CVE-2026-64038

CVE-2026-64038 concerns the Linux kernel hwmon lm90 driver. In lm90_probe(), devm actions to cancel alert_work and report_work were registered before hwmon device registration. With devm cleanup in reverse order, the hwmon device could be freed first, allowing lm90_update_alarms() to dereference ...

CVE-2026-64037

Concrete details found: CVE-2026-64037 affects the Linux kernel’s wifi: iwlwifi: mld path. When AMSDU is disabled, max_tid_amsdu_len can be 1 (sentinel) and the code checks for zero but not for this sentinel, causing num_subframes to compute to 0 and gso_size to be 0. This triggers skb_gso_segmen...

CVE-2026-64035

The CVE-2026-64035 entry concerns the Linux kernel igc driver: igc_fpe_init_smd_frame() failed to set the tx buffer type for SMD frames, causing igc_tx_buffer entries to retain a stale XDP/XSK type. This can lead TX completion to follow an incorrect cleanup path. The fix is to set the buffer type...

CVE-2026-64036

The CVE-2026-64036 issue affects the Linux kernel cgroup/rstat path. The vuln arises because css_rstat_updated(), a BPF kfunc, accepts a caller-provided cpu value used for per-cpu rstat lookups without validating it against a valid CPU. A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON could...

CVE-2026-64034

The CVE concerns the Linux kernel net: mana TOCTOU in hwc_msg_id handling. In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arit...

CVE-2026-64033

CVE-2026-64033 describes a use-after-free in Linux kernel RDMA/rtrs path file cleanup. In rtrs_srv_create_path_files(), if an error occurs after sysfs root folders were created and srv_path->kobj initialized, cleanup calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sysfs_root...

CVE-2026-64032

The CVE-2026-64032 entry documents a Linux kernel use-after-free in bridge multicast snooping when removing a bridge port. The issue occurs when both per-port and per-{port, VLAN} multicast contexts become enabled on a single bridge port due to interactions between per-VLAN multicast snooping and...

CVE-2026-64031

CVE-2026-64031 relates to the Linux kernel erofs module and fixes a managed cache race for unaligned extents in compressed data. The race could occur when two threads race to add the same folio to the managed cache (z_erofs_bind_cache) while folio->private is still Z_EROFS_PREALLOCATED_FOLIO. ...

CVE-2026-64029

The provided reports describe a Linux kernel vulnerability in ALSA seq: UMP output teardown where seq_ump_process_event() borrows client->out_rfile.output without proper synchronization, allowing a rawmidi substream to be torn down while an event_input callback is active. The fix, as documente...

CVE-2026-64030

The CVE-2026-64030 entries describe a Linux kernel WiFi bug in mac80211 (ieee80211_ml_epcs) where link_id = 15 can read sdata->link[15] beyond the 0..14 range, causing a crash when processing an EPCS Enable Response from a WiFi 7 AP. A NULL-check slip and dereferencing link->sdata leads to ...

CVE-2026-64028

In the Linux kernel tracing subsystem, CVE-2026-64028 affects hist_field_name() in the fully-qualified VAR_REF/EXPR path: when snprintf() truncation returns NULL, callers mistakenly dereference NULL in strcat(expr, hist_field_name(field, 0)) and in a sort-key strcmp, potentially leading to NULL d...

CVE-2026-64027

The CVE-2026-64027 issue affects the Linux kernel net: shaper component (XArray-based marking of entries). A race occurs when a reader observes a VALID mark is later invalidated by a writer reusing a slot, potentially leading to a use-after-free if net_shaper_rollback() frees entries without obse...

CVE-2026-64026

CVE-2026-64026 affects the Linux kernel’s rxrpc path. The issue was addressed by removing in-place decryption in splice()-transmitted DATA packets and instead unconditionally copying the packet content into a dedicated bounce buffer, which is decrypted there and then copied to the final destinati...

CVE-2026-64025

CVE-2026-64025 affects Linux kernel BPF plumbing where a TLS RX context could cause a use-after-free-like condition in data-path when a socket is inserted into a sockmap before TLS RX is configured. The issue arises because sk_psock_verdict_data_ready() does not guard against TLS RX ownership of ...

CVE-2026-64024

CVE-2026-64024 concerns a Linux kernel issue where a per-CPU tcp_tw_isn leak could enable ISN prediction. The root cause was that TIME_WAIT-derived ISNs were stored in a per-CPU variable and could be consumed by a subsequent SYN if a packet was dropped along several paths (e.g., min_ttl/min_hop, ...

CVE-2026-64022

The CVE-2026-64022 entry concerns the Linux kernel GPIO aggregator. The issue is that a dynamic software node created for the aggregator platform device (used with configfs) is leaked during device teardown. The fix is to destroy the software node as the last step in the tear-down path. Affected ...

CVE-2026-64023

Summary of CVE-2026-64023 (Linux kernel GPIO aggregator use-after-free) Affected component: the kernel’s GPIO aggregator code. The vulnerability arises from a race during cleanup: on error, the code frees aggr->lookups->dev_id before removing the corresponding entry from the lookup table. I...

CVE-2026-64021

The CVE concerns the Linux kernel DRM subsystem (drm/xe/oa). The issue occurs in xe_oa_stream_open_ioctl() when param.exec_q->width > 1: it returns -EOPNOTSUPP directly, bypassing the err_exec_q cleanup path, causing a leaked reference from xe_exec_queue_lookup() and preventing the file’s p...

CVE-2026-64020

The CVE-2026-64020 entry concerns the Linux kernel, specifically the nvme-pci driver. The issue was a leak of dma_vecs allocated for peer-to-peer (P2P) memory that was not unmapped, causing leakage on completion. Documents describe that the fix prevents the leak by addressing how dma_vecs are han...

CVE-2026-64019

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2026-64018

The Linux kernel vulnerability CVE-2026-64018 affects net: mana: validate rx_req_idx to prevent out-of-bounds array access. Root cause: mana_hwc_rx_event_handler() uses rx_req_idx derived from sge->address in DMA-coherent memory, and in Confidential VMs (SEV-SNP/TDX) this memory is shared unen...

CVE-2026-64017

The CVE-2026-64017 issue affects the Linux kernel’s blk-mq path. A use-after-free could occur when submitting a bio to blk-mq if a cached request is peeked and then the code path decides to sleep before popping it; a plug flush would free cached_rqs via blk_mq_free_plug_rqs. The fix pops the cach...

CVE-2026-64016

CVE-2026-64016 : In the Linux kernel, the ksmbd durable reconnect path could mismanage file objects when a later error path occurred after a successful durable reconnect. Specifically, ksmbd_reopen_durable_fd() republished the same ksmbd_file into the session volatile-id table, and if smb2_open()...

CVE-2026-64015

The CVE-2026-64015 entry concerns the Linux kernel keyring subsystem. The vulnerability arises from the keyring code calling assoc_array_find() in find_key_to_update() without holding the RCU read lock, while assoc_array_gc() is designed to remove the node and free it after an RCU grace period. T...

CVE-2026-64013

The CVE-2026-64013 issue affects the Linux kernel ACPI button handling. A change to the ACPI notify handler type to ACPI_ALL_NOTIFY in a commit (Install notifier for system events as well) was not reflected in acpi_button_remove(), causing the notify handler to leak after driver removal. The cons...

CVE-2026-64014

The CVE-2026-64014 issue affects the Linux kernel USB touchscreen path for NEXIO devices (nexio_read_data). It describes a vulnerability where data_len and x_len are read from a 16-bit header and used to walk packet data without proper bounds, potentially enabling a ~64 KiB out-of-bounds read pas...

CVE-2026-64012

The CVE affects the Linux kernel net/sched sch_sfb path. When sch_sfb has children (e.g., qfq) whose peek() callback is qdisc_peek_dequeued(), a dequeue on the parent can cause a NULL dereference in the child’s dequeue path, potentially leading to a kernel panic. The fix replaces the direct deque...

CVE-2026-64011

The CVE-2026-64011 issue affects the Linux kernel NFC LLCP path: llcp_sock_release() unlinks a socket from the local sockets list unconditionally, but if the socket is still in the connecting state it resides on the connecting list. The fix adds a state check and unlinks from the correct list, ad...

CVE-2026-64010

CVE-2026-64010 involves a use-after-free in the Linux NFC LLCP stack. The race occurs when nfc_llcp_recv_cc() moves a socket from the connecting_sockets list to the sockets list without holding the socket lock, risking linking a freed socket if llcp_sock_release() runs concurrently. The mitigatio...

CVE-2026-64009

The CVE-2026-64009 family affects the Linux kernel xfrm subsystem, specifically an out-of-bounds write in ESP handling due to an underflow in xfrm_state_mtu(). The function computes using unsigned arithmetic: it subtracts attacker-influenced header_len + authsize + net_adj from a small mtu, allow...

CVE-2026-64008

The CVE-2026-64008 issue affects the Linux kernel’s accel/rocket path. rocket_ioctl_create_bo() creates a GEM handle early via drm_gem_handle_create(), then proceeds through fallible steps (sgt allocation, drm_mm insert, iommu_map). If any step fails after the handle is live, the error path frees...

CVE-2026-64007

The CVE concerns the Linux kernel netfilter synproxy path. In synproxy_tstamp_adjust, the code rewrites the TCP timestamp in place and then updates the TCP checksum via inet_proto_csum_replace4() on a caller-supplied tcphdr pointer. Between retrieving the pointer (via skb_header_pointer) and use,...

CVE-2026-64006

The CVE affects Linux kernel netfilter nf_tables. A dst corruption in the same-register operation occurred during shift (lshift/rshift) when src and dst pointed to the same memory location: the carry for the next iteration was read from the dst (modified) instead of the original src. The fix cach...

CVE-2026-64005

Summary: CVE-2026-64005 affects the Linux kernel net/smc hashtables. The vulnerability arises from INIT_HLIST_HEAD(&smc_v*_hashinfo.ht) being re-initialized after smc_nl_init(), proto_register(), and sock_register(), which can reset hashinfo.ht entries that are still in use and lead to a corrupte...

CVE-2026-64003

CVE-2026-64003 — Linux kernel SCSI core queue handling fix . The vulnerability originates in scsi_run_host_queues: while a SCSI host is recovering, scsi_mq_requeue_cmd() does not guarantee requeued commands will be kicked, and scsi_run_host_queues() previously iterated devices via shost_for_each_...

CVE-2026-64004

CVE-2026-64004 concerns the Linux kernel net/iucv subsystem. The vulnerability arises from a race between recvmsg() and getsockopt(SO_MSGSIZE) where the SO_MSGSIZE path dereferences iucv->hs_dev->mtu after iucv_sock_close() has set hs_dev to NULL, causing a NULL pointer dereference oops. Mi...

CVE-2026-64002

CVE-2026-64002: Linux kernel fix for freeing net->ipv4.sysctl_local_reserved_ports too early. The issue occurs because ipv4_sysctl_exit_net() frees the pointer before unregister_net_sysctl_table(), risking use of sysctls such as /proc/sys/net/ipv4/ip_local_reserved_ports. The resolution ensure...

CVE-2026-64001

Vulnerability: CVE-2026-64001 in the Linux kernel’s ALSA: pcm: oss path. The bug arises in snd_pcm_oss_proc_write() where a newly allocated setup entry is linked into the OSS setup_list before the task-name is safely duplicated; if the task-name allocation fails, the error path frees the linked e...

CVE-2026-64000

The CVE-2026-64000 entry refers to a Linux kernel vulnerability in the net: hsr subsystem where supervision frame handling could trigger an out-of-bounds access (OOB) due to an inadequate check when accessing TLV headers. The root cause is traced to insufficient linearization of the entire TLV he...

CVE-2026-63999

The Linux kernel ethtool RSS issue CVE-2026-63999 is about a memory leak: rss_prepare_get() allocates the indirection table and hash key via rss_get_data_alloc() and calls ops->get_rxfh() to populate them. If get_rxfh() fails, the allocation is not freed, causing a leak. The connected document...

CVE-2026-63998

The CVE-2026-63998 entry relates to the Linux kernel: during ethtool module handling, ethnl_ops_begin() may be followed by a failed validate() that incorrectly skips ethnl_ops_complete(), potentially leaving an imbalance in operation lifecycle handling on module flash errors. The issue is describ...

CVE-2026-63997

CVE-2026-63997 – Linux kernel ethtool module flash error handling : The issue arises in module_flash_fw_schedule where undo is missing for setting the “in_progress” flag and for taking the netdev reference, allowing the net device to persist while the rtnl_lock is held. This could prevent proper ...

CVE-2026-63996

CVE-2026-63996 concerns the Linux kernel ethtool cmis path. The issue arises when a malicious SFP module responds with a reply length longer than what cmis_cdb_process_reply() expects, potentially causing out-of-bounds writes. The fix involves strengthening the existing length checks to also guar...

CVE-2026-63995

CVE-2026-63995 affects the Linux kernel ethtool CMIS firmware update path. The CMIS FW update code reads start_cmd_payload_size from the module FW Management Features CDB reply and uses it directly as the byte count for memcpy, writing into a destination buffer of 112 bytes (ETHTOOL_CMIS_CDB_LPL_...

CVE-2026-63993

CVE-2026-63993 corresponds to a Linux kernel issue in VXLAN handling: skb_tunnel_check_pmtu() may modify skb->head, causing a stale ip_hdr() reference to be reused and potentially leading to use-after-free (UAF). The advised remediation is to use ip_hdr(skb) instead of the cached value, as imp...

CVE-2026-63994

The CVE-2026-63994 issue affects the Linux kernel's tunnels code: iptunnel_pmtud_build_icmp(v6) and iptunnel_pmtud_build_icmp() cached ip_hdr()/ipv6_hdr() before skb_cow(), which could reallocate skb->head and cause use-after-free. The patch fixes this by initializing local variables after the...

CVE-2026-63992

The CVE-2026-63992 issue affects the Linux kernel’s iptunnel_pmtud_check_icmp() in tunnels, where the skb transport_header may not be set, risking an out-of-bounds access (transport_header observed as 65535). The fix ensures the ICMP header is read based on the IPv4 network header after confirmin...

CVE-2026-63991

The CVE CVE-2026-63991 concerns the Linux kernel Bluetooth 6lowpan path. The issue: skb_clone() may return NULL on allocation failure, and send_mcast_pkt() did not check this, risking a NULL pointer dereference in send_pkt() when dereferencing skb->data. The connected records indicate a fix wa...

CVE-2026-63990

In CVE-2026-63990, the Linux kernel bonding code incorrectly allowed enslaving CAN devices (including vxcan) to a bonding master, which mutated CAN private state (can_ml_priv) rather than Ethernet-like structures. This caused a kernel paging request crash in can_rx_unregister() and potential memo...

CVE-2026-63989

CVE-2026-63989 concerns the Linux kernel bridge netlink path. The issue arises because br_setport() was historically called with the bridge lock held, but br_setport processes many attributes (flags, FDB flushing, multicast, group forward mask, backup port/NHID) that do not require the bridge loc...