. When the kernel tries to duplicate network packets for wireless mesh routing, it doesn't check if the duplication succeeded before trying to use the packet. If memory is scarce and duplication fails, the code attempts to process a NULL pointer, causing a kernel panic. This affects systems using batman-adv, typically mesh networks and certain wireless setups.

• CVE-2026-52929HIGH 7.5

  A flaw in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation causes incomplete cleanup when an application attempts to add outgoing streams but the operation is denied. The kernel removes some metadata but leaves behind stale stream configuration data. When the application later tries to add streams again, the kernel reuses this leftover data incorrectly, leading to a null-pointer dereference that crashes the system. The fix ensures that denied stream-addition requests are fully rolled back, cleaning up all associated state to prevent the crash.

• CVE-2026-52932HIGH 7.5

  A memory management flaw has been discovered in the Linux kernel's IPsec compression (xfrm/ipcomp) subsystem. When the asynchronous compression function encounters an error, the kernel fails to properly release memory allocated for destination buffer pages, causing a memory leak. This issue is fixed by adjusting the error handling path to ensure cleanup occurs in all failure scenarios.

• CVE-2026-52945HIGH 7.5

  A vulnerability in the Linux kernel's WireGuard implementation causes network traffic decryption to stall and become unresponsive under certain conditions. When WireGuard processes incoming encrypted data for decryption, a race condition in the packet handling logic can cause the decryption queue to fill completely, blocking all further decryption for a specific peer connection while other peers continue working normally. Once triggered, the affected peer remains stuck until the system is restarted, even though CPU and memory appear healthy. This issue stems from a 2023 kernel change that switched WireGuard to use threaded NAPI (Network API), and has been observed in production Kubernetes clusters using Cilium with WireGuard encryption.

• CVE-2026-52946HIGH 7.5

  A deadlock vulnerability exists in the Linux kernel's file access signaling code. When a process group receives a signal via FASYNC (asynchronous I/O notification), the kernel can deadlock under specific conditions. The issue arises because the code uses a read lock on the task list while running in softirq context (a special kernel interrupt handler), but a writer somewhere else may be waiting to acquire that same lock. This creates a circular wait: the softirq handler is blocked trying to read-lock a resource, while a writer is spinning and preventing new readers. The vulnerability can be triggered remotely via TCP URG (urgent) packets, making it a potential denial-of-service vector without requiring authentication or user interaction.

• CVE-2026-52954HIGH 7.5

  A flaw in the Linux kernel's Ceph cluster storage client allows a malicious or corrupted OSD map message to crash the system. When the Ceph protocol processes cluster topology updates, it can decode optional routing data called choose_args. If an attacker sends a crafted message containing duplicate routing indices, the kernel hits an unprotected assertion and crashes. This is a denial-of-service vulnerability that requires network access to a Ceph cluster but no special privileges.

• CVE-2026-52956HIGH 7.5

  A flaw in the Linux kernel's Ceph network communication library allows an attacker to read beyond the boundaries of a memory buffer when processing encrypted messages. An incoming message with insufficient data can cause the decryption function to access memory outside the buffer's allocated space, leading to a denial of service. This affects systems using Ceph for distributed storage or cluster communication.

• CVE-2026-52957HIGH 7.5

  CVE-2026-52957 is a null pointer dereference vulnerability in the Linux kernel's libceph library that affects how Ceph OSD map messages are decoded. When a Ceph node receives an OSD map containing a CRUSH map with optional choose_args parameters, a specially crafted or corrupted message can reference a bucket index that exists but points to a NULL entry. This causes the kernel to crash when it tries to access that non-existent bucket. The vulnerability requires network access but no authentication, and results in denial of service to the affected system.

• CVE-2026-52960HIGH 7.5

  A memory management bug in the Linux kernel's Ceph filesystem code causes folios (memory pages) to not be properly released when they are unsuitable for writeback operations. When the kernel removes folios from a batch collection, it fails to decrement their reference counters, leaving them pinned in memory. This can exhaust system memory over time and lead to denial-of-service conditions.

• CVE-2026-52974HIGH 7.5

  A memory leak exists in the Linux kernel's TLS (Transport Layer Security) implementation that occurs when the system attempts to offload TLS processing to network hardware and the operation fails. Specifically, when the kernel tries to hand off TLS decryption work to a hardware accelerator and encounters an error, it fails to properly release a temporary data buffer (called an anchor skb) that was allocated during setup. This buffer is never freed, causing memory to leak. The vulnerability only manifests when hardware offload initialization fails; successful offloads and normal connection closures do not trigger the leak.

• CVE-2026-52981HIGH 7.5

  A memory leak has been identified in the Linux kernel's neighbor table networking subsystem. The vulnerability exists in the `neigh_xmit()` function, which is responsible for transmitting network packets through the kernel's neighbor discovery mechanism. Under specific conditions—particularly when a neighbor table is not initialized (such as when IPv6 is disabled but the function is still called)—the function returns an error without properly freeing the associated network buffer (SKB). This means memory is consumed and never released, potentially exhausting system memory over time.

• CVE-2026-52983HIGH 7.5

  A flaw in the Linux kernel's Airoha network driver causes incorrect tracking of in-flight network packets across TX (transmit) queues. The driver counts packets sent through some queues but reports completions for all queues, creating an accounting mismatch that can degrade network performance or trigger scheduler anomalies. This is a kernel-level networking issue that affects systems running vulnerable Linux versions with Airoha hardware.

• CVE-2026-52998HIGH 7.5

  A flaw in the Linux kernel's netfilter subsystem could cause the system to crash when processing certain network packets. The vulnerability stems from code that checks Time-To-Live (TTL) values in network traffic without first confirming that the network device pointer is valid. When the code attempted to access device information without this validation, it could dereference a NULL pointer, leading to a kernel panic. This affects systems running vulnerable versions of the Linux kernel, particularly those using netfilter for network filtering or firewalling.

• CVE-2026-53003HIGH 7.5

  A flaw in the Linux kernel's PPPoE (Point-to-Point Protocol over Ethernet) driver allows attackers or misconfigured devices to send specially crafted network frames that can cause system instability. The vulnerability exists because the kernel accepts compressed protocol headers that the PPPoE standard explicitly discourages and that legitimate PPPoE implementations should never use. When such a frame arrives, it causes memory to be misaligned in a way that can crash the system on certain CPU architectures. The fix involves dropping these malformed frames entirely rather than attempting to process them.

• CVE-2026-53026HIGH 7.5

  A logic error in the Linux kernel's NFS server (NFSD) component causes duplicate access counts on file objects when multiple threads concurrently add read access to a delegated write file. This prevents proper cleanup of file resources when the NFS service stops, triggering a kernel crash. The issue is triggered by specific workload patterns—notably the Git project's test suite run over NFS—rather than by direct network attack.

• CVE-2026-53069HIGH 7.5

  A flaw in the Linux kernel's XDP (eXpress Data Path) networking code can crash a system when specific network bonding configurations are exploited. The vulnerability occurs because XDP redirect operations assume bonding devices are fully initialized, but they may not be if the bond was never activated. When an XDP program attempts to redirect traffic through an inactive bond, the kernel tries to access memory structures that were never allocated, causing a null pointer dereference and kernel panic. This affects any Linux system running both bonded network interfaces and XDP-based traffic filtering or forwarding.

• CVE-2026-53070HIGH 7.5

  A Linux kernel vulnerability affects SCTP (Stream Control Transmission Protocol) over UDP networking, where packets are incorrectly dropped due to improper CPU context management. When SCTP traffic is encapsulated over UDP, the kernel's bottleneck handler (BH) is not disabled during transmission, allowing execution context to shift between CPU cores. This breaks an internal counter that tracks packet recursion depth, triggering false positive overflow detection and causing legitimate packets to be silently discarded. The issue manifests as severe throughput degradation—affected systems experience roughly 1% of expected network performance when SCTP over UDP is enabled.

• CVE-2026-53087HIGH 7.5

  A memory leak exists in the Linux kernel's Broadcom GENET network driver. When the driver cleans up the transmit queue during error recovery or shutdown, it discards frames still in flight but fails to return the associated memory buffers back to the free pool. This causes those buffers to become unavailable for reuse, gradually depleting the driver's ability to transmit new data until the system may become unresponsive or crash.

• CVE-2026-53165HIGH 7.5

  A race condition in the Linux kernel's I/O mapping layer can cause a null pointer dereference when the system attempts to report a buffered read error. The vulnerability occurs when multiple read operations complete out of order on the same memory page, and truncate operations simultaneously clear the page's metadata. An attacker with network access could exploit this to crash the system or cause a denial of service, though no active exploitation is currently known.

• CVE-2026-53180HIGH 7.5

  CVE-2026-53180 is a Linux kernel vulnerability in the timer migration subsystem that causes a livelock (infinite loop) condition. When the kernel handles timer expiration across multiple CPUs, it can incorrectly skip processing timers on the local CPU under certain timing conditions. This causes expired timers to remain stuck in the queue, and the system repeatedly checks if they've expired without ever removing them, spinning indefinitely and consuming CPU resources. The vulnerability affects high-availability and real-time systems where timer reliability is critical.

• CVE-2026-53183HIGH 7.5

  A flaw in the Linux kernel's MPTCP (Multipath TCP) implementation allows the receive window to grow larger than intended, potentially causing incoming network traffic to exceed the receiver's buffer capacity. This happens because the kernel incorrectly inflates the TCP-level receive window when data arrives out-of-order or is temporarily held in a backlog, even though the sender is behaving correctly. An attacker on the network could exploit this to send more data than the system can safely handle, leading to a denial of service.

• CVE-2026-53184HIGH 7.5

  A memory safety flaw exists in the Linux kernel's UDP socket handling when used with eBPF socket maps. The kernel accidentally reuses a packet buffer field (skb->dev) to cache memory accounting data, but this cached value persists when the kernel attempts to look up socket information via eBPF programs. When an eBPF socket-lookup helper tries to dereference what it thinks is a network device pointer, it actually reads garbage data, causing a kernel crash. The vulnerability requires a locally-privileged setup of UDP sockets with attached eBPF socket map programs, but once triggered, reliably crashes the kernel.

• CVE-2026-53199HIGH 7.5

  The Linux kernel's Hyper-V network driver (hv_netvsc) has a memory access flaw that causes system crashes during network packet transmission. The vulnerability arises when the driver attempts to copy network packet data into a shared memory buffer used for communication with the Hyper-V hypervisor. On 32-bit x86 systems with high memory support enabled, certain pages (specifically user-space or cached pages) can exist above a memory boundary where the driver's address translation method breaks down. When the driver tries to access these incorrectly translated addresses, it triggers a fatal fault in the networking code path. The fix replaces the flawed address translation with proper page mapping functions that work correctly regardless of where the page resides in memory.

• CVE-2026-53229HIGH 7.5

  A memory leak vulnerability exists in the Linux kernel's mlx5e network driver, specifically in the XSK (AF_XDP zero-copy socket) transmission path. When the driver attempts to transmit an XDP frame but fails because its transmit queue is full, it neglects to release DMA mappings and free the frame buffer. Over time, this causes accumulated DMA memory leaks that are particularly visible when the driver is unloaded. The vulnerability is triggered during normal XDP_TX operations on systems using Mellanox network adapters with AF_XDP sockets.

• CVE-2026-53235HIGH 7.5

  A vulnerability exists in the Linux kernel's Generic Receive Offload (GRO) handling path. The kernel attempts to pull data from a network packet without verifying that the data is actually available in the expected location. When packets arrive through certain network paths with fragmented data, this check is bypassed, causing the kernel to crash. The fix adds a safety check before accessing the data, ensuring the packet structure is valid before manipulation.

• CVE-2026-53244HIGH 7.5

  A flaw in the Linux kernel's file creation code can leave a parent directory locked indefinitely when certain error conditions occur during file creation via NFS exports. The vulnerability exists in how the kernel handles failed file creation attempts on filesystems that support atomic create operations, causing the parent directory lock to never be released. This can lead to system hangs or denial of service when affected NFS clients or servers attempt file operations.

• CVE-2026-53284HIGH 7.5

  CVE-2026-53284 is a Linux kernel vulnerability in the Btrfs filesystem driver that affects how dirty page writes are managed during filesystem transactions. When a write operation fails, the kernel incorrectly clears its internal tracking of pending disk writes without properly handling those unsaved changes. This leads to memory and state management issues that can cause the filesystem to crash or become read-only during shutdown. The vulnerability requires no special privileges or user interaction to trigger—a combination of filesystem stress and an I/O error can initiate it.

• CVE-2026-9071HIGH 7.5

  IBM WebSphere Application Server versions 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.6 contain a vulnerability that allows remote attackers to crash or severely degrade server performance by sending specially crafted requests. The vulnerability causes the affected server to consume excessive memory, leading to denial of service. No authentication is required to exploit this issue, and attackers can trigger it over the network.

• CVE-2026-9901HIGH 7.5

  A use-after-free flaw in ANGLE (the graphics abstraction layer used by Chrome) allows an attacker to run malicious code on a target's machine. The attack requires two conditions: the attacker must first compromise Chrome's renderer process (the component that draws web content), and the victim must then visit a specially crafted web page. Once both conditions are met, arbitrary code can execute with the privileges of the compromised renderer process. This affects Chrome versions before 148.0.7778.216.

• CVE-2026-9909HIGH 7.5

  A flaw in Skia, the graphics rendering library used by Google Chrome, can be exploited by an attacker who has already compromised Chrome's sandboxed renderer process. The vulnerability stems from improper handling of integer values, which an attacker could leverage to execute arbitrary code within the sandbox by serving a specially crafted HTML page. While the vulnerability requires prior compromise of the renderer process, it represents a critical step in a potential attack chain that could lead to full browser compromise.

• CVE-2026-9933HIGH 7.5

  CVE-2026-9933 is a use-after-free memory vulnerability in Google Chrome's input handling code that allows attackers to corrupt heap memory on affected systems. Exploitation requires an attacker to trick a user into performing specific UI interactions (such as unusual mouse or keyboard gestures) while viewing a specially crafted HTML page. This is not a passive drive-by attack; active user participation is required. If successfully exploited, an attacker could execute arbitrary code with the privileges of the Chrome process, leading to complete compromise of the affected user's system.

• CVE-2026-9954HIGH 7.5

  A use-after-free vulnerability exists in Google Chrome's TabStrip component that can lead to memory corruption. An attacker must trick a user into performing specific UI interactions (like clicking or dragging tabs in a particular sequence) on a malicious website to potentially trigger the flaw. Successful exploitation could allow the attacker to read sensitive data, modify page content, or crash the browser. The vulnerability affects Chrome versions prior to 148.0.7778.216 across Windows, macOS, and Linux.

• CVE-2026-9960HIGH 7.5

  A flaw in PDFium, the PDF rendering library used by Google Chrome, allows an attacker who has already compromised Chrome's renderer process to break out of the sandbox and run arbitrary code with elevated privileges by supplying a specially crafted font file. This represents a significant post-compromise risk for users who may have already been exposed to initial malware or browser exploits.

• CVE-2026-46320HIGH 7.4

  A memory leak in the Linux kernel's TAP (network) device driver causes pages of system memory to accumulate and never be freed when certain network packets are rejected or fail to process. Specifically, when the driver receives a packet that is too short or encounters an error while building a network packet buffer, it bypasses the cleanup routine that should release allocated memory. In batch-processing scenarios, this leak compounds—each rejected frame discards a page fragment, potentially exhausting system memory over time and leading to a denial of service.

• CVE-2026-8646HIGH 7.4

  IBM WebSphere Application Server versions 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.6 contain a flaw that allows attackers to craft malicious HTTP requests that bypass normal request processing. These smuggled requests can circumvent security controls, impersonate legitimate users, gain elevated privileges, and access sensitive data. The vulnerability requires specific conditions to exploit but poses significant risk to organizations relying on these servers.

• CVE-2026-9006HIGH 7.4

  IBM WebSphere Application Server versions 8.5 and 9.0 contain a server-side request forgery (SSRF) flaw when the Ajax Proxy feature is enabled. An attacker can exploit this to make unauthorized requests from the vulnerable server, potentially accessing internal resources, bypassing security controls, or extracting sensitive information. The vulnerability requires specific network conditions but does not require user interaction or authentication.

• CVE-2026-10845HIGH 7.3

  IBM WebSphere Application Server versions 8.5 and 9.0 contain an authentication bypass vulnerability in their JAX-WS (Java API for XML Web Services) implementations. An attacker on the network can exploit this flaw to bypass login controls and gain unauthorized access to affected applications without providing valid credentials. The vulnerability requires no user interaction and can be triggered remotely, making it a practical threat to organizations running these older WebSphere versions.

• CVE-2026-46250HIGH 7.3

  CVE-2026-46250 is a critical initialization failure in the Linux kernel affecting MIPS-based systems. The vulnerability arises from a compiler bug in LLVM versions 18–21 where the compiler incorrectly restores the `$gp` (global pointer) register even when code intentionally modifies it as a global register variable. On MIPS, the kernel uses `$gp` to track the current thread info, and during boot the kernel relocates itself and updates `$gp` accordingly. When LLVM restores the old `$gp` value after this intentional modification, the register points to pre-relocation memory, causing the kernel to crash during the `init_idle` phase of scheduler initialization. This affects MIPS-based systems including Loongson and other MIPS processors, particularly those compiled with affected LLVM versions.

• CVE-2026-46328HIGH 7.3

  A vulnerability exists in the Linux kernel's AppArmor security module where resource limits (rlimits) for POSIX CPU timers are not being properly enforced. AppArmor is designed to restrict what processes can do, but this flaw means the CPU timer limits may not be correctly applied when a process is confined by AppArmor policies. An attacker with local access could exploit this to exceed intended resource restrictions, potentially causing performance degradation or denial of service on the affected system.

• CVE-2026-11269HIGH 7.1

  Google Chrome versions prior to 149.0.7827.53 contain a vulnerability in how the browser handles extensions that allows an attacker positioned on the same network as a user to execute arbitrary code within Chrome's sandbox. The attacker must craft a malicious extension and the user must interact with it (such as installing or clicking something), making this a moderate-complexity attack. While Chromium rated this as low severity internally, the CVSS assessment reflects the potential for complete compromise of the sandboxed process.

• CVE-2026-46130HIGH 7.1

  A bug in the Linux kernel's dm-verity-fec (forward error correction) component can cause it to read data from outside the intended memory buffer. This occurs when parity bytes used to verify disk integrity are split across storage blocks in a specific way. Under certain non-default configurations and low-memory conditions, the code attempts to access more data than is available, leading to potential information disclosure or system instability. The issue only manifests with particular combinations of error correction parameters and buffer allocation scenarios.

• CVE-2026-46140HIGH 7.1

  A flaw in the Linux kernel's Bluetooth driver (btmtk) fails to verify that incoming firmware responses contain sufficient data before reading from them. If a Bluetooth device sends a truncated or malformed response, the kernel code will read beyond the valid data boundaries, potentially exposing sensitive kernel memory. A local attacker with Bluetooth access could exploit this to leak information or crash the system.

• CVE-2026-46149HIGH 7.1

  A vulnerability in the Linux kernel's SCSI target subsystem allows a local attacker with low privileges to read sensitive kernel memory and potentially crash the system. The issue occurs in the configfs interface where storage path group membership information is displayed. When a storage fabric's name is unusually long, the kernel writes more data than expected to a temporary buffer, and then copies that overrun data to a user-readable sysfs file. On systems with fortify checks enabled, this causes a kernel panic; on others, it leaks kernel memory to unprivileged users.

• CVE-2026-46150HIGH 7.1

  A flaw in the Linux kernel's fanotify file monitoring subsystem can allow a local user with minimal privileges to bypass permission checks on file access events. The vulnerability stems from a logic error where the kernel incorrectly returns false for marks belonging to unrelated monitoring groups, causing permission event validation to be skipped. An attacker with local access could exploit this to circumvent intended file access restrictions.

• CVE-2026-46175HIGH 7.1

  A flaw in the Linux kernel's F2FS (Flash-Friendly File System) garbage collection process can cause the system to incorrectly track file metadata during node block migration. When the garbage collector moves data blocks, it fails to properly clear internal markers that indicate whether data has been explicitly synced by a user. This confusion causes file system consistency checks (fsck) to report false inconsistencies, potentially leading to data integrity warnings or failures. The issue is triggered by specific sequences of file creation, deletion, and garbage collection operations, particularly when the system experiences power loss after garbage collection but before a checkpoint is written.

• CVE-2026-46190HIGH 7.1

  A memory access flaw exists in the Linux kernel's SPI NOR flash debugging code. When displaying flash chip parameters through the debugfs interface, the kernel incorrectly calculates the size of an internal lookup table, treating the table's byte-size instead of its element count. This can cause the kernel to read memory beyond the intended bounds when processing certain flag values. An unprivileged local user could exploit this to crash the system or potentially leak sensitive kernel memory.

• CVE-2026-46191HIGH 7.1

  CVE-2026-46191 is a memory access vulnerability in the Linux kernel's framebuffer console (fbcon) subsystem. When the kernel attempts to rotate the console display and the memory reallocation fails, it continues using an undersized font buffer. If a user then prints characters with high numeric codes to the rotated console, the kernel will write beyond the buffer's boundaries, potentially corrupting kernel memory. An attacker with local system access can trigger this by printing specific characters after inducing a console rotation failure.

• CVE-2026-46199HIGH 7.1

  A flaw in the Linux kernel's AMD GPU video codec (VCN4) driver allows a local attacker to read memory beyond the intended boundaries of a buffer when processing decode messages. An authenticated user with local access can exploit this to access sensitive kernel memory, potentially exposing confidential data or triggering a system crash. The vulnerability requires local access and valid user privileges, limiting its reach but making it a concern for multi-user systems and containerized environments.

• CVE-2026-46203HIGH 7.1

  A flaw in the Linux kernel's Cadence QuadSPI controller driver can cause the system to access hardware registers without proper power management during driver shutdown. When the driver is unloaded, it attempts to disable the controller without ensuring the hardware is powered up first, potentially causing system instability or data corruption. This is a local issue requiring user-level access to trigger.

• CVE-2026-46204HIGH 7.1

  A bounds-checking vulnerability exists in the Linux kernel's AMD GPU video codec (VCN4) instruction buffer parser. When the kernel processes instruction buffers from user space, it can read beyond allocated memory if malicious or malformed data is provided. A local attacker with basic user privileges can trigger out-of-bounds reads, potentially exposing sensitive kernel memory or causing a denial of service. The fix involves rewriting the parser to use proper bounds-checking functions.

• CVE-2026-46218HIGH 7.1

  A vulnerability exists in the Linux kernel's AMD GPU driver where video codec processing code (used for UVD, VCE, and VCN hardware) accesses memory buffers without verifying those buffers are large enough. An attacker with local access could exploit this to read sensitive kernel memory or cause a system crash. The fix adds proper bounds checking before these memory accesses and corrects an integer type to prevent overflow conditions that could bypass the checks.

• CVE-2026-46230HIGH 7.1

  A boundary-checking flaw in the Linux kernel's AMD GPU video codec driver (VCN3) allows a local user with moderate privileges to read memory beyond allocated buffer boundaries when the driver processes video decoding messages. This out-of-bounds read could expose sensitive kernel memory or crash the system. The vulnerability requires local access and existing user-level permissions to trigger.

• CVE-2026-46243HIGH 7.1

  A Linux kernel vulnerability allows unprivileged local users to manipulate CIFS (Common Internet File System) authentication credentials by creating spoofed credential requests. The vulnerability exists because the kernel's SMB client accepts cifs.spnego key descriptions that contain sensitive fields—like process ID, user ID, and credential UID—regardless of whether those fields come from the kernel itself or from untrusted userspace. An attacker with local access can forge these fields to impersonate legitimate credential requests, potentially gaining unauthorized access to network resources or intercepting authentication flows. The fix restricts acceptance of cifs.spnego keys only when they originate from the kernel's own credential handler.

• CVE-2026-46293HIGH 7.1

  A Linux kernel vulnerability exists in the Microchip PolarFire SoC clock controller driver where the software attempts to write data to memory locations outside the bounds of an allocated array during clock output registration. Specifically, when the driver registers the last two clock outputs, it accesses array indices that were never allocated, corrupting adjacent memory. This occurs because the code defines space for two PLLs and their outputs but fails to properly offset the array indices when handling DLL (Delay-Locked Loop) outputs that the driver doesn't actually support. An attacker with local access can exploit this to read sensitive kernel memory or cause a denial of service.

• CVE-2026-46321HIGH 7.1

  A memory leak vulnerability exists in the Linux kernel's TUN device driver. When a frame shorter than the Ethernet header minimum is rejected, the kernel fails to release allocated memory pages. An attacker with local access to /dev/net/tun and /dev/vhost-net can exploit this by repeatedly sending undersized frames through a vhost-net backend, exhausting system memory and potentially causing the host to crash.

• CVE-2026-46322HIGH 7.1

  A memory leak exists in the Linux kernel's TUN network device driver. When the kernel attempts to construct a network packet (skb) from XDP program data and that construction fails, it doesn't properly release a memory page that was allocated earlier in the process. This causes a small chunk of memory to leak each time this failure occurs. In batch processing scenarios—common in virtual networking—multiple failures can accumulate, gradually consuming system memory and potentially degrading performance or availability.

• CVE-2026-52915HIGH 7.1

  A flaw in the Linux kernel's IPv6 hop-by-hop header filtering allows a local attacker with standard user privileges to trigger an out-of-bounds array access. The vulnerability exists because the kernel accepts oversized option lists in netfilter rules without validating that they fit within the fixed 16-element array used to store them. An attacker can craft a malicious firewall rule to cause the kernel to read or write beyond array boundaries, potentially enabling privilege escalation or denial of service.

• CVE-2026-52917HIGH 7.1

  A race condition exists in the Linux kernel's SCTP (Stream Control Transmission Protocol) diagnostic module that allows a local attacker with low privileges to crash the system or read sensitive kernel memory. The vulnerability arises when the kernel attempts to retrieve SCTP socket diagnostic information while an association is being freed, causing it to read from memory that has already been deallocated or modified. This results in either a denial of service or potential information disclosure.

• CVE-2026-52942HIGH 7.1

  A flaw in the Linux kernel's netfilter logging subsystem allows a local attacker to read memory beyond allocated buffer boundaries. When the kernel logs network packets, it attempts to dump the MAC (media access control) header without properly verifying that the header information has been set. An attacker with local access can craft and send specially crafted packets through AF_PACKET with QDISC bypass enabled, causing the logging function to read approximately 64 KB past the intended buffer and leak that kernel memory into the system log. This information disclosure could expose sensitive kernel data to unprivileged users.

• CVE-2026-52953HIGH 7.1

  A flaw in the Linux kernel's IOMMU (Input/Output Memory Management Unit) VT-d driver can crash a system when certain device assignment operations occur, particularly when QEMU virtual machines are terminated. The issue arises from the kernel trying to access memory beyond the bounds of a special internal structure called the 'blocked domain,' causing a protection fault that halts the affected process or system. This is a memory safety issue specific to how the kernel manages I/O device permissions and virtual machine configurations.

• CVE-2026-52988HIGH 7.1

  A vulnerability exists in the Linux kernel's netfilter subsystem where the nf_tables module does not safely handle concurrent updates to firewall rules. When administrators modify firewall rules while the system is simultaneously retrieving rule information, a race condition can occur that may cause the kernel to crash or allow information disclosure. The issue stems from improper synchronization during the commit phase when new firewall hooks are added to the active rule list.

• CVE-2026-53040HIGH 7.1

  A flaw in the Linux kernel's OCFS2 filesystem driver can be triggered when a user issues a specific diagnostic request (OCFS2_IOC_INFO with non-coherent mode) against a crafted filesystem. An attacker with local access can supply malformed filesystem metadata that causes the kernel to read memory outside the bounds of a bitmap structure, leading to a use-after-free condition. This can crash the system or potentially allow information disclosure. The vulnerability requires local access and standard user privileges to trigger.

• CVE-2026-53041HIGH 7.1

  A flaw in how the Linux kernel's OCFS2 filesystem reports extended file attributes (xattrs) can cause a kernel crash when listing these attributes on files that store them in multiple locations. When a file's inline xattrs exactly fill a user's buffer and there are additional xattrs stored in blocks, the kernel incorrectly reports a size that exceeds the buffer and then attempts to write beyond it, triggering a kernel panic. This affects systems using OCFS2 as their filesystem, particularly in Oracle environments and high-availability clusters.

• CVE-2026-53044HIGH 7.1

  A memory access vulnerability exists in the Linux kernel's Tegra SoC cross-bar (CBB) fabric code. The vulnerability stems from incorrect array size calculations in lookup tables used during target timeout operations. When the kernel attempts to access fabric configuration data during a timeout event, it may read memory outside the intended table boundaries. This could allow a local attacker with minimal privileges to read sensitive kernel memory or cause a system crash.

• CVE-2026-53068HIGH 7.1

  A vulnerability exists in the Linux kernel's display driver (DRM/Komeda) where a math error during framebuffer validation can allow a user to trick the system into accepting an undersized memory buffer. When the kernel adds two numbers together to check buffer size requirements, it doesn't protect against arithmetic overflow—if the sum wraps around to a small number, a malformed request passes validation when it shouldn't. This could lead to memory access outside the intended buffer boundaries, potentially exposing sensitive data or causing system instability.

• CVE-2026-53076HIGH 7.1

  A flaw in the Linux kernel's BPF (Berkeley Packet Filter) subsystem allows an unprivileged local user to read memory beyond intended boundaries. The vulnerability arises when copying data between certain kernel map types—specifically from a CGROUP_STORAGE map into a per-CPU map when both have non-standard sizes (not aligned to 8 bytes). The kernel incorrectly assumes all source memory is rounded up to 8 bytes, causing it to read extra data it shouldn't access. This could leak sensitive kernel memory to an attacker with local access.

• CVE-2026-53132HIGH 7.1

  A flaw in the Linux kernel's vsock (virtual socket) transport layer could allow an attacker to exhaust system memory by flooding the network queue with malformed packets. An attacker with local access can craft packets with zero payload length but marked as end-of-message (EOM), bypassing the kernel's normal quota checks. Because these packets consume almost no actual data bytes, the kernel's safeguards fail to detect the buildup, allowing an unbounded number of empty packets to accumulate in the receive queue. This eventually starves legitimate network traffic and system processes of available memory, causing a denial of service.

• CVE-2026-53138HIGH 7.1

  A flaw in the Linux kernel's AMD display driver can cause the system to loop indefinitely when processing a corrupted graphics firmware (VBIOS) image. During system startup, the driver reads firmware records to configure the display hardware. If the firmware is malformed and missing the expected end-marker, the driver keeps reading memory in 256-byte increments until it either crashes or exhausts resources. An attacker with physical access to replace the firmware, or a supply-chain compromise affecting pre-installed firmware, could trigger this condition. Local users with sufficient privilege to load modified firmware could also exploit it. The fix limits the loop to a reasonable maximum of 256 records, preventing runaway iteration.

• CVE-2026-53146HIGH 7.1

  A memory disclosure vulnerability exists in the Linux kernel's Thunderbolt XDomain (cross-domain) communication handler. When a system receives a shorter-than-expected response packet over Thunderbolt, the kernel incorrectly reads beyond the legitimate frame data into stale memory contents from previous transactions. This allows an attacker with adjacent network access to extract sensitive information from kernel memory, such as cryptographic keys or other data processed in prior Thunderbolt communications.

• CVE-2026-53149HIGH 7.1

  A flaw in the Linux kernel's Thunderbolt driver allows a local user with restricted privileges to read sensitive memory or crash the system. The vulnerability exists in how the kernel validates directory structures when parsing Thunderbolt property data. When a malformed directory header claims to contain more content than the allocated memory block actually holds, the kernel fails to reject it and instead reads beyond the intended boundaries, potentially exposing kernel memory or causing a denial of service.

• CVE-2026-53179HIGH 7.1

  A buffer over-read vulnerability exists in the Linux kernel's RTL8723BS wireless driver. The rtw_update_protection() function is called with a pointer that references a specific position within a buffer, but it is passed the total length of the entire buffer rather than the remaining bytes from that position. This causes the function to read beyond the intended region of memory, potentially exposing sensitive kernel data. The flaw affects the staging driver and requires local access to trigger.

• CVE-2026-53187HIGH 7.1

  A vulnerability exists in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem where user-supplied CPU IDs are not properly validated before being used in system operations. An attacker with local access can supply an invalid CPU ID that causes the kernel to read memory outside the valid CPU bitmap range, potentially exposing sensitive information or crashing the system. This is particularly dangerous on systems configured to panic when kernel warnings are triggered.

• CVE-2026-53203HIGH 7.1

  A buffer overflow vulnerability exists in the Linux kernel's Intel VPU (Vision Processing Unit) acceleration driver. When the driver queries metric stream information from firmware, it does not properly validate whether the returned data size exceeds the allocated buffer. An attacker with local access could trigger this condition, potentially leading to information disclosure or system instability. The vulnerability affects systems running vulnerable Linux kernel versions with the Intel VPU driver enabled.

• CVE-2026-53205HIGH 7.1

  The Linux kernel contains a vulnerability in the Intel VPU (Video Processing Unit) acceleration driver where firmware-supplied log buffer indices are not properly validated. When the firmware provides read or write indices that fall outside the valid range of the log buffer, the kernel does not catch this before using them to access memory. This can lead to the kernel reading from or writing to unintended memory locations, potentially exposing sensitive data or causing system instability. The fix adds validation to ensure indices stay within bounds and clamps out-of-range values to safe defaults.

• CVE-2026-53223HIGH 7.1

  A flaw in the Linux kernel's network stack allows a local attacker to misuse socket timestamping features to read or leak adjacent kernel heap memory. The vulnerability arises from incorrect classification of packet socket buffers, where the kernel mistakenly treats outgoing AF_PACKET frames as error-queue messages when timestamping is enabled. This confusion causes the kernel to read control buffer state from the wrong location, potentially exposing sensitive data or triggering memory protection mechanisms.

• CVE-2026-53253HIGH 7.1

  A flaw in the Linux kernel's Bluetooth BNEP (Bluetooth Network Encapsulation Protocol) handler allows a remote Bluetooth peer to trigger a memory access violation by sending malformed frames. The vulnerability stems from the kernel reading packet fields without first verifying that enough data is present in the incoming frame. When an attacker sends a truncated BNEP packet, the code attempts to access memory beyond the actual packet contents, leading to a crash or potential information disclosure. The issue affects systems with Bluetooth connectivity that process BNEP traffic.

• CVE-2026-53255HIGH 7.1

  The Linux kernel contains a flaw in how it validates Bluetooth advertising data when processing management commands. A malformed advertising request can cause the kernel to read memory beyond the bounds of the supplied data buffer. This out-of-bounds read is triggered when a length field points past the actual data, allowing an attacker with local access to crash the system or potentially leak sensitive memory contents.