CVE-2026-23221

CVE-2026-23221 – Linux kernel (bus/fsl-mc driver) : The vulnerability arises from reading the driver_override string in driver_override_show() without holding the device_lock while driver_override_store() uses driver_set_override() to modify/free the string while the lock is held. This can cause ...

CVE-2026-31420

CVE-2026-31420 affects Linux kernel bridge MRP interval handling. Vulerability arises when br_mrp_start_test/br_mrp_start_in_test accept a user-supplied interval from netlink with no validation; if interval is 0, the delay becomes zero and a tight loop can exhaust memory, causing an OOM kernel pa...

CVE-2026-23159

CVE-2026-23159 is a Linux kernel vulnerability related to perf: sched crashing when tracing user-space tasks. The issue arose from an unsafe test for user-space task memory access: older checks relied on task_struct.mm, newer code attempted PF_KTHREAD checks and is_user_task() but not all kernel ...

CVE-2026-23162

CVE-2026-23162 relates to the Intel Xe GPU driver in the Linux kernel (drm/xe/nvm). A double-free vulnerability occurs during initialization: after auxiliary_device_init() succeeds, if auxiliary_device_add() then fails, the memory may be freed twice (via the device release path and a premature fr...

CVE-2026-23222

CVE-2026-23222 has been resolved in the Linux kernel. The bug was due to omap_crypto_copy_sg_lists() allocating an array of scatterlist pointers instead of scatterlist objects, causing a 4x under-allocation. The fix uses sizeof(*new_sg) to allocate the correct object size, ensuring proper scatter...

CVE-2026-23359

CVE-2026-23359 stems from a Linux kernel bug in BPF devmap handling. get_upper_ifindexes() could write upper-device indices beyond the allocated stack, because the code assumed MAX_NEST_DEV (8) bounds, but the number of upper devices (e.g., many macvlan) could exceed that. The result is a stack-o...

CVE-2026-23383

CVE-2026-23383 affects the Linux kernel’s BPF JIT path on arm64. The root cause was 4-byte alignment in bpf_jit_binary_pack_alloc() causing the JIT buffer’s base to be only 4-byte aligned, which could misalign the 64-bit target field in struct bpf_plt. Consequences include UBSAN misaligned-access...

CVE-2026-23400

Summary of CVE-2026-23400 : In the Linux kernel, the rust_binder component is affected by a deadlock risk when processing death notifications. The root cause is calling set_notification_done() while the process lock (proc lock) is still held and the current thread is not a looper, which can cause...

CVE-2026-23447

The CVE-2026-23447 issue concerns the Linux kernel USB CDC NCM driver (cdc_ncm). The root cause is a bounds-check failure in handling NDP32 frames where the DPE array size is not correctly validated against the skb length due to neglecting ndpoffset, allowing out-of-bounds reads when an NDP32 sit...

CVE-2026-31523

In the Linux kernel NVMe PCI driver, CVE-2026-31523 is a race condition: a running change to the polled queue count can create a brief window during reset where a hipri task poll occurs before queue maps are updated, risking double completions when the interrupt-driven path takes over. The issue ...

CVE-2026-31582

CVE-2026-31582 affects the Linux kernel hwmon powerz driver. A use-after-free occurs when a USB disconnect frees the URB and mutex, and a subsequent powerz_read() can dereference the freed URB in powerz_read_data(). The fix, as described across sources, is to set priv->urb to NULL in powerz_di...

CVE-2026-31595

CVE-2026-31595 affects the Linux kernel PCI endpoint driver for the vntb (pci-epf-vntb) where the cleanup path epf_ntb_epc_cleanup does not disable the delayed work before clearing BAR mappings and doorbells. The referenced details describe that if the delayed work isn’t disabled, the cmd_handler...

CVE-2026-31601

CVE-2026-31601 affects the Linux kernel vfio/xe driver. When resetting a Virtual Function (VF) device that does not support migration, a kernel page fault can occur due to the vfio_pci core structure not being fully initialized until migration init. The root cause described in connected docs is t...

CVE-2026-31618

CVE-2026-31618 affects the Linux kernel fbdev subsystem, specifically the tdfxfb and udlfb drivers. The issue is a divide-by-zero crash in FBIOPUT_VSCREENINFO when the code uses pixclock for division, which can crash the system and lead to a DoS condition as described in the advisory. A fix has b...

CVE-2026-43016

The CVE-2026-43016 entries describe a use-after-free in the Linux kernel BPF sockmap path (sockmap) affecting AF_UNIX sockets. The issue occurs in sk_psock_verdict_data_ready(), when the peer’s sk_socket may be freed after an RCU grace period, while the sender holds the peer’s refcount. The root ...

CVE-2026-43057

CVE-2026-43057 concerns the Linux kernel networking stack. The issue arises in how IPv6 traffic with extension headers or with no inner IP protocol is processed when using IPV6_CSUM GSO fallback. The fix, described in the CVE entry and corroborated by Debian/Red Hat advisories, changes the fallba...

CVE-2026-43062

CVE-2026-43062 concerns the Linux kernel Bluetooth L2CAP path, where l2cap_ecred_reconf_rsp() incorrectly casts incoming data to struct l2cap_ecred_conn_rsp instead of struct l2cap_ecred_reconf_rsp. This type confusion causes: (1) the length check to require 8 bytes instead of 2, rejecting valid ...

CVE-2026-43099

The CVE-2026-43099 issue affects the Linux kernel, specifically the IPv4/ICMP path and the IPv6 stub handling. When the IPv6 stack is not active (CONFIG_IPV6=m and not loaded), ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT); passing that to dev_hold() can cause a null pointer dereference and a...

CVE-2026-43158

CVE-2026-43158 is a Linux kernel XFS vulnerability where freemap adjustments in leaf blocks when adding xattrs can collide with the entries area, causing an assertion and potential filesystem shutdown (DoS). The root cause is incorrect freemap sizing/update logic in xfs_attr3_leaf_add_work, leadi...

CVE-2026-43439

CVE-2026-43439 : In the Linux kernel, a race between task migration and iteration in cgroup can cause iterators to skip tasks when a task migrates from cset->tasks to cset->mg_tasks. The patch adds a call to css_set_skip_task_iters() before unlinking the task from cset->tasks, advancing ...

CVE-2026-43498

CVE-2026-43498 is a Linux kernel issue in the accel/ivpu path. The vulnerability stems from the ability to re-export imported GEM buffers; a fix adds a custom prime_handle_to_fd callback that checks if the GEM object is imported and returns -EOPNOTSUPP in that case. Under re-export scenarios, buf...

CVE-2026-45836

The CVE-2026-45836 vulnerability affects the Linux kernel Bluetooth L2CAP code and stems from a missing NULL guard in l2cap_sock_get_sndtimeo_cb(), which can cause a null pointer dereference. The issue is resolved by adding the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_s...

CVE-2026-45838

CVE-2026-45838 – Linux kernel : The vulnerability arises in BPF handling for cgroup_storage_get_next_key, where list_next_entry() can wrap to the list head and a subsequent NULL check becomes dead code, causing get_next_key() to read storage->key from a bogus pointer and copy it to userspace. ...

CVE-2026-45897

The CVE-2026-45897 entry concerns the Linux kernel netfilter nft_counter: serialize reset with spinlock vulnerability. A global static spinlock was added to serialize concurrent counter fetch+reset operations, preventing two parallel resets from underrunning values when dumping and resetting coun...

CVE-2026-45923

Summary: CVE-2026-45923 affects the Linux kernel’s USB-CATC driver. Affected codePath: probe time endpoint verification for CATC USB endpoints. Root cause: CATC probe uses hardcoded endpoint pipes (TX/RX bulk 1, interrupt status 2) without validating endpoint descriptors, allowing a malformed USB...

CVE-2026-45928

CVE-2026-45928 relates to the Linux kernel media driver (chips-media wave5). In wave5_vpu_open_enc() and wave5_vpu_open_dec(), a vpu instance is kzalloc()-ed; if the subsequent allocation for inst->codec_info fails, the error path returns -ENOMEM without freeing the previously allocated vpu, c...

CVE-2026-46006

The CVE-2026-46006 entry concerns the Linux kernel’s drm/nouveau driver. A 32‑bit overflow in nouveau_gem_pushbuf_reloc_apply() could cause incorrect relocation bounds checks: r->reloc_bo_offset + 4 is computed in 32‑bit space, wrapping before comparing to nvbo->bo.base.size. The fix casts ...

CVE-2026-46046

The CVE reports a refcount leak in ext4_xattr_inode_dec_ref_all() due to not releasing iloc with brelse() after ext4_get_inode_loc(), fixed by commit c8e008b6. OSV entries show patches in Root:Ubuntu 22.04/24.04, Debian, Debian-based RootIO builds, and openSUSE kernel-devel 7.0.11-1.1 for GA medi...

CVE-2026-46049

CVE-2026-46049 concerns the Linux kernel ALSA ctxfi driver (S/PDIF path). The issue arises in spdif_passthru_playback_setup() when pll_rate is not updated (remains 0), causing the MSR calculation loop to spin if 32000 Hz is skipped. The fix adds a fallback: if atc->pll_rate is 0, use atc->r...

CVE-2026-46058

CVE-2026-46058 affects the Linux kernel’s amphion VPU driver, where a race in the Video4Linux m2m framework could lead to a use-after-free and kernel panic. The issue arises when v4l2_m2m_ctx_release() frees the m2m_ctx while v4l2_m2m_try_run() is about to call device_run, potentially crashing vi...

CVE-2026-46085

CVE-2026-46085 affects the Linux kernel rxrpc subsystem (rxkad crypto unalignment handling). The vulnerability arises from processing a packet with a misaligned crypto length and from handling non-ENOMEM decryption errors, with the WARN_ON_ONCE removal enabling remote triggering of issues. A remo...

CVE-2026-46094

CVE-2026-46094 affects the Linux kernel ext4 code. The vulnerability arises from a bounds check in check_xattrs() for the next xattr entry, where the code compared (void*)next >= end. This could allow next to point within sizeof(u32) bytes of end, and on the subsequent loop iteration IS_LAST_E...

CVE-2026-46118

CVE-2026-46118 concerns the Linux kernel component pseries/papr-hvpipe, where a null pointer dereference could occur in papr_hvpipe_dev_create_handle() after changing to FD_PREPARE. The root cause described across sources is that src_info is reused post-retain_and_null_ptr when adding to a global...

CVE-2026-46125

CVE-2026-46125 describes a Linux kernel issue in the wifi mac80211 path where, if Multi-Link Operation (MLO) connection preparation fails, the associated station may not be removed correctly. The advisory states that the interface is reset to non-MLD and the station linked to the vif should be de...

CVE-2026-46170

CVE-2026-46170 affects the Linux kernel MPTCP implementation. When ADD_ADDR is retransmitted, the socket reference counting can fail to free the sk, which may trigger indefinite waiting in timer synchronization and cause a DoS. The root cause is improper timer handling during sk_free that could c...

CVE-2026-46221

CVE-2026-46221 concerns the Linux kernel EDAC/versalnet component. The issue is a memory leak where the device name allocated with kzalloc() in init_one_mc() is assigned to dev->init_name, then never freed on the normal removal path. Since device_register() copies init_name and then sets dev-&...

CVE-2026-46234

CVE-2026-46234 affects the Linux kernel vsock code, specifically the vsock_update_buffer_size path. The bug arises from clamping the buffer size: it first enforces the maximum, then the minimum, which allows vsk->buffer_size to exceed vsk->buffer_max_size when a larger minimum is configured...

CVE-2026-46246

The CVE-2026-46246 issue affects the Linux kernel driver power: supply: pm8916_lbc. It describes a use-after-free race: when requesting IRQs with the devm_ helper before the extcon handle is allocated/registered, the extcon resource can be freed while an IRQ handler is still active, leading to ex...

CVE-2026-52981

CVE-2026-52981 concerns a Linux kernel issue in neigh_xmit: when called with an uninitialized neighbor table (e.g., NEIGH_ND_TABLE with IPv6 disabled), neigh_xmit can return -EAFNOSUPPORT without releasing the skb, risking a memory leak. The fix removes the remaining code path that could neither ...

CVE-2026-53005

CVE-2026-53005 affects the Linux kernel af_unix SOCKMAP feature. The issue arises from improper handling of SCM attributes when data is passed to SOCKMAP, enabling a use-after-free and inflight-file-descriptor leaks due to inability of GC paths to inspect psock queues after skb redirection. Multi...

CVE-2026-53074

The CVE-2026-53074 issue affects the Linux kernel BPF test path: bpf_prog_test_run_skb may access IPv4/IPv6 headers (ip_hdr/ipv6_hdr) after eth_type_trans() when the test input only contains an Ethernet header. The fix folds IPv4/IPv6 header length checks into the existing protocol switch and ret...

CVE-2026-53137

CVE-2026-53137 concerns the Linux kernel drm/amd display path where, during HDCP2.x repeater authentication over HDMI, the driver reads the sink RxStatus and uses a 10-bit message size field (max 1023) to set the read length for the ReceiverID list. The length was not clamped to the destination b...

CVE-2026-53230

CVE-2026-53230 describes a slab-out-of-bounds vulnerability in the Linux kernel mlx5 driver: mlx5_query_nic_vport_mac_list sizes its firmware command buffer using the PF’s log_max_current_uc/mc_list, risking an overflow when querying a VF vport with a larger max. The resulting memory access is a ...

CVE-2026-53232

The CVE-2026-53232 entry concerns the Linux kernel net: phy component. The root cause is that on PHY probing failure, the SFP upstream is not cleaned up, leaving a dangling upstream reference on the SFP bus. Impact is potential system instability or unexpected behavior during SFP events. The issu...

CVE-2026-53353

CVE-2026-53353 affects the Linux kernel HSR code. The issue arises from a window where a device can be found but hsr->self_node is not set because of the ordering of dellink() and unregister_netdevice_many(), leading to a warning in hsr_addr_is_self() that is being removed. The fix removes WAR...

CVE-2026-53385

CVE-2026-53385 relates to a Linux kernel issue in vc_screen where a race in vcs_write() can yield a stale vc_data after the console_lock is dropped and re-acquired. If the vc has been deallocated in the interim, a subsequent call to vcs_scr_updated() uses a NULL vc, causing a null-pointer derefer...

CVE-2026-64189

CVE-2026-64189 affects the Linux kernel netfilter ipset dump path. A race between dump and ip_set_list resize allows a use-after-free when a concurrent ip_set_create() grows the array and the old one is freed before it is fully dereferenced. The advisory notes that the dump code reads inst->ip...

CVE-2026-64238

CVE-2026-64238 affects the Linux kernel gpio: shared subsystem. The root cause was a too-wide critical section protecting the offset field in struct gpio_shared_entry, which could cause a deadlock during removal of a shared GPIO proxy’s parent. The fix shortens the critical section to protect the...

CVE-2026-64276

CVE-2026-64276 affects the Linux kernel synaptics-rmi4 input driver. The F30/GP I/O mapping code incorrectly allocated gpioled_key_map for at most 6 entries but later iterated up to gpioled_count (0..31) and advanced input->keycodemax to the full count, risking out-of-bounds reads in the atten...

CVE-2026-64298

CVE-2026-64298: Linux kernel NFSv4: when O_TRUNC is used, the open permission mask must include MAY_WRITE so the local check aligns with server behavior. Current nfs_open_permission_mask() derives the mask from O_ACCMODE, which can let an open(O_RDONLY|O_TRUNC) pass local checks while the server ...