CVE-2026-46234

CVE-2026-46234 affects the Linux kernel vsock code, specifically the vsock_update_buffer_size path. The bug arises from clamping the buffer size: it first enforces the maximum, then the minimum, which allows vsk->buffer_size to exceed vsk->buffer_max_size when a larger minimum is configured...

CVE-2025-38735

CVE-2025-38735 affects the Linux kernel gve driver; a crash can occur if an ethtool operation is dispatched after shutdown() when internal data structures are torn down. The documented fix is to call netif_device_detach() during shutdown to mark the device detached, causing the ethtool ioctl hand...

CVE-2025-39678

CVE-2025-39678 affects the Linux kernel, specifically the x86/amd/hsmp code path. The vulnerability arises when sock->metric_tbl_addr is NULL, which can cause a NULL pointer dereference when accessing metrics_bin. The provided connected SUSE advisory confirms the fix: a NULL check was added to...

CVE-2025-39679

CVE-2025-39679: In the Linux kernel driver drm/nouveau/nvif, fixing a memory leak in nvif_vmm_ctor() when nvif_vmm_type is invalid. The patch returns -EINVAL and frees resources; connected advisories reference this CVE but provide no additional exploit details.

CVE-2025-39704

The provided connected documents confirm CVE-2025-39704 affects LoongArch KVM in the Linux kernel, where send_ipi_data() calls kvm_io_bus_read() and may write an 8-byte signed extension into *val regardless of the given length. This can cause a buffer overflow when CONFIG_STACKPROTECTOR is enable...

CVE-2025-39707

Technical details for CVE-2025-39707 (affected component, root cause, impact, or fix) are not publicly provided in the connected documents. Monitor for updates from vendor advisories and security feeds.

CVE-2025-39711

CVE-2025-39711 affects the Linux kernel, specifically the media/ivsc code (ACE/CSI drivers). The vulnerability arises from missing mei_cldev_disable() calls in the remove() paths, causing mei_cl client objects to remain on mei_device->file_list after memory is freed by mei_cl_bus_dev_release()...

CVE-2025-39714

CVE-2025-39714 affects the Linux kernel media/usbtv subsystem. When streaming (e.g., ffplay) and another process changes TV standard NTSC↔PAL, the kernel could crash by copying to unmapped memory, caused by an overflow in the usbtv video plane buffer due to the struct’s increased resolution not b...

CVE-2025-39807

CVE-2025-39807 : Open kernel vulnerability in Linux kernel's DRM/Mediatek path, where after a hotplug event the cursor update could dereference NULL old_state->crtc, causing a kernel panic. The connected security sources confirm the fix adds NULL pointer checks to ensure stability by preventin...

CVE-2025-39864

CVE-2025-39864 affects the Linux kernel wifi subsystem (cfg80211) and specifically the cmp_bss() path after a use-after-free in bss_free(). The fix, applied via commits addressing the hidden_beacon_bss handling, ensures the last beacon frame elements are freed only when not shared by the hidden_b...

CVE-2025-39967

CVE-2025-39967 affects the Linux kernel, specifically a vulnerability in fbcon_do_set_font where integer overflow in font size calculations could occur when processing user-controlled parameters. The issue stems from unsafe size calculations in CALC_FONTSZ(h, pitch, charcount) and related allocat...

CVE-2025-68340

The CVE-2025-68340 issue affects the Linux kernel team device driver (drivers/net/team). The root cause is a misordered type-change check in team_port_add: when adding a port device that is already UP, the operation succeeds until header_ops is changed from eth_header to ipgre_header inside team_...

CVE-2025-71154

CVE-2025-71154 concerns Linux kernel code for the rtl8150 USB driver. When usb_submit_urb() fails in async_set_registers(), the allocated async_req and URB are not freed, causing a memory leak. The completion callback async_set_reg_cb() frees these allocations only after a successful URB submissi...

CVE-2025-71229

CVE-2025-71229 is a Linux kernel vulnerability affecting the rtw88 Wi‑Fi driver (rtw_core_enable_beacon). The issue arises when the function reads 4 bytes from a non-4-byte-aligned address, which can trigger an alignment fault and crash the kernel on some systems. The fixed patch changes the acce...

CVE-2026-22977

CVE-2026-22977 affects the Linux kernel net: sock: fix hardened usercopy panic in sock_recv_errqueue. The issue arises when using skbuff_fclone_cache where no usercopy whitelist exists for skb.cb, causing a usercopy BUG() during put_cmsg() when copying serr->ee from skb->cb via sock_recv_er...

CVE-2026-23007

CVE-2026-23007 affects the Linux kernel: the auto-generated integrity buffer for writes could leave the non-PI portion of metadata uninitialized when PI is generated and the metadata size exceeds the PI tuple. This could allow reading uninitialized memory from userspace or via physical access to ...

CVE-2026-23011

CVE-2026-23011: In the Linux kernel, ip_gre: make ipgre_header() robust to prevent skb under_panic when a device (e.g., bonding/team) changes dev->needed_headroom or dev->hard_header_len. The crash described involves mld_newpack/mld_sendpack path with an skb that had insufficient headroom, ...

CVE-2026-23136

CVE-2026-23136 : Linux kernel vulnerability in the libceph OSD client where the sparse-read state isn’t reset after a mid-payload disruption, causing the client to treat a fresh reply as a continuation of the old one. This can lead to a denial of service condition due to persistent sparse-read st...

CVE-2026-23184

CVE-2026-23184 concerns a Linux kernel use-after-free in binder_netlink_report() triggered by a BR_TRANSACTION_PENDING_FROZEN path in binder_proc_transaction(). A one-way transaction to a frozen target could be treated as successful, leading to unsafe access to a transaction structure after a pen...

CVE-2026-23237

CVE-2026-23237 affects the Linux kernel, specifically the platform/x86 classmate-laptop driver. The issue arises when sysfs attributes of the input device are accessed before the driver has stored the input device address, causing NULL pointer dereferences via dev_get_drvdata(&inputdev->dev) i...

CVE-2026-23259

CVE-2026-23259 affects the Linux kernel io_uring/rw path. The issue arises when a read/write request with an allocated iovec attached fails to be placed into rw_cache, leaving an unaccounted iovec pointer. The fix makes io_rw_recycle() return whether the request was recycled, and uses that result...

CVE-2026-23302

Summary (CVE-2026-23302): The Linux kernel patch resolves a data-race in data-path pointers sk->sk_data_ready and sk->sk_write_space, where skmsg and possibly other layers could modify these pointers while others may read them concurrently. The fix adds corresponding READ_ONCE()/WRITE_ONCE(...

CVE-2026-31420

CVE-2026-31420 affects Linux kernel bridge MRP interval handling. Vulerability arises when br_mrp_start_test/br_mrp_start_in_test accept a user-supplied interval from netlink with no validation; if interval is 0, the delay becomes zero and a tight loop can exhaust memory, causing an OOM kernel pa...

CVE-2026-31430

CVE-2026-31430 affects the Linux kernel: X.509 extensions parsing could read the first byte of an extension before checking length, causing out-of-bounds access. The vulnerability can be triggered by an unprivileged user submitting a crafted certificate via the keyrings(7) API. A PoC exists. The ...

CVE-2026-31505

The CVE-2026-31505 issue affects the Linux kernel iavf driver: out-of-bounds writes occur because iavf_get_ethtool_stats() uses real_num_tx_queues for ETH_SS_STATS while other paths use num_tx_queues, enabling memory corruption when ethtool -L and ethtool -S run concurrently. The fix is to use im...

CVE-2026-31588

CVE-2026-31588 concerns the Linux kernel KVM MMIO handling bug where an MMIO write that spans multiple pages could reference on‑stack data, enabling a use‑after‑free path. The root cause is an internal temporary variable path during complete_emulated_mmio when emulated MMIO writes cross page boun...

CVE-2026-31642

The CVE-2026-31642 entry concerns the Linux kernel rxrpc module, where a flaw in call removal was fixed by using list_del_rcu() instead of list_del_init() to prevent infinite loops when reading /proc/net/rxrpc/calls. The underlying issue is that improperly deleting calls could disrupt list handli...

CVE-2026-43057

CVE-2026-43057 concerns the Linux kernel networking stack. The issue arises in how IPv6 traffic with extension headers or with no inner IP protocol is processed when using IPV6_CSUM GSO fallback. The fix, described in the CVE entry and corroborated by Debian/Red Hat advisories, changes the fallba...

CVE-2026-43105

The CVE-2026-43105 issue affects the Linux kernel’s DRM VC4 driver. The root cause is a memory leak where the hang state’s BO array is allocated with kzalloc() in vc4_save_hang_state() but is not freed in vc4_free_hang_state(), leaving memory allocated when the hang state is freed. A kfree() for ...

CVE-2026-43203

The CVE covers a Linux kernel fore200e ATM driver use-after-free during device removal (PCA-200E/SBA-200E). Vulnerability arises when tx_tasklet/rx_tasklet run or pending after fore200e is freed, risking access to freed memory. The published fixes synchronize tasklets with device shutdown by addi...

CVE-2026-43265

CVE-2026-43265 affects the Linux kernel KVM for x86. The vulnerability arises when a vCPU is put into a blocking state with an already-injected event or nested run, allowing a user or guest to manipulate vCPU state and trigger a spurious userspace exit (often KVM_EXIT_UNKNOWN) that could crash th...

CVE-2026-43430

The issue CVE-2026-43430 affects the Linux kernel USB driver for yurex. A race condition occurs in the probe path where the bbu field is not initialized before the URB completion handler uses it, creating a window during which descriptor data can be overwritten by concurrent probing. This can lea...

CVE-2026-43483

CVE-2026-43483 (Linux kernel, KVM/VMX-SVM) fixes a flaw in SVM AVIC handling where CR8 write interception could remain enabled after AVIC activation. The patch explicitly sets/clears CR8 interception when AVIC is (de)activated to prevent the dangling intercept, which could cause TPR desynchroniza...

CVE-2026-45838

CVE-2026-45838 – Linux kernel : The vulnerability arises in BPF handling for cgroup_storage_get_next_key, where list_next_entry() can wrap to the list head and a subsequent NULL check becomes dead code, causing get_next_key() to read storage->key from a bogus pointer and copy it to userspace. ...

CVE-2026-45861

CVE-2026-45861 refers to a Linux kernel vulnerability in the GFS2 file system. The root cause is a slab-use-after-free: during filesystem shutdown, quota data objects were freed without being removed from the LRU list due to the change in the a475c5dd16e5 sequence. As a result, the shrinker (gfs2...

CVE-2026-45867

The CVE-2026-45867 issue affects the Linux kernel power_supply subsystem (act8945a) and is caused by a race condition: requesting the IRQ with the devm_ path before the devm_ path that registers the power_supply handle can lead to use-after-free when the IRQ fires after the power_supply object is...

CVE-2026-45877

CVE-2026-45877 concerns the Linux kernel HID driver for Intel ISH. The issue is a NULL-pointer dereference in ishtp_bus_remove_all_clients during a warm reset when cl->device may be NULL while clients are enumerated, leading to a kernel panic. Multiple sources (NVD, Red Hat, SUSE, Debian/OSV, ...

CVE-2026-45923

Summary: CVE-2026-45923 affects the Linux kernel’s USB-CATC driver. Affected codePath: probe time endpoint verification for CATC USB endpoints. Root cause: CATC probe uses hardcoded endpoint pipes (TX/RX bulk 1, interrupt status 2) without validating endpoint descriptors, allowing a malformed USB...

CVE-2026-45987

Technical details about CVE-2026-45987 are not publicly provided in the connected documents. No explicit affected products, root cause, or fixes are present beyond generic patch notes; monitor for updates.

CVE-2026-46006

The CVE-2026-46006 entry concerns the Linux kernel’s drm/nouveau driver. A 32‑bit overflow in nouveau_gem_pushbuf_reloc_apply() could cause incorrect relocation bounds checks: r->reloc_bo_offset + 4 is computed in 32‑bit space, wrapping before comparing to nvbo->bo.base.size. The fix casts ...

CVE-2026-46024

CVE-2026-46024 targets the Linux kernel libceph component, where a CEPH_MSG_AUTH_REPLY containing zero values for both protocol and result could lead to a null pointer dereference due to ac->ops being NULL after faulty auth handling. The root cause is that a too-permissive check allowed ac-&gt...

CVE-2026-46042

CVE-2026-46042 concerns a Linux kernel memory-leak issue in mm/mempolicy (weighted_interleave_auto_store) that leaks old/new wi_state under certain input paths; the fix moves the old_wi_state fetch to an unconditional location, enabling a unified early return when the requested mode matches the c...

CVE-2026-46112

CVE-2026-46112 relates to the Linux kernel RDMA/hns driver. The vulnerability arises from an unlocked call to hns_roce_qp_remove() during error unwinding in hns_roce_create_qp_common(), where the caller did not hold the required locks, risking memory corruption. The fixes synchronize by grabbing ...

CVE-2026-46120

Concrete details found: CVE-2026-46120 affects the Linux kernel ip6_gre machinery. The issue is in ip6erspan_changelink(), which wrongly uses dev_net(dev) instead of the correct per-netns hash resolved by link_net, after a patch series that fixed per-netns resolution in ip6erspan_newlink(). This ...

CVE-2026-46125

CVE-2026-46125 describes a Linux kernel issue in the wifi mac80211 path where, if Multi-Link Operation (MLO) connection preparation fails, the associated station may not be removed correctly. The advisory states that the interface is reset to non-MLD and the station linked to the vif should be de...

CVE-2026-46202

CVE-2026-46202 concerns the Linux kernel HID driver for the Apple Touch Bar (hid-appletb-kbd). The issue arises when inactivity autodim uses backlight_device_set_brightness() from two atomic contexts (a timer_list callback and input/event paths), causing a mutex lock from an atomic context bug an...

CVE-2026-46222

In CVE-2026-46222, the Linux kernel’s media: rockchip: rkcif driver was fixed by adding the missing MUST_CONNECT flag to pads, addressing a null-pointer dereference when a media stream is enabled. The issue arose from pads not reliably checking for connected devices, enabling a local attacker to ...

CVE-2026-46288

CVE-2026-46288 (Linux kernel). The issue is a use-after-free in unittest changeset handling of device-tree nodes: a pointer (parent) shares the same struct device_node as nchangeset, and of_node_put(nchangeset) can drop the refcount to zero while code still uses parent to inspect properties, lead...

CVE-2026-52931

CVE-2026-52931 — Linux kernel (batman-adv tp_meter): The vulnerability arises when batadv_tp_recv_ack() or batadv_tp_stop() are invoked with a tp_vars in the BATADV_TP_RECEIVER role. In that case, code paths access sender-only members that were never initialized, causing undefined behavior. The f...

CVE-2026-53092

CVE-2026-53092 affects the Linux kernel’s BPF subsystem . The root cause is in register delta tracking when the same source and destination registers are used (e.g., rX += rX). In adjust_reg_min_max_vals(), the code mutates the destination in-place, and later, when evaluating the source register,...