kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memor...

kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

A flaw was found in the Linux kernel's synaptics-rmi4 input driver. The rmif3amapgpios function incorrectly allocates memory for the gpiokeymap, making it smaller than required. This allows a device reporting a specific gpiocount value to trigger an out-of-bounds read, leading to information...

K000163099: Linux kernel vulnerability CVE-2026-53253

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: reject short frames before parsing A BNEP peer can send a short BNEP SDU. bneprxframe reads the packet type byte immediately and, for control packets, reads the control opcode and...

kernel: dm log: fix out-of-bounds write due to region_count overflow

A flaw was found in the Linux kernel's device-mapper log dm log component. A local attacker could exploit an integer overflow vulnerability where a 64-bit value is truncated to 32 bits, leading to undersized memory allocations. This allows for out-of-bounds writes to kernel memory during log...

kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

A flaw was found in the Linux kernel's Asynchronous Transfer Mode ATM networking component. A local attacker, by acting as a malicious signaling daemon, could send a specially crafted message containing an unvalidated pointer. This unvalidated pointer would be directly used by the kernel, leading...

kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

A flaw was found in the Linux kernel's IPv6 networking implementation, specifically within the seg6 and rpl lwtunnels. A race condition can occur when handling destination cache entries, where a NOREF no reference destination object is used after it has been freed. This use-after-free vulnerabili...

kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

A flaw was found in the Linux kernel's CIFS Common Internet File System client. When the cifssanitizeprepath function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-boun...

kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

A flaw was found in the Linux kernel's CIFS Common Internet File System client. When the cifssanitizeprepath function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-boun...

kernel: dm log: fix out-of-bounds write due to region_count overflow

A flaw was found in the Linux kernel's device-mapper log dm log component. A local attacker could exploit an integer overflow vulnerability where a 64-bit value is truncated to 32 bits, leading to undersized memory allocations. This allows for out-of-bounds writes to kernel memory during log...

kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

A flaw was found in the Linux kernel's Asynchronous Transfer Mode ATM networking component. A local attacker, by acting as a malicious signaling daemon, could send a specially crafted message containing an unvalidated pointer. This unvalidated pointer would be directly used by the kernel, leading...

kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

A flaw was found in the Linux kernel's IPv6 networking implementation, specifically within the seg6 and rpl lwtunnels. A race condition can occur when handling destination cache entries, where a NOREF no reference destination object is used after it has been freed. This use-after-free vulnerabili...

PT-2026-82148

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An infinite loop issue exists in the XFS file system during online fsck operations. The xrep iunlink resolve bucket function, which reconstructs incore prev and next unlinked list pointe...

PT-2026-82202

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A remote peer can send a malformed Data Sequence Signal DSS with an incorrect size, followed by another DSS or Multipath TCP MPTCP Control MPC and Data. This sequence causes the first...

PT-2026-82135

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ovpn component where crypto completion callbacks do not properly manage references to the key-slot and peer. Specifically, the peer reference pins the netdev, and...

PT-2026-82197

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASOC SOF ipc4-pcm component where IPC errors during pipeline state changes were not handled correctly. If the firmware state crashed or an IPC timeout occurred, th...

PT-2026-82193

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A NULL pointer dereference exists in the drm/panthor component. The function panthor fw load section entry fails to handle zero-sized firmware sections correctly by skipping the creation...

PT-2026-82195

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fbdev component where the fb set var function can delete a mode from the info-modelist when userspace provides FB ACTIVATE INV MODE via FBIOPUT VSCREENINFO. While...

PT-2026-82196

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fbdev component where the mode string function uses snprintf, which may return a value exceeding the remaining buffer space. The show modes function accumulates th...

PT-2026-82163

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390/vfio ccw component where the CRW region, which relies exclusively on asynchronous events from hardware, lacks a proper locking mechanism. This necessitates th...

PT-2026-82124

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ipvlan module where devices inherit hard header len from phy dev during ipvlan init but fail to inherit needed headroom and needed tailroom, leaving them set to 0...