CVE-2026-64504

A flaw was found in the Linux kernel's bmc150 accelerometer driver. A malicious or malfunctioning accelerometer device, or an attacker tampering with the I2C/SPI bus, can report an excessively large number of FIFO frames. This improper handling of the frame count leads to a stack out-of-bounds...

CVE-2026-64510

A flaw was found in the Linux kernel's Advanced Configuration and Power Interface ACPI Non-Volatile Memory NVM Firmware Interface Table NFIT core. Improper error handling during the initialization process can leave a dangling pointer. A local attacker could potentially trigger an ACPI Machine Che...

CVE-2026-64426

A flaw was found in the Linux kernel's iouring/nop component. A local user could exploit this by submitting a specially crafted no-operation NOP request. This could lead to a file reference not being properly released, resulting in a memory leak. Over time, this memory leak could impact system...

CVE-2026-64381

A flaw was found in the SMB client of the Linux kernel. A remote attacker could exploit a memory leak in the receiveencryptedstandard function by sending specially crafted compound Protocol Data Units PDUs. This vulnerability occurs because a buffer is allocated before a necessary size check,...

kernel: net: sched: act_csum: validate nested VLAN headers

A flaw was found in the Linux kernel's network scheduler component. A remote attacker could send specially crafted network packets containing nested Virtual Local Area Network VLAN headers. This could cause the kernel to read beyond allocated memory, leading to a system crash and a denial of...

kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...

kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nfconntrackhelper. When a connection tracking helper is unregistered, its associated expectations are not properly cleaned up. This oversight can lead to a use-after-free vulnerability, where the system attempts t...

kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture USB audio subsystem. An inconsistency in how USB audio playback and capture streams are handled can lead to an out-of-bounds write to a memory buffer. This can result in a system crash, causing a denial of service for a...

kernel: net: sched: act_csum: validate nested VLAN headers

A flaw was found in the Linux kernel's network scheduler component. A remote attacker could send specially crafted network packets containing nested Virtual Local Area Network VLAN headers. This could cause the kernel to read beyond allocated memory, leading to a system crash and a denial of...

kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...

kernel: nvmet-tcp: fix race between ICReq handling and queue teardown

A flaw was found in the Linux kernel's NVMe over TCP nvmet-tcp implementation. A race condition exists between the handling of an Initialization Connection Request ICReq and the teardown of a queue. A remote attacker, by sending an ICReq and immediately closing the connection, could trigger a...

CVE-2026-64527

A flaw was found in the drm/hyperv component of the Linux kernel. The hypervreceivesub function, responsible for processing VMBus packets, does not adequately validate the size of incoming data. This oversight allows a malicious or compromised host to send specially crafted packets, potentially...

CVE-2026-64455

A flaw was found in the Linux kernel's chaoskey driver. A local user could trigger a use-after-free vulnerability by closing the device file after the associated USB device has been unplugged. This could lead to a system crash due to memory corruption when a debugging statement attempts to access...

CVE-2026-64408

A flaw was found in the Bluetooth Network Encapsulation Protocol BNEP module of the Linux kernel. The bnepaddconnection function reads the Logical Link Control and Adaptation Protocol L2CAP connection without properly holding a channel lock. This can allow a local attacker to trigger a...

CVE-2026-64389

A flaw was found in the Linux kernel's ksmbd component. A remote attacker could exploit a vulnerability in the NTLMv2 authentication process to modify a session key even when authentication fails. This bypasses security checks and could potentially lead to unauthorized access or session hijacking...

CVE-2026-64347

A flaw was found in the USB gadget composite driver in the Linux kernel. An issue with an empty check in the USBDTOTG handler can lead to reading from an invalid memory location. This can result in a kernel AddressSanitizer KASAN fault, potentially causing information disclosure or a denial of...

CVE-2026-64267

A flaw was found in the Linux kernel's Filesystem in Userspace FUSE component. On 32-bit systems, an integer overflow vulnerability exists in the handling of FUSENOTIFYPRUNE messages. A malicious FUSE daemon or a local user could craft a prune notification with a specific count, causing an intege...

CVE-2026-64528

A flaw was found in the Linux kernel's Samsung serial driver. When console flow control is enabled, a redundant attempt to acquire a port lock occurs within the receive helper functions. This can lead to a deadlock on the same CPU, causing the system to become unresponsive...

CVE-2026-64470

A flaw was found in the Linux kernel's Bluetooth USB btusb driver. This vulnerability occurs during the Marvell Out-Of-Band OOB wakeup configuration when a probe failure happens. An attacker could potentially exploit a use-after-free condition in the completion callback, which may lead to system...

CVE-2026-64501

A flaw was found in the Linux kernel's adsigmadelta driver for analog-to-digital converters ADCs. This vulnerability occurs when the Chip Select CS line, which controls communication with the ADC, remains asserted after a conversion or in an error state. This can prevent other devices on the Seri...