CVE-2026-23105

CVE-2026-23105 (Linux kernel) : A fix in the net/sched/qfq code changes the activation check of a class from relying on the child qdisc’s qlen to using cl_is_active in qfq_rm_from_ag. This patch makes activation determination more consistent and aims to prevent exploits that could manipulate chil...

CVE-2026-43116

The CVE-2026-43116 issue affects the Linux kernel’s netfilter ctnetlink master conntrack handling. The root cause is insufficient locking around the master conntrack object, which can become invalid while still referenced (exp->master). The fix extends the nf_conntrack_expect_lock and the spin...

CVE-2026-43247

CVE-2026-43247 affects the Linux kernel media driver for wave5 (chips-media). The issue causes a kernel panic triggered by an asynchronous SError interrupt when the system enters suspend mode due to an autosuspend delay timeout, leading to an unresponsive system (DoS-like impact). The vulnerabili...

CVE-2026-45840

CVE-2026-45840 : The vulnerability in the Linux kernel openvswitch path allows a CAP_NET_ADMIN user to overflow the vport netlink reply buffer by providing a large upcall PID array, triggering a -EMSGSIZE and a kernel BUG. The root cause is ovs_vport_set_upcall_portids() accepting any non-zero mu...

CVE-2026-46136

CVE-2026-46136 affects the Linux kernel wifi driver mt7921 (mt76) where a buf_len underflow in the country power setting retrieval can occur after changes to the CLC power table. This underflow may cause an almost infinite loop or an invalid power setting, leading to driver initialization failure...

CVE-2026-46147

CVE-2026-46147 concerns the Linux kernel KVM on ARM64, where two bugs in vCPU initialisation can leak pin references to host vCPU/SVE pages and allow observation of a partially initialised vCPU object. The fixes extract a helper for vCPU registration, ensure proper unpinning on error, and enforce...

CVE-2026-46151

CVE-2026-46151 affects the Linux kernel USB printer driver usblp, causing a heap leak in IEEE 1284 device ID handling due to short GET_DEVICE_ID responses. The issue stems from usblp_ctrl_msg() discarding actual bytes and usblp_cache_device_id_string() trusting a 2‑byte length prefix, exposing st...

CVE-2026-46273

The CVE-2026-46273 entry describes a Linux kernel vulnerability in the ibmveth driver affecting Power systems: GSO offload fails when MSS < 224 bytes, potentially freezing the network adapter and causing DoS until a manual reset. The fix adds an ndo_features_check to disable GSO for MSS 1; si...

CVE-2026-53071

CVE-2026-53071 concerns the Linux kernel Bluetooth L2CAP implementation. The flaw arises when l2cap_ecred_reconf_rsp() deletes a channel without holding l2cap_chan_lock(), unlike other callers which acquire the lock first. This can allow a remote BLE device to corrupt the channel list while anoth...

CVE-2026-53275

CVE-2026-53275 affects the Linux kernel IPv6 multicast path (net/ipv6/mcast.c) during MLD query processing. A pointer to the multicast group address is captured during initial packet parsing but is not reloaded after skb header changes from pskb_may_pull(), leading to a use-after-free in __mld_qu...

CVE-2026-53328

CVE-2026-53328 relates to the Linux kernel sched_ext path, where a WARN was triggered during cgroup migration when scx_cgroup_move_task() encountered a NULL cgrp_moving_from. The root cause was a mismatch between cgroup identity used for migration (css) and identity used for migration triggering,...

CVE-1999-1166

CVE-1999-1166 affects Linux 2.0.37 and is caused by not properly encoding the Custom segment limit, which allows local users to gain root privileges by accessing or modifying kernel memory. The connected documents reiterate the same description and do not provide a concrete remediation, workaroun...

CVE-2002-0046

The CVE-2002-0046 vulnerability affects the Linux kernel (and possibly other OS) where remote attackers can read memory by sending fragmented ICMP packets that trigger an ICMP TTL Exceeded response containing memory fragments. This exposes partial confidentiality and relies on ICMP handling in th...

CVE-2002-0499

The CVE relates to the Linux kernel vulnerability where the d_path function truncates long pathnames without error in Linux kernel versions 2.2.20 and earlier, and 2.4.18 and earlier. This behavior can cause local users to cause programs to operate on incorrect directories, potentially enabling i...

CVE-2006-0036

CVE-2006-0036 affects the Linux kernel (2.6.14 and other versions) via the ip_nat_pptp code in the PPTP NAT helper (netfilter/ip_nat_helper_pptp.c). The vulnerability occurs when processing an inbound PPTP_IN_CALL_REQUEST packet, which can trigger a null pointer dereference in an offset calculati...

CVE-2016-10285

CVE-2016-10285 concerns an elevation-of-privilege in the Qualcomm video driver within Android's kernel (Kernel-3.18). A local malicious application could execute arbitrary code in kernel context if it first compromises a privileged process. The issue is rated High and requires local access with u...

CVE-2016-10296

CVE-2016-10296 is an information-disclosure vulnerability in the Qualcomm shared memory driver affecting Android kernels those listed (Kernel-3.10, Kernel-3.18). The issue could allow a local malicious application to access data beyond its permissions, and is categorized as Moderate because explo...

CVE-2016-8393

CVE-2016-8393 describes an elevation of privilege in the Synaptics touchscreen driver that could let a local malicious Android application execute arbitrary code in kernel context. Affected product: Android (kernel 3.10). Root cause: a vulnerability in the Synaptics touchscreen driver enabling co...

CVE-2016-8473

CVE-2016-8473 is an information-disclosure vulnerability in the STMicroelectronics driver on Android (Kernel-3.10). A local, malicious app could access data outside its permissions after compromising a privileged process. Affected devices listed for this CVE include Nexus 5X and Nexus 6P. The pat...

CVE-2016-8478

CVE-2016-8478 describes an information-disclosure vulnerability in the Qualcomm video driver on Android (Kernel 3.18). The issue allows a local malicious application to access data outside its permission levels, but only after compromising a privileged process. The root cause is information expos...

CVE-2016-8483

CVE-2016-8483 describes an information-disclosure vulnerability in the Qualcomm power driver used by Android on Kernel-3.10. A locally installed, malicious app could access data outside its permission levels due to a flaw in the Qualcomm power driver component. The issue is categorized as High ri...

CVE-2017-0536

CVE-2017-0536 concerns an information-disclosure flaw in the Synaptics touchscreen driver on Android, affecting Kernel-3.10 and Kernel-3.18. The vulnerability could let a local malicious process access data outside its privileges, requiring compromise of a privileged process. Publicly disclosed d...

CVE-2017-0580

CVE-2017-0580 is an elevation-of-privilege flaw in the Synaptics Touchscreen driver within Android’s kernel (3.18). A local malicious process could exploit the driver to run arbitrary code in kernel context. The issue is described as High severity, contingent on compromising a privileged process ...

CVE-2023-53361

CVE-2023-53361 affects the Linux kernel on LoongArch where pmd_leaf() was not defined, causing a panic in ksm06 during LTP tests (Huge page pmd to pte_present). The issue is resolved by adding LoongArch-specific p?d_leaf() definitions (as per commits referenced in the CVE description). The connec...

CVE-2025-38096

The connected SUSE/OpenSUSE advisory confirms CVE-2025-38096 is addressed by an openSUSE Leap 16.0 kernel security update (openSUSE-SU-2025-20081-1). The CVE concerns the Linux kernel wifi/iwlwifi code, specifically iwl_trans_reclaim warning behavior when the FW is not alive or a FW restart is pe...

CVE-2025-38311

CVE-2025-38311 affects the Linux kernel iavf driver. Root cause: removal of the crit_lock to avoid error-prone try_locks, replacing it with netdev_lock in most cases. This change aims to fix deadlock scenarios observed during VF removal by canceling work without netdev_lock and by expanding the p...

CVE-2025-38329

CVE-2025-38329 – Linux kernel: firmware: cs_dsp: fixes OOB memory read in KUnit test (wmfw info). KASAN reported out-of-bounds access in cs_dsp_mock_wmfw_add_info() where source string length was rounded up to the allocation size. Impact: local attacker with LOW privileges; confidentiality and av...

CVE-2025-38368

CVE-2025-38368 concerns the Linux kernel fix for a NULL dereference in the tps6594-pfsm subsystem. The issue arises in the misc: tps6594-pfsm driver where devm_kasprintf() could return NULL for pfsm->miscdev.name. The patch adds a NULL pointer check in tps6594_pfsm_probe() to prevent dereferen...

CVE-2025-38511

CVE-2025-38511 affects the Linux kernel DRM/xe/pf LMEM handling: when provisioning VFs, LMEM PTEs beyond the actually provisioned LMEM range may remain stale, risking leakage to other VFs or PF pages. The fix is to explicitly clear all new LMTT pages on allocation to eliminate this gap. The chang...

CVE-2025-38532

Technical details for CVE-2025-38532 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2025-38727

Linux kernel vulnerability CVE-2025-38727 affects netlink in the Linux kernel. A bug in netlink_attachskb() may cause an infinite retry loop when memory checks for skb->truesize against sk_rcvbuf are inconclusive (rmem + skb->truesize > sk_rcvbuf), potentially triggering an rcu_sched sta...

CVE-2025-38728

Technical details for CVE-2025-38728 are not publicly provided in the supplied documents. Monitor official advisories and vendor notices for updates.

CVE-2025-39700

CVE-2025-39700 concerns the Linux kernel damon migration code. According to connected advisories, damon_migrate_pages() can perform migration to an invalid target node, triggering a kernel BUG (PAGEFAULT/OOP) on local execution. The fix adds a target-node validity check in damon_migrate_pages(), ...

CVE-2025-39798

CVE-2025-39798 concerns the Linux kernel’s NFS automount handling. The issue arises from how capabilities are set across a new filesystem boundary: capabilities cannot be inherited when crossing into a new filesystem, so they must be reset to minimal defaults and probed again. The connected advis...

CVE-2025-71074

CVE-2025-71074 concerns the Linux kernel’s functionfs subsystem, where a race between open and removal can leave a freed object referenced by file->private_data. The root cause is the way ffs->opened is updated; using atomic_dec_and_test() vs atomic_add_return() leads to a window where an o...

CVE-2025-71304

CVE-2025-71304 — Linux kernel Smack DOI handling : The issue arises when writing to /smack/doi with a value previously used, which can disable networking for non-ambient labels. This can lead to privilege escalation, DoS, or information leaks. Debian/RootOS OSV notes indicate patches exist (e.g.,...

CVE-2026-23066

CVE-2026-23066 concerns the Linux kernel RXRPC receive path. The issue arises in rxrpc_recvmsg() where, if MSG_DONTWAIT is requested and the front of the recvmsg queue has its mutex held, the call is unconditionally requeued, potentially corrupting the recvmsg queue and causing Use-After-Frees or...

CVE-2026-31657

CVE-2026-31657 affects the Linux kernel batman-adv component. The flaw arises when batman-adv’s batadv_bla_add_claim() can replace claim->backbone_gw and drop the old gateway’s final reference while readers still follow the pointer. The netlink claim dump path dereferences claim->backbone_g...

CVE-2026-43049

CVE-2026-43049 affects the Linux kernel HID logitech-hidpp driver (Logitech G920 force feedback). If force feedback init fails, resources may be torn down inconsistently, enabling a use-after-free (UAF) if userspace still references dangling objects. The fixed approach chose to warn but return su...

CVE-2026-43391

CVE-2026-43391 affects the Linux kernel nsfs component. The issue arises from insufficient permission checks when opening handles, enabling privileged services to potentially view other privileged services’ namespaces and leak information. The fix centralizes policy via may_see_all_namespaces() a...

CVE-2026-45843

CVE-2026-45843 affects the Linux kernel’s SLIP/VJ-compressed TCP header handling (slip and slhc_uncompress). The vulnerability stems from decode() and pull16() not enforcing bounds against the packet end, and decode() masking its return value to 0xFFFF, causing potential over-reads when a compres...

CVE-2026-45919

CVE-2026-45919 relates to Linux kernel sched/rt self-IPI loops caused by LB on CPU0. A patch fixes the issue by filtering out the initiating CPU in rto_next_cpu to prevent self-IPIs and CPU hardlockups. Public OSV entries show Root:Ubuntu patches (e.g., ROOT-OS-UBUNTU-2404-CVE-2026-45919 and ROOT...

CVE-2026-45936

The CVE-2026-45936 entry concerns a race in the Linux kernel power_supply_changed() handling for Goldfish power supplies. The issue arises when using devm_ allocations for IRQs before the power_supply handle is allocated/registered, creating a window where an interrupt fires after the power_suppl...

CVE-2026-46032

Summary: CVE-2026-46032 relates to Linux kernel KVM nSVM, where a failed restore of L1 host CR3 during a nested VMEXIT could leave L1 with corrupted state and trigger a triple fault instead of a clean recovery. The fix removes the nested_svm_vmexit return value and ensures proper cleanup, resulti...

CVE-2026-46189

CVE-2026-46189 affects the Linux kernel RDMA pvrdma component (pvrdma_alloc_ucontext). The issue is a double free: pvrdma_uar_free() is invoked in pvrdma_dealloc_ucontext() and is erroneously called before, creating a double free condition. Concrete fixes exist in OSV entries for multiple distrib...

CVE-2026-46238

CVE-2026-46238 affects the Linux kernel’s BAT IV implementation via the batman-adv subsystem. The issue stems from caching an auxiliary originator pointer derived from a temporary lookup in neigh_node state, where the pointer can be freed or become stale after purge handling. The documented fix i...

CVE-2026-46315

CVE-2026-46315 affects the Linux kernel’s io_uring waitid path. The issue arises because IORING_OP_WAITID stores results in io_waitid::info and may copy stale data to userspace if the wait completes without a child event. The fix is to clear the result storage during prep so the kernel’s path mir...

CVE-2026-52914

In the Linux kernel, the batman-adv component is affected by CVE-2026-52914. The root cause is an accounting bug where the accumulated fragment length used for validating queued fragment chains can be truncated during updates. This allows malformed fragment chains to bypass validation and drive r...

CVE-1999-0782

KDE kppp is affected by CVE-1999-0782. Local users can create a directory in an arbitrary location by manipulating the HOME environment variable. The core issue is the use of HOME to determine user directories, enabling an attacker with local access to create files/directories outside their inten...

CVE-1999-1442

The CVE-1999-1442 entry describes a bug in AMD K6 processors running Linux 2.0.x and 2.1.x kernels where a specific sequence of instructions can be used by a local attacker to trigger a denial of service (kernel crash). Affected component: AMD K6 processor in these Linux kernel versions; root cau...