CVE-2026-43282

CVE-2026-43282 affects the Linux kernel, specifically the RDMA ionic driver. The issue is in ionic_query_port(), which calls ib_device_get_netdev() without validating the return value, risking a NULL pointer dereference. The documented fix is to check the returned netdev and return -ENODEV if it ...

CVE-2026-43281

CVE-2026-43281 affects the Linux kernel mailbox subsystem. The flaw is an out-of-bounds access in fw_mbox_index_xlate() that can occur when #mbox-cells is

CVE-2026-43274 mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()

In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchpipcgetclusteraggrirq The clustercfg array is dynamically allocated to hold per-CPU configuration structures, with its size based on the number of online CPUs. Previously, thi...

CVE-2026-43272 ring-buffer: Fix possible dereference of uninitialized pointer

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix possible dereference of uninitialized pointer There is a pointer headpage in rbmetavalidateevents which is not initialized at the beginning of a function. This pointer can be dereferenced if there is a failure...

CVE-2026-43262

CVE-2026-43262 stems from a Linux kernel gfs2 fiemap page fault: gfs2_fiemap() calls iomap_fiemap() while holding the inode glock, risking recursive glock taking if the fiemap buffer maps to the same inode. The fix disables page faults for iomap_fiemap() and faults in the buffer by hand when need...

CVE-2026-43255

The CVE-2026-43255 entry concerns the Linux kernel component for wireless Libertus (wifi: libertas). The vulnerability arises when usb_tx_block() submits cardp->tx_urb without guaranteeing the previous URB has completed; a second call during active URB state can trigger a warning (“URB submitt...

CVE-2026-43238

In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbedit: fix divide-by-zero in tcfskbedithash Commit 38a6f0865796 "net: sched: support hash selecting tx queue" added SKBEDITFTXQSKBHASH support. The inclusive range size is computed as: mappingmod = queuemappingmax...

CVE-2026-43224

The CVE-2026-43224 entry concerns the Linux kernel io_uring/zcrx subsystem. A memory leak could occur when mapping fails in io_populate_area_dma() on PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA, as io_zcrx_map_area() would allocate a sgtable that isn’t freed due to the error path not freeing it when !is_...

CVE-2026-43223

CVE-2026-43223 concerns the Linux kernel media driver pvrusb2. The issue arises when pvr2_send_request_ex() submits a write URB and, if the subsequent read URB submission fails (e.g., due to -ENOMEM), returns early without waiting for the write to complete. Because the same URB structure is reuse...

CVE-2026-43212

The CVE-2026-43212 entries involve the Linux kernel on LoongArch where cpumask_of_node() failed to handle NUMA_NO_NODE, which is a valid index. The root cause is an insufficient check in the arch-specific cpumask_of_node() implementation, leading to potential instability or incorrect behavior if ...

CVE-2026-43193 nfsd: fix nfs4_file refcount leak in nfsd_get_dir_deleg()

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4file refcount leak in nfsdgetdirdeleg Claude pointed out that there is a nfs4file refcount leak in nfsdgetdirdeleg. Ensure that the reference to "fp" is released before returning...

CVE-2026-43193

The CVE-2026-43193 entry concerns the Linux kernel NFS daemon (nfsd). Affected component: kernel NFS implementation, specifically nfsd_get_dir_deleg(). Root cause: a refcount leak in nfs4_file where the reference to the object fp was not released before returning. Impact stated in sources is a re...

CVE-2026-43162

In the Linux kernel, the media: tegra-video path has a memory leak in __tegra_channel_try_format() caused by failing to free the allocated __v4l2_subdev_state (sd_state) in two error paths after v4l2_subdev_call() failures. The fix introduces a cleanup label and goto-based error handling to ensur...

CVE-2026-43162 media: tegra-video: Fix memory leak in __tegra_channel_try_format()

In the Linux kernel, the following vulnerability has been resolved: media: tegra-video: Fix memory leak in tegrachanneltryformat The state object allocated by v4l2subdevstatealloc must be freed with v4l2subdevstatefree when it is no longer needed. In tegrachanneltryformat, two error paths return...

CVE-2026-43145 remoteproc: imx_rproc: Fix invalid loaded resource table detection

In the Linux kernel, the following vulnerability has been resolved: remoteproc: imxrproc: Fix invalid loaded resource table detection imxrprocelffindloadedrsctable may incorrectly report a loaded resource table even when the current firmware does not provide one. When the device tree contains a...

CVE-2026-43137 ASoC: SOF: Intel: hda: Fix NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix NULL pointer dereference If there's a mismatch between the DAI links in the machine driver and the topology, it is possible that the playback/capture widget is not set, especially in the case of loopbac...

CVE-2026-43124 pstore: ram_core: fix incorrect success return when vmap() fails

In the Linux kernel, the following vulnerability has been resolved: pstore: ramcore: fix incorrect success return when vmap fails In persistentramvmap, vmap may return NULL on failure. If offset is non-zero, adding offsetinpagestart causes the function to return a non-NULL pointer even though the...

CVE-2026-43124 pstore: ram_core: fix incorrect success return when vmap() fails

In the Linux kernel, the following vulnerability has been resolved: pstore: ramcore: fix incorrect success return when vmap fails In persistentramvmap, vmap may return NULL on failure. If offset is non-zero, adding offsetinpagestart causes the function to return a non-NULL pointer even though the...

CVE-2026-43122

...

kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsitdecsessionusagecount In iscsitdecsessionusagecount, the function calls complete while holding the sess-sessionusagelock. Similar to the connection usage count logic, the waiter...