CVE-2026-45835

CVE-2026-45835: In the Linux kernel, Bluetooth L2CAP code is vulnerable to a NULL pointer dereference in l2cap_sock_new_connection_cb() due to a missing NULL guard. The fix adds the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb(), addressing the null-ptr-deref ...

CVE-2025-39844

CVE-2025-39844 relates to a Linux kernel memory-management bug where page-table synchronization was not consistently performed when vmemmap spans multiple PGD entries. The issue caused intermittent boot failures and a kernel panic (notably on 4-level paging with large persistent memory) due to a ...

CVE-2025-39871

CVE-2025-39871 relates to the Linux kernel dmaengine idxd driver. The fix removes an improper idxd_free() call that could trigger a duplicate put_device() leading to refcount underflow and a use-after-free during module unload. The issue arises in idxd_remove() and during module exit when CONFIG_...

CVE-2025-39929

The CVE-2025-39929 issue is in the Linux kernel SMB client, specifically the smbd_negotiate() path in fs/smb/client/smbdirect.c, where a memory leak can occur if an error path triggers the leak (objects left on __kmem_cache_shutdown()). This memory leak can impact availability. Public advisories ...

CVE-2025-40082

CVE-2025-40082 targets the Linux kernel’s hfsplus code and causes a slab-out-of-bounds read in hfsplus_uni2asc() when listing extended attributes. The issue arises because the expected unicode buffer structure size varies (hfsplus_attr_unistr vs hfsplus_unistr), so a previous fix was insufficient...

CVE-2025-71077

In the Linux kernel vulnerability CVE-2025-71077, tpm2_get_pcr_allocation() did not cap the number of PCR banks, allowing out-of-bounds values to cause more than minimal harm. The fix caps the limit to eight banks, limiting potential damage from external I/O. The issue affects the TPM/PCR allocat...

CVE-2025-71112

The CVE-2025-71112 entry concerns the Linux kernel net/hns3 VLAN handling. A VLAN ID may be used without validation when receiving a VLAN configuration mailbox from a VF, because vlan_del_fail_bmap length (BITS_TO_LONGS(VLAN_N_VID)) can permit out-of-bounds access if the VLAN ID is >= VLAN_N_V...

CVE-2025-71313

Summary (CVE-2025-71313) : In the Linux kernel PCI endpoint driver, there is a missing NULL check after alloc_workqueue(), which can return NULL on memory allocation failure. If a NULL workqueue pointer is later passed to queue_work() in epf_ntb_epc_init(), this can cause a NULL pointer dereferen...

CVE-2026-23103

Technical details about CVE-2026-23103 are not provided in the supplied documents. The description mentions making addrs_lock per port and related fixes, but lacks explicit affected products, versions, or remediation steps. Monitor for updates.

CVE-2026-23132

CVE-2026-23132 : Linux kernel vulnerability in the dw-dp bridge (drm/bridge: synopsys: dw-dp) resolved. The issue concerned error handling in dw_dp_bind(), with three problems: (1) Missing return after drm_bridge_attach() failure, causing continued execution; (2) Resource leak where drm_dp_aux_un...

CVE-2026-23204

CVE-2026-23204 affects the Linux kernel net/sched cls_u32. The root cause is that skb_header_pointer() does not fully validate negative @offset values, enabling a slab-out-of-bounds condition in u32_classify() (reported as BUG: KASAN). The fix replaces skb_header_pointer() with skb_header_pointer...

CVE-2026-23284

Technical details for CVE-2026-23284 are not publicly provided in the supplied documents; none of the connected advisories describe affected product/version or fix for this CVE. Monitor for updates.

CVE-2026-23315

The CVE affects the Linux kernel mt76 wifi driver (mt76_connac2_mac_write_txwi_80211). The root cause is that the function could perform an out-of-bounds access by not validating the frame length before accessing management fields, including mgmt->u.action.u.addba_req.capab. This could enable ...

CVE-2026-31655

CVE-2026-31655 affects the Linux kernel’s pmdomain: imx8mp-blk-ctrl module, where the NOC_HDCP clock must be kept enabled. The underlying issue is an inconsistent clock state that can disrupt the NoC ADB400 port power‑down handshake, potentially causing a system hang. Reported impact is a DoS-lik...

CVE-2026-31681

CVE-2026-31681 affects the Linux kernel netfilter xt_multiport component. The issue is in ports_match_v1() where a non-zero pflags entry is treated as a range start, causing the end of the range to be consumed incorrectly and potentially reading past the last ports[] element when a malformed rule...

CVE-2026-31707

The CVE-2026-31707 issue affects the Linux kernel ksmbd component. The overflow vulnerability in ipc_validate_msg() arises from arithmetic on attacker-controlled fields when computing per-response message sizes, allowing wraparound in three cases (RPC_REQUEST, SHARE_CONFIG_REQUEST, LOGIN_REQUEST_...

CVE-2026-43119

In CVE-2026-43119, the Linux kernel Bluetooth HCI synchronous command infrastructure has a data race on hdev->req_status: __hci_cmd_sync_sk() updates it under req_lock on one workqueue, while other paths (e.g., hci_send_cmd_sync on a different workqueue, plus hci_cmd_sync_complete/cancel) read...

CVE-2026-43260

The CVE concerns the bnxt_en driver in the Linux kernel. The vulnerability stems from RSS context deletion logic that could leak VNICs in firmware when deleting RSS contexts with the interface down, leading to failures when re-opening and restoring RSS contexts. The fix removes the netif_running(...

CVE-2026-43304

CVE-2026-43304 affects the Linux kernel libceph component. The flaw arises when decoding key material in process_auth_done(), where the code failed to enforce an upper bound on key length. The fix defines and enforces CEPH_MAX_KEY_LEN and clamps key material to a fixed-size buffer, addressing a v...

CVE-2026-43334

CVE-2026-43334 concerns the Linux kernel Bluetooth SMP pairing flow. The issue arises in smp_cmd_pairing_req() where the pairing response is built from the initiator auth_req before enforcing the local BT_SECURITY_HIGH, allowing the response to omit SMP_AUTH_MITM if the initiator did. Consequentl...

CVE-2026-43491

CVE-2026-43491 affects the Linux kernel net:qrtr:ns by not bounding the number of server registrations per node. The fixed limit is 256 per node; messages for an old port are not restricted. The issue can cause memory exhaustion. Upstream fix is included in kernel 6.6.141+ (and related advisories...

CVE-2026-43493

CVE-2026-43493 affects the Linux kernel crypto/pcrypt code and concerns MAY_BACKLOG handling. MAY_BACKLOG requests could return EBUSY; the fix adds a check for EBUSY and filters out EINPROGRESS notifications, addressing potential processing instability. The vulnerability is resolved in the Linux ...

CVE-2026-45882

The CVE-2026-45882 issue affects the Linux kernel power supply subsystem, specifically the pm8916_bms_vm driver. A race condition arises from using devm_ variants for IRQ requests before the power_supply handle is registered, causing the handle to be deallocated/unregistered before the IRQ handle...

CVE-2026-45898

The CVE-2026-45898 issue affects the Linux kernel’s RDMA/iwcm component, where flawed work submission logic could cause queue_work() to queue items that are still live, enabling a work item to be processed and freed while still on the workqueue and triggering list corruption. The root cause is th...

CVE-2026-45982

CVE-2026-45982 concerns the Linux kernel ACPICA component, specifically a NULL pointer dereference in the function acpi_ev_address_space_dispatch(). The issue arises from a missed execution path due to an incomplete check, which could be exploited locally (as indicated by the CVSS vector and Red ...

CVE-2026-45998

CVE-2026-45998 affects the Linux kernel RxRPC stack. The vulnerability arises when skb_unshare() fails to unshare a packet during rxrpc_input_packet(); the parent’s skb pointer can be NULL, risking a kernel oops in trace_rxrpc_rx_done(). The fix moves the unsharing logic down to rxrpc_input_call_...

CVE-2026-46038

CVE-2026-46038 relates to the Linux kernel net: qrtr: ns path where a node’s memory is leaked after processing BYE, because the node is not freed in ctrl_cmd_bye() failure or success. The fix removes the node from the Xarray and frees memory in both outcomes. Reported CVSS 3.1/3.1_VECTORS via NVD...

CVE-2026-46046

The CVE reports a refcount leak in ext4_xattr_inode_dec_ref_all() due to not releasing iloc with brelse() after ext4_get_inode_loc(), fixed by commit c8e008b6. OSV entries show patches in Root:Ubuntu 22.04/24.04, Debian, Debian-based RootIO builds, and openSUSE kernel-devel 7.0.11-1.1 for GA medi...

CVE-2026-46083

CVE-2026-46083 concerns the Linux kernel SPI subsystem. The description indicates a fix for resource leaks that occur when a device is being set up and spi_setup() fails during registration, requiring a call to controller cleanup() to avoid leaking resources allocated by setup(). OpenSUSE/SUSE ad...

CVE-2026-46197

The CVE-2026-46197 issue affects the Linux kernel DRM/AMDKFD component, where the nattr field validation for SVM ioctl was insufficient against the reported buffer size, enabling out-of-bounds access via a user-controlled attribute count. The root cause is input size validation failure in the SVM...

CVE-2026-46200

CVE-2026-46200 affects the Linux kernel SPI MPC52xx driver. The issue stems from improper controller deregistration: the driver may deregister the controller after or without ensuring proper release of resources (interrupts, GPIOs) during driver unbind, risking system instability or resource exha...

CVE-2026-46205

Summary (grounded from provided sources): CVE-2026-46205 affects the Linux kernel atomisp driver (staging: media). The root cause is unsafe handling of private IOCTLs; the change disallows all private IOCTLs and returns early when cmd is non-zero to satisfy static checkers. This vulnerability is ...

CVE-2026-46220

CVE-2026-46220 affects the Linux kernel’s drm/amdgpu sdma4 fence emission. The vulnerability stems from two BUG_ON(addr & 0x3) assertions in sdma_v4_0_ring_emit_fence(), which could be triggered by unprivileged userspace submissions via DRM_IOCTL_AMDGPU_CS, causing a kernel panic in a scheduler w...

CVE-2026-46276

CVE-2026-46276 concerns the Linux kernel AMDGPU driver on RDNA4 (GFX 12). The issue: amdgpu_ttm_init_on_chip() is called for GDS, GWS and OA resources regardless of whether they exist; when a resource size is zero, drm_mm_init(0,0) triggers DRM_MM_BUG_ON and can crash the kernel during modprobe o...

CVE-2026-46293

CVE-2026-46293 : In the Linux kernel, the mpfs-ccc clock driver suffers an out-of-bounds access during output registration UBSAN reports. The hws array is allocated for two PLLs and four output dividers, but IDs include two DLLs and their outputs, which the driver does not support. The documented...

CVE-2026-46299

CVE-2026-46299 (Linux kernel) affects the hfsplus filesystem during mount. hfsplus_fill_super() calls hfs_find_init() to initialize a search structure, which grabs tree->tree_lock. If hfsplus_cat_build_key() fails, control jumps to out_put_root without releasing the lock, causing a later clean...

CVE-2026-46330

The CVE-2026-46330 entry concerns the Linux kernel TCP ULP support for SMC. The vulnerability arises when an active TCP socket is converted into an SMC socket by in-place modifications to core VFS structures (struct file, dentry, inode), violating VFS invariants that expect these structures to be...

CVE-2026-52982

The CVE-2026-52982 issue affects the Linux kernel driver rtl8150 for Realtek RTL8150 USB Ethernet devices. A use-after-free (UAF) can occur in rtl8150_start_xmit() when reading skb->len for tx_bytes statistics after usb_submit_urb() is issued, because the skb may be freed in the USB completion...

CVE-2026-53000

CVE-2026-53000 affects the Linux kernel netfilter NAT path. The root issue is partial exposure of nf_hook_ops during error handling, which can lead to unsafe access to internal hook data via the datapath and nat dispatcher flow. Exploitation details are not provided in the documents, but the desc...

CVE-2026-53221

Linux kernel CVE-2026-53221 affects ip6_vti’s vti6_tnl_lookup() where, after an exact tunnel match fails, the fallback search for wildcard tunnels did not consistently verify that candidate tunnels actually have wildcard addresses. This mismatching happens because all tunnel types are stored in a...

CVE-2026-53253

CVE-2026-53253 affects the Linux kernel Bluetooth BNEP stack. The vulnerability arises when a BNEP peer sends a short SDU and the kernel bnep_rx_frame() reads the packet type, then bnep_rx_control() dereferences the control opcode or setup UUID-size byte before ensuring those bytes are present. T...

CVE-2026-53273

CVE-2026-53273 describes a use-after-free in the Linux kernel TEE/OP-TEE path. When a client exits before the supplicant finishes processing, freed request memory could be dereferenced, enabling a potential crash or code execution path. The root cause is a race around request lifetime between the...

CVE-2016-10295

An information disclosure vulnerability in the Qualcomm LED driver (CVE-2016-10295) could allow a local malicious Android app to access data outside its permission levels. Affected product: Android; Kernel version: 3.18. Android ID: A-33781694. The issue is rated Moderate because exploitation req...

CVE-2022-50193

CVE-2022-50193 concerns Linux kernel erofs: wake up all waiters after z_erofs_lzma_head is ready. The issue can cause the decompression thread to hang when mounting erofs a second time due to a sequence where Task A loads lzma config and fills z_erofs_lzma_head after Task B has already slept wait...

CVE-2022-50400

The CVE-2022-50400 issue concerns the Linux kernel greybus: audio_helper code, where debugfs usage was removed due to incorrect handling that could leak memory and even erase all debugfs entries. The fix is to remove all debugfs logic from the audio_helper code; if needed later, a fix for the inc...

CVE-2023-53193

CVE-2023-53193 – Linux kernel (amdgpu): The issue is in the drm/amdgpu driver, specifically gmc_v10_0_hw_fini calling amdgpu_irq_put. The firmware enables gmc.ecc_irq and the host driver is not privileged to enable/disable it, making amdgpu_irq_put in gmc_v10_0_hw_fini meaningless and causing a c...

CVE-2023-53245

CVE-2023-53245 refers to the Linux kernel Hyper-V StorVSC integration for virtual Fibre Channel timeouts. The issue arises from a faulty integration where the FC transport timeout handler (fc_eh_timed_out()) could dereference a NULL rport, causing a kernel panic. The published fix removes the cal...

CVE-2023-53285

CVE-2023-53285 : in the Linux kernel ext4, a bounds-check fix was added in get_max_inline_xattr_value_size() to prevent reading beyond allocated memory if the inode table is corrupted by block-device writes while mounted. This resolves a potential memory read issue in inline xattrs. Impact: HIGH ...

CVE-2023-53472

CVE-2023-53472 affects the Linux kernel PWM driver for LPC32xx. The patch removes handling of PWM channels because LPC32xx PWM controllers expose a single output, so pwm->hwpwm is always 0. This simplifies the code and, per the description, fixes a NULL pointer dereference by ensuring lpc32xx-...

CVE-2025-38434

Technical details for CVE-2025-38434 are not provided in the connected documents. Public information about affected products/versions, root cause, impact, or fixes is not available here. Monitor for updates in the sources referenced by the Initial document.