CVE-2026-72327

A flaw was found in the Linux kernel's drm/v3d component. The v3dgetcpuindirectcsdparams function does not properly validate a userspace-supplied indirect buffer object BO handle. An attacker, by providing a bogus or stale handle, can cause a NULL pointer dereference. This can lead to a system...

CVE-2026-72155

A flaw was found in the Linux kernel's mtd: spi-nor: swp component. When a user attempts to unlock specific blocks on a Serial Peripheral Interface SPI NOR flash device, particularly those at the beginning of the device, the operation may fail. This occurs due to an incorrect calculation of the...

CVE-2026-72010

A flaw was found in the Linux kernel's cgroup/cpuset component. A local user can exploit this by configuring a child cpuset without explicitly setting its memory nodes. When a CPU hotplug event occurs, a division-by-zero error is triggered during memory policy rebind, leading to a system crash...

CVE-2026-72009

A flaw was found in the Linux kernel. The MIPI DSI Display Serial Interface and CSI Camera Serial Interface power domains share control bits for clock and reset. This improper resource management allows one domain to disable shared resources while the other is still active, leading to incorrect...

CVE-2026-72007

A flaw was found in the Linux kernel's power management domain pmdomain component, specifically impacting the i.MX8MP VC8000E. A timing issue during the power up and down cycling of the VC8000E/VPUMIX can cause the VPUNOC power down handshake to hang. This can lead to system instability and a...

CVE-2026-72005

A flaw was found in the rt2x00 WiFi driver within the Linux kernel. During the device probing process, if memory or workqueue allocations fail prematurely, the system attempts a full device teardown. This teardown incorrectly assumes that certain work items have been initialized, leading to inval...

CVE-2026-72004

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. This issue occurs when the system attempts to copy Wi-Fi band structures, and an error during this process causes a memory resource to not be properly released. This oversight leads to a memory leak within the kernel, which could...

CVE-2026-74555

A flaw was found in the scsi: libsas component of the Linux kernel. A deadlock can occur during the system resume process, preventing the host from becoming fully operational. Additionally, a race condition can cause the controller to suspend prematurely while disks are still waking up. This can...

CVE-2026-74579

A flaw was found in the Linux kernel's netfilter subsystem. The nftpayloadoffloadmask function, which builds offload match masks for network packet header fields, contains a shift-out-of-bounds error. This occurs when processing partial IPv6 address matches, leading to an incorrect mask calculati...

CVE-2026-72308

A flaw was found in the mlxsw driver of the Linux kernel. This vulnerability occurs when the mlxswspportlagjoin function fails to properly release a network resource reference, leading to a reference count leak. Over time, this leak could exhaust system resources, potentially resulting in a denia...

CVE-2026-74448

A flaw was found in the Linux kernel's drm/amdkfd component. When a process attempts to create its first queue, a failure in memory allocation can cause the pqmcreatequeue function to exit prematurely without releasing a reserved Queue ID QID bit. This leads to a permanent leak of QID slots. Over...

CVE-2026-72068

A flaw was found in the Linux kernel's posix-cpu-timers component on 32-bit systems. An integer truncation vulnerability occurs in the updaterlimitcpu function when converting the RLIMITCPU value to nanoseconds. This issue causes the process CPU timer to be programmed to fire prematurely for...

CVE-2026-72396

A flaw was found in the Linux kernel's hwmon subsystem, specifically in the adm1275 driver. This vulnerability allows a local attacker or a specially crafted device to trigger an out-of-bounds read during device name comparison. By providing a device name shorter than expected, uninitialized stac...

CVE-2026-72403

A flaw was found in the ALSA FireWire Control Protocol FCP component of the Linux kernel. A local attacker with a specially crafted USB device could trigger a NULL pointer dereference. This occurs because the fcpfindfcinterface function attempts to access an endpoint descriptor from a malformed U...

CVE-2026-72245

A flaw was found in the Linux kernel's gpu: host1x subsystem. An error handling path in the host1xdeviceparsedt function, when called from host1xdeviceadd, fails to properly release a device reference. This oversight leads to a device reference leak, which could potentially result in resource...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 Android arm64 Local Privilege Escalation Adapta...

ghostlock-cve-2026-43499

CVE-2026-43499 GhostLock — ARM32 커널 권한 상승 연구 Linux 커널 futex PI rtmutex Use-After-Free 취약점 연구 및 Huawei Watch 4 Pro MDS-AL00 , Snapdragon SW5100, armv7l, 커널 5.4.210을 대상으로 한 익스플로잇 개발. 취약점 kernel/locking/rtmutex.c의 removewaiter는 프록시 잠금 롤백 과정에서 waiter-task 대신 current를 잘못 사용하여 웨이터 태스크의 piblockedon을 지우지...

kernel: dm log: fix out-of-bounds write due to region_count overflow

A flaw was found in the Linux kernel's device-mapper log dm log component. A local attacker could exploit an integer overflow vulnerability where a 64-bit value is truncated to 32 bits, leading to undersized memory allocations. This allows for out-of-bounds writes to kernel memory during log...

kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

A flaw was found in the Linux kernel's Asynchronous Transfer Mode ATM networking component. A local attacker, by acting as a malicious signaling daemon, could send a specially crafted message containing an unvalidated pointer. This unvalidated pointer would be directly used by the kernel, leading...

kernel: crypto: ccp - copy IV using skcipher ivsize

A flaw was found in the Linux kernel's cryptographic coprocessor CCP driver. When processing AFALG rfc3686-ctr-aes-ccp requests, the ccpaescomplete function attempts to restore more data than the allocated buffer for the Initialization Vector IV can hold. This leads to a buffer overrun, which can...