CVE-2026-64420

Summary : CVE-2026-64420 affects the Linux kernel in the Cros EC (ChromeOS) subsystem. The issue arises during driver probing where dev_set_drvdata() is set before probe success, allowing sub-drivers such as cros_ec_typec to retain a stale pointer to the device even if ec_device_probe() fails. Th...

CVE-2026-23248

CVE-2026-23248 affects the Linux kernel perf/core component, specifically the perf_mmap path that initializes a ring_buffer. The issue is a race between a failing mmap() setup and a concurrent mmap() on a dependent event (e.g., due to output redirection). The ring_buffer pointer (event->rb) is...

CVE-2026-23346

CVE-2026-23346 affects the Linux kernel (arm64) in the ioremap_prot pathway. The root cause is that ioremap_prot() may extract non-address bits from a user mapping’s pgprot_t (including permissions) and generate a new user mapping, which can be accessed by the kernel when PAN is enabled. This can...

CVE-2026-31430

CVE-2026-31430 affects the Linux kernel: X.509 extensions parsing could read the first byte of an extension before checking length, causing out-of-bounds access. The vulnerability can be triggered by an unprivileged user submitting a crafted certificate via the keyrings(7) API. A PoC exists. The ...

CVE-2026-31474

The CVE-2026-31474 issue affects the Linux kernel’s CAN ISO-TP (isotp) path. The bug is a use-after-free involving isotp_sendmsg() and the so->tx.buf buffer: if a signal interrupts wait_event_interruptible() inside close() while tx.state is ISOTP_SENDING, the release path may free so->tx.bu...

CVE-2026-31626

CVE-2026-31626 affects the Linux kernel’s rtl8723bs staging driver, specifically the rtw_BIP_verify() function. A u64 variable (le_tmp64) was not fully initialized, which Smatch warned could leave the last two bytes uninitialized (only 6 of 8 bytes copied). The issue is resolved by initializing l...

CVE-2026-31687

The CVE-2026-31687 issue concerns the Linux kernel GPIO/omap driver: omap_mpuio_driver was registered from omap_gpio_probe() and could deadlock because a device lock may be held during probe, compounded by the driver core changes enforcing device_lock for driver_match_device(). The driver was als...

CVE-2026-31715

In Linux kernel (f2fs), CVE-2026-31715 is a use-after-free triggered by decrementing sbi->nr_pages[] during F2FS_WB_CP_DATA handling. The root cause is that f2fs_put_super() calls iput(sbi->node_inode) and NULLs the node_inode after the counter reaches zero, allowing f2fs_in_warm_node_list(...

CVE-2026-43078

The CVE-2026-43078 entry affects the Linux kernel crypto/af_alg component. A root-cause was an overflow in page reassignment within af_alg_pull_tsgl where the update to support page reallocation wasn’t fully reflected in the loop, allowing one extra page to be reassigned. The vulnerability is des...

CVE-2026-43215

The CVE-2026-43215 issue affects the Linux kernel CIFS implementation: the code used cifs_tcp_ses_lock to guard tcon fields, but this lock protected more than intended. The patch introduces more granular locking (tc_lock) within tcon-related structures (in addition to srv_lock and ses_lock) to re...

CVE-2026-43320

The CVE-2026-43320 entry concerns the Linux kernel’s drm/amd/display component. The root cause described across sources is a missing function hook check before use, which could affect dsc eDP handling. Public descriptions indicate a potential for instability or unexpected behavior in the display ...

CVE-2026-43337

CVE-2026-43337 concerns the Linux kernel DRM/AMD display path, where a NULL pointer dereference can occur in dcn401_init_hw() when calling update_bw_bounding_box() without validating the callback pointer. The existing condition ((!fams2_enable && update_bw_bounding_box) || freq_changed) can evalu...

CVE-2026-43350

In the Linux kernel, a vulnerability in the SMB client path can allow a malicious server to exploit an ACE with sid_unix_NFS_mode by providing an ACE with only two subauthorities. parse_dacl() would treat this as an NFS mode SID and read sub_auth[2], potentially reading four bytes past the end of...

CVE-2026-43436

The CVE-2026-43436 vulnerability affects the Linux kernel ALSA USB-audio driver (Scarlett2 mixer quirk). A malformed USB descriptor can trigger a NULL dereference in scarlett2_find_fc_interface() due to assuming an endpoint exists. The patch adds a sanity check for bNumEndpoints and skips invalid...

CVE-2026-43480

In CVE-2026-43480, the Linux kernel ASoC driver for the amd acp3x-rt5682-max9836 (acp3x_5682_init) failed to check the return value of clk_get(), risking dereferencing an error pointer in rt5682_clk_enable(). The fix is to switch to device-managed devm_clk_get() and add IS_ERR() checks for both c...

CVE-2026-43481

The CVE-2026-43481 issue affects the Linux kernel net-shapers component. The vulnerability arises because, on genlmsg_reply() failure, the reply skb could be freed twice (the code path freed or nlmsg_free(msg) after genlmsg_reply() and in all return paths). The root cause is that netlink_unicast(...

CVE-2026-43497

The CVE-2026-43497 issue affects the Linux kernel fbdev path (udlfb/dlfb) where dlfb_ops_mmap maps vmalloc framebuffer pages without vm_ops, preventing mmap tracking. This allowed stale user PTEs to coexist with freed kernel pages after dlfb_realloc_framebuffer() via FBIOPUT_VSCREENINFO, causing ...

CVE-2026-45899

CVE-2026-45899 is a Linux kernel/ext4 issue where, if a split extent operation fails, stale extent entries may remain in the extent status tree. The fix requires dropping all of the potentially stale extents when the split fails to prevent inconsistent metadata. Exploitation details are not provi...

CVE-2026-46004

CVE-2026-46004 concerns the Linux kernel ALSA caiaq driver. The issue stems from the probe path in setup_card(), where error handling was insufficient: on certain errors the code could drop into non-fatal paths, risking a use-after-free (UAF) on subsequent caiaq-initiated calls. The patch introdu...

CVE-2026-46031

The CVE-2026-46031 entry describes a Linux kernel issue in the ks8851 network driver where a race/deadlock can occur between TX softirq handling and RX processing when BHs are enabled around IRQ handling. The root cause is a potential deadlock: ks8851_irq() holds a spinlock while ks8851_start_xmi...

CVE-2026-46062

In the Linux kernel ntfs3 driver, CVE-2026-46062 arises from an integer overflow in run_unpack() where the volume boundary check uses raw addition (lcn + len) against sbi->used.bitmap.nbits. This can wrap for large lcn/len values, bypassing validation. A fix uses check_add_overflow() (consiste...

CVE-2026-46074

CVE-2026-46074 is addressed in openSUSE openSUSE Tumbleweed via kernel-devel-7.0.11-1.1. The issue is in the Linux kernel SPI ch341 driver, where memory leaks occur on probe failures due to improper cleanup. The patch requests deregistration of the controller, disabling pins, and killing/freeing ...

CVE-2026-46106

CVE-2026-46106 concerns the Linux kernel eventfs remount race. The root cause is a race where eventfs_inodes are traversed while remounts are performed, due to mixing rcu_read_lock usage with SRCU and not holding eventfs_mutex during the critical walk. The fix (commit 340f0c7067a9) updates the ev...

CVE-2026-46108

In the Linux kernel, CVE-2026-46108 affects the ipmi:si path where a failure to allocate a message could leave the driver in a bad state. The root cause is insufficiently returning to normal operation after allocation fails, which can impact availability (local access, low privileges). The vulner...

CVE-2026-46112

CVE-2026-46112 relates to the Linux kernel RDMA/hns driver. The vulnerability arises from an unlocked call to hns_roce_qp_remove() during error unwinding in hns_roce_create_qp_common(), where the caller did not hold the required locks, risking memory corruption. The fixes synchronize by grabbing ...

CVE-2026-46183

CVE-2026-46183 affects the Linux kernel DAMON sysfs code. The vulnerability is a use-after-free in damon_sysfs_quot_goal->path: user reads/writes to the sysfs 'path' file can deallocate the underlying buffer, and current protection only guards parameter reads during commit; direct user access ...

CVE-2026-46198

The CVE-2026-46198 issue affects the Linux kernel’s batman-adv component. A mismatch between integer types caused an integer overflow in batadv_iv_ogm_send_to_if, where buff_pos is s16 while the size check uses an int in batadv_iv_ogm_aggr_packet, potentially enabling an out-of-bounds read. The v...

CVE-2026-46245

CVE-2026-46245 affects the AMDGPU display driver in the Linux kernel. The vulnerability arises in amdgpu_dm_hpd_init() where a NULL dc_link could be dereferenced while setting up HPD interrupts, despite an earlier check for polling decisions. The provided patch assigns dc_link early and skips con...

CVE-2026-46308

CVE-2026-46308 affects the Linux kernel: a use-after-free in mediatek’s pmdomain code, within scpsys_get_bus_protection_legacy(). The bug stems from of_find_node_with_property() returning a device node with an incremented refcount, followed by of_node_put(node) before validating the result of sys...

CVE-2026-52904

CVE-2026-52904 affects the Linux kernel's DRM Nouveau NVKM path. When aperture_remove_conflicting_pci_devices() fails, nvkm_device_pci_new() could leak the device wrapper and pci_enable_device() reference. The fix redirects to the existing fail_nvkm path so nvkm_device_del() runs and balances res...

CVE-2026-53086

The CVE concerns the Linux kernel bcmgenet driver: the bcmgenet_timeout handler erroneously attempts to bring down all TX queues when a single queue times out, creating race conditions with active queues. The fixed behavior restarts only the timed-out queue, mitigating the race. Reported impact i...

CVE-2026-53135

The CVE-2026-53135 issue affects the Linux kernel’s DRM AMD display path, specifically SDP debugfs writes. Root cause: dp_sdp_message_debugfs_write() dereferenced connector->base.state->crtc without NULL checks, potentially crashing when a connected-but-unbound connector exists (e.g., after...

CVE-2026-53145

Summary of CVE-2026-53145 (Linux kernel drm/gem change_handle race) : A race between gem_close and gem_change_handle ioctls in the DRM GEM subsystem was addressed but not cleanly fixed initially. The root cause involved confusion around the local handle variable (which is the new handle) and seve...

CVE-2026-53154

The CVE-2026-53154 issue affects the Linux kernel mm/hugetlb path where, on error during copy of huge pages, the per-VMA reservation can leak despite free_huge_folio() restoring the global pool. Concrete details from connected sources show that two code paths allocate a hugetlb folio (alloc_huget...

CVE-2026-53181

CVE-2026-53181 affects the Linux kernel vsock/vmci stack. On failing handshake, vmci_transport_recv_listen() could leave sk_ack_backlog incremented (due to missing sk_acceptq_removed() call), allowing backlog growth toward sk_max_ack_backlog and a possible listener denial of new connections (-ECO...

CVE-2026-53218

CVE-2026-53218 affects the Linux kernel netfilter nft_exthdr path. The root cause is a mismatch in register initialization: nft_exthdr_init() passes priv->len to nft_parse_register_store(), which marks that many bytes as initialized, but when NFT_EXTHDR_F_PRESENT is set the eval paths write on...

CVE-2026-53350

CVE-2026-53350 : Linux kernel ASoC wm_adsp vulnerable to a NULL dereference during control removal. The fix adds a NULL pointer check in wm_adsp_control_remove() before cleaning up priv data. The private data may be absent for SYSTEM controls or when a codec driver’s hidden control prevents wm_ad...

CVE-2026-53368

CVE-2026-53368 concerns the Linux kernel f2fs filesystem. Multiple sources describe a fix for fsck inconsistency caused by incorrect nat_entry flag handling during checkpoint sequencing. The root cause is that f2fs_need_dentry_mark() reads nat_entry flags without mutual exclusion with the checkpo...

CVE-2026-64150

CVE-2026-64150 concerns the Linux kernel netfilter nft_inner code. The issue arises from an incorrect order in the error path where local_bh_enable() is called before local_unlock_nested_bh(), effectively releasing a local_lock out of order. This has been resolved in the kernel via the referenced...

CVE-2026-64218

CVE-2026-64218 affects the Linux kernel’s batman-adv subsystem. The bug in batadv_bla_purge_backbone_gw() could leak or misuse report_work structures when purging stale backbone gateway entries. The root cause: a previous loop held entries under spin_lock_bh() and called cancel_work_sync(), which...

CVE-2026-64343

CVE-2026-64343 is a use-after-free in the Linux kernel's USB ldusb driver triggered by a race between release() and disconnect(). The root cause is that mutex_unlock() is non-atomic and may access the mutex structure after the lock is released, making it unsuitable for managing object lifetime di...

CVE-2026-64422

CVE-2026-64422 describes a Linux kernel vulnerability in net/ipv4: bound TCP reordering sysctl writes and MTU probe sizes. The issue arises when negative values written to net.ipv4.tcp_reordering are copied into the u32 tp->reordering field for new sockets, allowing wraparound and potential mi...

CVE-2022-50232

CVE-2022-50232 affects the Linux kernel on arm64 with FEAT_EPAN: UXN was not set on swapper PTEs, causing idmap_kpti_install_ng_mappings to panic when accessing __idmap_kpti_flag. Upstream fix sets UXN on swapper page tables; originated from a boot-flow refactor (commit c3cee924bd85) and a simple...

CVE-2022-50262

CVE-2022-50262 concerns the Linux kernel NTFS handling in the ntfs3 file system. Technical details in the connected documents show that when the NTFS BOOT record_size is negative (treated as a shift value), there is no validation of the resulting shift. This allows an invalid size to propagate in...

CVE-2022-50265

CVE-2022-50265 pertains to the Linux kernel and concerns data races in the kernel crypto/messaging flow involving kcm->rx_wait and kcm->rx_psock. The description states that kcm->rx_psock can be read locklessly in kcm_rfree(), and the issue was mitigated by annotating the corresponding r...

CVE-2022-50319

CVE-2022-50319 affects the Linux kernel’s coresight/trbe path. The vulnerability stems from cpuhp_state_add_instance() and cpuhp_state_remove_instance() not being used in proper pairs, which can trigger a warning in cpuhp_remove_multi_state() due to a non-empty cpuhp_step list, potentially leavin...

CVE-2022-50410

CVE-2022-50410 pertains to the Linux kernel NFSD component handling NFSv2 READ. The issue arises from the historical optimization that combines the RPC receive and send buffers into a single page array, shrinking the send buffer when a large RPC Call is received. A client can trigger this shrinka...

CVE-2022-50415

CVE-2022-50415 affects the Linux kernel on the parisc architecture, where start_task() calls create_singlethread_workqueue() without validating its return value. If the call returns NULL, a null pointer dereference can occur later in queue_delayed_work/on and __queue_work, accessing wq->flags....

CVE-2023-53179

The CVE-2023-53179 entry concerns the Linux kernel netfilter ipset component. Issue: the missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet.c caused an incorrect CIDR_POS(c) calculation, risking slab-out-of-bounds access due to integer underflow. Root cause: absence of IP_SET_HASH_WITH...

CVE-2023-53188

CVE-2023-53188: In the Linux kernel, net: openvswitch: fix race on port output. The vulnerability arises when an Open vSwitch vport is racing with netns/namespace deletion, potentially triggering an infinite loop in skb_tx_hash in dev_queue_xmit if dev->real_num_tx_queues becomes 0 during unre...