boxscore/security

A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?

Sunday, October 18, 2026 · all times UTC← 2026-10-17 · archive

Security Box Score — October 18, 2026 — page 2

Edition of October 18, 2026, continued — page 2 of 2. Back to page 1

Results (continued, ranked) — ranks 401–552 of 552
CVECVSSEPSS %ileVendorProductCWETitle
CVE-2026-98727await—LinuxLinux—nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
CVE-2026-98728await—LinuxLinux—tpm: fix off-by-four bounds check in tpm2_get_random()
CVE-2026-98729await—LinuxLinux—x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h
CVE-2026-98730await—LinuxLinux—Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
CVE-2026-98731await—LinuxLinux—Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
CVE-2026-98732await—LinuxLinux—Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
CVE-2026-98733await—LinuxLinux—Bluetooth: hci_core: Serialize fragmented ISO packet queueing
CVE-2026-98734await—LinuxLinux—Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
CVE-2026-98735await—LinuxLinux—Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
CVE-2026-98736await—LinuxLinux—Bluetooth: hci_conn: Lock parent access during enhanced SCO setup
CVE-2026-98737await—LinuxLinux—Bluetooth: hci_sync: Fix inquiry cache use-after-free
CVE-2026-98738await—LinuxLinux—Bluetooth: Serialize SMP remote OOB data access
CVE-2026-98739await—LinuxLinux—Bluetooth: RFCOMM: Fix initial port reference race
CVE-2026-98740await—LinuxLinux—EDAC/altera: Drop __init from ECC setup paths for re-probe safety
CVE-2026-98741await—LinuxLinux—ALSA: ua101: reject mismatched capture/playback packet sizes
CVE-2026-98742await—LinuxLinux—ALSA: seq: Serialize compat port-info ioctls
CVE-2026-98743await—LinuxLinux—ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type
CVE-2026-98744await—LinuxLinux—ASoC: codecs: max98363: fix uninitialized stream_config->type
CVE-2026-98745await—LinuxLinux—arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
CVE-2026-98746await—LinuxLinux—serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()
CVE-2026-98747await—LinuxLinux—serial: core: fix NULL pointer dereference in serial_core_unregister_port()
CVE-2026-98748await—LinuxLinux—serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
CVE-2026-98749await—LinuxLinux—tty: serial: max3100: shut down timer before freeing port
CVE-2026-98750await—LinuxLinux—tty: fix saved termios reset race
CVE-2026-98751await—LinuxLinux—tty: abort break signalling on hangup
CVE-2026-98752await—LinuxLinux—tty: port: fix tty_port_tty_vhangup() race
CVE-2026-98753await—LinuxLinux—tty: tty_port: restore TTY_IO_ERROR on activation failure
CVE-2026-98754await—LinuxLinux—tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
CVE-2026-98755await—LinuxLinux—tty: vcc: zero-initialize control packet in vcc_send_ctl()
CVE-2026-98756await—LinuxLinux—usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
CVE-2026-98757await—LinuxLinux—usb: cdns3: fix use-after-free in cdns3_gadget_exit()
CVE-2026-98758await—LinuxLinux—usb: typec: ucsi: glink: fix use-after-free of ucsi on remove
CVE-2026-98759await—LinuxLinux—usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()
CVE-2026-98760await—LinuxLinux—usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
CVE-2026-98761await—LinuxLinux—usb: typec: tcpm: recover after failure to start the frs ams
CVE-2026-98762await—LinuxLinux—USB: dwc2: shut down wakeup timer before freeing HCD state
CVE-2026-98763await—LinuxLinux—usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
CVE-2026-98764await—LinuxLinux—usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
CVE-2026-98765await—LinuxLinux—USB: gadget: dummy-hcd: Fix wait for outstanding request completions
CVE-2026-98766await—LinuxLinux—usb: gadget: aspeed-vhub: cancel wake work on device removal
CVE-2026-98767await—LinuxLinux—usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
CVE-2026-98768await—LinuxLinux—usb: typec: anx7411 - stop the IRQ before destroying the workqueue
CVE-2026-98769await—LinuxLinux—usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
CVE-2026-98770await—LinuxLinux—usb: gadget: midi2: Fix the jack descriptor array sizes
CVE-2026-98771await—LinuxLinux—usb: storage: sierra_ms: reject short SWoC info transfers
CVE-2026-98772await—LinuxLinux—USB: serial: fix port tear down use-after-free
CVE-2026-98773await—LinuxLinux—USB: cdc-acm: skip URB restart in port_shutdown if disconnected
CVE-2026-98774await—LinuxLinux—rust_binder: cancel deferred work items in thread exit
CVE-2026-98775await—LinuxLinux—nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
CVE-2026-98776await—LinuxLinux—binderfs: fix UAF write in binder_add_device
CVE-2026-98777await—LinuxLinux—binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
CVE-2026-98778await—LinuxLinux—binder: fix is_failure flag for superseded transaction cleanup
CVE-2026-98779await—LinuxLinux—drm/amdgpu: fix ACP MFD device leak on init failure
CVE-2026-98780await—LinuxLinux—drm/amdgpu: fix IP instance memory leak on kobject add failure
CVE-2026-98781await—LinuxLinux—drm/mediatek: Fix pdev reference leak in mtk_drm_bind()
CVE-2026-98782await—LinuxLinux—drm/mediatek: Fix ovl adaptor platform device leak
CVE-2026-98783await—LinuxLinux—drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
CVE-2026-98784await—LinuxLinux—drm/amdgpu/gfx6: fix firmware leak on teardown
CVE-2026-98785await—LinuxLinux—drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
CVE-2026-98786await—LinuxLinux—drm/amd/display: guard dc_sink dereferences in MST mode validation
CVE-2026-98787await—LinuxLinux—bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()
CVE-2026-98788await—LinuxLinux—futex: Fix private hash use-after-free on resize
CVE-2026-98789await—LinuxLinux—bpf: Fix objects stuck in free_by_rcu_ttrace
CVE-2026-98790await—LinuxLinux—perf: Fix race between perf_event_exit_task() and perf_pending_task()
CVE-2026-98791await—LinuxLinux—net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
CVE-2026-98792await—LinuxLinux—netfilter: flowtable: generalize pending status bit
CVE-2026-98793await—LinuxLinux—netfilter: bpf: reject invalid NAT manipulation types
CVE-2026-98794await—LinuxLinux—ipvs: filter some flags received in the backup server
CVE-2026-98795await—LinuxLinux—net: sparx5: skip ptp deinit if init was skipped
CVE-2026-98796await—LinuxLinux—net: ethernet: mtk_eth_soc: allocate dummy netdev sooner
CVE-2026-98797await—LinuxLinux—net: cap skb->queue_mapping when the tx queue is picked
CVE-2026-98798await—LinuxLinux—net: bcmgenet: fix NULL dereference in set_coalesce before first open
CVE-2026-98799await—LinuxLinux—bpf: Skip detached progs in trampoline images that are still in use
CVE-2026-98800await—LinuxLinux—bpf: Wait for an RCU tasks grace period before freeing trampoline progs
CVE-2026-98801await—LinuxLinux—net: restrict SO_RESERVE_MEM to TCP sockets and cap max value
CVE-2026-98802await—LinuxLinux—seg6: ensure packet data is writable before modifying SRH and IPv6 DA
CVE-2026-98803await—LinuxLinux—net: stmmac: fix rx Scatter-Gather support
CVE-2026-98804await—LinuxLinux—net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
CVE-2026-98805await—LinuxLinux—tipc: prevent GCM nonce reuse on peer key changes
CVE-2026-98806await—LinuxLinux—octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled
CVE-2026-98807await—LinuxLinux—net/mlx5: Fix slab-out-of-bounds when handling team device events
CVE-2026-98808await—LinuxLinux—net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
CVE-2026-98809await—LinuxLinux—Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
CVE-2026-98810await—LinuxLinux—wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()
CVE-2026-98811await—LinuxLinux—net/sched: cls_api: reclaim an empty proto on the error path
CVE-2026-98812await—LinuxLinux—net/mctp: publish the mctp_dev only after it is initialised
CVE-2026-98813await—LinuxLinux—bpf: Hold map BTF for the memory allocator destructor record
CVE-2026-98814await—LinuxLinux—nvme: fix command effects log lifetime for multipath heads
CVE-2026-98815await—LinuxLinux—nvme: fix cdev lifetime
CVE-2026-98816await—LinuxLinux—bpf: Fix overflow of jump offset in constant blinding
CVE-2026-98817await—LinuxLinux—ASoC: SDCA: Add better pm_runtime error handling in func probe
CVE-2026-98818await—LinuxLinux—mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()
CVE-2026-98819await—LinuxLinux—Bluetooth: btintel: validate DDC record lengths
CVE-2026-98820await—LinuxLinux—blk-mq: set RQF_USE_SCHED when the operation is known
CVE-2026-98821await—LinuxLinux—block: reject polled dio with user integrity metadata
CVE-2026-98822await—LinuxLinux—wifi: mac80211: prevent AP VLAN tx from other interfaces
CVE-2026-98823await—LinuxLinux—wifi: cfg80211: preserve hidden-group beacon IE ownership
CVE-2026-98824await—LinuxLinux—wifi: mac80211: validate TX status rate metadata
CVE-2026-98825await—LinuxLinux—rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()
CVE-2026-98826await—LinuxLinux—rtc: ac100: Fix clock provider use-after-free on probe failure
CVE-2026-98827await—LinuxLinux—wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE
CVE-2026-98828await—LinuxLinux—wifi: ath9k: reject short WMI command responses
CVE-2026-98829await—LinuxLinux—wifi: mac80211: drop oversized fragments to avoid extra_len overflow
CVE-2026-98830await—LinuxLinux—wifi: wfx: validate MIB read length before copying to caller
CVE-2026-98831await—LinuxLinux—of/overlay: don't leak fragment references when changeset init fails
CVE-2026-98832await—LinuxLinux—blk-cgroup: save IRQ state in blkg_tryget_closest()
CVE-2026-98833await—LinuxLinux—mtd: core: call _get_device() with the master MTD
CVE-2026-98834await—LinuxLinux—mtd: core: avoid double-free of OTP NVMEM device
CVE-2026-98835await—LinuxLinux—iio: accel: kionix-kx022a: Fix array boundary check
CVE-2026-98836await—LinuxLinux—ALSA: line6: reject oversized playback packets
CVE-2026-98837await—LinuxLinux—ALSA: caiaq: unregister the input device when probe fails
CVE-2026-98838await—LinuxLinux—vt: skip screen update for DEC alignment test on backgroup consoles
CVE-2026-98839await—LinuxLinux—vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_se…
CVE-2026-98840await—LinuxLinux—vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
CVE-2026-98841await—LinuxLinux—virt: vmgenid: set driver_data before registering notification handlers
CVE-2026-98842await—LinuxLinux—module: fix lost error code from codetag_load_module()
CVE-2026-98843await—LinuxLinux—netfs: zero gaps in read-gaps folio to avoid writing back stale data
CVE-2026-98844await—LinuxLinux—netfs: clear post-EOF pagecache when extending a file via write
CVE-2026-98845await—LinuxLinux—tpm: Disable TPM on null key name mismatch
CVE-2026-98846await—LinuxLinux—sctp: check RCV_SHUTDOWN after the sendmsg connect wait
CVE-2026-98847await—LinuxLinux—rtc: spear: initialize IRQ state before requesting alarm IRQ
CVE-2026-98848await—LinuxLinux—rtc: ac100: Assign .num before accessing .hws
CVE-2026-98849await—LinuxLinux—pfcp: fix socket lifetime on netdevice registration failure
CVE-2026-98850await—LinuxLinux—net/packet: prevent TX_RING byte count overflow
CVE-2026-98851await—LinuxLinux—netfilter: nft_flow_offload: drop flowtable reference on init error path
CVE-2026-98852await—LinuxLinux—net: extend IPv6 exthdr detection of tunneled packets
CVE-2026-98853await—LinuxLinux—net: gso: limit recursive IP-in-IP segmentation
CVE-2026-98854await—LinuxLinux—of/overlay: only treat a positive changeset id as registered
CVE-2026-98855await—LinuxLinux—of/overlay: put property on deadprops only after changeset add succeeds
CVE-2026-98856await—LinuxLinux—kprobes: Skip disarmed probes when checking optkprobe overlap
CVE-2026-98857await—LinuxLinux—ipvs: bound LBLCR and LBLC cache growth
CVE-2026-98858await—LinuxLinux—io_uring: fix task_work add use-after-free with SQPOLL
CVE-2026-98859await—LinuxLinux—HID: multitouch: stop the release timer from being rearmed on remove
CVE-2026-98860await—LinuxLinux—HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
CVE-2026-98861await—LinuxLinux—fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
CVE-2026-98862await—LinuxLinux—audit: fix exe mark UAF in kill_rules()
CVE-2026-98863await—LinuxLinux—KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
CVE-2026-98864await—LinuxLinux—sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task
CVE-2026-98865await—LinuxLinux—sched_ext: Don't run ops.dequeue() with a DSQ lock held
CVE-2026-98866await—LinuxLinux—sched/cache: Introduce task_struct->sched_cache_grp to fix UAF
CVE-2026-98867await—LinuxLinux—dm-pcache: bound the logical key offset from persistent memory
CVE-2026-98868await—LinuxLinux—dm-pcache: reject a kset that overruns its segment
CVE-2026-104627await—GiteaGiteaCWE-287Gitea OpenID account linking without session binding
CVE-2026-105661await—GiteaGiteaCWE-248Gitea panic on the repositories route of individual users
CVE-2026-105964await—GiteaGiteaCWE-770Gitea Actions artifact v4 API unbounded request body
CVE-2026-107618await—GiteaGitea—Gitea cross-site request forgery on repository topics
CVE-2026-107686await—GiteaGitea—Gitea reactions accepted on locked issues and comments
CVE-2026-109553await—GiteaGitea—Gitea SSH certificate principal impersonation of other users
CVE-2026-109844await—GiteaGiteaCWE-862Gitea watched repositories API disclosure after access revocation
CVE-2026-110311await—GiteaGiteaCWE-200Gitea draft release creation disclosing attachment metadata
CVE-2026-110324await—GiteaGiteaCWE-200Gitea private profile information disclosure through POST request
CVE-2026-110494await—GiteaGiteaCWE-639Gitea release attachment re-linking of issue attachments