CVE-2026-43076

The vulnerability CVE-2026-43076 affects the ocfs2 filesystem in the Linux kernel. When reading an inode from disk, ocfs2_validate_inode_block() did not validate the i_size of inline data against the inline data capacity (id_count). A corrupted filesystem could make i_size exceed id_count, causin...

CVE-2026-43091

The CVE-2026-43091 vulnerability affects the Linux kernel xfrm policy handling during netns exit. The root cause is that xfrm_policy_fini() frees the policy_bydst hash tables after flushing work items and deleting policies, but does not wait for concurrent RCU readers to exit read-side critical s...

CVE-2026-43279

The CVE-2026-43279 entry concerns the Linux kernel ALSA USB-audio subsystem. A discrepancy between playback and capture stream setups (e.g., USB core max packet size) can cause out-of-bounds writes to the buffer, potentially crashing the system. A fix was implemented by adding a sanity check of t...

CVE-2026-43348

The CVE-2026-43348 issue affects the Linux kernel’s mshv_vtl path: when registering VTL0 memory via MSHV_ADD_VTL0_MEMORY, the calculation of pgmap->vmemmap_shift can exceed MAX_FOLIO_ORDER, causing a WARN and -EINVAL during memremap_pages(). The root cause is failing to clamp the computed shif...

CVE-2026-43437

CVE-2026-43437 affects the Linux kernel ALSA PCM subsystem (snd_pcm_drain). The issue is a use-after-free in the drain path: during drain, runtime is reassigned to a linked stream’s runtime and after releasing the stream lock, runtime fields (no_period_wakeup, rate, buffer_size) are accessed with...

CVE-2026-43452

CVE-2026-43452 affects the Linux kernel netfilter x_tables option walkers (xt_tcpudp and xt_dccp). The vulnerability arises when processing packet options: walkers that increment with i += op[i + 1] ? : 1 can read op[i + 1] past the end of the option area, enabling an out-of-bounds read. Multiple...

CVE-2026-43483

CVE-2026-43483 (Linux kernel, KVM/VMX-SVM) fixes a flaw in SVM AVIC handling where CR8 write interception could remain enabled after AVIC activation. The patch explicitly sets/clears CR8 interception when AVIC is (de)activated to prevent the dangling intercept, which could cause TPR desynchroniza...

CVE-2026-43496

CVE-2026-43496 affects the Linux kernel net/sched subsystem (sch_red). When red qdiscs with children (e.g., qfq) perform a peek() to expose an skb and then immediately dequeue from the child, the code path could dereference NULL and trigger a kernel panic. The fix changes the sequence from direct...

CVE-2026-45841

CVE-2026-45841 affects the Linux kernel netfilter nfnetlink_osf in the OSF_WSS_MODULO path. The root cause is a divide-by-zero in nf_osf_match_one() when ctx->window is taken modulo f->wss.val with no guard for f->wss.val == 0. A CAP_NET_ADMIN user can add such a fingerprint via nfnetlin...

CVE-2026-45879

The CVE-2026-45879 entry describes a race condition in the Linux kernel power subsystem (bq25980) where a devm_ IRQ request and devm_ power_supply handle registration order can lead to use-after-free in power_supply_changed(), potentially triggering a crash or memory corruption. The root cause is...

CVE-2026-45910

The CVE-2026-45910 issue affects the Linux kernel RDMA/rxe driver, caused by a race between retransmit_timer() and rxe_destroy_qp that can drop a Queue Pair (QP) reference count to zero during timer handling. Public documents describe a use-after-free risk and refcount underflow in affected flows...

CVE-2026-45918

CVE-2026-45918 concerns a race condition in the Linux kernel related to OpenVPN TCP handling. When a peer is kept alive and later removed, the kernel temporarily places the peer in a release list and detaches from the socket by restoring its proto and socket callbacks. If userspace closes the soc...

CVE-2026-45951

The CVE-2026-45951 issue affects the Linux kernel BPF subsystem, caused by incorrect reference counting in check_pseudo_btf_id() that could cause a use-after-free of a BTF object. The mitigation is a kernel patch that fixes the refcount handling (and related code). RedHat notes potential privileg...

CVE-2026-45957

CVE-2026-45957 documents a Linux kernel RCU bug: missing recursion protection in rcu_read_unlock() can cause a deadloop when softirq handling runs under ftrace, as shown in the call stack involving raise_softirq_irqoff() and rcu_read_unlock_special(). The issue was fixed by commits that adjust ir...

CVE-2026-45995

A CVE-2026-45995 has been resolved in the Linux kernel for a local, low-privilege UAF issue in io_uring zcrx handling (io_free_rbuf_ring with a user_struct, freed by io_zcrx_ifq_free before ring destruction). The advisory for openSUSE Tumbleweed indicates the fix is delivered via kernel-devel-7.0...

CVE-2026-46018

CVE-2026-46018 is a Linux kernel issue in ALSA: usb-audio (UAC2) where parse_uac2_sample_rate_range() capped at MAX_NR_RATES but only broke the inner loop; a malformed UAC2 RANGE could continue parsing and flood with "invalid uac2 rates". The fix stops the whole parse at the cap and returns the c...

CVE-2026-46048

CVE-2026-46048 relates to a leak in the Linux kernel ALSA caiaq driver. The issue arises because create_card() takes a usb_get_dev() reference to a USB device and stores the corresponding usb_put_dev() in card_free(), which is registered as snd_card’s private_free destructor. However, private_fre...

CVE-2026-46146

CVE-2026-46146 affects the Linux kernel's ALSA USB audio stack, specifically the convert_chmap_v3() routine. A loop uses cs_desc->wLength for increment but this value isn’t validated, allowing a potential endless loop with malformed descriptors. The issue is resolved by adding a proper size ch...

CVE-2026-46245

CVE-2026-46245 affects the AMDGPU display driver in the Linux kernel. The vulnerability arises in amdgpu_dm_hpd_init() where a NULL dc_link could be dereferenced while setting up HPD interrupts, despite an earlier check for polling decisions. The provided patch assigns dc_link early and skips con...

CVE-2026-46288

CVE-2026-46288 (Linux kernel). The issue is a use-after-free in unittest changeset handling of device-tree nodes: a pointer (parent) shares the same struct device_node as nchangeset, and of_node_put(nchangeset) can drop the refcount to zero while code still uses parent to inspect properties, lead...

CVE-2026-52918

The CVE-2026-52918 entry concerns a race in the Linux kernel Bluetooth subsystem. Specifically, bt_sock_poll() traverses the accept_q without proper synchronization, allowing a race between normal polling and child socket teardown which can drop the last reference on the same socket. The advisory...

CVE-2026-52927

Summary (CVE-2026-52927) Linux kernel: netfilter/ebtables: fix OOB read in compat_mtw_from_user. The issue arises from insufficient validation of user-supplied match_size/target_size when converting 32-bit user structures to kernel-native structures in compat_from_user(). If an extension provides...

CVE-2026-52928

CVE-2026-52928 affects the Linux kernel af_unix implementation. In non-stream sockets (e.g., SOCK_DGRAM, SOCK_SEQPACKET), SIOCATMARK is incorrectly handled for MSG_OOB and should be rejected; the fix returns -EOPNOTSUPP before inspecting the receive queue. Multiple advisories note the issue is re...

CVE-2026-52944

Technical details are not publicly available in the provided documents. The CVE describes a permission bypass in ksmbd/fsctl_set_sparse, but no concrete affected products/versions/fixes are included here. Monitor for updates and vendor advisories.

CVE-2026-53174

CVE-2026-53174 affects the Linux kernel overlay filesystem (ovl). The bug in ovl_iterate_merged() stores PTR_ERR(cache) in err before validating the cache with IS_ERR(cache), so on success err may hold a truncated cache pointer and be returned as a bogus non-zero error. The repro path goes throug...

CVE-2026-53194

The CVE-2026-53194 entry covers a defect in the Linux kernel USB serial driver kl5kusb105 (klsi_105_prepare_write_buffer). The bug occurs when the generic write path uses the bulk-out buffer (size 64) and copies the payload from the write_fifo without reserving space for the 2-byte header, result...

CVE-2026-53250

CVE-2026-53250 : In the Linux kernel, the xsk_skb_metadata() path is vulnerable to a TOCTOU race in which csum_start and csum_offset are read from shared UMEM and then read again for skb assignment. A malicious userspace process can overwrite values between reads, bypassing bounds checks and caus...

CVE-2026-53256

CVE-2026-53256 concerns the Linux kernel Bluetooth RFCOMM implementation. A race in rfcomm_connect_ind() can cause a use-after-free when handling listener sockets: rfcomm_get_sock_by_channel() may drop the list lock without holding a reference, and subsequent operations may free the listener befo...

CVE-2026-53265

The CVE-2026-53265 entry describes a Linux kernel race in the dm-cache policy SMQ path. A check-then-act race occurs in smq_invalidate_mapping where an e->allocated check was left outside the mq->lock after the destructive section was serialized; two concurrent invalidators can observe allo...

CVE-2026-53326

The CVE-2026-53326 entry concerns the Linux kernel debugobjects subsystem. Affected scenario is booting a debug PREEMPT_RT kernel on ARM64 where interrupts can occur before the scheduler is fully enabled, causing a hardirq context to attempt pool filling. This can lead to a deadlock when the inte...

CVE-2026-53347

CVE-2026-53347 affects the Linux kernel DRM/virtio driver when KMS is disabled. The issue caused DRM atomic/modesetting not to initialize on virtio-gpu, leading to access of uninitialized data during driver removal/unbinding and kernel crashes. The fix skips shutting down the atomic core if KMS i...

CVE-2026-53392

CVE-2026-53392 affects the Linux kernel’s NFSv4/flexfiles path. The flaw arises in ff_layout_alloc_lseg(), which decodes the filehandle-version array count and uses it to allocate with kzalloc_objs(). A zero count can yield ZERO_SIZE_PTR and get stored in dss_info->fh_versions, while later fle...

CVE-2026-64106

Linux kernel KVM arm64 vgic-its vulnerability: a userspace process can restore an ITS Device Table Entry with a Size encoding more EventID bits than the virtual ITS supports. Although MAPD rejects the state, vgic_its_restore_dte() stores the out-of-range value in dev->num_eventid_bits, allowin...

CVE-2026-64134

The CVE-2026-64134 entry concerns the Linux kernel ALSA PCM path. The vulnerability arises during transition to iov_iter for PCM data transfer, where iov_iter was also configured for silencing (data = NULL), leading to a bogus iov_iter calculation and a NULL dereference on some architectures, not...

CVE-2026-64274

The CVE-2026-64274 issue is in the Linux kernel Goodix touchscreen driver. The code reads device-reported touch counts without clamping, allowing a malfunctioning/malicious controller (or I2C bus tampering) to advertise up to 15 contacts. This enables a stack out-of-bounds write in goodix_ts_read...

CVE-2026-64275

CVE-2026-64275 affects the Linux kernel elan_i2c driver. The fault is division by zero when x_traces/y_traces are zero and an unsigned underflow in width calculation; patch adds non-zero checks and clamps width to >=0, with safe defaults (1) to ensure probe/sysfs nodes work and recovery firmwa...

CVE-2026-64296

The CVE concerns the Linux kernel exFAT driver: in exfat_find_dir_entry(), processing directory NAME entries (TYPE_EXTEND) advances the output buffer by a fixed amount while the guard tracks name length, allowing an out-of-bounds read/write when name fragments are long/short. The bug arises becau...

CVE-2026-64362

CVE-2026-64362 is a use-after-free in the Linux kernel's HID lg-g15 driver. The driver allocates lg_g15_data via devm and schedules a work item from input report handlers, but had no remove callback to cancel pending work. When a supported keyboard (G15, G15 v2, or G510) is unplugged, devres free...

CVE-2026-64395

Summary: CVE-2026-64395 in the Linux kernel ksmbd exposes information disclosure via FSCTL_DUPLICATE_EXTENTS_TO_FILE. The source file is passed directly to vfs_clone_file_range() / vfs_copy_file_range() without checking the SMB access mask, enabling a handle opened with attribute access to copy c...

CVE-2026-64418

CVE-2026-64418 is a Linux kernel memory-management race in the shrinker subsystem. The vulnerability arises when the shrinker_info array is freed while still accessible, causing use-after-free or double-free. The root cause is that alloc_shrinker_info() can drop shrinker_mutex before finishing in...

CVE-2026-64443

Summary (CVE-2026-64443): Linux kernel staging: rtl8723bs vulnerable in the update_beacon_info() IE loop, where parsing of IEs could read beyond the received frame. The loop advances by (pIE->length + 2) but only guards on i length extending beyond len. The fix adds two guards at the top of th...

CVE-2026-64445

The CVE-2026-64445 record documents concrete fixes in the Linux kernel (staging: rtl8723bs) for WEP-related issues in the OnAuth() path. Specifically, a vulnerability existed where rtw_wep_decrypt() could read beyond the frame when the frame length was shorter than WLAN_HDR_A3_LEN + iv_len + icv_...

CVE-2007-6434

CVE-2007-6434 affects Linux kernel 2.6.23. A local attacker can create low pages in virtual userspace memory and bypass mmap_min_addr protection by supplying a crafted executable that calls do_brk. This is a local-attack scenario with partial impact on availability as per CVSS 2.0 (low base score...

CVE-2016-6785

CVE-2016-6785 is described across multiple sources as an elevation of privilege vulnerability in the MediaTek driver on Android, enabling a (local) attacker to execute arbitrary code in the context of the kernel. The documented impact is a kernel-level compromise that requires a privileged proces...

CVE-2022-50009

CVE-2022-50009 corresponds to a Linux kernel vulnerability in f2fs → fixed null-ptr-deref in f2fs_get_dnode_of_data during atomic write. The provided data describe a scenario where f2fs_do_write_data_page writes a cow_inode (for atomic writes) and ends up dereferencing a NULL cow_inode, triggerin...

CVE-2022-50147

CVE-2022-50147 refers to a Linux kernel memory policy bug: mm/mempolicy get_nodes can access the nmask array out of bounds when a user specifies more nodes than supported. The issue is resolved in the Linux kernel (patches referenced), with CVSSv3.1 base score 7.1 (HIGH), local access, low privil...

CVE-2022-50210

CVE-2022-50210 concerns the Linux kernel on MIPS where a warning is produced in /proc/cpuinfo due to cpu_max_bits_warn() iterating CPUs with NR_CPUS when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled. The root cause is using NR_CPUS as the iteration limit; the fix switches to ...

CVE-2022-50255

CVE-2022-50255 (Linux kernel tracing) : The issue affects the tracing subsystem where the synthetic event field, specifically the character array file[], could be read as a string without validating the user-space address. This caused crashes when reading from user memory during open/openat strin...

CVE-2022-50363

CVE-2022-50363 relates to the Linux kernel skmsg path: alloc_sk_msg() could be invoked from a non-sleepable context. The root cause is missing gfp_t argument passing, with sk_psock_verdict_recv() using rcu_read_lock(). The provided documents trace a call path from sk_psock_verdict_recv through al...

CVE-2022-50374

CVE-2022-50374 affects the Linux kernel Bluetooth stack (hci_ldisc/hci_serdev). The issue is a missing handling of percpu_init_rwsem() failure, leading to a NULL pointer dereference in hci_uart_tty_close() because rcu_sync_enter() can be called without rcu_sync_init() after hci_uart_tty_open() ig...