CVE-2026-64019

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2026-64018

The Linux kernel vulnerability CVE-2026-64018 affects net: mana: validate rx_req_idx to prevent out-of-bounds array access. Root cause: mana_hwc_rx_event_handler() uses rx_req_idx derived from sge->address in DMA-coherent memory, and in Confidential VMs (SEV-SNP/TDX) this memory is shared unen...

CVE-2026-64017

The CVE-2026-64017 issue affects the Linux kernel’s blk-mq path. A use-after-free could occur when submitting a bio to blk-mq if a cached request is peeked and then the code path decides to sleep before popping it; a plug flush would free cached_rqs via blk_mq_free_plug_rqs. The fix pops the cach...

CVE-2026-64016

CVE-2026-64016 : In the Linux kernel, the ksmbd durable reconnect path could mismanage file objects when a later error path occurred after a successful durable reconnect. Specifically, ksmbd_reopen_durable_fd() republished the same ksmbd_file into the session volatile-id table, and if smb2_open()...

CVE-2026-64015

The CVE-2026-64015 entry concerns the Linux kernel keyring subsystem. The vulnerability arises from the keyring code calling assoc_array_find() in find_key_to_update() without holding the RCU read lock, while assoc_array_gc() is designed to remove the node and free it after an RCU grace period. T...

CVE-2026-64013

The CVE-2026-64013 issue affects the Linux kernel ACPI button handling. A change to the ACPI notify handler type to ACPI_ALL_NOTIFY in a commit (Install notifier for system events as well) was not reflected in acpi_button_remove(), causing the notify handler to leak after driver removal. The cons...

CVE-2026-64014

The CVE-2026-64014 issue affects the Linux kernel USB touchscreen path for NEXIO devices (nexio_read_data). It describes a vulnerability where data_len and x_len are read from a 16-bit header and used to walk packet data without proper bounds, potentially enabling a ~64 KiB out-of-bounds read pas...

CVE-2026-64012

The CVE affects the Linux kernel net/sched sch_sfb path. When sch_sfb has children (e.g., qfq) whose peek() callback is qdisc_peek_dequeued(), a dequeue on the parent can cause a NULL dereference in the child’s dequeue path, potentially leading to a kernel panic. The fix replaces the direct deque...

CVE-2026-64011

The CVE-2026-64011 issue affects the Linux kernel NFC LLCP path: llcp_sock_release() unlinks a socket from the local sockets list unconditionally, but if the socket is still in the connecting state it resides on the connecting list. The fix adds a state check and unlinks from the correct list, ad...

CVE-2026-64010

CVE-2026-64010 involves a use-after-free in the Linux NFC LLCP stack. The race occurs when nfc_llcp_recv_cc() moves a socket from the connecting_sockets list to the sockets list without holding the socket lock, risking linking a freed socket if llcp_sock_release() runs concurrently. The mitigatio...

CVE-2026-64009

The CVE-2026-64009 family affects the Linux kernel xfrm subsystem, specifically an out-of-bounds write in ESP handling due to an underflow in xfrm_state_mtu(). The function computes using unsigned arithmetic: it subtracts attacker-influenced header_len + authsize + net_adj from a small mtu, allow...

CVE-2026-64008

The CVE-2026-64008 issue affects the Linux kernel’s accel/rocket path. rocket_ioctl_create_bo() creates a GEM handle early via drm_gem_handle_create(), then proceeds through fallible steps (sgt allocation, drm_mm insert, iommu_map). If any step fails after the handle is live, the error path frees...

CVE-2026-64007

The CVE concerns the Linux kernel netfilter synproxy path. In synproxy_tstamp_adjust, the code rewrites the TCP timestamp in place and then updates the TCP checksum via inet_proto_csum_replace4() on a caller-supplied tcphdr pointer. Between retrieving the pointer (via skb_header_pointer) and use,...

CVE-2026-64006

The CVE affects Linux kernel netfilter nf_tables. A dst corruption in the same-register operation occurred during shift (lshift/rshift) when src and dst pointed to the same memory location: the carry for the next iteration was read from the dst (modified) instead of the original src. The fix cach...

CVE-2026-64005

Summary: CVE-2026-64005 affects the Linux kernel net/smc hashtables. The vulnerability arises from INIT_HLIST_HEAD(&smc_v*_hashinfo.ht) being re-initialized after smc_nl_init(), proto_register(), and sock_register(), which can reset hashinfo.ht entries that are still in use and lead to a corrupte...

CVE-2026-64003

CVE-2026-64003 — Linux kernel SCSI core queue handling fix . The vulnerability originates in scsi_run_host_queues: while a SCSI host is recovering, scsi_mq_requeue_cmd() does not guarantee requeued commands will be kicked, and scsi_run_host_queues() previously iterated devices via shost_for_each_...

CVE-2026-64004

CVE-2026-64004 concerns the Linux kernel net/iucv subsystem. The vulnerability arises from a race between recvmsg() and getsockopt(SO_MSGSIZE) where the SO_MSGSIZE path dereferences iucv->hs_dev->mtu after iucv_sock_close() has set hs_dev to NULL, causing a NULL pointer dereference oops. Mi...

CVE-2026-64002

CVE-2026-64002: Linux kernel fix for freeing net->ipv4.sysctl_local_reserved_ports too early. The issue occurs because ipv4_sysctl_exit_net() frees the pointer before unregister_net_sysctl_table(), risking use of sysctls such as /proc/sys/net/ipv4/ip_local_reserved_ports. The resolution ensure...

CVE-2026-64001

Vulnerability: CVE-2026-64001 in the Linux kernel’s ALSA: pcm: oss path. The bug arises in snd_pcm_oss_proc_write() where a newly allocated setup entry is linked into the OSS setup_list before the task-name is safely duplicated; if the task-name allocation fails, the error path frees the linked e...

CVE-2026-64000

The CVE-2026-64000 entry refers to a Linux kernel vulnerability in the net: hsr subsystem where supervision frame handling could trigger an out-of-bounds access (OOB) due to an inadequate check when accessing TLV headers. The root cause is traced to insufficient linearization of the entire TLV he...

CVE-2026-63999

The Linux kernel ethtool RSS issue CVE-2026-63999 is about a memory leak: rss_prepare_get() allocates the indirection table and hash key via rss_get_data_alloc() and calls ops->get_rxfh() to populate them. If get_rxfh() fails, the allocation is not freed, causing a leak. The connected document...

CVE-2026-63998

The CVE-2026-63998 entry relates to the Linux kernel: during ethtool module handling, ethnl_ops_begin() may be followed by a failed validate() that incorrectly skips ethnl_ops_complete(), potentially leaving an imbalance in operation lifecycle handling on module flash errors. The issue is describ...

CVE-2026-63997

CVE-2026-63997 – Linux kernel ethtool module flash error handling : The issue arises in module_flash_fw_schedule where undo is missing for setting the “in_progress” flag and for taking the netdev reference, allowing the net device to persist while the rtnl_lock is held. This could prevent proper ...

CVE-2026-63996

CVE-2026-63996 concerns the Linux kernel ethtool cmis path. The issue arises when a malicious SFP module responds with a reply length longer than what cmis_cdb_process_reply() expects, potentially causing out-of-bounds writes. The fix involves strengthening the existing length checks to also guar...

CVE-2026-63995

CVE-2026-63995 affects the Linux kernel ethtool CMIS firmware update path. The CMIS FW update code reads start_cmd_payload_size from the module FW Management Features CDB reply and uses it directly as the byte count for memcpy, writing into a destination buffer of 112 bytes (ETHTOOL_CMIS_CDB_LPL_...

CVE-2026-63993

CVE-2026-63993 corresponds to a Linux kernel issue in VXLAN handling: skb_tunnel_check_pmtu() may modify skb->head, causing a stale ip_hdr() reference to be reused and potentially leading to use-after-free (UAF). The advised remediation is to use ip_hdr(skb) instead of the cached value, as imp...

CVE-2026-63994

The CVE-2026-63994 issue affects the Linux kernel's tunnels code: iptunnel_pmtud_build_icmp(v6) and iptunnel_pmtud_build_icmp() cached ip_hdr()/ipv6_hdr() before skb_cow(), which could reallocate skb->head and cause use-after-free. The patch fixes this by initializing local variables after the...

CVE-2026-63992

The CVE-2026-63992 issue affects the Linux kernel’s iptunnel_pmtud_check_icmp() in tunnels, where the skb transport_header may not be set, risking an out-of-bounds access (transport_header observed as 65535). The fix ensures the ICMP header is read based on the IPv4 network header after confirmin...

CVE-2026-63991

The CVE CVE-2026-63991 concerns the Linux kernel Bluetooth 6lowpan path. The issue: skb_clone() may return NULL on allocation failure, and send_mcast_pkt() did not check this, risking a NULL pointer dereference in send_pkt() when dereferencing skb->data. The connected records indicate a fix wa...

CVE-2026-63990

In CVE-2026-63990, the Linux kernel bonding code incorrectly allowed enslaving CAN devices (including vxcan) to a bonding master, which mutated CAN private state (can_ml_priv) rather than Ethernet-like structures. This caused a kernel paging request crash in can_rx_unregister() and potential memo...

CVE-2026-63989

CVE-2026-63989 concerns the Linux kernel bridge netlink path. The issue arises because br_setport() was historically called with the bridge lock held, but br_setport processes many attributes (flags, FDB flushing, multicast, group forward mask, backup port/NHID) that do not require the bridge loc...

CVE-2026-63988

CVE-2026-63988 concerns a Linux kernel fix for sleeping in atomic context during sysfs path handling in bridge brport_store(). The root cause: brport_store() previously held the bridge lock for many attributes; now most attributes don’t require the lock. As a result, calling dev_set_promiscuity()...

CVE-2026-63987

Summary: CVE-2026-63987 affects the Linux kernel’s ethtool/ethnl path. The issue arises in ethnl_update_profile(): it iterates a nested Netlink list with index i and writes new_profile[i++] without bounding i. The destination is kmemdup()’d at NET_DIM_PARAMS_NUM_PROFILES entries (5), while Netlin...

CVE-2026-63986

CVE-2026-63986 concerns the Linux kernel ethtool tsinfo handling. When ethnl_tsinfo_prepare_dump() fails, the code path incorrectly calls genlmsg_cancel(skb, ehdr) via a goto err, even though no genlmsg was started, risking a crash by passing an error pointer to genlmsg_cancel. The connected reco...

CVE-2026-63985

CVE-2026-63985 affects the Linux kernel ethtool EEPROM Netlink fallback path. The vulnerability arises because the Netlink fallback function fallback_set_params() only validates that offset

CVE-2026-63984

CVE-2026-63984 affects the Linux kernel, addressing an overflow in the IPv6 RPL SRH decompression path. The bug occurs in ipv6_rpl_srh_decompress(): hdrlen is computed as outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); since hdrlen is an 8-bit value, for n >= 127 the resu...

CVE-2026-63983

The CVE-2026-63983 entry concerns the Linux kernel net/sched component with netem, where duplicating a packet could cause recursive duplication loops in the qdisc tree, potentially exhausting stack or memory. Root cause: the old duplication guard invalidly zeroed q->duplicate around re-enqueue...

CVE-2026-63982

This CVE concerns the Linux kernel net/sched mirred loop where redirecting between ingress and egress could lose the loop state in sched_mirred_dev, preventing discovery of a loop. The issue arises when packets are deferred to backlog and the sched_mirred_dev array is cleared, causing loop state ...

CVE-2026-63981

CVE-2026-63981 — Linux kernel net/sched act_mirred blockcast recursion fix . The issue arises in tcf_mirred_act() where, on a blockcast path (tcfm_blockid != 0), the recursion counter sched_mirred_nest isn’t incremented before calling tcf_blockcast(), allowing MIRRED_NEST_LIMIT to be bypassed and...

CVE-2026-63979

CVE-2026-63979: In the Linux kernel, a use-after-free-like window can occur during TLS handshakes in net/handshake where accept-side dereferences use sock->file via req->hr_sk->sk_socket. The fix retargets dereferences to req->hr_file (pinned at submit time) and adds an extra file ref...

CVE-2026-63980

CVE-2026-63980 affects the Linux kernel net/handshake path in NVMe targets. nvmet_tcp_state_change() can reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue() and tls_handshake_cancel(), where hn_lock was acquired with spin_lock(). If a process-context thread holds the lock while a ...

CVE-2026-63978

The CVE-2026-63978 issue affects the Linux kernel in net/handshake handling during net namespace exit. The root cause is reversed arguments to list_splice_init() in handshake_net_exit(), which transfers the pending handshake requests to the wrong list, causing the drain loop to skip, leaving some...

CVE-2026-63976

Summary (CVE-2026-63976) : In the Linux kernel’s Bluetooth L2CAP path, ECRED reconfiguration success could fail to clear chan->ident, allowing a remote peer to replay a failure with the stale ident and cause the kernel to match/destroy an already-established channel (via l2cap_chan_del with EC...

CVE-2026-63977

The CVE-2026-63977 entry concerns the Linux kernel dpll ( zl3073x ) subsystem. The fix replaces the change_work mechanism with the exported __dpll_device_change_ntf(), calling it directly while holding dpll_lock, and removes the change_work infrastructure. This addresses a race where change_work ...

CVE-2026-63975

In the Linux kernel Bluetooth L2CAP stack, CVE-2026-63975 describes a crash when a dcid arrives for an already-assigned destination CID. The fix avoids invalidating a temporary cursor from list_for_each_entry_safe and instead defers closing the channel by scheduling l2cap_chan_timeout with a dela...

CVE-2026-63973

Concrete details found: Linux kernel net: mana module added NULL guards in teardown paths to prevent panics when attach fails. The fix protects against dereferencing apc->rxqs and apc->tx_qp after partial queue allocation failures. Affected functions and behavior: mana_chn_setxdp() now chec...

CVE-2026-63974

CVE-2026-63974 affects the Linux kernel Bluetooth subsystem. The issue arises in hci_sync where HCI_CMD_DRAIN_WORKQUEUE must be set during device close because hci_dev_close_sync() can be invoked on a reset path, preventing timeouts from being queued while the hdev workqueue drains. The consequen...

CVE-2026-63972

The CVE-2026-63972 entry concerns the Linux kernel vulnerability in the mana net driver. Affected component: mana per-port queue handling in the kernel’s mana_detach path. Root cause: after a prior detach succeeded but attach failed, a port remained detached with apc->tx_qp and apc->rxqs fr...

CVE-2026-63970

CVE-2026-63970 — Linux kernel vulnerability in vsock/virtio where zerocopy skb handling could fail due to allocation order: uarg must be bound before filling the skb to ensure correct lifetime handling. The fix ensures the zerocopy uarg is passed into virtio_transport_alloc_skb() and bound prior ...

CVE-2026-63971

CVE-2026-63971 — Linux kernel SCTP race : The issue occurs when sctp_wait_for_connect drops and re-acquires the socket lock while waiting for an association to reach ESTABLISHED. During this window, another thread can peeloff the association to a new socket via getsockopt(SCTP_SOCKOPT_PEELOFF), c...