129 Linux Kernel Vulnerabilities Disclosed in One Week, Including Two Critical iSCSI Flaws

TL;DR

The Linux kernel CNA published 129 new CVEs between October 26 and November 1, 2026. Two of these Linux kernel vulnerabilities score a critical 9.8, and both sit in the iSCSI initiator code. Another 29 rate high severity, according to CVE Watchtower data.

Linux kernel CVEs this week centered on networking, graphics drivers and SCSI storage. The two critical bugs let a malicious iSCSI target corrupt memory on a connected host. Fixes are in stable kernels 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59 and 7.2.13, and in mainline 7.3.

Notable CVEs

Why It Matters

The kernel runs servers, cloud hosts, phones and embedded devices. As a result, one bug can reach a huge number of systems at once. However, not every CVE affects every machine. Most bugs live in a single driver or feature, so your exposure depends on what you have enabled.

So far, none of these flaws has been confirmed as exploited in the wild. CVE Watchtower shows no public proof-of-concept either. In addition, none appears in CISA’s Known Exploited Vulnerabilities catalog.

The week in numbers

• Total CVEs: 129, published on October 26 (12) and October 28 (117)
• Critical: 2
• High: 29
• Not yet scored: 98
• Top areas: networking (18), DRM graphics drivers (15) and SCSI (9)

How the Attacks Work

iSCSI task index flaws (CVE-2026-99154, CVE-2026-99153)

Both critical bugs sit in libiscsi, which handles iSCSI storage connections. The kernel trusts a task index taken from data the storage target sends. In CVE-2026-99154, the code checks the index “from above only,” so a negative value reads memory before the array. Meanwhile, CVE-2026-99153 lets a Reject message name any task in the pool. A third bug, CVE-2026-99152, rated 7.5, adds a similar check for management responses. To exploit these, an attacker would need to control or impersonate an iSCSI target.

FireWire race condition (CVE-2026-99185)

This bug scores 8.8. A response handler and a timeout callback can both process the same split transaction. The fix notes that this “could lead to a use-after-free.” An attacker must sit on the adjacent FireWire bus.

Mount lock bypass (CVE-2026-99170)

Also rated 8.8, this flaw affects mount namespaces. A task that is root in its own user namespace can remove a locked mount cover. That can expose files the cover was meant to hide.

Other high-severity bugs

CVE-2026-99216 (8.4) leaves a Hyper-V VMBus connection open on error paths. Similarly, CVE-2026-99131 (8.2) lets users evade XFS group quotas. The remaining high-severity issues are mostly local use-after-free and memory bugs. They span vsock, KVM SEV, tracing, ntfs, SMB client and traffic control.

Affected Versions

Most of these bugs affect every kernel branch up to the fixed releases. Some are newer, though. For example, the FireWire and mount namespace flaws are fixed only in 7.2.13 and 7.3. Check each CVE record for the exact range.

Patch and Mitigation

• Install your distribution’s next kernel security update and reboot.
• Prioritize hosts that connect to iSCSI storage, especially across untrusted networks.
• Where possible, restrict unprivileged user namespaces until you patch.
• Unload unused drivers such as FireWire to shrink your attack surface.

Overall, these Linux kernel vulnerabilities reward steady patching more than panic. Track the stable fixes on git.kernel.org and your vendor’s security notices.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.