CVE-2026-31490 drm/xe/pf: Fix use-after-free in migration restore

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Fix use-after-free in migration restore When an error is returned from xesriovpfmigrationrestoreproduce, the data pointer is not set to NULL, which can trigger use-after-free in subsequent .write calls. Set the pointer...

CVE-2026-31490

CVE-2026-31490 affects the Linux kernel drm/xe/pf component. A use-after-free vulnerability occurs when xe_sriov_pf_migration_restore_produce() returns an error and the data pointer is not cleared, potentially enabling memory corruption or a crash. The fix sets the data pointer to NULL on error t...

CVE-2026-31485 spi: spi-fsl-lpspi: fix teardown order issue (UAF)

In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-lpspi: fix teardown order issue UAF There is a teardown order issue in the driver. The SPI controller is registered using devmspiregistercontroller, which delays unregistration of the SPI controller until after the...

CVE-2026-31477

In CVE-2026-31477, the Linux kernel ksmbd component smb2_lock() had three error-handling issues after detaching smb_lock from lock_list: (1) non-UNLOCK path leaks smb_lock and its flock when vfs_lock_file() returns an unexpected error, (2) UNLOCK path leaks on -ENOENT with stale error code, and (...

CVE-2026-31477 ksmbd: fix memory leaks and NULL deref in smb2_lock()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix memory leaks and NULL deref in smb2lock smb2lock has three error handling issues after listdel detaches smblock from locklist at nocheckcl: 1 If vfslockfile returns an unexpected error in the non-UNLOCK path, goto out...

CVE-2026-31477 ksmbd: fix memory leaks and NULL deref in smb2_lock()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix memory leaks and NULL deref in smb2lock smb2lock has three error handling issues after listdel detaches smblock from locklist at nocheckcl: 1 If vfslockfile returns an unexpected error in the non-UNLOCK path, goto out...

CVE-2026-31471 xfrm: iptfs: only publish mode_data after clone setup

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: only publish modedata after clone setup iptfsclonestate stores x-modedata before allocating the reorder window. If that allocation fails, the code frees the cloned state and returns -ENOMEM, leaving x-modedata pointi...

CVE-2026-31471

In CVE-2026-31471, the Linux kernel’s xfrm: iptfs path had a use-after-free-like issue during IPTFS clone state setup. iptfs_clone_state() stored x->mode_data before allocating the reorder window; if allocation failed, the code freed the cloned state but left x->mode_data pointing at freed ...

CVE-2026-31459 mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fix paramctx leak on damonsysfsnewtestctx failure Patch series "mm/damon/sysfs: fix memory leak and NULL dereference issues", v4. DAMONSYSFS can leak memory under allocation failure, and do NULL pointer dereferenc...

CVE-2026-31459

CVE-2026-31459 affects the Linux kernel DAMON_SYSFS path. The vulnerability is a memory leak: when damon_sysfs_new_test_ctx() fails inside damon_sysfs_commit_input(), param_ctx is leaked because the cleanup at the out label is skipped. The patch series “mm/damon/sysfs: fix memory leak and NULL de...

CVE-2026-31459 mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fix paramctx leak on damonsysfsnewtestctx failure Patch series "mm/damon/sysfs: fix memory leak and NULL dereference issues", v4. DAMONSYSFS can leak memory under allocation failure, and do NULL pointer dereferenc...

CVE-2026-31458 mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts-nr before accessing contextsarr0 Multiple sysfs command paths dereference contextsarr0 without first verifying that kdamond-contexts-nr == 1. A user can set nrcontexts to 0 via sysfs while DAMON is...

CVE-2026-31457 mm/damon/sysfs: check contexts->nr in repeat_call_fn

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts-nr in repeatcallfn damonsysfsrepeatcallfn calls damonsysfsupdtunedintervals, damonsysfsupdschemesstats, and damonsysfsupdschemeseffectivequotas without checking contexts-nr. If nrcontexts is set to ...

CVE-2026-31457 mm/damon/sysfs: check contexts->nr in repeat_call_fn

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts-nr in repeatcallfn damonsysfsrepeatcallfn calls damonsysfsupdtunedintervals, damonsysfsupdschemesstats, and damonsysfsupdschemeseffectivequotas without checking contexts-nr. If nrcontexts is set to ...

CVE-2026-31457

The CVE-2026-31457 entry describes a Linux kernel vulnerability in DAMON (mm/damon/sysfs) where damon_sysfs_repeat_call_fn() dereferences contexts_arr[0] when nr_contexts is set to 0 via sysfs, due to a missing check on contexts->nr. This can occur while DAMON is running and cause a NULL point...

CVE-2026-31458 mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts-nr before accessing contextsarr0 Multiple sysfs command paths dereference contextsarr0 without first verifying that kdamond-contexts-nr == 1. A user can set nrcontexts to 0 via sysfs while DAMON is...

CVE-2026-31458

Technical details (affected product, vulnerable component, and remediation) are not provided in the connected documents. Monitor for updates.

CVE-2026-31444

CVE-2026-31444 affects ksmbd in the Linux kernel. The vulnerability arises from two flaws in the oplock publication sequence inside smb_grant_oplock(): (1) opinfo is linked into ci->m_op_list before add_lease_global_list(), so if that call fails, a freed node is dereferenced by concurrent read...

CVE-2026-31444 ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free and NULL deref in smbgrantoplock smbgrantoplock has two issues in the oplock publication sequence: 1 opinfo is linked into ci-moplist via opinfoadd before addleasegloballist is called. If...

CVE-2026-31444 ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free and NULL deref in smbgrantoplock smbgrantoplock has two issues in the oplock publication sequence: 1 opinfo is linked into ci-moplist via opinfoadd before addleasegloballist is called. If...