kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr

A flaw was found in the Linux kernel's NFSv4/pNFS implementation. The nfs4decodempdsaddr function, responsible for decoding network address information, does not properly handle zero-length raddr opaque data. A malicious or compromised metadata server can exploit this by providing a zero-length...

kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

A flaw was found in the Linux kernel's crypto QAT QuickAssist Technology module. A race condition exists during the teardown of Virtual Function to Physical Function VF2PF work in the adfdisablesriov function. This allows a concurrently scheduled or already queued worker to attempt to access memo...

kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation

A flaw was found in the Linux kernel's userfaultfd mechanism. A local attacker with userfaultfd access could register on shadow stack Virtual Memory Areas VMAs. By discarding a page and injecting a page with chosen return addresses, an attacker could achieve arbitrary code execution. This...

kernel: nvmet-auth: reject short AUTH_RECEIVE buffers

A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...

kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()

A flaw was found in the Linux kernel. The rtspinunlock function, and similar real-time RT locking mechanisms, incorrectly release Read-Copy-Update RCU protection before fully unlocking, leading to a Use-After-Free UAF vulnerability. This issue could allow a local attacker to potentially cause a...

CVE-2026-80704

A flaw was found in the Linux kernel's drm/amd/display component. This vulnerability arises from the improper use of an uninitialized logging context, which can lead to a NULL pointer dereference. A local attacker could potentially trigger this flaw, causing the system to crash and resulting in a...

CVE-2026-80698

A flaw was found in the dmaengine: idxd component of the Linux kernel. This vulnerability is caused by a double free error where memory allocated for work queue wq, engine, and group structures is freed twice. This occurs because kfree is explicitly called in error handling and cleanup routines, ...

CVE-2026-80708

A flaw was found in the Linux kernel's s390/zcrypt module. During the clear key to secure key token import process, an internal buffer used by the ipcprbhelper function was not properly scrubbed after use. This oversight could leave sensitive clear key material in memory. A local attacker could...

CVE-2026-80716

A flaw was found in the Linux kernel. Specifically, in the Advanced Linux Sound Architecture ALSA Pulse-Code Modulation PCM subsystem, a use-after-free vulnerability exists. This occurs when a linked stream is unlinked, and a wait entry is not properly removed from the drained peer's sleep list. ...

CVE-2026-80715

A flaw was found in the Linux kernel's igc network driver. When an application using AFXDP, a high-performance network data path, is abruptly terminated, a synchronization issue can occur. This prevents the network interface from properly shutting down. A local attacker could exploit this to caus...

CVE-2026-80709

A flaw was found in the Linux kernel's s390/zcrypt component. An incorrect upper limit check for the domain value when processing an EP11 Cryptographic Coprocessor Request Block CPRB can allow a local user on custom device nodes to access heap memory. This could lead to information disclosure or...

CVE-2026-80686

A flaw was found in the Linux kernel's memory management component. Specifically, the migratedevice functionality may attempt to access memory page table entries PTEs that are not present. This incorrect handling can lead to system instability, potentially causing a system crash Denial of Service...

CVE-2026-80657

A flaw was found in the Linux kernel's accel/amdxdna component. The management mailbox channel cleanup helpers, xdnamailboxfreechannel and xdnamailboxstopchannel, could be called from error handling paths when the mgmtchann was already destroyed. This could lead to a NULL pointer dereference,...

CVE-2026-80638

A flaw was found in the ocfs2 component of the Linux kernel. When a user unlinks a refcounted file whose refcount tree has leaf blocks, an out-of-bounds write occurs within the ocfs2removerefcountextent function. This happens because a memset operation writes past the intended memory boundary due...

Exploit for Use After Free in Linux Linux_Kernel

Weaponisation research for CVE-2026-43499 ghostlock. the...

CVE-2026-80688

A flaw was found in the Linux kernel, specifically within the RISC-V architecture's veccheckunalignedaccessspeedallcpus function. This function, intended for initialization, could continue running as a kernel thread after its allocated memory is released. If this occurs, the system attempts to...

CVE-2026-80659

A flaw was found in the Linux kernel's vub300 driver. When the vub300cmndworkthread function holds a command mutex and a command response times out, the device reset path attempts to re-acquire the same mutex recursively. This recursive locking can lead to a deadlock, causing a Denial of Service...

CVE-2026-80703

A flaw was found in the Linux kernel's drm/amdkfd component. A local user with access to /dev/kfd could exploit a missing authorization check to terminate another process's active Graphics Processing Unit GPU debug session. This could lead to a denial of service for other users attempting to debu...

CVE-2026-80637

A flaw was found in the Linux kernel's netfilter synproxy component. This vulnerability is due to unaligned memory access when adjusting timestamp fields. An attacker could potentially trigger this flaw by sending specially crafted network traffic, leading to performance degradation or a system...

CVE-2026-80626

A flaw was found in the Linux kernel's powerpc/perf component. An issue in the fslembpmudel function can lead to a preempt count underflow. This occurs when the function attempts to decrement a preemption counter without a corresponding increment, specifically when event-hw.idx is negative. On...