CVE-2026-80981

A flaw was found in the Linux kernel's net/smc component. A local attacker could exploit a use-after-free vulnerability in the smcllcsrvaddlink function, where a freed memory region is improperly accessed. This can lead to memory corruption and potentially result in a denial of service DoS...

CVE-2026-80971

A flaw was found in the ALSA bcd2000 driver of the Linux kernel. When a USB device using this driver is disconnected while a rawmidi substream is still active, the driver fails to clear the Universal Serial Bus Request Block URB pointers. This oversight allows a local attacker to trigger a...

CVE-2026-80958

A flaw was found in the dm-pcache component of the Linux kernel. The tail-kset read operations, used by cachereplay, the writeback worker, and the garbage collection GC worker, incorrectly calculate the length of the data region. This error causes the system to read beyond the intended segment da...

CVE-2026-89690

A flaw was found in the nfsd component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead to memory corruption. This could result in a system crash...

CVE-2026-89686

A flaw was found in the Linux kernel's Network File System Daemon nfsd for NFSv4 layouts. A race condition allows a remote attacker to trigger a kernel panic, leading to a Denial of Service DoS. This occurs when the nfsd4alloclayoutstateid function accesses a file pointer without proper locking...

CVE-2026-89679

A flaw was found in the Linux kernel's nfsd component. A remote attacker can exploit this by sending a specially crafted SETATTR request that includes specific delegation timestamp attributes and a special NFSv4 state ID. This triggers a null dereference, leading to a kernel crash and a Denial of...

CVE-2026-89660

A flaw was found in the Linux kernel's Network File System Daemon NFSD. This vulnerability, a use-after-free, occurs during the revocation of client administrative states. A race condition can allow a client's memory to be freed prematurely while still being referenced, potentially leading to...

CVE-2026-89652

A flaw was found in the Linux kernel's Ceph file system. A malicious or compromised Ceph Metadata Server MDS can send a specially crafted LOOKUPNAME reply that causes a buffer overflow when copying dentry names during an NFS export operation. This out-of-bounds write can lead to memory corruption...

CVE-2026-89596

A flaw was found in the Linux kernel's forcedeth driver. An off-by-one error in the nvsuspend and nvresume functions, which handle saving and restoring non-PCI configuration space, can lead to an out-of-bounds memory access. This occurs during system suspend and resume operations. If specific...

CVE-2026-89511

A flaw was found in the qede driver in the Linux kernel. Under specific memory pressure conditions, the driver can encounter a NULL pointer dereference when processing network traffic using TPA TCP Segmentation Offload continuation fragments. This issue stems from an uninitialized data pointer,...

CVE-2026-89495

A flaw was found in ocfs2 in the Linux kernel. A malicious or compromised node within a Distributed Lock Manager DLM cluster can send specially crafted messages with unchecked length fields. This can lead to a heap out-of-bounds write, potentially allowing for arbitrary code execution, or an...

CVE-2026-89489

A flaw was found in the Linux kernel. The sysor1katomic syscall, specific to the openrisc architecture, does not adequately validate user-provided pointers. An unprivileged process can exploit this by supplying kernel addresses to the syscall, gaining unauthorized read and write access to kernel...

CVE-2026-80936

A flaw was found in the Linux kernel's mt7925 Wi-Fi driver. During multi-link power-save setup, the mlopmwork is queued with a delay but not properly cancelled when the device is stopped. This can lead to the work item attempting to access a deallocated workqueue, resulting in a kernel warning an...

CVE-2026-89654

A flaw was found in the Ceph file system component of the Linux kernel. A race condition exists in the checknewmap function during session handling. This allows a local attacker to exploit a use-after-free vulnerability by freeing a session while another thread attempts to access it. This could...

CVE-2026-89648

A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph Metadata Server MDS could send a specially crafted reply with an unbounded number of delegated inode intervals. This could cause the client to enter an infinite loop or exhaust memory resources, leading to a denia...

CVE-2026-89644

A flaw was found in the Linux kernel's btrfs filesystem. When performing direct I/O writes in a NOCOW No Copy-On-Write range, an extent map reference may not be properly released if an error occurs during extent creation. This oversight can lead to an extent map leak, potentially causing memory...

CVE-2026-89630

A flaw was found in the Linux kernel's Server Message Block SMB client. An incorrect calculation of the dataoffset bound in the isvalidoplockbreak function can lead to a read overflow. This vulnerability allows a malicious SMB server to potentially trigger an out-of-bounds read, which could resul...

CVE-2026-89624

A flaw was found in the Linux kernel's universal-pidff driver. This vulnerability occurs when the force-feedback initialization fails, leaving a hidraw character device active. A local attacker can exploit this by opening the device, leading to a use-after-free condition where the system attempts...

CVE-2026-89598

A flaw was found in the Linux kernel's fbdev framebuffer device subsystem, specifically within the ssd1307fb driver. This vulnerability occurs when display damage callbacks, which handle updates to the display, perform synchronous I2C Inter-Integrated Circuit transfers from an atomic context. Thi...

CVE-2026-89566

A flaw was found in the Linux kernel's jbd2 component. When the kernel's journaling block device jbd2 processes busy checkpoint buffers, it can skip a crucial rescheduling check. This oversight can lead to prolonged holding of a critical lock, causing other central processing units CPUs to wait...

CVE-2026-89553

A flaw was found in the Linux kernel's nouveau/gem component. A race condition exists where the graphics execution manager GEM close path can close a virtual memory area VMA while an information lookup is still trying to access it. This timing issue leads to a use-after-free vulnerability, which...

CVE-2026-89547

A flaw was found in the Linux kernel's SUNRPC component. A local administrator, under specific conditions of memory pressure or fault injection during RPC server startup, can trigger a failure in per-CPU counter allocation. This failure leads to uninitialized counters, which, when subsequently...

CVE-2026-89527

A flaw was found in the Linux kernel's svcrdma module. This vulnerability occurs when a listener creation fails, leading to an improper release of a network namespace reference. This resource leak can be exploited by a local attacker, potentially causing a denial of service DoS by exhausting syst...

CVE-2026-89515

A flaw was found in the Linux kernel's SCSI core component. When processing data transfers using scatter-gather lists, the system does not properly initialize padding bytes for unaligned data elements. This can result in the exposure of uninitialized memory, potentially allowing a local attacker ...

CVE-2026-89512

A flaw was found in the Linux kernel's remoteproc SCP component. This vulnerability involves a device reference leak, where the system fails to properly release a reference to a device during a driver data lookup. This occurs specifically before the driver has been fully bound. A local attacker...

CVE-2026-89458

A flaw was found in the Linux kernel's s390/dasd component. The dasdinthandler function incorrectly marks failed Extended Sense Data ESE read operations as successful when processing unallocated ESE tracks. This leads to the block layer receiving stale or uninitialized memory instead of properly...

CVE-2026-89457

A flaw was found in the s390/dasd component of the Linux kernel. An unprivileged local user can trigger a null pointer dereference by reading specific world-readable sysfs attributes while the device is being brought online. This can lead to a kernel panic, resulting in a denial of service...

CVE-2026-81016

A flaw was found in the Linux kernel. Specifically, within the AMD Platform Management Controller PMC component, the amdstbs2dinit function does not properly validate memory addresses returned by System Management Unit SMU commands. This can result in the kernel attempting to map a critical memor...

CVE-2026-81006

A flaw was found in the Linux kernel's Intelligent Platform Management Interface IPMI component. During the registration of an IPMI system management interface, an error in the cleanup process can leave a system file sysfs attribute registered even after its associated memory has been released...

CVE-2026-80997

A flaw was found in the Linux kernel's IP Accelerator IPA network driver. Specifically, the ipastartxmit function incorrectly manages the transmit TX queue during a device's runtime resume process. This can lead to the TX queue stopping permanently because the mechanism intended to restart it is...

CVE-2026-80995

A flaw was found in the Linux kernel's MCTP Message Control Transport Protocol networking implementation. This vulnerability arises because the mctproutelookup function accesses a route device without holding a persistent reference, allowing the device to be deallocated while still in use. A loca...

CVE-2026-80994

A flaw was found in the Open vSwitch component of the Linux kernel. A local attacker could exploit a use-after-free vulnerability during flow deletion. This occurs due to a race condition where the flow mask is freed prematurely, allowing subsequent operations to access deallocated memory...

CVE-2026-80992

A flaw was found in the net: ravb component of the Linux kernel. This vulnerability allows for a NULL pointer dereference when the Precision Time Protocol PTP clock's index is queried before it is properly initialized or if its registration fails. This issue could lead to a system crash, resultin...

CVE-2026-80957

A flaw was found in the dm-pcache component of the Linux kernel. A local attacker could exploit a vulnerability in the cachereplay function, which does not properly handle a forged last-kset chain. By crafting a malicious chain that points back to an already visited segment, an attacker can cause...

CVE-2026-80952

A flaw was found in the Linux kernel's i3c master component. During device unregistration, a race condition can occur where the device descriptor is prematurely cleared. This can lead to an information leak, exposing kernel stack contents in the generated modalias. Additionally, this flaw could...

CVE-2026-89693

A flaw was found in the Linux kernel's Network File System NFS daemon, nfsd. This vulnerability arises from improper error handling within the nfsd4create function, which is responsible for creating files and directories. When Access Control Lists ACLs are translated, any errors are silently...

CVE-2026-89634

A flaw was found in the Server Message Block SMB client within the Linux kernel. An integer overflow in the ALIGN function, specifically within the symlinkdata error context loop, can lead to an out-of-bounds read. This issue allows a malicious SMB server to cause a denial of service DoS by...

CVE-2026-89583

A flaw was found in the Linux kernel's Bluetooth subsystem. An out-of-bounds OOB read vulnerability exists in the eirgetservicedata function due to incorrect length calculation when parsing Extended Inquiry Response EIR advertising data. A remote attacker, by sending a specially crafted periodic...

CVE-2026-89569

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. This vulnerability arises because the system does not properly manage memory when handling Bluetooth security confirmations. A race condition allows a part of the system to free memory that is still in use by another part, leading...

CVE-2026-89544

A flaw was found in the Linux kernel's SUNRPC component. Multiple defects in the gssxdecoptionarray XDR option-array decoder's error handling can lead to a NULL dereference, a reference count leak, and a use-after-free vulnerability. An attacker could potentially exploit these issues by providing...

CVE-2026-89543

A flaw was found in the kernel's sunrpc component. A use-after-free vulnerability can occur due to improper handling of clnt-pipefssb pointers during mount and unmount events. This can lead to stale pointers, which, when accessed, may result in a system crash Denial of Service...

CVE-2026-89533

A flaw was found in the svcrdma component of the Linux kernel. Incorrect offset arithmetic in the svcrdmareadchunkrange function can lead to a u32 underflow. This underflow can cause the system to attempt to allocate a large amount of memory, potentially resulting in a Denial of Service DoS due t...

CVE-2026-89476

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could exploit this by sending specially crafted duplicate RECONF responses. This action can cause an underflow in the stream-outcnt counter, potentially leading to unexpected system...

CVE-2026-89450

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv module. A Virtual Machine Manager VMM can exploit this vulnerability by providing a virtual Stream ID vSID that exceeds the intended 20-bit width of the SIDMATCH field. This improper input validation causes the system to incorrectly...

CVE-2026-80935

A flaw was found in the Linux kernel's Wi-Fi driver for MediaTek MT7996 devices. A malicious or malfunctioning Wi-Fi device can exploit improper validation of an EEPROM Electrically Erasable Programmable Read-Only Memory address during a copy operation. This can lead to an out-of-bounds write,...

CVE-2026-89643

A flaw was found in the Linux kernel's audit subsystem. When fsnotify rules are automatically removed, the system incorrectly manages memory references, leading to a situation where freed memory can be accessed again. This memory corruption vulnerability could allow a local attacker to cause a...

CVE-2026-89626

A flaw was found in the Linux kernel's Human Interface Device HID sensor custom driver. When creating sysfs groups for custom sensor fields, the hidsensorcustomaddattributes function fails to properly clean up previously created groups if an error occurs. This improper resource management could...

CVE-2026-89593

A flaw was found in the Linux kernel's huge page hugetlb subsystem. This vulnerability occurs when a huge page of memory is shared between a parent and a child process. If the parent process unmaps the huge page before the child, the system can incorrectly reduce the count of reserved huge pages...

CVE-2026-89590

A flaw was found in the accel/rocket driver within the Linux kernel. Incorrect error handling in the rocketjobrun function can lead to resource leaks. This occurs when the system fails to properly release references to Direct Memory Access DMA fences and Power Management PM resources during error...

CVE-2026-89555

A flaw was found in the Linux kernel's Multiprotocol Label Switching MPLS subsystem. When processing specially crafted Geneve packets through an MPLS multipath setup, a use-after-free vulnerability occurs. This issue arises because a cached header pointer hdr is not reloaded after pskbmaypull...