CVE-2026-97608

The Linux kernel contains a race condition in the netfilter subsystem, specifically within nf_log_syslog and nfnetlink_log . The vulnerability occurs because these backends unregister per-network namespace operations before unregistering their global logger backends. This creates a window where a...

CVE-2026-97609

The Linux kernel contains a use-after-free (UAF) vulnerability within the netfilter: cttimeout component during module unload. The issue occurs because cttimeout_exit() unregisters per-net operations before clearing the hook, allowing a race condition where one CPU can free the pernet storage whi...

CVE-2026-97607

The Linux kernel contains a vulnerability in the vdpa: ifcvf component where unsupported provisioned features were not handled consistently. The issue caused a failure to release the allocated device and adapter pointers consistently following the vdpa_alloc_device() call. The vulnerability has b...

CVE-2026-97605

The Linux kernel contains a vulnerability in the erofs filesystem involving the pool-resize path for LZMA decoders . The root cause is that the system frees old decoders before successfully allocating replacements; if an allocation fails mid-process, the failed stream is returned to the list with...

CVE-2026-97606

The Linux kernel contains a memory leak vulnerability in the autofs filesystem component within the autofs_fill_super() function. The issue occurs because the system creates a new inode using autofs_new_ino(), but fails to free this inode if the root_inode creation fails, resulting in an -ENOMEM ...

CVE-2026-97603

The Linux kernel contains a use-after-free vulnerability in the idpf driver. The issue occurs because the driver fails to drain Tx/Rx DIM works before freeing the q_vectors memory in idpf_vport_intr_rel(). Specifically, tx_dim and rx_dim are queued via net_dim() during NAPI polling, but nothing c...

CVE-2026-97604

The Linux kernel contains a use-after-free vulnerability within the fbdev: vfb driver. The issue occurs because FBIOGETCMAP takes a shallow snapshot of info->cmap and performs a usercopy after dropping the info->lock . Simultaneously, vfb_remove() may free the colormap immediately after unr...

CVE-2026-97602

The Linux kernel is vulnerable to a flaw where fqdir_pre_exit() flushes skbs from incomplete queues without updating their completion state. This allows a fragment to reuse stale reassembly metadata after a queue is cleared. In IPv6 , this can cause ip6_frag_reasm() to use an old nhoffset with a ...

CVE-2026-97600

The Linux kernel contains a use-after-free vulnerability in the ieee802154 driver within the cc2520 component. The issue arises because the FIFOP interrupt handler queues cc2520_fifop_irqwork , but the cc2520_remove() function only flushes the work instead of disabling it. Consequently, the devm-...

CVE-2026-97601

The Linux kernel contains a vulnerability in the ieee802154: 6lowpan component where a NULL pointer dereference can occur in the lowpan_newlink() function. This issue is triggered when an RTM_NEWLINK request allows a TUN device to change its link-layer type to ARPHRD_IEEE802154 via TUNSETLINK wit...

CVE-2026-97599

The Linux kernel contains a vulnerability in the ieee802154: hwsim component where a double-free condition can occur. The root cause is an unserialized read-swap-free of phy->pib within the hwsim_update_pib() function. Because the mac802154 scan worker can update channels without holding the R...

CVE-2026-97598

The Linux kernel contains a vulnerability in the ipv4: fib component where the fib_empty_table() function probes every table ID starting from 1 until a free one is found. In a dense set of IDs, this causes each probe to walk a growing hash chain while the RTNL is held. To mitigate this, the autom...

CVE-2026-97597

The Linux kernel contains a vulnerability in the ipv6 flowlabel mechanism where the ipv6_flowlabel_get() function fails to apply lease admission checks during the recheck path for compatible existing flowlabels. This allows repeated GET requests for a shareable label to grow a socket's lease list...

CVE-2026-97595

The Linux kernel contains a use-after-free vulnerability in the mac802154 component. The issue stems from the ieee802154_subif_frame() softirq producer queuing beacon and MAC-command frames onto lists without proper locking or reference counting. This allows sibling interfaces on the same PHY to ...

CVE-2026-97596

The Linux kernel contains a vulnerability in IPVS where sync receivers fail to reject invalid states in connection template sync records . While ordinary connections are validated, connection templates only log states outside the allowed range while still storing them. This allows TCP and SCTP to...

CVE-2026-97594

The Linux kernel contains a use-after-free vulnerability in the landlock LSM. The current_check_refer_path() function reads old_dentry->d_parent without holding a reference or lock, leading to a race condition during filename_linkat(). Because hook_path_link() does not lock the parent, a concu...

CVE-2026-97593

The Linux kernel contains a NULL pointer dereference vulnerability in the iommu/s390 component. When using a 5-level translation table via ZPCI_TABLE_TYPE_RFX , the function get_rto_from_iova() fails to verify if the region-second origin rso is non-NULL before accessing rso[rsx] . This occurs bec...

CVE-2026-97592

The Linux kernel contains a vulnerability in the s390/crypto component related to the AES CTR and GCM algorithms. Specifically, the ctr_aes_crypt() function failed to scrub a buffer used for processing remaining bytes smaller than AES_BLOCK_SIZE, potentially leading to the exposure of sensitive d...

CVE-2026-97590

The Linux kernel contains a vulnerability in the s390/crypto implementation where temporary buffers used with the PAES algorithm were not properly scrubbed. Specifically, in the ctr_paes_do_crypt() function, a buffer used to process remaining bytes (less than AES_BLOCK_SIZE) lacked explicit scrub...

CVE-2026-97591

The Linux kernel (specifically the s390/crypto architecture) contained a logic flaw in how it handled return codes when pushing requests to the crypto engine. In the PHMAC function, the crypto_transfer_hash_request_to_engine() call could return EBUSY in addition to EINPROGRESS to signal a success...

CVE-2026-97589

The Linux kernel contains a vulnerability in the s390/crypto subsystem where asynch callbacks return an incorrect error code. Specifically, when crypto_finalize_hash_request() or crypto_finalize_skcipher_request() explicitly completes a request, the do_one_request callback must return 0. Returnin...

CVE-2026-97587

The Linux kernel contained a vulnerability in the perf subsystem affecting RISC-V architectures. The issue stemmed from the available-counter mask being stored as a single unsigned long , while the iteration process used RISCV_MAX_COUNTERS (64). On RV32 systems, this caused the kernel to read pas...

CVE-2026-97588

The Linux kernel contains a vulnerability in the s390/crypto component where persistent -EBUSY errors from hardware during key conversion result in the error being swallowed by the crypto API's completion wrapper. Because the wrapper treats -EBUSY as a queueing status, the completion callback fai...

CVE-2026-97586

The Linux kernel contains a vulnerability in the afs component related to the afs_dir_search_bucket() function. The root cause is a missing kunmap operation for the block utilized in the "bad:" path . The provided documents indicate that this issue has been resolved by ensuring the block is prope...

CVE-2026-97585

The Linux kernel contained a vulnerability in the afs component where a double-kunmap could occur. The root cause is located in afs_edit_dir_remove() , where manually kunmapping blocks without clearing iter.blocks leads to issues if afs_dir_find_block() is called twice consecutively (specifically...

CVE-2026-97584

The Linux kernel contains a vulnerability in the afs component related to an incorrect memory free operation in the afs_lookup_server() function. Specifically, the function was incorrectly freeing an existing server's endpoint state during the cleanup of a candidate server, even though the candid...

CVE-2026-97582

The Linux kernel contains a use-after-free vulnerability within the hwmon: (gpio-fan) component. The issue stems from fan_alarm_irq_handler() queuing fan_data->alarm_work without a corresponding cancellation mechanism, while fan_alarm_notify() dereferences fan_data and the hwmon device. During...

CVE-2026-97583

The Linux kernel contains a slab-use-after-free vulnerability in the AFS (Andrew File System) component. The issue arises because afs_fs_probe_fileserver() fetches the current endpoint state but leaves old_alist as NULL . Consequently, afs_set_peer_appdata() fails to unbind peers removed from the...

CVE-2026-97581

The Linux kernel contains a vulnerability in the verisilicon hantro media driver. The prepare_tile_info_buffer() function fails to properly bound loops when writing entries into the tile_sizes DMA buffer , which is sized based on the PPS uAPI array capacity . This lack of bounds checking can lead...

CVE-2026-97579

The Linux kernel contains a vulnerability in the mediatek vcodec component. Specifically, the function vdec_av1_slice_setup_tile() fails to validate that the number of entries copied from the bitstream tile_info (calculated as tile_cols + 1 and tile_rows + 1) does not exceed the capacity of the m...

CVE-2026-97580

The Linux kernel contains a vulnerability in the rkvdec media driver where HEVC tile loops and PPS IDs were not properly bound to the array capacity. Specifically, the functions compute_tiles_uniform() and compute_tiles_non_uniform() looped over entries based on untrusted PPS data, and assemble_h...

CVE-2026-97578

The Linux kernel contains a vulnerability in the Verisilicon Rockchip VPU981 AV1 decoder. The function rockchip_vpu981_av1_dec_set_tile_info() improperly handles cases where tile_cols (derived from the bitstream) is zero, leading to a division by zero error. Additionally, the function fails to pr...

CVE-2026-97576

The Linux kernel contains a vulnerability in the v4l2-ctrls component where stateless HEVC decoders fail to bound u8 counts for num_tile_columns_minus1 and num_tile_rows_minus1 . Specifically, the std_validate_compound() function does not validate these counts, allowing them to be used as tile-lo...

CVE-2026-97577

The Linux kernel contains a vulnerability in the rockchip AV1 decoder driver. Specifically, the function rockchip_vpu981_av1_dec_set_tile_info() fails to properly validate the number of tiles in an AV1 frame against the submitted entry count and the maximum capacity of the AV1_MAX_TILES buffer. T...

CVE-2026-97574

The Linux kernel contains a vulnerability in the bnxt_en driver where the bnxt_queue_mem_alloc() function performs a shallow copy of the live RX ring into a clone. Because the rx_tpa and rx_tpa_idx_map pointers are not cleared during this copy, they continue to point to the memory of the live rin...

CVE-2026-97575

The Linux kernel contains a vulnerability in the v4l2-ctrls component where stateless AV1 decoders fail to properly bound the tile_info.tile_cols and tile_info.tile_rows fields within std_validate_compound(). These fields are used as loop bounds, array indices for mi_*_starts[] and *_in_sbs_minus...

CVE-2026-97573

The Linux kernel contains a vulnerability in the bnxt_en driver. The function bnxt_rx_ring_reset() fails to properly handle memory allocation errors when reallocating ring buffers. Specifically, bnxt_alloc_one_rx_ring() can return -ENOMEM during bnxt_alloc_one_tpa_info_data(), leaving the rxr-&gt...

CVE-2026-97572

The Linux kernel contains a vulnerability in the bnxt_en driver where bnxt_init_nic() fails to propagate errors from bnxt_init_rx_rings(). Specifically, if bnxt_alloc_one_rx_ring() fails, the return value is ignored, allowing bnxt_init_chip() to enable TPA (TCP Segmentation Offload) on a partiall...

CVE-2026-97571

The Linux kernel contains a vulnerability in the bnxt_en driver within the bnxt_queue_mem_alloc() function. The issue stems from bnxt_alloc_one_tpa_info_data() returning -ENOMEM upon a single allocation failure while leaving remaining rxr->rx_tpa[] entries zeroed. Because bnxt_queue_mem_alloc(...

CVE-2026-97570

The Linux kernel contains a vulnerability in the bnxt_en driver where 57608 NICs with firmware version 233 can experience a crash at boot . The issue arises because the bnxt_alloc_agg_idx function can produce a software ID exceeding the 32 entries allocated for rx_tpa, leading to an out-of-bounds...

CVE-2026-97568

The Linux kernel contains a vulnerability within the mptcp component related to syncookies. The root cause is the use of an uninitialised bit when copying information in the subflow_ulp_clone() function. To resolve this, the backup flag from struct mptcp_subflow_request_sock is now correctly hand...

CVE-2026-97569

The Linux kernel contains a vulnerability in the bnxt_en driver where a burst of packets can cause the queue to stop permanently. This occurs because the driver may defer completions for all packets in a small ring (

CVE-2026-97566

The Linux kernel contains a vulnerability in the in-kernel MPTCP path manager where removing the id 0 endpoint fails to tear down pending announcements. This asymmetry between the id 0 path and non-zero id paths leaves a stale ADD_ADDR announcement entry alive. When the path manager later reselec...

CVE-2026-97567

The Linux kernel contains a vulnerability where a race condition can occur between the disconnect() and rtx events within the mptcp component. This race condition can lead to an inconsistent status . The issue is resolved by implementing a synchronous timer stop operation to prevent the concurren...

CVE-2026-97565

The Linux kernel contains a vulnerability in the CIFSSMBRead() function where it fails to verify that a complete READ_RSP has been received from a server. Specifically, the code dereferences DataLengthHigh , DataLength , and DataOffset without ensuring the response length is at least read_rsp_siz...

CVE-2026-97563

The Linux kernel contains a vulnerability in the SMB1 synchronous read helper CIFSSMBRead() . The function fails to validate the DataOffset field, allowing a malicious or compromised SMB1 server to provide a large DataOffset with an in-range DataLength . This can cause memcpy() to read past the e...

CVE-2026-97564

The Linux kernel contains a vulnerability in the SMB client where the cifs.idmap key type lacks a vet_description hook. This allows userspace to create keys via request_key(2) or add_key(2) containing authority-bearing fields (such as SIDs and uid/gid values) that are improperly treated as kernel...

CVE-2026-97561

The Linux kernel contains a vulnerability where the SMB client fails to honor forceuid and forcegid mount options. Specifically, the functions smb311_posix_info_to_fattr(), cifs_posix_to_fattr(), and parse_sec_desc() unconditionally called sid_to_id(), allowing server-provided values to overwrite...

CVE-2026-97562

The Linux kernel contains a vulnerability in the smb client where a race condition exists during DFS automount expiry . Specifically, tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() fails to take the active reference until after iterate_supers_type() has dropped the s_umou...

CVE-2026-97560

The Linux kernel contains a one-byte out-of-bounds (OOB) read vulnerability within the smb2_parse_native_symlink() function of the SMB client. The flaw occurs when parsing a share-root relative native symlink, where memcpy copies smb_target+1 (skipping the leading separator) but incorrectly uses ...