Skip to content
← All tracked CVEs

Updated 03:00

last 30 days

933 fixed within SLA

CVEStatusSeveritySummaryReleaseClock startedDeadlineFixedTime to fix
Fixed within SLAMediumERoFS inode xattr init: metabuf/folio ref leak on error paths after erofs_read_metabufsecure-packages-26.05Aug 19, 2026Oct 3, 2026Aug 19, 2026same day
Fixed within SLAHighHSR RTM_DELLINK frees nodes without RCU, causing generic-netlink reader use-after-freesecure-packages-26.05Aug 19, 2026Sep 3, 2026Aug 19, 2026same day
Fixed within SLACriticalNetfs: Tearing in remote_i_size/zero_point may corrupt i_size_seqcountsecure-packages-25.11Aug 18, 2026Aug 25, 2026Aug 19, 20261 day
Fixed within SLAMediumnetfs_release_folio zero_point update uses i_size not remote_i_size, causing EOF short readssecure-packages-25.11Aug 18, 2026Oct 2, 2026Aug 19, 20261 day
Fixed within SLAMediumReference leak in a6xx_gpu_init() due to missed of_node_put on early error pathssecure-packages-25.11Aug 18, 2026Oct 2, 2026Aug 19, 20261 day
Fixed within SLAMediumERoFS inode xattr init error paths leak metabuf, causing folio reference leaksecure-packages-25.11Aug 18, 2026Oct 2, 2026Aug 19, 20261 day
Fixed within SLAHighBlink use-after-free enables sandboxed RCE via crafted HTML in Chrome <151.0.7922.137secure-packages-25.11Aug 18, 2026Sep 2, 2026Aug 19, 20261 day
Fixed within SLAHighChrome <151.0.7922.137 HTML use-after-free enables sandboxed remote code execution via crafted pagesecure-packages-25.11Aug 18, 2026Sep 2, 2026Aug 19, 20261 day
Fixed within SLAHighUse-after-free in Chrome Extensions pre-151.0.7922.137 enables sandboxed code execution via malicious extensionsecure-packages-25.11Aug 18, 2026Sep 2, 2026Aug 19, 20261 day
Fixed within SLAHighGoogle Chrome Mac TabStrip use-after-free enables sandbox escape from compromised renderer via crafted HTML (pre-151.0.7922.137)secure-packages-25.11Aug 18, 2026Sep 2, 2026Aug 19, 20261 day
Fixed within SLAHighHigh-severity V8 use-after-free in Chrome <151.0.7922.137 enables sandboxed RCE via crafted HTMLsecure-packages-25.11Aug 18, 2026Sep 2, 2026Aug 19, 20261 day
Fixed within SLAHighChrome <151.0.7922.137 Blink use-after-free allows sandboxed remote code execution via crafted HTMLsecure-packages-rollingAug 18, 2026Sep 2, 2026Aug 19, 20261 day
Fixed within SLAHighChrome <151.0.7922.137 HTML use-after-free enables sandboxed RCE via crafted pagesecure-packages-rollingAug 18, 2026Sep 2, 2026Aug 19, 20261 day
Fixed within SLAHighUse-after-free in Chrome Extensions pre-151.0.7922.137 enables sandboxed arbitrary code executionsecure-packages-rollingAug 18, 2026Sep 2, 2026Aug 19, 20261 day
Fixed within SLAHighHigh-severity TabStrip use-after-free enables sandbox escape via HTML on Chrome Mac <151.0.7922.137secure-packages-rollingAug 18, 2026Sep 2, 2026Aug 19, 20261 day
Fixed within SLAHighUse-after-free in Chrome V8 pre-151.0.7922.137 allows sandboxed remote code executionsecure-packages-rollingAug 18, 2026Sep 2, 2026Aug 19, 20261 day
Fixed within SLAHighKVM guest_memfd offset+size treated signed, letting negative sum bypass file size checksecure-packages-25.11Aug 17, 2026Sep 1, 2026Aug 18, 20261 day
Fixed within SLAHighFFmpeg 7.0–8.1.2 vf_quirc heap OOB write via crafted PGS/SUP subtitles mismatched dimensionssecure-packages-rollingAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighHeap out-of-bounds write in FFmpeg PNG/APNG encoder eXIf handling (≤8.1.2)secure-packages-rollingAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg <=8.1.2 MACE6 CAF bytes_per_packet integer overflow causes heap OOB write, RCEsecure-packages-rollingAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg up to 8.1.2 LCL/ZLIB decoder leaks uninitialized heap; short inflate enables ASLR bypasssecure-packages-rollingAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg ≤8.1.2 IAMF demuxer uncontrolled allocation from 17-byte input via count_labelsecure-packages-rollingAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg ≤8.1.2 vf_hqdn3d heap OOB write when -reinit_filter 0 and resolution increasessecure-packages-rollingAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg 3.0-8.1.2 vf_swaprect OOB write on odd-width NV12 frames causing heap corruptionsecure-packages-rollingAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg 3.4-8.1.2 vf_floodfill OOB write with -reinit_filter 0, heap corruptionsecure-packages-rollingAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg <=8.1.2 heap corruption via TY demuxer OOB write using crafted ffconcat with -safe 0secure-packages-rollingAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLAHighFFmpeg 2.7–8.1.2 TDSC decoder OOB write causing heap corruption and potential RCEsecure-packages-rollingAug 10, 2026Aug 25, 2026Aug 18, 20268 days
Fixed within SLACriticalUAF in netfs_unlock_abandoned_read_pages and netfs_unlock_read_folio after request progress clearedsecure-packages-25.11Aug 12, 2026Aug 19, 2026Aug 18, 20266 days
Fixed within SLALowsecure-packages-rollingJun 15, 2026Sep 13, 2026Aug 18, 202663 days
Fixed within SLAMediumArithmetic overflow in af_alg AEAD AD length leads to TX buffer size miscalculationsecure-packages-25.11Jul 16, 2026Aug 30, 2026Aug 17, 202632 days
Fixed within SLAMediumsecure-packages-25.11Jul 8, 2026Aug 22, 2026Aug 17, 202640 days
Fixed within SLAMediumsecure-packages-25.11Jul 8, 2026Aug 22, 2026Aug 17, 202640 days
Fixed within SLAMediumsecure-packages-25.11Jul 8, 2026Aug 22, 2026Aug 17, 202640 days
Fixed within SLAMediumsecure-packages-25.11Jul 8, 2026Aug 22, 2026Aug 17, 202640 days
Fixed within SLAMediumsecure-packages-25.11Jul 8, 2026Aug 22, 2026Aug 17, 202640 days
Fixed within SLAMediumsecure-packages-25.11Jul 8, 2026Aug 22, 2026Aug 17, 202640 days
Fixed within SLAMediumsecure-packages-25.11Jul 8, 2026Aug 22, 2026Aug 17, 202640 days
Fixed within SLAHighmlx5e XSK race: unlocked ICOSQ IRQ trigger during NAPI affinity change causes CQE errorssecure-packages-rollingAug 12, 2026Aug 27, 2026Aug 15, 20262 days
Fixed within SLAHighmlx5e XSK: Unprotected ICOSQ IRQ trigger races with NAPI and CPU affinity changessecure-packages-26.05Aug 12, 2026Aug 27, 2026Aug 15, 20262 days
Fixed within SLAHighLinux iwlwifi BA handlers use ffs on zero sta_mask, causing out-of-bounds accesssecure-packages-25.11Aug 14, 2026Aug 29, 2026Aug 15, 2026same day
Fixed within SLAMediumath11k EMA/MBSSID beacon template memory leak on parameter setup error pathssecure-packages-25.11Jul 27, 2026Sep 10, 2026Aug 15, 202618 days
Fixed within SLAMediumpowerpc/64s: munmap race with PMD migration entries hits VM_BUG_ON in pmdp_huge_get_and_clear_fullsecure-packages-25.11Jul 27, 2026Sep 10, 2026Aug 15, 202618 days
Fixed within SLAMediumlibertas wifi: URBs killed in interrupt context causing sleep-in-atomic bug on TX pathsecure-packages-25.11Jul 27, 2026Sep 10, 2026Aug 15, 202618 days
Fixed within SLAMediumDeleting BPF local storage in NMI/reentrant contexts may deadlock via RCU deferralsecure-packages-25.11Jul 27, 2026Sep 10, 2026Aug 15, 202618 days
Fixed within SLAMediummt76 WiFi driver memory leak from RX queue page_pools on device destroysecure-packages-25.11Jul 27, 2026Sep 10, 2026Aug 15, 202618 days
Fixed within SLAMediumDeadlock during station removal: mt7925_roc_abort_sync vs roc_work holding dev->mt76.mutexsecure-packages-25.11Jul 23, 2026Sep 6, 2026Aug 15, 202622 days
Fixed within SLAMediumLinux mt76 skb memory leak when mt76_connac_mcu_alloc_sta_req fails in wed_update/key_tlvsecure-packages-25.11Jul 23, 2026Sep 6, 2026Aug 15, 202622 days
Fixed within SLAMediumf2fs GC reads already updated page causing VM_BUG_ON in folio_end_readsecure-packages-25.11Jul 17, 2026Aug 31, 2026Aug 15, 202628 days
Fixed within SLAMediumF2FS data loss from incorrect nat_entry flag use in fsync-checkpoint racesecure-packages-25.11Jul 17, 2026Aug 31, 2026Aug 15, 202628 days
Fixed within SLAMediumvsock/virtio MSG_ZEROCOPY misaccounts pinned pages; last skb skips RLIMIT_MEMLOCK enforcementsecure-packages-25.11Jul 17, 2026Aug 31, 2026Aug 15, 202628 days