CVE-2026-63858

The CVE concerns the Linux kernel netfilter nf_tables subsystem. A patch resolves a vulnerability related to hook transactions for device deletions: it reintroduces NFT_HOOK_REMOVE and adds a new transaction object to track hook deletions without altering the basechain/flowtable hook_list during ...

CVE-2026-63857

In the Linux kernel, CVE-2026-63857 affects the airoha net code where the transmit loop in airoha_dev_xmit() reads fragment address/length on the last iteration (skb_shinfo(skb)->nr_frags) when the fragment data is uninitialized. The issue is unsafe reads that could trigger a page fault. The f...

CVE-2026-63855

CVE-2026-63855 affects the Linux kernel's drm/amdgpu/vcn component, specifically VCN v2.5 encoder/decoder rings. The vulnerability arises because these rings do not support 64-bit user fence writes, leading to rejection of CS submissions that use user fences. A fix has been applied by setting no_...

CVE-2026-63856

In the Linux kernel, CVE-2026-63856 affects the AMDGPU VCN subsystem. The issue stems from not supporting 64-bit user fence writes in VCN v2.0 encoder/decoder rings, leading to rejection of CS submissions that use user fences. A fix was applied by setting no_user_fence for VCN v2.0 enc/dec rings ...

CVE-2026-63854

CVE-2026-63854 affects the Linux kernel’s DRM amdgpu/vcn path. The issue is that VCN v3.0 encoder/decoder rings do not support 64-bit user fence writes, causing the kernel to reject CS submissions that use user fences. The vulnerability has a CVSS 3.1 base score of 7.8 (HIGH) with local access, l...

CVE-2026-63853

CVE-2026-63853 affects the Linux kernel's AMDGPU/VCN subsystem. The vulnerability arises in the VCN v4.0 encoder/decoder rings, which do not support 64-bit user fence writes; as a result, the driver now rejects CS submissions that use user fences to prevent potential misuse. The fix, cherry-picke...

CVE-2026-63852

Summary: The CVE-2026-63852 entry relates to the Linux kernel DRM/AMDGPU VCN engine. The vulnerability arises because VCN encoder and decoder rings do not support 64-bit user fence writes, leading to rejected CS submissions when user fences are used. The root cause is identified as the change to ...

CVE-2026-63851

The CVE-2026-63851 entry documents a Linux kernel vulnerability in drm/amdgpu/vcn where VCN encoder/decoder rings (v4.0.5 enc ring) do not support 64-bit user fence writes. Consequently, the kernel now rejects CS submissions with user fences to mitigate unsafe fence usage. Root cause: 64-bit user...

CVE-2026-63850

The CVE-2026-63850 vulnerability affects the Linux kernel’s DRM/AMDGPU VCN path. Specifically, the VCN encoder/decoder rings in certain AMDGPU environments do not support 64-bit user fence writes, and are now prevented from submitting CS with user fences. The issue arises in VCN v5.0.0 enc ring b...

CVE-2026-63849

CVE-2026-63849 affects Linux kernel DRM/AMDGPU VCN: the VCN encoder/decoder rings (v5.0.1 enc ring) do not support 64-bit user fence writes, and submissions using user fences are rejected. This is caused by set_no_user_fence for the VCN enc ring, fixed via a cherry-pick in the referenced commit. ...

CVE-2026-63847

CVE-2026-63847 affects the Linux kernel DRM/amdgpu/jpeg component; JPEG v2.5 rings do not support 64-bit user fence writes, causing rejection of CS submissions with user fences. A fix was cherry-picked from commit 3216a7f4e2642bda5fd14f57586e835ae9202587. References indicate the issue is addresse...

CVE-2026-63848

The CVE-2026-63848 entry describes a Linux kernel vulnerability in the drm/amdgpu/jpeg path, specifically the JPEG v2.0 ring. The underlying issue is a change to set no_user_fence for the JPEG v2.0 ring, as JPEG rings do not support 64‑bit user fence writes and will reject CS submissions with use...

CVE-2026-63845

The CVE-2026-63845 entry concerns the Linux kernel DRM/AMDGPU JPEG driver: JPEG v4.0 rings do not support 64-bit user fence writes, and submissions using user fences are rejected. This is a local, low-privilege path (LOCAL, LOW attack complexity, user interaction NONE) with high impact on confide...

CVE-2026-63846

Summary: CVE-2026-63846 concerns the Linux kernel DRM/amdgpu JPEG v3.0 ring. The issue is that JPEG rings do not support 64-bit user fence writes, so submissions using user fences were rejected, which is the root cause described as a patch in the kernel commit (cherry picked from commit 4d7d774f1...

CVE-2026-63844

Linux kernel vulnerability (CVE-2026-63844) affecting the AMDGPU JPEG path: JPEG rings (v4.0.3) do not support 64-bit user fence writes, so submissions using user fences are rejected. The fix enables no_user_fence for the JPEG ring, addressing the issue via a cherry-picked commit. Exploitation de...

CVE-2026-63842

CVE-2026-63842 concerns the Linux kernel DRM/AMDGPU JPEG subsystem: JPEG v5.0.0 ring now sets no_user_fence due to 64-bit user fence writes not being supported, rejecting CS submissions with user fences. This vulnerability is addressed by a patch cherry-picked from commit 0f43893d3cd478fa57836697...

CVE-2026-63843

The CVE-2026-63843 issue affects the Linux kernel, specifically the drm/amdgpu/jpeg path where JPEG v4.0.5 rings did not support 64-bit user fence writes. The underlying vulnerability arises from enabling user fences for these rings, leading to potential issues when submitting command streams. Th...

CVE-2026-63841

The CVE-2026-63841 entry documents a fix in the Linux kernel for the AMDGPU JPEG ring: the system now sets no_user_fence for the JPEG v5.0.1 ring, rejecting 64-bit user fence writes during CS submissions. This addresses a vulnerability where JPEG rings did not support 64-bit user fences. The issu...

CVE-2026-63839

CVE-2026-63839 affects Linux kernel platform/x86 Lenovo WMI helpers (lwmi_dev_evaluate_int). The bug leaks output.pointer when retval == NULL; the fix moves ret_obj = output.pointer outside the if (retval) block so the pointer is always freed by the __free cleanup callback. No functional change i...

CVE-2026-63840

The CVE-2026-63840 issue affects the Linux kernel’s DRM AMDGPU JPEG ring. It concerns the JPEG v5.3.0 ring failing to support 64-bit user fence writes, rejecting CS submissions with user fences. The vulnerability is resolved by a patch that sets no_user_fence for the JPEG ring (cherry-picked from...

CVE-2026-63838

The CVE-2026-63838 entry concerns the Linux kernel ASoC rsnd subsystem. It fixes a potential out-of-bounds access in rsnd_dai_of_node() caused by a boundary check (i >= RSND_MAX_COMPONENT) not guaranteeing component_dais[RSND_MAX_COMPONENT] remains zero, so a loop could read past the end of th...

CVE-2026-63837

The CVE affects the Linux kernel ENA PHC path. In ena_phc_gettimex64, the output timestamp was written to the user via the PTP ioctl regardless of whether ena_com_phc_get_timestamp() succeeded. If an error occurs (e.g., PHC disabled or blocked), the timestamp could contain uninitialized memory or...

CVE-2026-63836

The CVE-2026-63836 issue is in batman-adv tp_meter within the Linux kernel, caused by a 32-bit arithmetic overflow in batadv_tp_update_cwnd() that can yield a divide-by-zero when cwnd reaches 0x20000000. The correct calculation should be (mss ** 2) * 8 / cwnd to avoid overflow, preserving the 8x ...

CVE-2026-63835

CVE-2026-63835 concerns the Linux kernel’s batman-adv OGM aggregation on disabled hard interfaces. When an interface is disabled, batadv_hardif_disable_interface() disables the worker and frees the skb aggr_list; however batadv_v_ogm_send_meshif() may still queue new skbs via batadv_v_ogm_queue_o...

CVE-2026-63834

The CVE concerns the Linux kernel’s batman-adv tp_meter: unacked_list can be pressured to grow (via crafted small messages, seqno gaps) if the list is unbounded. The result is potential out-of-memory or high CPU usage from scanning a large unacked_list. If a limit is applied, the implementation m...

CVE-2026-63833

The CVE-2026-63833 issue affects the Linux kernel ntfs3 module: an unprivileged user on a writable NTFS3 mount could abuse the empty-prefix xattr handler to write to reserved $LX* attributes, enabling planting root ownership and S_ISUID on their file and obtaining effective user ID 0 after inode ...

CVE-2026-63831

CVE-2026-63831 (Linux kernel, mac802154 llsec) : In in-place crypto paths, llsec_do_encrypt_/llsec_do_decrypt_ modify skb data that may be shared across clones, risking silent data corruption, use-after-free, and kernel crashes under concurrent 802.15.4 traffic. The documented fix is to call skb_...

CVE-2026-63832

CVE-2026-63832 addresses a Linux kernel wifi issue in mt76/mt7925: a publish sequence in mt76_sta_add can reinitialize wcid->poll_list, risking list corruption (found in dev->sta_poll_list during mt7925 mt76 interactions). Advisories from NVD/SUSE/OSV/NASL show the fix involves adding a wci...

CVE-2026-63830

The CVE-2026-63830 entry describes a Linux kernel vulnerability in net: skmsg where the sg.copy bitmap could become unsynchronized with sg.data[] during various sk_msg transforms, potentially allowing writable exposure to page cache data via BPF ctx->data. The issue covers transformations like...

CVE-2026-63829

The CVE-2026-63829 issue affects the Linux kernel’s GRE/IP tunnel handling: the changelink path for RTM_NEWLINK did not require CAP_NET_ADMIN in the tunnel’s link netns, allowing a caller with CAP_NET_ADMIN in dev_net(dev) but not in t->net to rewrite tunnels. The fix adds rtnl_dev_link_net_ca...

CVE-2026-63827

Root cause: Linux kernel AppArmor uses a use-after-free in the rawdata dedup loop (aa_replace_profiles) due to unsafe refcount handling when traversing ns->rawdata_list. The dedup path calls aa_get_profile_loaddata() which has plain kref_get() semantics, allowing a zero counter to be dereferen...

CVE-2026-63828

In CVE-2026-63828, the Linux kernel patch fixes an AppArmor mediation gap for MSG_FASTOPEN: sendmsg/sendto could trigger an implicit connect, allowing a confined task to open an outbound TCP/MPTCP connection even if connect would be denied. The vulnerability arises because apparmor_socket_sendmsg...

CVE-2026-63826

The CVE-2026-63826 issue affects the Linux kernel fbdev path, where store_modes() frees a framebuffer modelist but leaves stale pointers in fb_display[i].mode and fb_info->mode. The root cause is use-after-free reads when fbcon_mode_deleted() and show_mode() dereference these pointers after fb...

CVE-2026-63824

CVE-2026-63824 — Linux kernel KEYS overflow : The issue arises from an incorrect calculation of the internal output buffer size in keyctl_pkey_params_get_2(), which can overflow a too-small caller-provided buffer. The vulnerability is rooted in the kernel’s handling of cryptographic primitive len...

CVE-2026-63825

CVE-2026-63825 describes a Linux kernel issue where GCC GCOV instrumentation could merge global counters with loop induction variables, causing inconsistent values and an out-of-bounds write during IPComp processing when inflate_fast() runs on multiple CPUs. The root cause is in the GCOV counter ...

CVE-2026-63822

CVE-2026-63822 relates to the Linux kernel, addressing a double-free condition in the ath11k PCI path during unbind when firmware initialization partially failed. The issue arises because buffers in dp->tx_ring[i].tx_status are released and then released again on unbind, triggering a warning i...

CVE-2026-63823

The CVE-2026-63823 entry concerns a Linux kernel use-after-free in request_key_auth payload handling within the key management path (instantiate/reject) for credentials keys. The issue stems from not maintaining a proper payload reference during the instantiate/revoke lifecycle, allowing a payloa...

CVE-2026-63820

CVE-2026-63820 relates to the Linux kernel's f2fs filesystem. The issue occurs in f2fs_read_data_large_folio(), which can keep a read bio across multiple readahead folios. If a later folio errors before any of its blocks are added to the bio, folio_in_bio is false and the path returns after endin...

CVE-2026-63821

In the Linux kernel, the wifi driver stack for rtw88/USB fixed memory leaks when USB write submissions fail. Specifically, rtw_usb_write_port() failures in rtw_usb_write_data() and rtw_usb_tx_agg_skb() could leave allocated skbs and a txcb/aggregated skbs unfreed due to a missing completion callb...

CVE-2026-63818

CVE-2026-63818 affects the Linux kernel’s f2fs filesystem. The issue arises when f2fs_recover_orphan_inodes() trusts the orphan block entry_count from the checkpoint pack; a corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK can cause the recovery loop to read past the inode array, leading ...

CVE-2026-63819

CVE-2026-63819 affects the Linux kernel f2fs filesystem. The issue arises in f2fs_do_truncate_blocks/f2fs_get_node_folio_ra where a corrupted inode footer can lead to a negative count in ADDRS_PER_PAGE(dn.node_folio, inode) and trigger a kernel panic (BUG_ON) during truncation/evict_inode. Root c...

CVE-2026-63817

The CVE-2026-63817 issue pertains to the Linux kernel file system F2FS: when the compress_cache mount option is enabled, F2FS_COMPRESS_INO() uses NM_I(sbi)->max_nid as the synthetic inode for the compressed page cache inode. If compress_cache is disabled, max_nid lies outside the valid inode r...

CVE-2026-63816

CVE-2026-63816 describes a Linux kernel issue in F2FS where the UAF can occur during garbage collection when handling f2fs_inode_info.atomic_inode. The public descriptions across NVD, SUSE, OSVs, Debian/OSV indicate the code path: gc_data_segment → ra_data_block(cow_inode) → mapping = F2FS_I(inod...

CVE-2026-63815

CVE-2026-63815 (Linux kernel, f2fs) : The vulnerability arises when flexible_inline_xattr is enabled; do_read_inode() unconditionally loads i_inline_xattr_size from disk, but sanity_check_inode() only validates it if FI_INLINE_XATTR is set. This enables an attacker-controlled i_inline_xattr_size ...

CVE-2026-63813

Summary: CVE-2026-63813 relates to the Linux kernel and a revert of a previous f2fs change in move_data_block that could cause page-cache/folio handling race conditions. The embedded details describe a race where the GC path can evict the tail-end folio from the page cache, drop page-cache refere...

CVE-2026-63814

CVE-2026-63814 (Linux kernel, f2fs) is resolved. A malformed ACL in f2fs_acl_from_disk() could bypass proper length checks because f2fs_acl_count() only validates the aggregate ACL xattr length, allowing ACL_USER/ACL_GROUP entries to be read before a full entry fits. The fix adds checks: require ...

CVE-2026-63811

Summary of CVE-2026-63811 (Linux kernel, f2fs) : A defect in atomic writes for F2FS can cause a mismatch between the cryptographic context used for decrypted reads and the actual on-disk data, due to how the COW inode and original inode are chosen for page reads. The read path may decrypt data us...

CVE-2026-63812

The CVE describes a Linux kernel f2fs bug: when __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it fails to reset the length of the largest extent and update the inode folio, causing a stale cached extent and an error seen in xfstests generic/388. The issue arises in the f2fs_drop_inode...

CVE-2026-63810

In CVE-2026-63810, the Linux kernel fixed a vulnerability in the block subsystem by unregistering the bdev pseudo-filesystem to prevent userspace from mounting it. The issue arose because move_mount() could use inode_operations pointers that were always zero for this filesystem, enabling a NULL p...

CVE-2026-63809

CVE-2026-63809 affects the Linux kernel memory-management path used by BPF when handling proc sysctl writes. The vulnerability stems from proc_sys_call_handler() allocating a temporary sysctl buffer with kvzalloc() and passing it to __cgroup_bpf_run_filter_sysctl(); since kvzalloc() may fall back...