By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 29 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
33Monitor	CVE-2026-81017No exploit	platform/chrome: sensorhub: Bound the EC-reported sensor numberlinux · linux	High8.4	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89436No exploit	platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]linux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89440No exploit	mmc: via-sdmmc: stop card-detect handling on probe failurelinux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89441No exploit	mmc: via-sdmmc: cancel card-detect work on removelinux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89442No exploit	platform/x86: ISST: Validate socket ID in clos_assoc ioctllinux · linux	High7.8	—	0.1%	Sep 11, 2026
28Monitor	CVE-2026-89443No exploit	platform/x86: ISST: Validate level in perf mask ioctlslinux · linux	High7.1	—	0.1%	Sep 11, 2026
35Monitor	CVE-2026-89445No exploit	iommufd: Fix UAF in selftest IOPF reportinglinux · linux	High8.8	—	0.1%	Sep 11, 2026
37Monitor	CVE-2026-89448No exploit	iommu/vt-d: Force requesting ACS when tboot is enabledlinux · linux	Critical9.3	—	0.1%	Sep 11, 2026
35Monitor	CVE-2026-89450No exploit	iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH fieldlinux · linux	High8.8	—	0.1%	Sep 11, 2026
33Monitor	CVE-2026-89452No exploit	iommu/msm: Unwind probe state on registration failurelinux · linux	High8.4	—	0.1%	Sep 11, 2026
28Monitor	CVE-2026-89456No exploit	s390/dasd: Propagate partial completion length across ERP recoverylinux · linux	High7.0	—	0.1%	Sep 11, 2026
28Monitor	CVE-2026-89459No exploit	s390/percpu: Fix MVIY_PERCPU() with older binutilslinux · linux	High7.0	—	0.1%	Sep 11, 2026
33Monitor	CVE-2026-89465No exploit	power: supply: rt9455: quiesce delayed work before teardownlinux · linux	High8.4	—	0.1%	Sep 11, 2026
30Monitor	CVE-2026-89466No exploit	power: supply: qcom_battmgr: terminate the strings from firmwarelinux · linux	High7.7	—	0.1%	Sep 11, 2026
33Monitor	CVE-2026-89469No exploit	power: supply: lp8727: fix use-after-free in lp8727_release_irq()linux · linux	High8.4	—	0.1%	Sep 11, 2026
33Monitor	CVE-2026-89470No exploit	power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTSlinux · linux	High8.4	—	0.1%	Sep 11, 2026
33Monitor	CVE-2026-89471No exploit	power: supply: cros_usbpd-charger: bound the EC-reported port countlinux · linux	High8.4	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89472No exploit	power: supply: charger-manager: register regulators before exposing sysfslinux · linux	High7.8	—	0.1%	Sep 11, 2026
30Monitor	CVE-2026-89476No exploit	sctp: fix stream->outcnt underflow on duplicate RECONF responseslinux · linux Pre-auth Denial of service	High7.5	—	0.6%	Sep 11, 2026
30Monitor	CVE-2026-89477No exploit	sctp: fix NULL deref on untransmitted RECONF completionlinux · linux Pre-auth Denial of service	High7.5	—	0.5%	Sep 11, 2026
39Monitor	CVE-2026-89478No exploit	sctp: drop a chunk if its transport was removedlinux · linux Pre-auth	Critical9.8	—	0.5%	Sep 11, 2026
39Monitor	CVE-2026-89479No exploit	sctp: stop processing a packet once its association is deletedlinux · linux Pre-auth	Critical9.8	—	0.5%	Sep 11, 2026
30Monitor	CVE-2026-89480No exploit	nvme-tcp: reject a read that transferred too few byteslinux · linux Pre-auth	High7.5	—	0.4%	Sep 11, 2026
30Monitor	CVE-2026-89481No exploit	nvme-tcp: fix host memory disclosure on R2T for a read commandlinux · linux Pre-auth	High7.5	—	0.4%	Sep 11, 2026
39Monitor	CVE-2026-89482No exploit	nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alonelinux · linux Pre-auth	Critical9.8	—	0.7%	Sep 11, 2026
30Monitor	CVE-2026-89483No exploit	nvme: zero the discard fallback pagelinux · linux Pre-auth	High7.5	—	0.5%	Sep 11, 2026
39Monitor	CVE-2026-89485No exploit	lockd: pin next file across nlm_inspect_file lock-droplinux · linux Pre-auth	Critical9.8	—	0.7%	Sep 11, 2026
31Monitor	CVE-2026-89486No exploit	ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()linux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89487No exploit	openvswitch: only skb_tx_error() a packet we are about to droplinux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89488No exploit	openvswitch: Fix CT limit teardown use-after-freelinux · linux Local privilege escalation	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89489No exploit	openrisc: fix arbitrary kernel memory access via or1k_atomic syscalllinux · linux Local privilege escalation	High7.8	—	0.1%	Sep 11, 2026
39Monitor	CVE-2026-89492No exploit	ocfs2: validate directory-index entry counts when reading metadatalinux · linux Pre-auth	Critical9.8	—	0.7%	Sep 11, 2026
35Monitor	CVE-2026-89493No exploit	ocfs2: validate rl_used against rl_count in refcount block validatorlinux · linux	High8.8	—	0.6%	Sep 11, 2026
39Monitor	CVE-2026-89494No exploit	ocfs2: validate lengths in dlm_mig_lockres_handlerlinux · linux Pre-auth	Critical9.8	—	0.7%	Sep 11, 2026
39Monitor	CVE-2026-89495No exploit	ocfs2: bound namelen in dlm_migrate_request_handlerlinux · linux Pre-auth	Critical9.8	—	0.7%	Sep 11, 2026
31Monitor	CVE-2026-89497No exploit	orangefs: skip leading spaces before parsing client debug maskslinux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89499No exploit	ring-buffer: Stop remote reader update when page swap failslinux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89500No exploit	ring-buffer: Make cpu_buffer::free_page a buffer_data_read_pagelinux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89501No exploit	ring-buffer: Hold cpu_buffer::lock when resizing a subbuflinux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89503No exploit	ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()linux · linux	High7.8	—	0.1%	Sep 11, 2026
33Monitor	CVE-2026-89504No exploit	regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointerlinux · linux	High8.4	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89507No exploit	RDMA/ucma: Lock the handler in ucma_write_cm_event()linux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89508No exploit	RDMA/ucma: Lock the handler in ucma_set_ib_path()linux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89510No exploit	RDMA/cxgb4: Cancel reg_work before freeing device on removelinux · linux	High7.8	—	0.1%	Sep 11, 2026
30Monitor	CVE-2026-89511No exploit	qede: Fix NULL pointer dereference in TPA fragment processinglinux · linux Pre-auth Denial of service	High7.5	—	0.7%	Sep 11, 2026
35Monitor	CVE-2026-89513No exploit	RISC-V: KVM: Fix PMU event info array size overflowlinux · linux	High8.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89520No exploit	sched/core: Make core-sched flips wait for in-flight selectionslinux · linux	High7.8	—	0.1%	Sep 11, 2026
29Monitor	CVE-2026-89521No exploit	sched/core: Handle pick_task() releasing the rq locklinux · linux	High7.3	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89522No exploit	media: staging/ipu7: fix async notifier UAF on probe error pathlinux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89523No exploit	wifi: mt76: mt7925: cancel pending mlo_pm_worklinux · linux	High7.8	—	0.1%	Sep 11, 2026
32Monitor	CVE-2026-89524No exploit	wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsetslinux · linux Pre-auth	High8.1	—	0.2%	Sep 11, 2026
39Monitor	CVE-2026-89526No exploit	svcrdma: Validate Read chunk positions before reconstructionlinux · linux Pre-auth	Critical9.8	—	0.6%	Sep 11, 2026
30Monitor	CVE-2026-89528No exploit	svcrdma: Reject Read lists that exceed the page budgetlinux · linux Pre-auth Denial of service	High7.5	—	0.7%	Sep 11, 2026
39Monitor	CVE-2026-89530No exploit	svcrdma: Reject inline replies that overflow the pull-up bufferlinux · linux Pre-auth	Critical9.8	—	0.4%	Sep 11, 2026
36Monitor	CVE-2026-89532No exploit	svcrdma: Fix pcl_for_each_segment for empty chunkslinux · linux Pre-auth	Critical9.1	—	0.5%	Sep 11, 2026
39Monitor	CVE-2026-89533No exploit	svcrdma: Fix offset arithmetic in read_chunk_rangelinux · linux Pre-auth	Critical9.8	—	0.5%	Sep 11, 2026
35Monitor	CVE-2026-89534No exploit	svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement failslinux · linux Pre-auth	High8.8	—	0.2%	Sep 11, 2026
32Monitor	CVE-2026-89535No exploit	svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_idlinux · linux Pre-auth	High8.1	—	0.5%	Sep 11, 2026
39Monitor	CVE-2026-89536No exploit	SUNRPC: wait for in-flight client TLS handshake callbacklinux · linux Pre-auth	Critical9.8	—	0.6%	Sep 11, 2026
36Monitor	CVE-2026-89537No exploit	SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2linux · linux Pre-auth	Critical9.1	—	0.7%	Sep 11, 2026
39Monitor	CVE-2026-89538No exploit	SUNRPC: Reject krb5 v2 wrap tokens with oversized ec fieldlinux · linux Pre-auth	Critical9.8	—	0.7%	Sep 11, 2026
31Monitor	CVE-2026-89540No exploit	sunrpc: init gssp_lock before publishing proc entrylinux · linux	High7.8	—	0.1%	Sep 11, 2026
39Monitor	CVE-2026-89541No exploit	SUNRPC: harden gss_unwrap_resp_priv length checkslinux · linux Pre-auth	Critical9.8	—	0.5%	Sep 11, 2026
39Monitor	CVE-2026-89542No exploit	SUNRPC: harden gss_krb5_unwrap_v2 against short tokenslinux · linux Pre-auth	Critical9.8	—	0.5%	Sep 11, 2026
30Monitor	CVE-2026-89544No exploit	SUNRPC: fix gssx_dec_option_array error path bugslinux · linux Pre-auth Denial of service	High7.5	—	0.7%	Sep 11, 2026
31Monitor	CVE-2026-89545No exploit	sunrpc: defer rq_argp and rq_resp free until after RCU grace periodlinux · linux	High7.8	—	0.1%	Sep 11, 2026
39Monitor	CVE-2026-89546No exploit	SUNRPC: close backchannel before destroying callback servicelinux · linux Pre-auth	Critical9.8	—	0.5%	Sep 11, 2026
32Monitor	CVE-2026-89547No exploit	SUNRPC: Check svc pool percpu counter allocationlinux · linux Pre-auth	High8.1	—	0.5%	Sep 11, 2026
31Monitor	CVE-2026-89548No exploit	SUNRPC: always drain cache_cleaner before destroying a cache_detaillinux · linux	High7.8	—	0.1%	Sep 11, 2026
30Monitor	CVE-2026-89549No exploit	sunrpc: route to a populated pool in svc_pool_for_cpu()linux · linux Pre-auth Denial of service	High7.5	—	0.7%	Sep 11, 2026
39Monitor	CVE-2026-89550No exploit	SUNRPC: svcauth_gss: enforce krb5 token minimum lengthlinux · linux Pre-auth	Critical9.8	—	0.4%	Sep 11, 2026
39Monitor	CVE-2026-89551No exploit	SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflowlinux · linux Pre-auth	Critical9.8	—	0.5%	Sep 11, 2026
31Monitor	CVE-2026-89553No exploit	nouveau/gem: reserve the bo in the info ioctl around the vma lookuplinux · linux	High7.8	—	0.1%	Sep 11, 2026
32Monitor	CVE-2026-89554No exploit	mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstructionlinux · linux Pre-auth	High8.2	—	0.5%	Sep 11, 2026
39Monitor	CVE-2026-89555No exploit	mpls: reload header after pskb_may_pull()linux · linux Pre-auth	Critical9.8	—	0.6%	Sep 11, 2026
31Monitor	CVE-2026-89557No exploit	md: do overflow check for sb->bblog_shift in super_1_load()linux · linux	High7.8	—	0.1%	Sep 11, 2026
39Monitor	CVE-2026-89558No exploit	md/raid10: fix still_degraded being inverted in raid10_sync_request()linux · linux Pre-auth	Critical9.8	—	0.6%	Sep 11, 2026
31Monitor	CVE-2026-89559No exploit	libnvdimm/labels: Prevent integer overflow in __nd_label_validate()linux · linux	High7.8	—	0.1%	Sep 11, 2026
33Monitor	CVE-2026-89560No exploit	landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creationlinux · linux	High8.4	—	0.1%	Sep 11, 2026
30Monitor	CVE-2026-89561No exploit	ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()linux · linux Pre-auth Denial of service	High7.5	—	0.4%	Sep 11, 2026
31Monitor	CVE-2026-89562No exploit	ip6_gre: fix hardware header length for NBMA tunnelslinux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89563No exploit	ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()linux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89564No exploit	ip: orphan prefetched skbs before multicast forwardinglinux · linux	High7.8	—	0.1%	Sep 11, 2026
35Monitor	CVE-2026-89569No exploit	Bluetooth: RFCOMM: serialize security confirmation handlinglinux · linux Pre-auth	High8.8	—	0.3%	Sep 11, 2026
31Monitor	CVE-2026-89570No exploit	cxl/mce: Make the MCE notifier per-regionlinux · linux	High7.8	—	0.1%	Sep 11, 2026
28Monitor	CVE-2026-89571No exploit	cxl/features: bound fwctl command payload to the input bufferlinux · linux	High7.1	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89573No exploit	dm array: reject an array block whose value size is not the caller'slinux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89574No exploit	dm array: validate array block headers on readlinux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89579No exploit	bpf: Harden bloom filter sizing and indexing on 32-bit kernelslinux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89580No exploit	bpf: Disable preemption in __bpf_get_stacklinux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89581No exploit	bpf, x86: Fix per-CPU address resolution into an extended registerlinux · linux	High7.8	—	0.1%	Sep 11, 2026
32Monitor	CVE-2026-89583No exploit	Bluetooth: eir: Fix OOB read in eir_get_service_data()linux · linux Pre-auth	High8.1	—	0.2%	Sep 11, 2026
31Monitor	CVE-2026-89584No exploit	block: validate user space vectors during extractionlinux · linux	High7.8	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89585No exploit	auxdisplay: charlcd: cancel backlight work on registration failurelinux · linux	High7.8	—	0.1%	Sep 11, 2026
32Monitor	CVE-2026-89586No exploit	ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 byteslinux · linux Pre-auth	High8.2	—	0.6%	Sep 11, 2026
31Monitor	CVE-2026-89587No exploit	ACPI: pfr_update: fix stack buffer overflow in query_capability()linux · linux	High7.8	—	0.1%	Sep 11, 2026
33Monitor	CVE-2026-89588No exploit	ACPI: APEI: GHES: fix ARM section length accounting after headerlinux · linux	High8.4	—	0.1%	Sep 11, 2026
28Monitor	CVE-2026-89593No exploit	hugetlb: only adjust reservation during unmapping if mapcount is 0linux · linux	High7.1	—	0.1%	Sep 11, 2026
31Monitor	CVE-2026-89594No exploit	hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller devicelinux · linux	High7.8	—	0.1%	Sep 11, 2026
28Monitor	CVE-2026-89596No exploit	forcedeth: fix off-by-one when saving/restoring non-PCI config spacelinux · linux	High7.1	—	0.1%	Sep 11, 2026

CVE-2026-81017
33Monitor
platform/chrome: sensorhub: Bound the EC-reported sensor number
HighCVSS 8.4No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89436
31Monitor
platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89440
31Monitor
mmc: via-sdmmc: stop card-detect handling on probe failure
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89441
31Monitor
mmc: via-sdmmc: cancel card-detect work on remove
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89442
31Monitor
platform/x86: ISST: Validate socket ID in clos_assoc ioctl
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89443
28Monitor
platform/x86: ISST: Validate level in perf mask ioctls
HighCVSS 7.1No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89445
35Monitor
iommufd: Fix UAF in selftest IOPF reporting
HighCVSS 8.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89448
37Monitor
iommu/vt-d: Force requesting ACS when tboot is enabled
CriticalCVSS 9.3No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89450
35Monitor
iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
HighCVSS 8.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89452
33Monitor
iommu/msm: Unwind probe state on registration failure
HighCVSS 8.4No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89456
28Monitor
s390/dasd: Propagate partial completion length across ERP recovery
HighCVSS 7.0No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89459
28Monitor
s390/percpu: Fix MVIY_PERCPU() with older binutils
HighCVSS 7.0No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89465
33Monitor
power: supply: rt9455: quiesce delayed work before teardown
HighCVSS 8.4No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89466
30Monitor
power: supply: qcom_battmgr: terminate the strings from firmware
HighCVSS 7.7No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89469
33Monitor
power: supply: lp8727: fix use-after-free in lp8727_release_irq()
HighCVSS 8.4No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89470
33Monitor
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
HighCVSS 8.4No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89471
33Monitor
power: supply: cros_usbpd-charger: bound the EC-reported port count
HighCVSS 8.4No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89472
31Monitor
power: supply: charger-manager: register regulators before exposing sysfs
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89476
30Monitor
sctp: fix stream->outcnt underflow on duplicate RECONF responses
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxSep 11, 2026
CVE-2026-89477
30Monitor
sctp: fix NULL deref on untransmitted RECONF completion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxSep 11, 2026
CVE-2026-89478
39Monitor
sctp: drop a chunk if its transport was removed
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89479
39Monitor
sctp: stop processing a packet once its association is deleted
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89480
30Monitor
nvme-tcp: reject a read that transferred too few bytes
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89481
30Monitor
nvme-tcp: fix host memory disclosure on R2T for a read command
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89482
39Monitor
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89483
30Monitor
nvme: zero the discard fallback page
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89485
39Monitor
lockd: pin next file across nlm_inspect_file lock-drop
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89486
31Monitor
ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89487
31Monitor
openvswitch: only skb_tx_error() a packet we are about to drop
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89488
31Monitor
openvswitch: Fix CT limit teardown use-after-free
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
linux · linuxSep 11, 2026
CVE-2026-89489
31Monitor
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
linux · linuxSep 11, 2026
CVE-2026-89492
39Monitor
ocfs2: validate directory-index entry counts when reading metadata
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89493
35Monitor
ocfs2: validate rl_used against rl_count in refcount block validator
HighCVSS 8.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89494
39Monitor
ocfs2: validate lengths in dlm_mig_lockres_handler
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89495
39Monitor
ocfs2: bound namelen in dlm_migrate_request_handler
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89497
31Monitor
orangefs: skip leading spaces before parsing client debug masks
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89499
31Monitor
ring-buffer: Stop remote reader update when page swap fails
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89500
31Monitor
ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89501
31Monitor
ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89503
31Monitor
ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89504
33Monitor
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
HighCVSS 8.4No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89507
31Monitor
RDMA/ucma: Lock the handler in ucma_write_cm_event()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89508
31Monitor
RDMA/ucma: Lock the handler in ucma_set_ib_path()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89510
31Monitor
RDMA/cxgb4: Cancel reg_work before freeing device on remove
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89511
30Monitor
qede: Fix NULL pointer dereference in TPA fragment processing
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxSep 11, 2026
CVE-2026-89513
35Monitor
RISC-V: KVM: Fix PMU event info array size overflow
HighCVSS 8.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89520
31Monitor
sched/core: Make core-sched flips wait for in-flight selections
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89521
29Monitor
sched/core: Handle pick_task() releasing the rq lock
HighCVSS 7.3No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89522
31Monitor
media: staging/ipu7: fix async notifier UAF on probe error path
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89523
31Monitor
wifi: mt76: mt7925: cancel pending mlo_pm_work
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89524
32Monitor
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89526
39Monitor
svcrdma: Validate Read chunk positions before reconstruction
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89528
30Monitor
svcrdma: Reject Read lists that exceed the page budget
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxSep 11, 2026
CVE-2026-89530
39Monitor
svcrdma: Reject inline replies that overflow the pull-up buffer
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89532
36Monitor
svcrdma: Fix pcl_for_each_segment for empty chunks
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89533
39Monitor
svcrdma: Fix offset arithmetic in read_chunk_range
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89534
35Monitor
svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89535
32Monitor
svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89536
39Monitor
SUNRPC: wait for in-flight client TLS handshake callback
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89537
36Monitor
SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89538
39Monitor
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89540
31Monitor
sunrpc: init gssp_lock before publishing proc entry
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89541
39Monitor
SUNRPC: harden gss_unwrap_resp_priv length checks
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89542
39Monitor
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89544
30Monitor
SUNRPC: fix gssx_dec_option_array error path bugs
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxSep 11, 2026
CVE-2026-89545
31Monitor
sunrpc: defer rq_argp and rq_resp free until after RCU grace period
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89546
39Monitor
SUNRPC: close backchannel before destroying callback service
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89547
32Monitor
SUNRPC: Check svc pool percpu counter allocation
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89548
31Monitor
SUNRPC: always drain cache_cleaner before destroying a cache_detail
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89549
30Monitor
sunrpc: route to a populated pool in svc_pool_for_cpu()
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxSep 11, 2026
CVE-2026-89550
39Monitor
SUNRPC: svcauth_gss: enforce krb5 token minimum length
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89551
39Monitor
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89553
31Monitor
nouveau/gem: reserve the bo in the info ioctl around the vma lookup
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89554
32Monitor
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89555
39Monitor
mpls: reload header after pskb_may_pull()
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89557
31Monitor
md: do overflow check for sb->bblog_shift in super_1_load()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89558
39Monitor
md/raid10: fix still_degraded being inverted in raid10_sync_request()
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89559
31Monitor
libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89560
33Monitor
landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
HighCVSS 8.4No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89561
30Monitor
ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxSep 11, 2026
CVE-2026-89562
31Monitor
ip6_gre: fix hardware header length for NBMA tunnels
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89563
31Monitor
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89564
31Monitor
ip: orphan prefetched skbs before multicast forwarding
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89569
35Monitor
Bluetooth: RFCOMM: serialize security confirmation handling
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89570
31Monitor
cxl/mce: Make the MCE notifier per-region
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89571
28Monitor
cxl/features: bound fwctl command payload to the input buffer
HighCVSS 7.1No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89573
31Monitor
dm array: reject an array block whose value size is not the caller's
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89574
31Monitor
dm array: validate array block headers on read
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89579
31Monitor
bpf: Harden bloom filter sizing and indexing on 32-bit kernels
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89580
31Monitor
bpf: Disable preemption in __bpf_get_stack
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89581
31Monitor
bpf, x86: Fix per-CPU address resolution into an extended register
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89583
32Monitor
Bluetooth: eir: Fix OOB read in eir_get_service_data()
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89584
31Monitor
block: validate user space vectors during extraction
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89585
31Monitor
auxdisplay: charlcd: cancel backlight work on registration failure
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89586
32Monitor
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
linux · linuxSep 11, 2026
CVE-2026-89587
31Monitor
ACPI: pfr_update: fix stack buffer overflow in query_capability()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89588
33Monitor
ACPI: APEI: GHES: fix ARM section length accounting after header
HighCVSS 8.4No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89593
28Monitor
hugetlb: only adjust reservation during unmapping if mapcount is 0
HighCVSS 7.1No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89594
31Monitor
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 11, 2026
CVE-2026-89596
28Monitor
forcedeth: fix off-by-one when saving/restoring non-PCI config space
HighCVSS 7.1No exploitEPSS 0%
linux · linuxSep 11, 2026