CVE-2026-31449

The CVE-2026-31449 entry concerns the Linux kernel ext4 extent code. A vulnerability was fixed in ext4_ext_correct_indexes where path[k].p_idx could point outside the valid index range if the on-disk eh_entries were corrupted, causing a slab-out-of-bounds read. The fix validates path[k].p_idx aga...

CVE-2026-31557

Summary of CVE-2026-31557 (Linux kernel) : The issue affects the NVMe over Fabrics target (nvmet/nvmet_rdma) where flushing an asynchronous-event work item on nvmet-wq can recurse the same worker, risking a deadlock and DoS. The root cause is a potential re-entrant lock when nvmet_ctrl_free() flu...

CVE-2026-31623

The CVE-2026-31623 issue affects the Linux kernel net: usb: cdc-phonet driver. A malicious USB device claiming to be a CDC Phonet modem can overflow the skb_shared_info->frags[] array by sending an unbounded sequence of full-page bulk transfers in rx_complete(). The consequence described is a ...

CVE-2026-31655

CVE-2026-31655 affects the Linux kernel’s pmdomain: imx8mp-blk-ctrl module, where the NOC_HDCP clock must be kept enabled. The underlying issue is an inconsistent clock state that can disrupt the NoC ADB400 port power‑down handshake, potentially causing a system hang. Reported impact is a DoS-lik...

CVE-2026-31707

The CVE-2026-31707 issue affects the Linux kernel ksmbd component. The overflow vulnerability in ipc_validate_msg() arises from arithmetic on attacker-controlled fields when computing per-response message sizes, allowing wraparound in three cases (RPC_REQUEST, SHARE_CONFIG_REQUEST, LOGIN_REQUEST_...

CVE-2026-43119

In CVE-2026-43119, the Linux kernel Bluetooth HCI synchronous command infrastructure has a data race on hdev->req_status: __hci_cmd_sync_sk() updates it under req_lock on one workqueue, while other paths (e.g., hci_send_cmd_sync on a different workqueue, plus hci_cmd_sync_complete/cancel) read...

CVE-2026-43120

In the Linux kernel RDMA/irdma driver, CVE-2026-43120 describes a double-free during rereg_user_mr when IB_MR_REREG_TRANS is set. If the trans reg path fails after allocating a new umem, the code releases it but fails to NULL the iwmr->region, causing ib_umem_release to be invoked again during...

CVE-2026-43215

The CVE-2026-43215 issue affects the Linux kernel CIFS implementation: the code used cifs_tcp_ses_lock to guard tcon fields, but this lock protected more than intended. The patch introduces more granular locking (tc_lock) within tcon-related structures (in addition to srv_lock and ses_lock) to re...

CVE-2026-43232

Summary: CVE-2026-43232 is a Linux kernel vulnerability in the FarSync WAN driver (net: wan: farsync) that causes a use-after-free when detaching a FarSync T-series card. The issue arises from a race between tasklets/work queues and card removal: fst_card_info is freed in fst_remove_one() but fst...

CVE-2026-43467

CVE-2026-43467 affects the Linux kernel mlx5_core/mlx5_eswitch stack. Root cause: when moving a device to switchdev mode on a system that does not support IPsec, the code erroneously cleans up IPsec resources, triggering a local crash/DoS. With concrete details from multiple vendors (Red Hat, SUS...

CVE-2026-43491

CVE-2026-43491 affects the Linux kernel net:qrtr:ns by not bounding the number of server registrations per node. The fixed limit is 256 per node; messages for an old port are not restricted. The issue can cause memory exhaustion. Upstream fix is included in kernel 6.6.141+ (and related advisories...

CVE-2026-45844

Summary: CVE-2026-45844 affects the Linux kernel netfilter arp_tables on IEEE1394 (FireWire) interfaces. The vulnerability arises because arp_packet_match() unconditionally parses the ARP payload assuming both source and target hardware addresses exist, while IPv4-over-IEEE1394 ARP omits the targ...

CVE-2026-45946

CVE-2026-45946 affects the Linux kernel ab8500 power supply driver. A race condition arises when IRQs are requested before the power_supply handle is fully registered, leading to a use-after-free if an interrupt fires after deallocation but before IRQ unregistration. The issue can crash the syste...

CVE-2026-45957

CVE-2026-45957 documents a Linux kernel RCU bug: missing recursion protection in rcu_read_unlock() can cause a deadloop when softirq handling runs under ftrace, as shown in the call stack involving raise_softirq_irqoff() and rcu_read_unlock_special(). The issue was fixed by commits that adjust ir...

CVE-2026-45975

CVE-2026-45975 is a Linux kernel vulnerability in the ublk subsystem where a race condition can occur reading struct ublksrv_ctrl_cmd from userspace-mapped memory in the io_uring_sqe. The fix uses READ_ONCE() to copy ublksrv_ctrl_cmd from the io_uring_sqe to a local stack copy and then operates o...

CVE-2026-46086

The CVE-2026-46086 issue affects the Linux kernel’s bridge FDB code. Local FDB entries could be rewritten in place by fdb_delete_local(), changing f->dst to another port or NULL while entries remain alive. Several bridge RCU readers (e.g., br_fdb_fillbuf() via brforward_read()) may observe f-&...

CVE-2026-46130

CVE-2026-46130 concerns the Linux kernel’s dm-verity-fec component. The root cause is an incorrect assumption about parity data layout: when reading parity bytes across blocks, parity bytes for the first RS codeword can be split across parity blocks, causing an out-of-bounds read under certain no...

CVE-2026-46133

The CVE-2026-46133 issue affects Linux kernel’s Soft RoCE (RDMA/rxe) where an unauthenticated UDP packet with an unknown opcode could trigger an out-of-bounds read during ICRC/CRC processing due to missing validation of opcodes before length arithmetic. The advisory describes that entries in the ...

CVE-2026-46153

CVE-2026-46153 affects the Linux kernel 8021q VLAN code. The vulnerability arises because vlan_dev_set_egress_priority() kept cleared egress priority mappings as tombstones in a hash, allowing repeated set/clear cycles with different skb priorities to accumulate nodes and cause memory leakage. Th...

CVE-2026-46160

CVE-2026-46160 concerns the Linux kernel’s Btrfs filesystem: when removing a directory, last_unlink_trans is not updated, which can lead to incorrect fsync behavior if a directory with an open file descriptor is fsynced after removal. This can cause log replay during mount to fail with -EIO, pote...

CVE-2026-46200

CVE-2026-46200 affects the Linux kernel SPI MPC52xx driver. The issue stems from improper controller deregistration: the driver may deregister the controller after or without ensuring proper release of resources (interrupts, GPIOs) during driver unbind, risking system instability or resource exha...

CVE-2026-46219

CVE-2026-46219 concerns a use-after-free in the SPI mpc52xx path of the Linux kernel. The description indicates the state machine work is scheduled by the interrupt handler and must be cancelled after interrupts are disabled to avoid use-after-free. Connected OSV entries show patches in rootio-li...

CVE-2026-52932

In CVE-2026-52932, the Linux kernel xfrm IPcomp path contains a fix to ensure that the allocated destination scatter-gather (dst SG) list is freed on error as well as on success, preventing potential resource leaks. The root cause is improper memory deallocation during error handling in the xfrm ...

CVE-2026-52951

CVE-2026-52951 affects the Linux kernel, in the drm/xe/dma-buf subsystem, due to race conditions in the invalidate_mappings hook during BO (buffer object) handling. The issue arises when xe_bo_alloc() and an attach occur before xe_dma_buf_init_obj() completes, making the BO visible on the attachm...

CVE-2026-53117

Technical details about CVE-2026-53117 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-53159

CVE-2026-53159 (Linux kernel) : The vulnerability is in misc: fastrpc where fastrpc_get_args() uses find_vma() to locate the VMA for a user pointer and compute a DMA address. If the address lies in a gap before the returned VMA, (ptr & PAGE_MASK) - vma->vm_start underflows, corrupting the DMA ...

CVE-2026-53332

CVE-2026-53332 affects the Linux kernel’s Qualcomm NGD (qcom-ngd-ctrl) component. The issue is a race where callbacks can run before the NGD device is fully initialized, leading to operations on uninitialized data and boot issues on affected boards. The vulnerability stems from registering callba...

CVE-2026-53340

CVE-2026-53340 affects the Linux kernel i2c: imx driver. The root cause is an inconsistency between clock disable and pinctrl state switching in runtime PM: in i2c_imx_runtime_suspend(), the clock is disabled before pinctrl_sleep state is selected, so if pinctrl_pm_select_sleep_state() fails the ...

CVE-2007-6434

CVE-2007-6434 affects Linux kernel 2.6.23. A local attacker can create low pages in virtual userspace memory and bypass mmap_min_addr protection by supplying a crafted executable that calls do_brk. This is a local-attack scenario with partial impact on availability as per CVSS 2.0 (low base score...

CVE-2016-6778

CVE-2016-6778 is an Elevation of Privilege affecting the Android kernel path via the HTC sound codec driver. The vulnerability could let a local malicious application execute arbitrary kernel code, requiring initial compromise of a privileged process before exploitation. Affected stack: Android o...

CVE-2016-8469

CVE-2016-8469 is an information-disclosure vulnerability in the Android camera driver affecting Kernel-3.10-based Android devices. The issue could allow a local malicious app to access data outside its permission levels by exploiting a privileged-process assumption; impact is data disclosure with...

CVE-2022-50090

CVE-2022-50090 relates to the Linux kernel/Btrfs: it replaces the hard-coded limit BTRFS_MAX_EXTENT_SIZE with fs_info->max_extent_size. On zoned filesystems, data writes are limited by max_zone_append_size, and a large ordered extent can trigger more extents than expected, causing the estimato...

CVE-2022-50147

CVE-2022-50147 refers to a Linux kernel memory policy bug: mm/mempolicy get_nodes can access the nmask array out of bounds when a user specifies more nodes than supported. The issue is resolved in the Linux kernel (patches referenced), with CVSSv3.1 base score 7.1 (HIGH), local access, low privil...

CVE-2022-50432

CVE-2022-50432 : The Linux kernel kernfs use-after-free is caused by a race where the root node is freed during kernfs_drain(), allowing concurrent kernfs_remove_by_name_ns() calls to dereference freed memory. The fix adds an extra reference to the root of the tree before calling __kernfs_remove(...

CVE-2023-53193

CVE-2023-53193 – Linux kernel (amdgpu): The issue is in the drm/amdgpu driver, specifically gmc_v10_0_hw_fini calling amdgpu_irq_put. The firmware enables gmc.ecc_irq and the host driver is not privileged to enable/disable it, making amdgpu_irq_put in gmc_v10_0_hw_fini meaningless and causing a c...

CVE-2025-38325

CVE-2025-38325 relates to Linux kernel ksmbd: a free_transport operation was added to ksmbd connections to prevent a free_transport function for TCP from being invoked via smbdirect, which could trigger a kernel oops. The connected source notes that the patch implements free_transport ops per tra...

CVE-2025-38551

Technical details about CVE-2025-38551 are not publicly provided in the supplied connected documents. Monitor for updates.

CVE-2025-38559

CVE-2025-38559 (Linux kernel) affects the Intel PMT subsystem on x86 platforms. The issue is a NULL pointer dereference in intel_pmt_read() when an ep (endpoint) is missing, leading to kernel oops in crashlog handling. The fix, as described, augments intel_pmt_entry with a pointer to the pcidev t...

CVE-2025-38622

CVE-2025-38622 — Linux kernel UDP/GSO issue : The vulnerability occurs in the UDP receive path when a packet with virtio_net_hdr using SKB_GSO_UDP and a gso_size smaller than the UDP header can trigger a crash in skb_pull_rcsum, leading to a kernel BUG in net/core/skbuff.c and a local attacker ma...

CVE-2025-38680

The CVE CVE-2025-38680 affects the Linux kernel media: uvcvideo component, where a 1-byte out-of-bounds read can occur in uvc_parse_format(). The root cause is a buffer length check that only guaranteed buf > 2, while the code accesses buffer[3], requiring at least 4 bytes. The vulnerability’s...

CVE-2025-38697

The CVE relates to the Linux kernel JFS: an upper bound check in dbAllocAG when computing the tree index could go out of bounds if filesystem metadata is corrupted. This could enable a local attacker to trigger out-of-bounds conditions in JFS data structures. The vulnerability is resolved in the ...

CVE-2025-38699

CVE-2025-38699 is a Linux kernel double-free fix in the SCSI bfad (bfa) path. When bfad_im_probe() fails during init, bfad->im is freed but not set to NULL. If the driver is later uninstalled and bfad_sm_stopping triggers bfad_im_probe_undo(), the memory at bfad->im can be freed again, enab...

CVE-2025-38705

CVE-2025-38705: In the Linux kernel, writing a string without delimiters to gpu_od/fan_ctrl or pp_power_profile_mode for the CUSTOM profile can cause a NULL pointer dereference in drm/amd/pm. SUSE/OpenSUSE advisories (e.g., SUSE-SU-2025:03600-1) list this alongside many other kernel fixes and ind...

CVE-2025-39675

CVE-2025-39675 affects the Linux kernel DRM/AMD display path. In mod_hdcp_hdcp1_create_session(), get_first_active_display() may return NULL when the display list is empty, causing a NULL pointer dereference. The fix adds a NULL pointer check and returns MOD_HDCP_STATUS_DISPLAY_NOT_FOUND. This mi...

CVE-2025-39724

CVE-2025-39724 affects the Linux kernel serial 8250 driver. When PSLVERR_RESP_EN=1, an error response can be generated reading an empty RBR with FIFO enabled due to a race in serial8250_do_startup/DW paths. The fix wraps serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under port->lock to preve...

CVE-2025-39743

CVE-2025-39743 refers to a Linux kernel vulnerability in the JFS file system where inode pages were not truncated during eviction when the inode’s hard link count was 0. The reproducer observed AGGR_RESERVED_I on the inode copy and eviction with hard link 0, causing clear_inode() to trigger becau...

CVE-2025-39767

CVE-2025-39767 describes a Linux kernel issue on LoongArch where enabling CONFIG_KASAN, CONFIG_PREEMPT_VOLUNTARY_BUILD, and CONFIG_PREEMPT_VOLUNTARY together can trigger a soft deadlock due to slow module load times. The root cause involves module_frob_arch_sections() evaluating PLT/GOT counts; a...

CVE-2025-39783

CVE-2025-39783: Linux kernel PCI endpoint. The configfs group handling in pci_epf_remove_cfs() incorrectly called list_del() on epf_group, which is a list head, causing a slab-use-after-free (KASAN) when tearing down endpoint function drivers with a configfs attribute group. The connected Astra L...

CVE-2025-39815

The CVE-2025-39815 entry corresponds to a Linux kernel vulnerability in the RISC-V KVM area, where a stack overrun could occur while loading vlenb. The issue arises because user-space can place up to 2048 bits into an xlen-sized stack buffer, exceeding the intended xlen capacity. The advisory not...

CVE-2025-39824

The CVE CVE-2025-39824 affects the Linux kernel HID subsystem. A crafted HID descriptor can trigger a use-after-free in hid_input handling during hidinput_connect() after hid_hw_start(), notably via ASUS HID devices (e.g., ASUS ROG N-Key keyboard). The root cause is that capability bitmaps may no...