CVE-2025-38660

Summary: In the Linux kernel, the vulnerability in the Ceph code path arises because parse_longname() uses strrchr() without a guaranteed NUL-terminated string. This leads to improper handling when building arguments with kmemdup_nul() for kstrtou64(), since the string copy may not be NUL-termina...

CVE-2025-39677

CVE-2025-39677: In the Linux kernel, backlog accounting was fixed for qdisc_dequeue_internal affecting tbf-backed qdiscs (hhf, fq, fq_codel, fq_pie). The root cause was that when dropping packets to satisfy a new limit, only qlen was accounted for for some cases (gso_skb path), omitting qdisc_qst...

CVE-2025-39813

CVE-2025-39813 concerns the Linux kernel ftrace subsystem. A race between ftrace_dump() and trace_pipe reads could trigger WARN_ON_ONCE in trace_printk_seq() when trace data is consumed by other readers, causing iter.seq to be mispopulated. The documented fix moves the trace_printk_seq() call ins...

CVE-2025-39817

CVE-2025-39817 — Linux kernel efivarfs_d_compare may trigger a slab-out-of-bounds in memcmp when dentry->d_name.len

CVE-2025-39848

CVE-2025-39848 affects the Linux kernel’s ax25_kiss_rcv() path. The root cause is queuing or mangling input skbs without verifying whether the skb is shared, which could trigger a crash in __netif_receive_skb_core() after a regression linked to per-netns packet chains. The description and connect...

CVE-2025-39869

CVE-2025-39869: Linux kernel memory allocation bug in dmaengine: ti: edma caused out-of-bounds writes to queue_priority_map due to allocating with sizeof(s8) for a 2D array; manifested as kernel crashes on ARM (BeagleBoard-X15). The issue is fixed by changing the allocation to sizeof(*queue_prior...

CVE-2025-39902

The CVE-2025-39902 issue affects the Linux kernel mm/slub, where object_err() may access metadata for an invalid pointer, potentially crashing the kernel. The root cause is accessing object metadata when the pointer is invalid; a path is when alloc_consistency_checks() flags an invalid pointer du...

CVE-2025-68749

CVE-2025-68749 relates to the Linux kernel’s acceleration subsystem (ivpu) and a race condition when unbinding BOs. The issue could permit improper unmapping timing during context teardown because a BO might be removed from the BOs list before unmapping completes. The connected Astra Linux bullet...

CVE-2026-23067

CVE-2026-23067 centers on an integer signedness bug in the Linux kernel’s ARM IOMMU path (io-pgtable-arm). __arm_lpae_unmap() returned a size_t (unsigned) but could yield -ENOENT on error, turning into a large positive value on 64-bit systems and propagating through the call chain to __iommu_unma...

CVE-2026-23171

CVE-2026-23171 is a Linux kernel bonding driver use-after-free bug. It occurs when an enslave failure happens after a new slave is added to the bond’s slave array, risking use-after-free because the new slave could be used before cleanup frees it. The fixed sequence moves the slave-array update t...

CVE-2026-23192

Summary (CVE-2026-23192) : This is a use-after-free in the Linux kernel’s linkwatch subsystem. When a network device is deleted while linkwatch events are pending, the device reference may be freed prematurely (in linkwatch_do_dev), allowing __linkwatch_run_queue to access a freed device. The fix...

CVE-2026-23206

Summary: CVE-2026-23206 affects the Linux kernel dpaa2-switch driver where zero interfaces (num_ifs == 0) caused a NULL-like ZERO_SIZE_PTR allocation and a kernel panic during probe. The issue stems from allocating arrays with kcalloc() using ethsw->sw_attr.num_ifs and dereferencing ports[0] i...

CVE-2026-23276

CVE-2026-23276 fixes a recursion vulnerability in the Linux kernel networking stack. When a bonded interface in broadcast mode has GRE tunnel slaves, multicast/broadcast traffic could trigger infinite recursion between bond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), risking a kernel st...

CVE-2026-23288

The CVE-2026-23288 issue is in the Linux kernel’s accel/amdxdna component. It describes an out-of-bounds write caused by clearing the command header with memset() before validating the remaining space in a command slot, when the slot space is smaller than the header. The root cause is performing ...

CVE-2026-23400

Summary of CVE-2026-23400 : In the Linux kernel, the rust_binder component is affected by a deadlock risk when processing death notifications. The root cause is calling set_notification_done() while the process lock (proc lock) is still held and the current thread is not a looper, which can cause...

CVE-2026-23448

Vulnerability summary (CVE-2026-23448). In the Linux kernel, the net: usb: cdc_ncm path has a bounds-check defect related to NDP16/DPE16 processing. The function cdc_ncm_rx_verify_ndp16() correctly accounts for the NDP offset in the first check, but the second check ignores ndpoffset when validat...

CVE-2026-31396

Summary: CVE-2026-31396 affects the Linux kernel’s net/macb and PTP clock subsystem. The root cause is a use-after-free in ptp_clock_index() when the PTP clock is accessed via get_ts_info while the interface’s PTP clock object has been deregistered. This allows a local attacker to trigger a crash...

CVE-2026-31663

The CVE-2026-31663 vulnerability affects the Linux kernel xfrm subsystem, where a race between asynchronous crypto completion and device teardown could lead to using a freed dev reference. The fix changes the reference handling: the dev ref is no longer released on async resume entry and is inste...

CVE-2026-31692

In The Linux kernel, CVE-2026-31692 affects the rtnetlink path: the peer namespace CAP_NET_ADMIN check is missing in rtnl_newlink() when creating paired devices (e.g., veth, vxcan, netkit). This enables an unprivileged user with a user namespace to create interfaces in arbitrary network namespace...

CVE-2026-43029

The CVE-2026-43029 issue affects the Linux kernel MPTCP implementation. When data is received with MSG_PEEK and MSG_WAITALL, skb’s are not removed from the sk_receive_queue, causing sk_wait_data() to incorrectly report data available and potentially trigger a soft lockup. The root cause is the mi...

CVE-2026-43047

The CVE-2026-43047 issue concerns the Linux kernel HID multitouch subsystem. A malicious or misconfigured HID device could answer a feature request with a different report ID than requested, causing the HID core to misinterpret data and potentially trigger out-of-bounds writes. The bug is fixed b...

CVE-2026-43109

The CVE-2026-43109 issue concerns Linux kernel x86 shadow stacks where shstk_pop_sigframe() did not check errors from mmap_read_lock_killable(), and related __must_check annotations were missing. The connected OSV entries confirm patches in rootio-linux for Ubuntu/Debian releases (e.g., Ubuntu 22...

CVE-2026-43110

CVE-2026-43110 concerns the Linux kernel brcmfmac Wi‑Fi driver. The issue arises when processing firmware interface (IF) events: the code validates the firmware-provided interface index but still uses the raw bsscfgidx as an array index without a matching range check, enabling out-of-bounds acces...

CVE-2026-43376

CVE-2026-43376 affects ksmbd in the Linux kernel. The vulnerability arises from freeing oplock_info with kfree() while it can still be accessed under RCU read-side critical sections (e.g., opinfo_get), allowing a use-after-free. The fixes across connected reports switch to deferred freeing via ca...

CVE-2026-43476

CVE-2026-43476 affects the Linux kernel’s IIO sensor driver for SPS30 (iio: chemical: sps30_i2c). The root cause is a faulty buffer size calculation in sps30_i2c_read_meas() where sizeof(num) yields sizeof(size_t) (8 bytes on 64-bit) instead of the intended 4-byte __be32 element size; the fix use...

CVE-2026-45836

The CVE-2026-45836 vulnerability affects the Linux kernel Bluetooth L2CAP code and stems from a missing NULL guard in l2cap_sock_get_sndtimeo_cb(), which can cause a null pointer dereference. The issue is resolved by adding the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_s...

CVE-2026-45904

The CVE-2026-45904 issue affects the Linux kernel’s PowerPC EEH driver, where a restructuring workaround caused a recursive lock scenario around pci_lock_rescan_remove. The problem arose when EEH event handling briefly acquired the PCI bus lock while eeh_pe_bus_get() could also attempt the same l...

CVE-2026-45938

CVE-2026-45938 pertains to the Linux kernel pm8916_lbc power supply module. The issue is a use-after-free caused by a race between IRQ handling and power_supply handle lifetime: if IRQs are requested before the power_supply handle is registered, an interrupt can occur after the handle is freed bu...

CVE-2026-46049

CVE-2026-46049 concerns the Linux kernel ALSA ctxfi driver (S/PDIF path). The issue arises in spdif_passthru_playback_setup() when pll_rate is not updated (remains 0), causing the MSR calculation loop to spin if 32000 Hz is skipped. The fix adds a fallback: if atc->pll_rate is 0, use atc->r...

CVE-2026-46079

CVE-2026-46079 concerns the Linux kernel RBD path. The issue arises when device_add_disk() is followed by a failure in device_add_disk(); the code can call rbd_free_disk() twice and then rbd_dev_device_release(), causing a null-ptr-deref in __blk_mq_free_map_and_rqs() during blk-mq cleanup. The f...

CVE-2026-46102

The CVE-2026-46102 issue affects the Linux kernel network stream parser (net: strparser). When the stream parser is aborted (e.g., after a message assembly timeout), the partially assembled message referenced by strp->skb_head is not released in strp_abort_strp(), causing a memory leak that co...

CVE-2026-46121

The CVE-2026-46121 issue affects the Linux kernel DAMON sysfs interface (mm/damon/sysfs-schemes). A race between reads and writes of memcg_path and path can lead to a use-after-free when a user reads or writes the sysfs files while a buffer is being deallocated. The root cause is that user-direct...

CVE-2026-46131

CVE-2026-46131 affects the Linux kernel KVM x86 code. The issue is a faulty check in slow flush hypercalls where is_guest_mode(vcpu) was used incorrectly; translate_nested_gpa() is only valid when an L2 guest runs with nested EPT/NPT enabled, so the condition should match translate_nested_gpa() i...

CVE-2026-46185

The CVE-2026-46185 issue affects the Linux kernel SMB client. The root cause is insufficient length validation in smb2_check_message() when processing symlink error responses, allowing a symlink_data() path to read beyond the buffer if iov_len is smaller than the 64-byte SMB2 header and accessing...

CVE-2026-46193

CVE-2026-46193 concerns a Linux kernel xfrm AH (AH) implementation issue where ESN high bits are not accounted for in async callback paths, causing miscalculation of ICV/auth offsets on IPv4/IPv6 when ESN is enabled and async hmac is used. The vulnerability arises from reconstructing the temporar...

CVE-2026-46203

The CVE-2026-46203 issue affects the Linux kernel, specifically the spi: cadence-quadspi driver. The root cause is unclocked register access that can occur if the controller is not runtime-resumed before being disabled during driver unbind. The fix ensures the controller is runtime resumed prior ...

CVE-2026-46235

CVE-2026-46235 affects the Linux kernel saa7164 media driver. The issue arises from missing return value checks for ioremap calls in saa7164_dev_setup(), specifically for BAR0 and BAR2. When ioremap fails, the code now performs cleanup: releases allocated PCI memory regions, removes the device fr...

CVE-2026-46311

CVE-2026-46311 (Linux kernel) involves the drm/amdgpu/userq path where access to a stale wptr mapping could occur during queue creation. The root cause is improper locking when accessing the mapping data, risking unmapping of wptr_obj while a queue is in progress and another BO is at the same add...

CVE-2026-52958

CVE-2026-52958 affects the Linux kernel libceph subsystem. The vulnerability arises in osdmap_decode() when decoding osd_state and osd_weight for each osd; the ceph_decode_need() check did not account for map->max_osd*sizeof(*map->osd_weight), enabling a potential out-of-bounds memory acces...

CVE-2026-53043

CVE-2026-53043 affects the OCFS2 DLM in the Linux kernel. A crafted DLM_QUERY_REGION message can set qr_numregions beyond the buffer size (qr_regions) and trigger out-of-bounds reads due to insufficient validation in dlm_match_regions(). The issue is fixed by a patch series that adds a bounds che...

CVE-2026-53205

The CVE-2026-53205 issue is in the Linux kernel Intel Versatile Processing Unit (IVPU) accelerator driver (accel/ivpu). It stems from insufficient validation of read/write indices in the firmware log buffer, allowing potential out-of-bounds access if firmware supplies invalid indices. Affected sy...

CVE-2026-53274

CVE-2026-53274 affects the Linux kernel net/smc code. A logic flaw in __smc_setsockopt() allowed a local unprivileged user to cause a Denial of Service by keeping the socket lock held during a copy_from_sockptr() operation. The vulnerability occurs because the copy is performed while holding lock...

CVE-2026-53281

The CVE-2026-53281 entries describe a Linux kernel IOMMU VT-d issue where NULL pointer dereference or refcount corruption could occur during teardown if dev_pasid was not found in the dev_pasids list or if domain was never attached. The root cause was improper teardown execution after potential N...

CVE-2026-53349

CVE-2026-53349 affects Linux kernels where netfilter nf_conntrack may call a broken nf_ct_helper_expectfn_unregister path that leaves a dangling exp->expectfn when a NAT helper is removed (e.g., nf_nat_h323). Reproductions show a stale function pointer is invoked on a subsequent connection, po...

CVE-2026-53364

The CVE-2026-53364 vulnerability is in the Linux kernel Bluetooth HCI path: hci_le_big_terminate() may leak memory (iso_list_data) when neither pa_sync_term nor big_sync_term flags are set after PA/BIG state evaluation. The function was refactored to accept a struct hci_conn and added PA/BIG flag...

CVE-2014-9903

CVE-2014-9903 (Linux kernel) : Affects Linux kernel 3.14-rc1 to 3.14-rc3 (and earlier rc builds) where sched_read_attr in kernel/sched/core.c uses an incorrect size. This enables a local attacker to obtain sensitive information from kernel stack memory via a crafted sched_getattr system call. The...

CVE-2016-8408

CVE-2016-8408 describes a local information-disclosure vulnerability in the NVIDIA video driver on Android (Kernel-3.10). The issue could allow a local malicious application to access data outside its permission levels, and is rated Moderate because exploitation requires compromising a privileged...

CVE-2022-49967

CVE-2022-49967 is a Linux kernel data-race vulnerability in the bpf_jit_limit variable. The issue arises when bpf_jit_limit is read while it can be concurrently updated via sysctl, risking load-tearing due to the long size of the value. The fix adds a paired READ_ONCE() alongside WRITE_ONCE() in ...

CVE-2023-53152

CVE-2023-53152 concerns the Linux kernel AMDGPU driver. The issue arises during removal of the amdgpu driver where BOs allocated for PSP are not freed, triggering a calltrace warning in amddrm_buddy_fini and related shutdown paths (amdgpu_exit, amdgpu_driver_release_kms). The provided trace shows...

CVE-2023-53185

CVE-2023-53185 exists in the Linux kernel: wifi/ath9k allows overwriting ENDPOINT0 attributes, enabling a bad USB device to craft a service-connection response where the target is ENDPOINT0 (reserved for HTC_CTRL_RSVD_SVC). The vulnerability is fixed in the kernel by rejecting such responses; imp...