CVE-2026-53007

CVE-2026-53007 affects the Linux kernel ice driver. The vulnerability arises when ice_set_ringparam() clears tstamp_ring of temporary tx_rings without clearing ICE_TX_RING_FLAGS_TXTIME. If ICE_TX_RING_FLAGS_TXTIME is set and ice_setup_tx_ring() then fails, unwinding can dereference a NULL tstamp_...

CVE-2026-53007

In the Linux kernel, the following vulnerability has been resolved: ice: fix potential NULL pointer deref in error path of icesetringparam icesetringparam nullifies tstampring of temporary txrings, without clearing ICETXRINGFLAGSTXTIME bit. When ICETXRINGFLAGSTXTIME is set and the subsequent...

CVE-2026-53007 ice: fix potential NULL pointer deref in error path of ice_set_ringparam()

In the Linux kernel, the following vulnerability has been resolved: ice: fix potential NULL pointer deref in error path of icesetringparam icesetringparam nullifies tstampring of temporary txrings, without clearing ICETXRINGFLAGSTXTIME bit. When ICETXRINGFLAGSTXTIME is set and the subsequent...

CVE-2026-52998

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkosf: fix potential NULL dereference in ttl check The nfosfttl function accessed skb-dev to perform a local interface address lookup without verifying that the device pointer was valid. Additionally, the...

CVE-2026-52998 netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkosf: fix potential NULL dereference in ttl check The nfosfttl function accessed skb-dev to perform a local interface address lookup without verifying that the device pointer was valid. Additionally, the...

CVE-2026-52998

CVE-2026-52998 affects the Linux kernel’s netfilter nfnetlink_osf module. The nf_osf_ttl() function can dereference a device pointer (skb->dev) without validating the device, risking a NULL dereference. The patch removes the device dereference and the in_dev_for_each_ifa_rcu loop used to match...

CVE-2026-52998 netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkosf: fix potential NULL dereference in ttl check The nfosfttl function accessed skb-dev to perform a local interface address lookup without verifying that the device pointer was valid. Additionally, the...

CVE-2026-52997

The CVE-2026-52997 issue affects the Linux kernel’s net/sched sch_dualpi2 qdisc. The root cause was that dualpi2_change() could attempt to dequeue from the C-queue even when it was empty while packets resided in the L-queue, leading to a NULL skb dereference during limit/memlimit enforcement. The...

CVE-2026-52997

In the Linux kernel, the following vulnerability has been resolved: net/sched: schdualpi2: drain both C-queue and L-queue in dualpi2change Fix dualpi2change to correctly enforce updated limit and memlimit values after a configuration change of the dualpi2 qdisc. Before this patch, dualpi2change...

CVE-2026-52957 libceph: Fix potential null-ptr-deref in decode_choose_args()

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr-deref in decodechooseargs A message of type CEPHMSGOSDMAP contains an OSD map that itself contains a CRUSH map. When decoding this CRUSH map in crushdecode, an array of maxbuckets CRUSH buckets is...

CVE-2026-52957

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr-deref in decodechooseargs A message of type CEPHMSGOSDMAP contains an OSD map that itself contains a CRUSH map. When decoding this CRUSH map in crushdecode, an array of maxbuckets CRUSH buckets is...

CVE-2026-52957

Consolidated details from CVE-2026-52957 show a Linux kernel libceph flaw in processing CEPH_MSG_OSD_MAP: during CRUSH map decoding, bucket indices may reference NULL buckets when decoding crush_choose_arg_map, risking a NULL pointer dereference. A patch extends the validation to only access non-...

CVE-2026-52957 libceph: Fix potential null-ptr-deref in decode_choose_args()

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr-deref in decodechooseargs A message of type CEPHMSGOSDMAP contains an OSD map that itself contains a CRUSH map. When decoding this CRUSH map in crushdecode, an array of maxbuckets CRUSH buckets is...

CVE-2026-52941

A flaw was found in the Linux kernel's net/smc module. An unprivileged local user could trigger a null pointer dereference by performing sendmsg or recvmsg operations on an SMC-D Shared Memory Communications - Direct socket while the smcmsgevent tracepoint is enabled. This can lead to a general...

CVE-2026-52938

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF storage. A race condition can occur where a storage element is accessed after its associated map has been deallocated, leading to a null pointer dereference. This can cause a kernel crash, resulting in a Denial of Service DoS for t...

CVE-2026-52922

A flaw was found in the Linux kernel's batman-adv Better Approach To Mobile Ad-hoc Networking module. This vulnerability occurs because the batadvdatforwarddata function fails to validate the success of a memory allocation operation. An attacker could exploit this by triggering a scenario where t...

CVE-2026-52939

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS component. An unprivileged local user can trigger a kernel panic by sending a specially crafted atomic control message cmsg over an active RDS/InfiniBand IB connection. This issue is caused by improper handling of masked atomic...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: sched/rt: Fixed a race condition in the pushrttask function. Overview ======== When a CPU decides to call the pushrttask function and selects a task to be pushed onto another CPU’s runqueue, it will invoke the findlocklowestrq...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qusb2: Fixed NULL pointer dereferencing during early suspends. Enabling runtime PM before attaching the QPHY instance as driver data can lead to a NULL pointer dereferencing in runtime PM callbacks that expect valid...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: blk-cgroup: The reinit operation for blkgiostatset is performed after clearing data in blkcgresetstats. When the blkgalloc function is called to allocate a blkcggq structure along with its associated blkgiostatset, there are t...