CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-20 13:23 UTC )
This week: 5,114 CVEs published, 326 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,114 Show in the list Critical, last 7 days 326 Show in the list Healthcare-tagged, last 7 days 5 Show in the list Known exploited (CISA KEV) 1,748 Show in the list Showing CVEs that name the product linux:linux . Show all products
CVE Severity Title Published CVE-2026-90211 Not yet scored bpf, s390: Clear fetch destination on faulting arena atomic Assigned by Linux
Sep 17, 2026 CVE-2026-90210 High 7.8 bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure Assigned by Linux
Sep 17, 2026 CVE-2026-90209 Not yet scored s390/debug: Fix deadlock during unregister Assigned by Linux
Sep 17, 2026 CVE-2026-90208 Not yet scored clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type Assigned by Linux
Sep 17, 2026 CVE-2026-90207 High 7.8 ALSA: seq: midi: Serialize input teardown with event_input Assigned by Linux
Sep 17, 2026 CVE-2026-90206 Not yet scored nvmet: fix max_qid race between configfs and controller allocation Assigned by Linux
Sep 17, 2026 CVE-2026-90205 High 7.8 ocfs2: validate orphan slot during inode read Assigned by Linux
Sep 17, 2026 CVE-2026-90204 High 7.8 ocfs2: validate DIO orphan slot during inode read Assigned by Linux
Sep 17, 2026 CVE-2026-90203 High 7.1 Squashfs: check block offset is not negative Assigned by Linux
Sep 17, 2026 CVE-2026-90202 Not yet scored scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers Assigned by Linux
Sep 17, 2026 CVE-2026-90201 Not yet scored net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race Assigned by Linux
Sep 17, 2026 CVE-2026-90200 Not yet scored fs/ntfs3: fix integer overflow in MFT cluster validation Assigned by Linux
Sep 17, 2026 CVE-2026-90199 High 7.8 fs/ntfs3: reject out-of-range evcn in mi_enum_attr() Assigned by Linux
Sep 17, 2026 CVE-2026-90198 Not yet scored ALSA: core: Fix use-after-free in snd_card_do_free() Assigned by Linux
Sep 17, 2026 CVE-2026-90197 Not yet scored HID: haptic: don't write an uninitialized value to unhandled usages Assigned by Linux
Sep 17, 2026 CVE-2026-90196 Not yet scored ASoC: SOF: validate topology volume range before allocation Assigned by Linux
Sep 17, 2026 CVE-2026-90195 Not yet scored riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args Assigned by Linux
Sep 17, 2026 CVE-2026-90194 Not yet scored ACPI: scan: fix bus ID cleanup on device_add() failures Assigned by Linux
Sep 17, 2026 CVE-2026-90193 Not yet scored mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler Assigned by Linux
Sep 17, 2026 CVE-2026-90192 Not yet scored mailbox: qcom-cpucp: handle NULL data in send_data callback Assigned by Linux
Sep 17, 2026 CVE-2026-90191 High 8.4 mailbox: riscv-sbi-mpxy: validate RPMI notification lengths Assigned by Linux
Sep 17, 2026 CVE-2026-90190 Not yet scored null_blk: use DEFINE_MUTEX for the file-scope mutex Assigned by Linux
Sep 17, 2026 CVE-2026-90189 Not yet scored null_blk: register configfs subsystem after creating default devices Assigned by Linux
Sep 17, 2026 CVE-2026-90188 Not yet scored null_blk: free global tag_set on init error path Assigned by Linux
Sep 17, 2026 CVE-2026-90187 Not yet scored null_blk: free zones array on device power-off Assigned by Linux
Sep 17, 2026 CVE-2026-90186 Not yet scored null_blk: reject per-device queue resize for shared tag set Assigned by Linux
Sep 17, 2026 CVE-2026-90185 Not yet scored null_blk: serialize configfs attribute stores with the lock Assigned by Linux
Sep 17, 2026 CVE-2026-90184 Not yet scored null_blk: serialize configfs attribute updates with device setup Assigned by Linux
Sep 17, 2026 CVE-2026-90183 Not yet scored blk-iolatency: clear delay state when freeing policy data Assigned by Linux
Sep 17, 2026 CVE-2026-90182 Not yet scored blk-iocost: clear delay state when freeing policy data Assigned by Linux
Sep 17, 2026 CVE-2026-90181 Not yet scored ublk: avoid teardown retry loop on xarray allocation failure Assigned by Linux
Sep 17, 2026 CVE-2026-90180 Not yet scored block: mtip32xx: synchronize ioctls with device removal Assigned by Linux
Sep 17, 2026 CVE-2026-90179 Not yet scored apparmor: fix deadlock in complain-mode change_hat Assigned by Linux
Sep 17, 2026 CVE-2026-90178 Not yet scored hwmon: (coretemp) Fix core_data leak on CPUs without PTS Assigned by Linux
Sep 17, 2026 CVE-2026-90177 High 7.8 bpf: Check pointer type for all atomic RMW paths Assigned by Linux
Sep 17, 2026 CVE-2026-90176 High 8.1 ksmbd: Do not skip lock checks for single-byte ranges Assigned by Linux
Sep 17, 2026 CVE-2026-90175 Not yet scored smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer Assigned by Linux
Sep 17, 2026 CVE-2026-90174 High 7.1 ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() Assigned by Linux
Sep 17, 2026 CVE-2026-90173 Critical 9.8 smb: smbdirect: free completion queues with ib_free_cq() Assigned by Linux
Sep 17, 2026 CVE-2026-90172 High 7.5 smb: smbdirect: destroy QP before mem pools on accept failure Assigned by Linux
Sep 17, 2026 CVE-2026-90171 Not yet scored smb: smbdirect: release pending child sockets outside the handler lock Assigned by Linux
Sep 17, 2026 CVE-2026-90170 Not yet scored ksmbd: validate ipc response length before dereferencing its fields Assigned by Linux
Sep 17, 2026 CVE-2026-90169 Not yet scored ksmbd: free preauth sessions on connection teardown Assigned by Linux
Sep 17, 2026 CVE-2026-90167 Not yet scored ksmbd: serialize oplock close with pending break ownership Assigned by Linux
Sep 17, 2026 CVE-2026-90166 Not yet scored smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request() Assigned by Linux
Sep 17, 2026 CVE-2026-90165 Not yet scored smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger() Assigned by Linux
Sep 17, 2026 CVE-2026-90164 Not yet scored smb/server: abort initialization when proc setup fails Assigned by Linux
Sep 17, 2026 CVE-2026-90163 Not yet scored smb/server: call ksmbd_proc_cleanup() on module init failure Assigned by Linux
Sep 17, 2026 CVE-2026-90162 High 8.8 ksmbd: defer publishing granted locks to prevent UAF/double-free race Assigned by Linux
Sep 17, 2026 CVE-2026-90161 High 7.1 erofs: fix interlaced ztailpacking pclusters Assigned by Linux
Sep 17, 2026
Previous Page 36 of 152 Next CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
