CVE-2026-53039

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate group add input before caching BUG OCFS2IOCGROUPADD can trigger a BUGON in ocfs2setnewbufferuptodate: kernel BUG at fs/ocfs2/uptodate.c:509! Oops: invalid opcode: 0000 1 SMP KASAN NOPTI RIP:...

CVE-2026-52973

In the Linux kernel, the following vulnerability has been resolved: futex: Drop CLONETHREAD requirement for private default hash alloc Currently needfutexhashallocatedefault depends on strict pthread semantics, abusing CLONETHREAD. This breaks the non-concurrency assumptions when doing the...

CVE-2026-53044

In the Linux kernel, the following vulnerability has been resolved: soc/tegra: cbb: Fix incorrect ARRAYSIZE in fabric lookup tables Fix incorrect ARRAYSIZE usage in fabric lookup tables which could cause out-of-bounds access during target timeout lookup...

CVE-2026-54906

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLockreleasewritelock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can...

CVE-2026-53108 powerpc/64s: Fix unmap race with PMD migration entries

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix unmap race with PMD migration entries The following race is possible with migration swap entries or device-private THP entries. e.g. when movepages is called on a PMD THP page, then there maybe an intermediate...

CVE-2026-53078

The CVE-2026-53078 issue is a Linux kernel BPF sock_ops vulnerability. When a BPF sock_ops program accesses ctx fields with the same destination and source registers (dst_reg == src_reg), SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() failed to zero the destination register in the !fullsock/!locked_t...

CVE-2026-53071 Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2capecredreconfrsp l2capecredreconfrsp calls l2capchandel without holding l2capchanlock. Every other l2capchandel caller in the file acquires the lock first. A remote BLE device can sen...

CVE-2026-53071

CVE-2026-53071 concerns the Linux kernel Bluetooth L2CAP implementation. The flaw arises when l2cap_ecred_reconf_rsp() deletes a channel without holding l2cap_chan_lock(), unlike other callers which acquire the lock first. This can allow a remote BLE device to corrupt the channel list while anoth...

CVE-2026-53044 soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables

In the Linux kernel, the following vulnerability has been resolved: soc/tegra: cbb: Fix incorrect ARRAYSIZE in fabric lookup tables Fix incorrect ARRAYSIZE usage in fabric lookup tables which could cause out-of-bounds access during target timeout lookup...

CVE-2026-53038

CVE-2026-53038 affects the Linux kernel IMA subsystem. When handling unsupported TPM hash algorithms, ima_fs can access hash_algo_name[] with an invalid crypto_id (set to HASH_ALGO__LAST), causing a read-out-of-bounds in create_securityfs_measurement_lists. The issue is associated with TPM_ALG_SH...

CVE-2026-53029 fs/ntfs3: prevent uninitialized lcn caused by zero len

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent uninitialized lcn caused by zero len syzbot reported a uninit-value in ntfsiomapbegin 1. Since runs was not touched yet, runlookupentry immediately fails and returns false, which makes the value of "len" 0...

CVE-2026-53027 fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix missing run load for vcn0 in attrdatagetblocklocked When a compressed or sparse attribute has its clusters frame-aligned, vcn is rounded down to the frame start using cmask, which can result in vcn != vcn0. In this...

CVE-2026-53027

CVE-2026-53027 affects the Linux kernel's fs/ntfs3 component. A missing load of the vcn0 runs when a compressed/sparse attribute is frame-aligned can leave vcn0 in a different attribute segment than vcn, causing run_lookup_entry() to return SPARSE_LCN and triggering WARN_ON(1). The documented fix...

CVE-2026-53026 NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg

In the Linux kernel, the following vulnerability has been resolved: NFSD: fix nfs4file access extra count in nfsd4addrdaccesstowrdeleg In nfsd4addrdaccesstowrdeleg, if fp-fifdsORDONLY is already set by another thread, nfs4filegetaccess should not be called to increment the nfs4file access count...

CVE-2026-53026 NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg

In the Linux kernel, the following vulnerability has been resolved: NFSD: fix nfs4file access extra count in nfsd4addrdaccesstowrdeleg In nfsd4addrdaccesstowrdeleg, if fp-fifdsORDONLY is already set by another thread, nfs4filegetaccess should not be called to increment the nfs4file access count...

CVE-2026-53026

This CVE concerns Linux kernel NFSD: in nfsd4_add_rdaccess_to_wrdeleg, an extra nfs4_file access count may be incremented by multiple threads, preventing the corresponding nfsd_file from being freed and triggering a BUG during kmem_cache_destroy() when stopping the nfs-server. Descriptions across...

CVE-2026-53018

CVE-2026-53018 affects the Linux kernel f2fs filesystem. The issue occurs during garbage collection when a page has been moved and updated, but the system re-reads it from an outdated location, triggering a kernel BUG in mm/filemap.c and potentially a DoS. The vulnerability is addressed by a comm...

CVE-2026-53013 macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF

In the Linux kernel, the following vulnerability has been resolved: macvlan: fix macvlangetsize not reserving space for IFLAMACVLANBCCUTOFF macvlangetsize does not account for IFLAMACVLANBCCUTOFF, but macvlanfillinfo conditionally includes it when port-bccutoff != 1. This causes nlaputs32 to fail...

CVE-2026-53012

CVE-2026-53012 affects the Linux kernel: when an IPv6 nexthop is replaced with an IPv4 nexthop, the has_v4 flag in groups containing that nexthop is not updated. The reverse direction (AF_INET6 to AF_INET) is missed, enabling a stale has_v4=false to bypass fib6_check_nexthop and may cause a NULL ...

CVE-2026-52995 net/rds: zero per-item info buffer before handing it to visitors

In the Linux kernel, the following vulnerability has been resolved: net/rds: zero per-item info buffer before handing it to visitors rdsforeachconninfo and rdswalkconnpathinfo both hand a caller-allocated on-stack u64 buffer to a per-connection visitor and then copy the full itemlen bytes back to...