CVE-2026-53106

CVE-2026-53106 is described as a Linux kernel issue related to bpf storage deletion in NMIs. Connected OSV entries show that Root has patched CVE-2026-53106 in the rootio-linux package for Root:Debian:12 and Root:Debian:13, with multiple fixed versions available, and UBUNTU-2204 patches also noti...

CVE-2004-0058

The CVE-2004-0058 entry affects Antivir for Linux 2.0.9-9 and potentially earlier versions. It describes a local privilege issue where a symlink race on the temporary file .pid_antivir_$$ allows a local user to overwrite arbitrary files. The underlying cause is a symlink attack on a daemon-relate...

CVE-2026-43029

The CVE-2026-43029 issue affects the Linux kernel MPTCP implementation. When data is received with MSG_PEEK and MSG_WAITALL, skb’s are not removed from the sk_receive_queue, causing sk_wait_data() to incorrectly report data available and potentially trigger a soft lockup. The root cause is the mi...

CVE-2026-43128

Summary: CVE-2026-43128 affects the Linux kernel RDMA/umem subsystem. In ib_umem_dmabuf_get_pinned_with_dma_device(), if ib_umem_dmabuf_map_pages() fails, the code previously unpinned the dmabuf immediately while the umem_dmabuf->pinned flag remained set, causing a potential double dma_buf_unp...

CVE-2026-43335

CVE-2026-43335 pertains to the Linux kernel interconnect driver for Qualcomm SM8450. The issue arises from unconverted dynamic IDs for platform interconnects, which can lead to a NULL pointer dereference in icc_link_nodes() at runtime when a destination interconnect pointer is invalid. The conseq...

CVE-2026-43430

The issue CVE-2026-43430 affects the Linux kernel USB driver for yurex. A race condition occurs in the probe path where the bbu field is not initialized before the URB completion handler uses it, creating a window during which descriptor data can be overwritten by concurrent probing. This can lea...

CVE-2026-45996

The CVE-2026-45996 entry concerns a use-after-free in the Linux kernel SPI IMX driver (on unbind/deregistration). The root cause is that upon deregistering the SPI controller, driver data may be freed while still referenced, requiring an extra reference before deregistration to ensure data remain...

CVE-2026-46168

The CVE-2026-46168 issue affects the Linux kernel's multipath TCP (mptcp) scheduling around timestamp sockopts. The root cause is using lock_sock_fast() (atomic context) around sock_set_timestamp() and sock_set_timestamping(), which can sleep and cause atomic-context issues. The published fixes r...

CVE-2026-46202

CVE-2026-46202 concerns the Linux kernel HID driver for the Apple Touch Bar (hid-appletb-kbd). The issue arises when inactivity autodim uses backlight_device_set_brightness() from two atomic contexts (a timer_list callback and input/event paths), causing a mutex lock from an atomic context bug an...

CVE-2026-46224

The CVE-2026-46224 issue affects the Linux kernel drm/xe driver. The bug is a lifecycle/ownership problem in xe_dma_buf_init_obj() where a pre-allocated storage bo is not freed when drm_gpuvm_resv_object_alloc() fails, leading to a potential resource leak. The kernel now ensures that, on failure,...

CVE-2026-46309

The CVE-2026-46309 entry describes a Linux kernel issue in drm/xe/uapi where PAT indices with XE_COH_NONE coherency are rejected for CPU cached memory in madvise. The fix adds validation in xe_vm_madvise_ioctl() to prevent using coh_none on CPU cached buffers, as such usage could allow a GPU to b...

CVE-2026-46320

The CVE-2026-46320 vulnerability affects the Linux kernel tap driver where memory pages allocated for frames in vhost_net_xdp() are not freed on error paths. Specifically, tap_get_user_xdp() may reject frames shorter than ETH_HLEN (-EINVAL) or fail build_skb() (-ENOMEM), but both error paths jump...

CVE-2026-52958

CVE-2026-52958 affects the Linux kernel libceph subsystem. The vulnerability arises in osdmap_decode() when decoding osd_state and osd_weight for each osd; the ceph_decode_need() check did not account for map->max_osd*sizeof(*map->osd_weight), enabling a potential out-of-bounds memory acces...

CVE-2026-53273

CVE-2026-53273 describes a use-after-free in the Linux kernel TEE/OP-TEE path. When a client exits before the supplicant finishes processing, freed request memory could be dereferenced, enabling a potential crash or code execution path. The root cause is a race around request lifetime between the...

CVE-2026-53401

The CVE-2026-53401 vulnerability affects the Linux kernel fbdev omap2 driver (omapfb_mmap) with a race between mm_lock and fb_info->lock when mapping memory via OMAPFB_SETUP_PLANE. The race can lead to a use-after-free by reading start/len from mismatched region references and incrementing an ...

CVE-2026-63794

The CVE-2026-63794 issue affects the Linux kernel KVM SEV path (sev_dbg_crypt) where the ENCRYPT path could overflow a single-page buffer when d_off > s_off, because the per-iteration transfer length wasn’t bounded by the destination page offset. The root cause is that len was bounded by (PAGE...

CVE-2026-63801

CVE-2026-63801 is a Linux kernel vulnerability in TIPC crypto path. The issue arises when tipc_aead_decrypt() offloads to asynchronous crypto code and does not take a reference on the per-netns object before calling crypto_aead_decrypt(), unlike the encrypt path. If the bearer's netns is torn dow...

CVE-2026-64142

CVE-2026-64142 documents a Linux kernel issue in ksmbd where two races against m_fp_list walkers can lead to use-after-free or list corruption during durable-handle scavenging. The root causes are: (1) fp->node list-head reuse when expired handles are moved to a scavenger list, which can overw...

CVE-2026-64261

The CVE-2026-64261 issue affects the Linux kernel’s fuse-uring component. The vulnerability arises when fuse_uring_async_stop_queues() might run after the last reference on ring->queue_refs has been dropped, risking use-after-free. Red Hat, SUSE, Debian OSV, and other trackers confirm the flaw...

CVE-2026-64269

The CVE-2026-64269 issue affects the Linux kernel’s RDMA path (RDMA/rtrs-srv) where rdma_write_sg() uses desc[0].len from the wire descriptor to determine the RDMA_WRITE length. The length could exceed the bound of the mapped chunk because it wasn’t checked against max_chunk_size, enabling a peer...

CVE-2026-64294

CVE-2026-64294 affects the Linux kernel where in idmapped mounts, inode ownership checks for side-channel protection in mincore() and MADV_PAGEOUT could be performed against nop_mnt_idmap, ignoring the file’s mount idmap. The fix introduces a new abstraction, file_owner_or_capable(), to carry the...

CVE-2026-64303

In CVE-2026-64303, a Linux kernel vulnerability in the fsl-lpspi driver occurs when dmaengine_prep_slave_sg() fails for the TX channel: the TX path is terminated but the RX path (already submitted) continues, unmapping buffers on -EINVAL and risking memory corruption or use-after-free. The fixed ...

CVE-2007-5087

The CVE-2007-5087 issue affects the Linux kernel ATM module prior to 2.4.35.3 with CLIP support enabled. Reading /proc/net/atm/arp before the CLIP module is loaded can cause a denial-of-service (kernel panic) for local users. The vulnerability is documented in multiple sources (NVD/SUSE/Red Hat) ...

CVE-2013-3236

The CVE-2013-3236 issue affects the Linux kernel component vmci_transport_dgram_dequeue in net/vmw_vsock/vmci_transport.c; it fails to initialize a length variable, allowing local attackers to read kernel stack memory via crafted recvmsg/recvfrom. Affects kernels before 3.9-rc7. Multiple advisori...

CVE-2016-6757

CVE-2016-6757 describes an information-disclosure vulnerability affecting Qualcomm components used in Android devices, specifically the camera driver and video driver. The issue could allow a local malicious application to access data beyond its permissions after compromising a privileged process...

CVE-2016-8394

CVE-2016-8394 describes an elevation-of-privilege vulnerability in the Synaptics touchscreen driver on Android. The issue could allow a local malicious application to execute arbitrary code in the kernel context by exploiting the Synaptics driver, requiring initial compromise of a privileged proc...

CVE-2016-8404

CVE-2016-8404 is an information-disclosure vulnerability in Android kernel components (ION subsystem, Binder, USB driver, and networking). A local malicious application could access data outside its permission levels after compromising a privileged process. Affected product/versions: Android kern...

CVE-2016-8410

CVE-2016-8410 is an information-disclosure vulnerability in the Qualcomm sound driver affecting Android devices. The issue could allow a local malicious application to access data outside its permission levels, and is rated Moderate because exploitation requires first compromising a privileged pr...

CVE-2022-50090

CVE-2022-50090 relates to the Linux kernel/Btrfs: it replaces the hard-coded limit BTRFS_MAX_EXTENT_SIZE with fs_info->max_extent_size. On zoned filesystems, data writes are limited by max_zone_append_size, and a large ordered extent can trigger more extents than expected, causing the estimato...

CVE-2022-50163

CVE-2022-50163 concerns a Linux kernel fix for ax25: fix incorrect dev_tracker usage. The root cause was that an ax25_dev could be used by one or more ax25_cb structures, requiring separate dev_tracker per ax25_cb. The patch introduces per-structure tracking to prevent reference tracker mismanage...

CVE-2023-53250

The CVE-2023-53250 entry concerns a null-pointer dereference in Linux kernel firmware handling (dmi-sysfs). The issue occurs in dmi_sysfs_register_handle during initialization, triggered by a kobject/dmi_sysfs lifecycle sequence where list_add_tail is followed by an error path, leading to an unin...

CVE-2023-53439

CVE-2023-53439 concerns the Linux kernel fix for skb_partial_csum_set() where skb->transport_header used the sentinel value 0xFFFF to indicate the transport header status. The description indicates the vulnerability arose from callers potentially setting skb->transport_header to 0xFFFF, and...

CVE-2023-53545

CVE-2023-53545 affects the Linux kernel DRM/AMDGPU path. The issue arises when unmapping/removing csa_va during VM operations: the Root PD BO must be reserved before unmapping a bo_va to prevent lockdep warnings. The v2 fix changes the NULL-check from amdgpu_mcbp to fpriv->csa_va. Consequence ...

CVE-2025-38551

Technical details about CVE-2025-38551 are not publicly provided in the supplied connected documents. Monitor for updates.

CVE-2025-38558

In CVE-2025-38558, the Linux kernel USB gadget VAR: uvc frame-based format previously crashed when color_matching descriptor was missing, due to a NULL pointer dereference. The fix initializes the color matching descriptor for frame-based formats, mirroring the handling already present for uncomp...

CVE-2025-38622

CVE-2025-38622 — Linux kernel UDP/GSO issue : The vulnerability occurs in the UDP receive path when a packet with virtio_net_hdr using SKB_GSO_UDP and a gso_size smaller than the UDP header can trigger a crash in skb_pull_rcsum, leading to a kernel BUG in net/core/skbuff.c and a local attacker ma...

CVE-2025-38626

CVE-2025-38626 affects the Linux kernel with the F2FS file system in foreground log-structured (lfs) mode. The issue arises in f2fs_map_blocks() where allocations can trigger block allocations aggressively under parallel aio/dio/bufio workloads, potentially exhausting space and causing a system p...

CVE-2025-38632

CVE-2025-38632 affects the Linux kernel pinctrl/pinmux logic. The issue is a race where updates to mux_usecount and mux_owner were not performed atomically under the same lock, allowing a state where mux_usecount > 0 but mux_owner is NULL, potentially causing a NULL pointer on subsequent pin r...

CVE-2025-38635

The CVE-2025-38635 issue concerns the Linux kernel clk: davinci: davinci_lpsc_clk_register() path. The root cause is a missing NULL check after devm_kasprintf(), which can return NULL on memory allocation failure and lead to a NULL pointer dereference. The fix adds a NULL check after the devm_kas...

CVE-2025-38642

CVE-2025-38642 affects the Linux kernel’s wifi/mac80211 monitor mode handling. The issue arises on devices without WANT_MONITOR_VIF (and likely without channel context support), triggering a WARN_ON when modifying the per-link settings of a MONITOR interface. The fix moves this validation from a ...

CVE-2025-38655

The CVE-2025-38655 issue in the Linux kernel affects pinctrl for canaan: k230 where the group parser retrieved the device-tree property "pinmux" without validating the of_get_property() return. The root cause is a missing NULL check, leading to a potential NULL pointer dereference if the property...

CVE-2025-38680

The CVE CVE-2025-38680 affects the Linux kernel media: uvcvideo component, where a 1-byte out-of-bounds read can occur in uvc_parse_format(). The root cause is a buffer length check that only guaranteed buf > 2, while the code accesses buffer[3], requiring at least 4 bytes. The vulnerability’s...

CVE-2025-38709

CVE-2025-38709 affects the Linux kernel loop device where changing the loop block size while a filesystem is mounted can cause a block-size mismatch between the loop device and the superblock, triggering warnings such as in __getblk_slow(). The issue is remedied by obtaining an exclusive hold on ...

CVE-2025-39850

CVE-2025-39850 affects the Linux kernel vxlan implementation. When the VXLAN device runs with the proxy option enabled, ARP/IPv6 Neighbor Solicitation can be spuriously suppressed if the remote host’s MAC is not behind the any remote. The root cause is dereferencing an FDB nexthop entry that may ...

CVE-2025-39912

This CVE (CVE-2025-39912) affects the Linux kernel nfs/localio path. The issue occurs when the nfsd filecache code releases the nfsd_file before creds are properly handled, triggering a BUG_ON in __put_cred via current->cred. The vulnerability is resolved by restoring credentials before releas...

CVE-2025-39914

CVE-2025-39914 affects the Linux kernel tracing subsystem. The issue occurs when a fault injection triggers a failure during chunk allocation in trace_pid_list_alloc, causing trace_pid_list_set to fail and potentially trigger a double registration of the same tracepoint (tracepoint_add_func). The...

CVE-2025-39950

CVE-2025-39950 pertains to the Linux kernel: a NULL pointer dereference can occur in net/tcp when TCP-AO is used with TCP_REPAIR during connect(), due to dereferencing skb without null-check in tcp_ao_finish_connect(). The vulnerability affects code paths where a TCP-AO key is present and TCP_REP...

CVE-2025-71095

CVE-2025-71095 affects the Linux kernel’s net: stmmac driver, causing a crash during zero-copy XDP_TX due to improper handling of xdp_buff memory types. The bug occurs when an xdp_buff is converted to an xdp_frame and the code in stmmac_xdp_xmit_back() always assumes MEM_TYPE_PAGE_POOL, regardles...

CVE-2025-71104

The CVE-2025-71104 entry concerns the Linux kernel KVM on x86 with the HV timer. Root cause: when advancing the guest APIC timer expiration in periodic mode, adding a period to a past target expiration can create an unbounded sequence of hrtimer IRQs; if the guest is paused, this can trigger host...

CVE-2025-71156

CVE-2025-71156 : In the Linux kernel gve driver, interrupt enabling is deferred until NAPI registration. Currently interrupts may be enabled on request before the NAPI context is ready, causing failures (call trace leading to __napi_poll, net_rx_action, etc.). The workaround/mitigation described ...