CVE-2026-99236

A flaw was found in the Linux kernel. A local user can trigger out-of-bounds memory access to achieve privilege escalation or arbitrary code execution by submitting an incomplete event filter expression containing trailing logical operators. Alternatively, exploiting this flaw can expose sensitiv...

OESA-2026-4718 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: can: esdusb: kill anchored URBs before freeing netdevs esdusbdisconnect frees each CAN netdev with freecandev inside its per-netdev loop and only calls...

CVE-2026-99228

A flaw was found in the Linux kernel's iouring subsystem. When an application thread exits while running asynchronous operations via internal worker queues, the signal intended to interrupt and terminate worker tasks can be lost. A local user could exploit this vulnerability by submitting...

CVE-2026-99234

A flaw was found in the Linux kernel's tracing subsystem. When configuring event triggers, a failure during command parsing does not unregister the trigger before releasing its internal tracking memory. A local user with access to the kernel tracing interface could exploit this flaw by submitting...

CVE-2026-99232

A flaw was found in the Linux kernel. A local attacker can trigger this issue by invoking faultable system calls with non-user memory addresses while tracing is active. Because the kernel fails to verify that the source address resides in user space before copying data into trace buffers, this fl...

CVE-2026-99230

A flaw was found in the Linux kernel's iouring subsystem. When cancelable commands are removed, recycled request objects can retain stale list pointers instead of being cleanly reinitialized. A local attacker can trigger this issue by submitting specific asynchronous I/O requests, causing the...

CVE-2026-99229

A flaw was found in the Linux kernel's iouring subsystem. A local attacker can cause a Denial of Service DoS by triggering an infinite loop when waiting for completion queue events. If entries on the overflow list cannot be flushed into the completion queue, the waiting kernel task continuously...

kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources()

A flaw was found in the Linux kernel's RDMA/rxe component. A local user could exploit a memory corruption vulnerability in the freerdatomicresources function by updating the maxdestrdatomic value before the old array is properly freed, leading to an out-of-bounds write. This issue can cause a...

kernel: sctp: clear new_transport when removing a peer

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. An authenticated remote SCTP peer can trigger a use-after-free vulnerability by adding and then immediately removing a transport within the same ASCONF chunk. This can lead to a system crash, resultin...

kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem, specifically within the rxe component. A local, unprivileged user could exploit a race condition during a queue pair modification operation. This could lead to a use-after-free vulnerability, allowing the attacker ...

kernel: openvswitch: Fix CT limit teardown use-after-free

A flaw was found in the Linux kernel's Open vSwitch OVS component. An unprivileged user, operating from a user and network namespace, can trigger a use-after-free vulnerability during network namespace teardown. This occurs because packet processing attempts to use connection tracking CT limit...

CVE-2026-99223

A flaw was found in the Linux kernel. A local unprivileged attacker can exploit this flaw to cause an information disclosure by inserting keys with known descriptions into a keyring and observing the order in which they are retrieved. Because internal keyring indexing relies on memory addresses,...

CVE-2026-99226

A flaw was found in the Linux kernel's keyrings subsystem. A race condition between concurrent named keyring lookups and key ownership changes allows a local user to cause a use-after-free read. When a key's ownership is transferred while a lookup is in progress, the previous user structure can b...

CVE-2026-99225

A flaw was found in the Linux kernel. A local attacker could exploit this vulnerability to cause a Denial of Service DoS by crashing the system. This flaw occurs due to a race condition in the key management subsystem during process keyring searches, where revoking an authorization key concurrent...

CVE-2026-99224

A flaw was found in the Linux kernel's key management subsystem. A local user can cause a Denial of Service DoS or potentially achieve arbitrary code execution by exploiting a race condition when retrieving key information while the corresponding kernel module is being unloaded. This issue occurs...

CVE-2026-99222

A flaw was found in the Linux kernel's key management subsystem. A local user can cause a Denial of Service DoS by triggering a use-after-free condition during key read operations. This issue occurs because the key validation check accesses key type data without holding the proper lock, allowing...

CVE-2026-99221

A flaw was found in the Linux kernel's trusted keys subsystem. During the process of unsealing a key using a Trusted Platform Module TPM, the kernel fails to abort if the unseal operation fails, allowing a subsequent locking operation to overwrite the failure status with a success code. A local...

CVE-2026-99220

A flaw was found in the Linux kernel. A local, unprivileged attacker could exploit this vulnerability to cause a Denial of Service DoS by crashing the system. The issue occurs within the asymmetric key management subsystem when applying restrictions using a key that lacks identifiers, such as a...

CVE-2026-99219

A flaw was found in the Linux kernel's ftrace function tracing subsystem. This vulnerability allows a local user to cause a Denial of Service DoS by crashing the system. The issue occurs when reading tracing filter information while a kernel module is simultaneously loaded or unloaded, causing th...

CVE-2026-99218

A flaw was found in the Linux kernel's core dump subsystem. A local user can trigger a race condition during process core dump creation when releasing parked threads without proper synchronization. This issue allows the kernel to access memory after it has been freed, which could enable an attack...