CVE-2026-31395

In the Linux kernel, the following vulnerability has been resolved: bnxten: fix OOB access in DBGBUFPRODUCER async event handler The ASYNCEVENTCMPLEVENTIDDBGBUFPRODUCER handler in bnxtasynceventprocess uses a firmware-supplied 'type' field directly as an index into bp-bstrace without bounds...

CVE-2026-31398 mm/rmap: fix incorrect pte restoration for lazyfree folios

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix incorrect pte restoration for lazyfree folios We batch unmap anonymous lazyfree folios by foliounmapptebatch. If the batch has a mix of writable and non-writable bits, we may end up setting the entire batch writable...

CVE-2026-23444

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: always free skb on ieee80211txprepareskb failure ieee80211txprepareskb has three error paths, but only two of them free the skb. The first error path ieee80211txprepare returning TXDROP does not free it, while...

CVE-2026-23432

CVE-2026-23432 : In the Linux kernel mshv component, there is a use-after-free in the error path of mshv_map_user_memory . The problem occurs when, in the error path, the code calls vfree() directly on a region while the MMU notifier remains registered; if userspace later unmaps that memory, the ...

OESA-2026-1831 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: A vulnerability exists in the RDMA/umad component of the Linux kernel when processing user-space data. The ibumadwrite function calculates datalen based on user-controlled count and MAD header sizes. When a mismatched user MAD...

PT-2026-33746

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.3 through 6.12.81 Description A slab cross-cache free issue exists in the Linux kernel when KFENCE is enabled. The skb kfree head function uses skb end offset to distinguish between skb heads allocated from skb small he...

CVE-2026-31395: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bnxten: fix OOB access in DBGBUFPRODUCER async event handler The ASYNCEVENTCMPLEVENTIDDBGBUFPRODUCER handler in bnxtasynceventprocess uses a firmware-supplied 'type' field directly as an index into bp-bstrace without bounds...

CVE-2026-23416 mm/mseal: update VMA end correctly on merge

In the Linux kernel, the following vulnerability has been resolved: mm/mseal: update VMA end correctly on merge Previously we stored the end of the current VMA in currend, and then upon iterating to the next VMA updated currstart to currend to advance to the next VMA. However, this doesn't take...

EUVD-2026-17828

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so after dropping/zapping the existing SPTE if it's shadow-present. While commit a54aa15c6bda3 was right about...

The vulnerability of the unmerge_and_remove_all_rmap_items() function in the mm/ksm.c module of the Linux kernel’s memory management subsystem allows a hacker to trigger a service failure.

The vulnerability of the unmergeandremoveallrmapitems function in the mm/ksm.c module of the Linux kernel’s memory management subsystem is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to trigger a system failure...

PT-2026-36442

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-out-of-bounds read issue exists in the netfilter ctnetlink component. The problem occurs when userspace suggests a helper for a new expectation that differs from the existing mast...

CVE-2026-1679

The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow eswifi-buf, corrupting kernel memory CWE-120. Exploit requires local code that can call the socket send API; no remote attacker can reach it directly...

CVE-2026-1679

The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow eswifi-buf, corrupting kernel memory CWE-120. Exploit requires local code that can call the socket send API; no remote attacker can reach it directly...

CVE-2026-1679: Buffer Copy without Checking Size of Input

The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow eswifi-buf, corrupting kernel memory CWE-120. Exploit requires local code that can call the socket send API; no remote attacker can reach it directly...

CVE-2026-1679

The CVE-2026-1679 issue affects the eswifi socket offload driver, where the driver copies user-provided payloads into a fixed-size buffer without validating available space. This can cause a buffer overflow of eswifi->buf when oversized sends occur, leading to kernel memory corruption (CWE-120...

EUVD-2026-16903

The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow eswifi-buf, corrupting kernel memory CWE-120. Exploit requires local code that can call the socket send API; no remote attacker can reach it directly...

CVE-2026-1679 net: eswifi socket send payload length not bounded

The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow eswifi-buf, corrupting kernel memory CWE-120. Exploit requires local code that can call the socket send API; no remote attacker can reach it directly...

CVE-2026-1679 net: eswifi socket send payload length not bounded

The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow eswifi-buf, corrupting kernel memory CWE-120. Exploit requires local code that can call the socket send API; no remote attacker can reach it directly...

CVE-2026-1679

The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow eswifi-buf, corrupting kernel memory CWE-120. Exploit requires local code that can call the socket send API; no remote attacker can reach it directly...

CVE-2026-1679 net: eswifi socket send payload length not bounded

The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow eswifi-buf, corrupting kernel memory CWE-120. Exploit requires local code that can call the socket send API; no remote attacker can reach it directly...