End of life / Linux Kernel / 7.3 / CVEs
Known CVEs in Linux Kernel 7.3
3 known CVEs reach Linux Kernel 7.3, the most severe rated HIGH. Every one of them publishes an affected range that includes this release.
By severity
- HIGH
- 3
StackDrift tracks Linux Kernel advisories from HIGH upwards, so these totals cover CRITICAL and HIGH only. A release with none of those still has advisories rated MEDIUM and LOW against it, and they are not counted here rather than absent.
Every advisory that reaches 7.3
| Advisory | Severity | CVSS | Published | Fixed in |
|---|---|---|---|---|
| CVE-2026-98149 In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix percpu map update indexing with sparse CPU IDs
Per-CPU array, hash, and cgroup storage map updates without BPF_F_CPU
or BPF_F_ALL_CPUS use a value buffer whose per-CPU slots are packed in
possible-CPU order. The buffer is sized as:
round_up(value_size, 8) * num_possible_cpus()
The update paths iterate over possible CPUs, but use the logical CPU ID
to calculate the source offset:
value + size * cpu
This only wo | HIGH | 7.8 | 25 September 2026 | no fixed version published |
| CVE-2026-98136 In the Linux kernel, the following vulnerability has been resolved:
ntfs: bound $AttrDef table walk to the loaded table size
ntfs_attr_find_in_attrdef() walks the in-memory $AttrDef table, but the
loop condition bounds only the start of each entry, not the whole entry:
for (ad = vol->attrdef; (u8 *)ad - (u8 *)vol->attrdef <
vol->attrdef_size && ad->type; ++ad)
struct attr_def is 160 bytes; the guard reads ad->type at offset 128 and
the loop body reads further fields. vol->attrdef is kvza | HIGH | 7.1 | 25 September 2026 | no fixed version published |
| CVE-2026-98163 In the Linux kernel, the following vulnerability has been resolved:
cgroup: Avoid iteration of dying tasks with zero refcount
The commit 260fbcb92bbea ("cgroup: Move dying_tasks cleanup from
cgroup_task_release() to cgroup_task_free()") extended the lifetime of
tasks on the dying_tasks list.
The iterators have provision to go through dying_tasks because of
dying threadgroup leaders or explicit CSS_TASK_ITER_WITH_DEAD, however,
it was expected that such tasks can obtain a new reference (that is | HIGH | 7.0 | 26 September 2026 | no fixed version published |
A further 431 advisories publish no version range, so whether they reach 7.3 cannot be determined from the advisory alone.
Support dates for this release
Linux Kernel 7.3 end of life carries the support window, the countdown to it and the release to move to next.
Vendor sources last checked 22 October 2026, and checked daily. This data last changed on 22 October 2026.
Be told before Linux Kernel 7.3 runs out
One email, ahead of the date, and nothing else. No account, no newsletter, and every message carries a link that stops them for good.
This is one release, on one machine, read by hand
You had to already know which release you were on to look this up. StackDrift scans your machines, works out the build each one is running and mails you when a CVE lands on something you have deployed, across every runtime, operating system and kernel underneath your code.
A card is needed to open the trial and nothing is charged until it ends.