Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-13 21:46Z
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89471 — Linux: A malfunctioning, malicious or compromised EC that reports num_usbpd_ports == num_charger_ports == N for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89471

In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd-charger: bound the EC-reported port count cros_usbpd_charger_probe() reads two port counts from the EC and uses one of them, num_charger_ports, as the loop bound when populating a fixed-size array: struct port_data *ports[EC_USB_PD_MAX_PORTS]; /* 8 entries */ ... for (i = 0; i < charger->num_charger_ports; i++) charger->ports[charger->num_registered_psy++] = port; Both num_u CVSSv3.1 8.4 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89470 — Linux: A malicious embedded controller could return an inaccurate port count (up to 255) resulting

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89470

In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Currently the cros_usbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number of USB PD ports which the embedded controller also defines. A malicious embedded controller could return an inaccurate port count (up to 255) resulting in an out of bounds write and CVSSv3.1 8.4 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89469 — Linux: In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89469

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727_release_irq() lp8727_isr_func(), the threaded IRQ handler, is the only caller that arms pchg->work via schedule_delayed_work(). lp8727_release_irq() currently cancels the work before freeing the IRQ, so an IRQ delivered in between can re-arm the work through the threaded handler. After .remove returns the devm layer frees pchg while lp8727_delayed_func() CVSSv3.1 8.4 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89465 — Linux: In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89465

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwr_rdy_work, max_charging_time_work and batt_presence_work. pwr_rdy_work and batt_presence_work can also queue max_charging_time_work, while batt_presence_work can requeue itself. rt9455_remove() cancels max_charging_time_work before batt_presence_work. The latter can therefore queue max_charging_time_work aft CVSSv3.1 8.4 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89452 — Linux: In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89452

In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msm_iommu_probe() adds its devm-managed IOMMU object to qcom_iommu_devices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommu_device_sysfs_add() fails, probe returns with the object still on qcom_iommu_devices. The driver core then releases the devm allocation, leaving a dangling list entry that later list walks may de CVSSv3.1 8.4 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89450 — Linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89450

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH, whose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag. The HW therefore matches only a 20-bit Stream ID. The bound check rejects only virt_sid > UINT_MAX, which admits a value far wider than the field. The write "virt_sid << 1 | 0x1" then drops CVSSv3.1 8.8 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-89448 — Linux: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89448

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detect_intel_iommu() don't include tboot, leading to a possible misconfiguration with ACS disabled (e.g. due to user opts) while iommu is later forced on by tboot_force_iommu(). Fix it by checking tboot in detect_intel_iommu(). CVSSv3.1 9.3 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
728 × 90 / responsive · programmatic ad slot
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-89445 — Linux: In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-89445

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from group->pasid_array without synchronizing against PASID detach, then a concurrent iommu_report_device_fault() can dereference that borrowed handle's domain pointer after the detach erases the handle and frees the backing struct iommufd_attach_handle. TRIGGER_IOPF then dereferences the freed handle, causing CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-81017 — Linux: A sensor number of sensor_num or larger is an out-of-bounds read and write of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81017

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number (in->sensor_num). cros_ec_sensorhub_ring_handler() validates the FIFO event count, the per-read count and the ring bound, but not the sensor number, which cros_ec_sensor_ring_process_event() then uses unchecked to index sensorhub->batch_state[] - allocated with only sensorhub->sensor_num entries CVSSv3.1 8.4 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-81012 — Linux: In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81012

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() hp_get_string_from_buffer() clamps the converted string length against the destination buffer size with "size > dst_size", so when the converted length is exactly equal to dst_size, conv_dst_size is left at dst_size and the unconditional NUL terminator write dst[conv_dst_size] = 0; lands one byte past the destination buffer. Th CVSSv3.1 8.4 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-81004 — Linux: In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81004

In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly on an error If an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed. CVSSv3.1 8.4 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-81003 — Linux: Which can lead to - Accept-queue exhaustion (DoS) - Attacker-controlled peer identity in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81003

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucv_hs_rcv() by ingress device afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte name fields in the transport header alone. No check is made against the net_device the frame arrived on. This can cause a frame arriving on any netdev to be delivered to an AF_IUCV socket. Three problems follow. First, a frame arriving over HiperSockets can be delivered t CVSSv3.1 8.1 (HIGH) · EPSS 12th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-81002 — Linux: It allows the copied frame to occupy the page tail needed by skb_shared_info and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-81002

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb_shared_info and records zero headroom even when metadata separates the frame header from packet data. An AF_XDP zero-copy packet redirected through cpumap can therefore make the skb overlap skb_sh CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-80989 — Linux: In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Mark the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80989

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Mark the connection down when bringing it up fails Every failure path in tbnet_connected_work() undoes its own work and returns without clearing login_sent, so the connection still looks established. The next tbnet_tear_down() therefore takes its main branch and repeats a teardown that already happened: it stops rings that are already stopped, which is a dev_WARN() and fatal under panic_on CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-80986 — Linux: This happens on every SMC-Rv2 link addition, whatever the peer sends: [ 2.490065] BUG

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80986

In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has max_recv_sge == 1 there is no shared v2 receive buffer, and smc_llc_save_add_link_rkeys() takes the v2 extension from 44 bytes past the start of the queue entry's inline message: ext = (struct smc_llc_msg_add_link_v2_ext *)(llc_msg + SMC_WR_TX_SIZE); The entry is a 72-byte allocation and the extension starts at offset CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-80985 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/smc: carry oversized SMC-Rv2

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80985

In the Linux kernel, the following vulnerability has been resolved: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read the part of a v2 message that does not fit into the 44-byte union smc_llc_msg, and both bound themselves by the size of the buffer it landed in, not by what arrived. On a link with a shared v2 receive buffer a 44-byte DELETE_RKEY_V2 declaring 255 rkeys reaches rkey[9..254] in wha CVSSv3.1 8.2 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-80981 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80981

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() smc_llc_srv_add_link() keeps add_llc pointing into the queue entry: add_llc = &qentry->msg.add_link; smc_llc.c:1482 ... smc_llc_save_add_link_info(link_new, add_llc); smc_llc.c:1494 smc_llc_flow_qentry_del(&lgr->llc_flow_lcl); smc_llc.c:1495 ... u8 *llc_msg = smc_link_shared_v2_rxbuf(link) ? (u8 *)lgr->wr_rx_buf_v2 : (u CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-80980 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80980

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and out_of_sync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smc_connection and every store to one is a read-modify-write of the other two: u8 killed : 1; u8 freed : 1; u8 out_of_sync : 1; They are not written under a common lock. smc_cdc_msg_validate() sets out_of_sync from the receive tasklet, while CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-80976 — Linux: KASAN reports: BUG: KASAN: slab-out-of-bounds in ip6_protocol_deliver_rcu ip6_protocol_deliver_rcu+0x1118/0x1450 ip6_input_finish+0x11b/0x240 seg6_local_input_core+0xed/0x2e0 l

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80976

In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decap_and_validate() pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block still contains values collected while parsing the outer packet, including nhoff and extension-header flags. End.DX6 and End.DT6 route the inner IPv6 packet directly to the IPv6 input path. An unprivileged user can reach End.DT6 from a user an CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-80967 — Linux: In the Linux kernel, the following vulnerability has been resolved: ALSA: pcxhr: initialize mutexes

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80967

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcxhr: initialize mutexes before requesting threaded IRQ pcxhr_probe() requests pcxhr_threaded_irq() before initializing mgr->lock, even though the threaded handler takes that mutex. Initialize the manager locks before request_threaded_irq() so an early interrupt cannot run against uninitialized mutex state during probe. CVSSv3.1 8.4 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2d ago
2026-09-11 20:19Z
HIGH

CVE-2026-80953 — Linux: In the Linux kernel, the following vulnerability has been resolved: i3c: master: adi: initialize

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80953

In the Linux kernel, the following vulnerability has been resolved: i3c: master: adi: initialize the lock before enabling interrupts adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before the controller's IBI state, transfer queue list and transfer queue lock are initialized. A pending CMDR interrupt can therefore run adi_i3c_master_irq() and take master->xferqueue.lock before the dynamic lock has been initialized. This issue was found by our stat CVSSv3.1 8.4 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2d ago
2026-09-11 20:19Z
CRIT

CVE-2026-80945 — Linux: In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80945

In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware analytics error, decompress retries through the software fallback, which writes req->dst with the CPU while it is still mapped DMA_FROM_DEVICE. With SWIOTLB active the later dma_unmap_sg() copies the stale bounce buffer over req->dst, corrupting the result. Unmap before the fallback runs. The async path unmaps inline; the sync pat CVSSv3.1 9.1 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2d ago
2026-09-11 20:18Z
HIGH

CVE-2026-80937 — Linux: A malicious or malfunctioning device can report an arbitrary address and drive a 16-byte

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80937

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's dev->mt76.eeprom.data buffer at the offset reported by the MCU response (res->addr, a device-controlled __le32) without checking it against the buffer size. A malicious or malfunctioning device can report an arbitrary address and drive a 16-byte out-of-bounds write p CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2d ago
2026-09-11 20:18Z
HIGH

CVE-2026-80935 — Linux: A malicious or malfunctioning device can report an arbitrary address and drive an out-of-bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80935

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr, a device-controlled __le32) and clamps only the copy length, never the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address and drive an CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2d ago
2026-09-11 20:18Z
HIGH

CVE-2026-80932 — Linux: KASAN reported: BUG: KASAN: slab-use-after-free in virtio_transport_rx_work+0x487/0x4b0 Read of size 8 at addr ffff888114c2b008

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-80932

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtio_vsock_remove() stops the virtqueues and then flushes each work item before freeing the enclosing virtio_vsock. The current order does not account for dependencies between those items: tx_work may queue send_pkt_work, and send_pkt_work may queue rx_work. In particular, send_pkt_work can set restart_rx and release tx_lock. The remove path can then stop th CVSSv3.1 8.4 (HIGH) · EPSS 6th percentile

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score