# Linux kernel.

Every CVE that names Linux kernel among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [scsi: bsg: Fix TOCTOU in io_uring passthrough command setup](https://agentprime.io/advisories/CVE-2026-90009.md)
  `CVE-2026-90009` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame](https://agentprime.io/advisories/CVE-2026-90008.md)
  `CVE-2026-90008` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [scsi: pm8001: Use rollback index when freeing MSI-X vectors](https://agentprime.io/advisories/CVE-2026-90007.md)
  `CVE-2026-90007` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [samples/damon/mtier: handle damon_stop() failure](https://agentprime.io/advisories/CVE-2026-90006.md)
  `CVE-2026-90006` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [samples/damon/wsse: handle damon_start() failure](https://agentprime.io/advisories/CVE-2026-90005.md)
  `CVE-2026-90005` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [mm/damon/core: handle region split failure in apply_min_nr_regions()](https://agentprime.io/advisories/CVE-2026-90004.md)
  `CVE-2026-90004` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [futex: Prevent rcuwait use-after-free during requeue PI](https://agentprime.io/advisories/CVE-2026-90003.md)
  `CVE-2026-90003` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [ftrace: Take trace_array reference before accessing its ftrace_ops](https://agentprime.io/advisories/CVE-2026-90002.md)
  `CVE-2026-90002` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [HID: bpf: serialize device reference release in struct_ops destroy path](https://agentprime.io/advisories/CVE-2026-90001.md)
  `CVE-2026-90001` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [HID: rmi: fix OOB access with undersized RMI reports](https://agentprime.io/advisories/CVE-2026-90000.md)
  `CVE-2026-90000` · CVE record: Linux Linux · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026
- [HID: wacom: validate report length in wacom_intuos_pro2_bt_irq](https://agentprime.io/advisories/CVE-2026-89999.md)
  `CVE-2026-89999` · CVE record: Linux Linux · CVSS 8.1 High · Not analysed yet · Published 16 Sept 2026
- [dm: fix race when loading and unloading a table](https://agentprime.io/advisories/CVE-2026-89998.md)
  `CVE-2026-89998` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [dm: fix resume-vs-remove race](https://agentprime.io/advisories/CVE-2026-89997.md)
  `CVE-2026-89997` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds](https://agentprime.io/advisories/CVE-2026-89996.md)
  `CVE-2026-89996` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [dma-direct: return struct page from dma_direct_alloc_from_pool()](https://agentprime.io/advisories/CVE-2026-89995.md)
  `CVE-2026-89995` · CVE record: Linux Linux · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026
- [dmaengine: fsl-edma: tracing: no ptr dereference during log output](https://agentprime.io/advisories/CVE-2026-89994.md)
  `CVE-2026-89994` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [dmaengine: dw-edma: Initialize IRQ data before requesting IRQs](https://agentprime.io/advisories/CVE-2026-89993.md)
  `CVE-2026-89993` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [cpuidle: dt_idle_genpd: kfree() the original name allocation](https://agentprime.io/advisories/CVE-2026-89992.md)
  `CVE-2026-89992` · CVE record: Linux Linux · CVSS 8.4 High · Not analysed yet · Published 16 Sept 2026
- [bpf: Fix infinite loop in pcpu_freelist push with one possible CPU](https://agentprime.io/advisories/CVE-2026-89991.md)
  `CVE-2026-89991` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [ceph: lock mutex in ceph_mds_check_access()](https://agentprime.io/advisories/CVE-2026-89990.md)
  `CVE-2026-89990` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()](https://agentprime.io/advisories/CVE-2026-89989.md)
  `CVE-2026-89989` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [kprobes: Protect kprobe_blacklist with RCU](https://agentprime.io/advisories/CVE-2026-89988.md)
  `CVE-2026-89988` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [mm/huge_memory: transfer the pmd dirty bit to the folio on zap](https://agentprime.io/advisories/CVE-2026-89987.md)
  `CVE-2026-89987` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()](https://agentprime.io/advisories/CVE-2026-89986.md)
  `CVE-2026-89986` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [memcg: keep folio's objcg same as its node](https://agentprime.io/advisories/CVE-2026-89985.md)
  `CVE-2026-89985` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [perf/x86/intel: Fix kernel address leakages in LBR stack](https://agentprime.io/advisories/CVE-2026-89984.md)
  `CVE-2026-89984` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [i2c: core: fix debugfs UAF on adapter removal](https://agentprime.io/advisories/CVE-2026-89983.md)
  `CVE-2026-89983` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [i2c: mux: Fix channel node leak on adapter add failure](https://agentprime.io/advisories/CVE-2026-89982.md)
  `CVE-2026-89982` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [arm64: Don't read GMID_EL1 when MTE is disabled](https://agentprime.io/advisories/CVE-2026-89981.md)
  `CVE-2026-89981` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [ALSA: harmony: initialize locks before requesting IRQ](https://agentprime.io/advisories/CVE-2026-89980.md)
  `CVE-2026-89980` · CVE record: Linux Linux · CVSS 8.4 High · Not analysed yet · Published 16 Sept 2026
- [ALSA: pcm: Fix race between non-atomic ops and trigger-start](https://agentprime.io/advisories/CVE-2026-89979.md)
  `CVE-2026-89979` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [accel/amdxdna: return early from a zero-length flush](https://agentprime.io/advisories/CVE-2026-89978.md)
  `CVE-2026-89978` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [accel/ethosu: check MMIO mapping errors in probe](https://agentprime.io/advisories/CVE-2026-89977.md)
  `CVE-2026-89977` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [accel/ethosu: fix job completion fence cleanup](https://agentprime.io/advisories/CVE-2026-89976.md)
  `CVE-2026-89976` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [nvme-fabrics: fix DHCHAP secret leak on parse failure](https://agentprime.io/advisories/CVE-2026-89975.md)
  `CVE-2026-89975` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails](https://agentprime.io/advisories/CVE-2026-89974.md)
  `CVE-2026-89974` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026
- [nvme-tcp: check the data direction of a C2HData PDU](https://agentprime.io/advisories/CVE-2026-89973.md)
  `CVE-2026-89973` · CVE record: Linux Linux · CVSS 8.2 High · Not analysed yet · Published 16 Sept 2026
- [nvme: add missing SRCU grace period in error path](https://agentprime.io/advisories/CVE-2026-89972.md)
  `CVE-2026-89972` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [nvme: skip the zoned limits update if the zone info query failed](https://agentprime.io/advisories/CVE-2026-89971.md)
  `CVE-2026-89971` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026
- [nvmet-auth: Synchronize timeout work during SQ teardown](https://agentprime.io/advisories/CVE-2026-89970.md)
  `CVE-2026-89970` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU](https://agentprime.io/advisories/CVE-2026-89969.md)
  `CVE-2026-89969` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [nvmet-tcp: reject unsolicited H2CData PDUs](https://agentprime.io/advisories/CVE-2026-89968.md)
  `CVE-2026-89968` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026
- [mm/migrate_device: avoid out-of-bounds writes for compound folios](https://agentprime.io/advisories/CVE-2026-89967.md)
  `CVE-2026-89967` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio](https://agentprime.io/advisories/CVE-2026-89966.md)
  `CVE-2026-89966` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [nvdimm/btt: reject an arena whose nfree is below the lane count](https://agentprime.io/advisories/CVE-2026-89965.md)
  `CVE-2026-89965` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [parisc: eisa: Fix infinite loop when parsing invalid IRQ value](https://agentprime.io/advisories/CVE-2026-89964.md)
  `CVE-2026-89964` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [powerpc/kexec_file: Fix null-ptr-def in extra size calculation](https://agentprime.io/advisories/CVE-2026-89963.md)
  `CVE-2026-89963` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [powerpc/kexec_file: Prevent kexec range truncation](https://agentprime.io/advisories/CVE-2026-89962.md)
  `CVE-2026-89962` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population](https://agentprime.io/advisories/CVE-2026-89961.md)
  `CVE-2026-89961` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 16 Sept 2026
- [s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()](https://agentprime.io/advisories/CVE-2026-89960.md)
  `CVE-2026-89960` · CVE record: Linux Linux · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026
- [s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove](https://agentprime.io/advisories/CVE-2026-89959.md)
  `CVE-2026-89959` · CVE record: Linux Linux · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026
- [s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL](https://agentprime.io/advisories/CVE-2026-89958.md)
  `CVE-2026-89958` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed](https://agentprime.io/advisories/CVE-2026-89957.md)
  `CVE-2026-89957` · CVE record: Linux Linux · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026
- [s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects](https://agentprime.io/advisories/CVE-2026-89956.md)
  `CVE-2026-89956` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [s390/vfio-ap: Fix NULL deref in status_show() during queue probe](https://agentprime.io/advisories/CVE-2026-89955.md)
  `CVE-2026-89955` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [mtd: afs: validate v2 image info bounds](https://agentprime.io/advisories/CVE-2026-89954.md)
  `CVE-2026-89954` · CVE record: Linux Linux · CVSS 8.0 High · Not analysed yet · Published 16 Sept 2026
- [mtd: mtdoops: free page bitmap when the backing MTD is removed](https://agentprime.io/advisories/CVE-2026-89953.md)
  `CVE-2026-89953` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [mtd: rawnand: validate ONFI extended parameter page sections](https://agentprime.io/advisories/CVE-2026-89952.md)
  `CVE-2026-89952` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [batman-adv: fix stale receive device on merged fragments](https://agentprime.io/advisories/CVE-2026-89951.md)
  `CVE-2026-89951` · CVE record: Linux Linux · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026
- [batman-adv: mcast: linearize skbuff for packet generation](https://agentprime.io/advisories/CVE-2026-89950.md)
  `CVE-2026-89950` · CVE record: Linux Linux · No CVSS score · Not analysed yet · Published 16 Sept 2026

Newest: <https://agentprime.io/advisories/technology/linux-kernel.md>
Older: <https://agentprime.io/advisories/technology/linux-kernel.md?cursor=WyIyMDI2LTA5LTE2VDEwOjMyOjM1LjQ4NTAwMFoiLCJDVkUtMjAyNi04OTk1MCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=linux-kernel&cursor=WyIyMDI2LTA5LTE2VDEwOjMzOjE4LjExODAwMFoiLCJDVkUtMjAyNi05MDAxMCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/linux-kernel/?cursor=WyIyMDI2LTA5LTE2VDEwOjMzOjE4LjExODAwMFoiLCJDVkUtMjAyNi05MDAxMCJd>. Everything for agents: <https://agentprime.io/llms.txt>.