CVE-2026-23206 dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: prevent ZEROSIZEPTR dereference when numifs is zero The driver allocates arrays for ports, FDBs, and filter blocks using kcalloc with ethsw-swattr.numifs as the element count. When the device reports zero interfaces...

CVE-2026-23174 nvme-pci: handle changing device dma map requirements

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: handle changing device dma map requirements The initial state of dmaneedsunmap may be false, but change to true while mapping the data iterator. Enabling swiotlb is one such case that can change the result. The nvme...

EUVD-2026-5885

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: correctly decode TTLM with default link map TID-To-Link Mapping TTLM elements do not contain any link mapping presence indicator if a default mapping is used and parsing needs to be skipped. Note that access point...

kernel: RDMA/rxe: Fix incomplete state save in rxe_requester

An incorrect state restoration flaw was found in the Linux kernel's RDMA rxe soft-RoCE driver in the requester packet transmission logic. A local user with access to RDMA devices can trigger this issue when network layer packet drops occur during RDMA send operations, causing the work queue eleme...

kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping

A flaw was found in the Linux kernel’s ASoC Intel bytcrrt5640 driver. When an invalid value is passed via the driver’s “quirk” input option, the driver merely logs an error and retains the invalid value, rather than correcting it. This can result in out-of-bounds OOB memory access...

The vulnerabilities of the functions qla2x00_async_login_sp_done(), qla2x00_adisc_sp_done(), and qla2x00_prli_sp_done() in the driver module drivers/scsi/qla2xxx/qla_init.c, which is part of the Linux operating system’s SCSI device support driver. These vulnerabilities allow a hacker to cause a service failure.

The vulnerabilities of the functions qla2x00asyncloginspdone, qla2x00adiscspdone, and qla2x00prlispdone in the driver module drivers/scsi/qla2xxx/qlainit.c are related to code errors. Exploiting these vulnerabilities can allow an attacker to cause a service failure...

The vulnerability of the __fbnic_open() function in the drivers/net/ethernet/meta/fbnic/fbnic_netdev.c file of the Linux kernel’s network adapter driver allows a hacker to cause a service failure.

The vulnerability of the fbnicopen function in the drivers/net/ethernet/meta/fbnic/fbnicnetdev.c file of the Linux kernel’s network adapter driver module is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the dmabufexp_from_pages() function in the drivers/xen/gntdev-dmabuf.c driver code of the Linux kernel’s page buffer device driver allows a attacker to cause a service failure.

The vulnerability of the dmabufexpfrompages function in the drivers/xen/gntdev-dmabuf.c driver for Linux kernel-based device buffer devices is related to the reutilization of previously released memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the pci_device_is_present() function in the drivers/pci/pci.c module of the Linux operating system’s PCI device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the pcideviceispresent function in the drivers/pci/pci.c module of the Linux operating system’s PCI device driver lies in improper disabling or release of resources. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the x86_android_tabletremove() function in the drivers/platform/x86/x86-android-tablets/core.c driver, which is part of the Linux kernel support for X86 devices. This vulnerability allows a attacker to cause a service failure.

The vulnerability of the x86androidtabletremove function in the drivers/platform/x86/x86-android-tablets/core.c driver for supporting Linux kernel devices is related to errors during link counter updates. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the radeon_atombios_fini() function in the drivers/gpu/drm/radeon/radeon_device.c driver of the Direct Rendering Infrastructure (DRI) graphics card for Linux kernel cores allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the radeonatombiosfini function in the drivers/gpu/drm/radeon/radeondevice.c file of the DRI graphics card driver for Linux operating systems is related to the distribution of resources without any restrictions or regulation. Exploiting this vulnerability could allow an...

The vulnerability of the tpm2_init_space() function in the drivers/char/tpm/tpm2-space.c file of the Linux kernel driver for supporting alphanumeric devices with TPM cores allows a hacker to induce a service failure.

The vulnerability of the tpm2initspace function in the drivers/char/tpm/tpm2-space.c file of the Linux driver for alphanumeric devices with TPM cores is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability in the ` adreno_gpu_init()` function of the `drivers/gpu/drm/msm/adreno/adreno_gpu.c` file, a driver for the Direct Rendering Infrastructure (DRI) of the Linux operating system’s kernel, allows a malicious actor to cause a service failure.

The vulnerability of the adrenogpuinit function in the drivers/gpu/drm/msm/adreno/adrenogpu.c file of the Direct Rendering Infrastructure DRI driver for the Linux operating system is related to the assignment of a NULL pointer. Exploiting this vulnerability can allow an attacker to cause a servic...

The vulnerability of the isert_wait_conn() function in the drivers/infiniband/ulp/isert/ib_isert.c module of the RTRS server and client kernel driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the isertwaitconn function in the drivers/infiniband/ulp/isert/ibisert.c module of the RTRS server and client kernel driver for the Linux operating system is related to state management errors. Exploiting this vulnerability could allow a remote attacker to compromise the...

📄 NPU Driver Use-After-Free Detector

This Metasploit module detects vulnerable NPU drivers susceptible to CVE-2025-21424, a use-after-free vulnerability in the MSM NPU kernel driver. Additional details are included that identify shortcomings in the original proof of concept...

The vulnerability of the binder_inc_ref_for_node() function in the drivers/android/binder.c module of the Linux kernel’s Android communication driver allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the binderincrefornode function in the drivers/android/binder.c module of the Linux kernel’s communication driver with the Android kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability in the function interrupt_preinit_v3_hw() of the drivers/scsi/hisi_sas/hisi_sas_v3_hw.c file in the Linux operating system’s SCSI HiSilicon SAS device support driver allows a attacker to cause a service failure.

The vulnerability of the interruptpreinitv3hw function in the drivers/scsi/hisisas/hisisasv3hw.c file of the SCSI HiSilicon SAS device support driver in the Linux operating system involves disclosing confidential information. Exploiting this vulnerability could allow an attacker to cause a servic...

CVE-2026-23056 uacce: implement mremap in uacce_vm_ops to return -EPERM

In the Linux kernel, the following vulnerability has been resolved: uacce: implement mremap in uaccevmops to return -EPERM The current uaccevmops does not support the mremap operation of vmoperationsstruct. Implement .mremap to return -EPERM to remind users. The reason we need to explicitly disab...

The vulnerability of the amd_pmc_stbdebugfs_open_v2() function in the drivers/platform/x86/amd/pmc.c file of the Linux kernel device driver module allows a hacker to cause a service failure.

The vulnerability of the amdpmcstbdebugfsopenv2 function in the drivers/platform/x86/amd/pmc.c file of the Linux kernel device driver module is related to improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of the spmmc_drv_probe() function in the drivers/mmc/host/sunplus-mmc.c module of the MMC/SD/SDIO card driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the spmmcdrvprobe function in the drivers/mmc/host/sunplus-mmc.c module of the MMC/SD/SDIO card driver for the Linux operating system is related to the lack of checking for the return value. Exploiting this vulnerability could allow a remote attacker to compromise the...