CVE-2026-64242

The CVE-2026-64242 issue affects the Linux kernel USB gadget net2280 driver. A double free could occur in the probe error path: usb_initialize_gadget() registers gadget_release() as the release callback, so net2280 is freed via gadget_release() when the gadget reference drops. The probe error pat...

CVE-2026-46106

CVE-2026-46106 concerns the Linux kernel eventfs remount race. The root cause is a race where eventfs_inodes are traversed while remounts are performed, due to mixing rcu_read_lock usage with SRCU and not holding eventfs_mutex during the critical walk. The fix (commit 340f0c7067a9) updates the ev...

CVE-2026-46156

CVE-2026-46156 affects the Linux kernel LoongArch implementation, specifically loongson_gpu_fixup_dma_hang(), where the code may read device registers using an incorrect base (base+PCI_DEVICE_ID) when a discrete GPU is present. This causes ADE and can trigger a kernel panic, leading to local DoS....

CVE-2026-46183

CVE-2026-46183 affects the Linux kernel DAMON sysfs code. The vulnerability is a use-after-free in damon_sysfs_quot_goal->path: user reads/writes to the sysfs 'path' file can deallocate the underlying buffer, and current protection only guards parameter reads during commit; direct user access ...

CVE-2026-46188

CVE-2026-46188 affects the Linux kernel in the octeon_ep_vf driver. The vulnerability arises because napi_build_skb() can return NULL on allocation failure and __octep_vf_oq_process_rx() uses the result without checking for NULL in both the single-buffer and multi-fragment paths, causing a NULL p...

CVE-2026-46280

CVE-2026-46280 affects the Linux kernel in the HMM selftest path for device memory (dmirror) handling. The root cause is in dmirror_fops_release(), which frees the dmirror struct without migrating device-private pages back to system memory, leaving a stale zone_device_data pointer. If a fault occ...

CVE-2026-46288

CVE-2026-46288 (Linux kernel). The issue is a use-after-free in unittest changeset handling of device-tree nodes: a pointer (parent) shares the same struct device_node as nchangeset, and of_node_put(nchangeset) can drop the refcount to zero while code still uses parent to inspect properties, lead...

CVE-2026-46308

CVE-2026-46308 affects the Linux kernel: a use-after-free in mediatek’s pmdomain code, within scpsys_get_bus_protection_legacy(). The bug stems from of_find_node_with_property() returning a device node with an incremented refcount, followed by of_node_put(node) before validating the result of sys...

CVE-2026-52919

CVE-2026-52919 affects the batman-adv component in the Linux kernel. The root cause is an underflow of the atomic counter “sending” in batadv_tp_sender_shutdown(), which is decremented unconditionally and can become -1 when multiple code paths call it. A negative value causes the sender kthread t...

CVE-2026-52926

CVE-2026-52926 affects the Linux kernel component used by batman-adv. The root cause is in batman-adv teardown: batman-adv/batadv_gw_node_free() removes entries from the gateway list but does not clear the currently selected gateway. This leaves a stale gateway reference in bat_priv->gw.curr_g...

CVE-2026-52942

The CVE corresponds to a Linux kernel netfilter nf_log issue where the fallback dump_mac_header() could read past the buffer if the MAC header was not set. The root cause was testing mac_header against network_header without verifying skb_mac_header_was_set(), causing skb_mac_header to point far ...

CVE-2026-52944

Technical details are not publicly available in the provided documents. The CVE describes a permission bypass in ksmbd/fsctl_set_sparse, but no concrete affected products/versions/fixes are included here. Monitor for updates and vendor advisories.

CVE-2026-53090

The CVE-2026-53090 entry describes a Linux kernel BPF verifier flaw: when using ld_abs/ld_ind in subprogs, the verifier failed to simulate abnormal exits if packet loads failed. This is tied to the code path for bpf_gen_ld_abs() and affects subprograms that are BTF-annotated with scalar return ty...

CVE-2026-53134

A vulnerability in the Linux kernel netfilter NFT_FIB code (CVE-2026-53134) could leak uninitialized kernel stack via the OIFNAME result register on certain lookup-fail paths. The issue stems from NFT_FIB_RESULT_OIFNAME writes only a single byte and leaves the remaining IFNAMSIZ span stale in nft...

CVE-2026-53153

CVE-2026-53153 affects the Linux kernel memcg list_lru path. A race during memcg_reparent_list_lrus() clears the dying memcg’s xarray entry before reparenting per-node lists, letting concurrent list_lru_del/walk operate on the parent and corrupt next/prev pointers. The fix reverses the order: rep...

CVE-2026-53226

The CVE-2026-53226 issue affects the Linux kernel GPIO Rockchip driver: generic IRQ chips allocated via irq_alloc_domain_generic_chips() are not freed on driver removal, leaving domain generic chips and the global gc_list leaked and potentially visited later by suspend/resume/shutdown callbacks, ...

CVE-2026-53290

CVE-2026-53290 relates to the Linux kernel DRM subsystem (xe/stall path). The issue occurs in xe_eu_stall_stream_close() where drm_dev_put() is invoked before the stream is disabled and its resources freed. If this drops the last reference, device structures may be freed while subsequent cleanup ...

CVE-2026-53322

CVE-2026-53322 affects the Linux kernel’s vfio/pci subsystem. The issue occurs during device shutdown when vfio_pci_core_close_device() disables a function before calling vfio_pci_dma_buf_cleanup(), allowing a small window where the function’s MSE is cleared while DMABUF-access to BARs may still ...

CVE-2026-53330

In the Linux kernel, drm/amd/display fixes an out-of-bounds read in dp_get_eq_aux_rd_interval() triggered when a sink reports 8 LTTPR repeaters via DPCD. The aux_rd_interval array in struct dc_lttpr_caps was declared with MAX_REPEATER_CNT - 1 elements (indices 0..6), but the offset can be as larg...

CVE-2026-53368

CVE-2026-53368 concerns the Linux kernel f2fs filesystem. Multiple sources describe a fix for fsck inconsistency caused by incorrect nat_entry flag handling during checkpoint sequencing. The root cause is that f2fs_need_dentry_mark() reads nat_entry flags without mutual exclusion with the checkpo...

CVE-2026-53387

In the Linux kernel, the vulnerability CVE-2026-53387 affects the IIO light driver for veml6075. The issue arises in veml6075_it_ms indexing: veml6075_it_ms has 5 elements, but VEML6075_CONF_IT can yield 0–7, which can lead to an out-of-bounds access when the index is >= 5. The fix adds a boun...

CVE-2026-64065

CVE-2026-64065 affects the Linux kernel's netfs subsystem , specifically a VM_BUG_ON_FOLIO() assertion failure in netfs_write_begin() . The root cause is that folio_unlock() is called on an already-unlocked folio (at mm/filemap.c:1504), triggered through the Ceph filesystem write path (ceph_write...

CVE-2026-64085

CVE-2026-64085 is a buffer overflow in the Linux kernel's hwmon (pmbus/adm1266) driver. The helper adm1266_pmbus_block_xfer() trusts the device-supplied length and can write up to 255 bytes , but adm1266_nvmem_read_blackbox() advances in 64-byte strides within a 2048-byte dev_mem buffer. On the t...

CVE-2026-64174

Technical details for CVE-2026-64174 are not provided in the connected documents. Monitor for updates and public disclosures to confirm affected products, impact, and remediation.

CVE-2026-64255

Summary: CVE-2026-64255 affects the Linux kernel WiFi stack (iwlwifi, MLD). Three BA session handlers compute station IDs with ffs(ba_data->sta_mask) - 1 without ensuring sta_mask is non-zero, causing an out-of-bounds access on fw_id_to_link_sta[] when sta_mask is zero (ffd returns 0, wrapped ...

CVE-2026-64285

CVE-2026-64285 affects the Linux kernel KVM SEV SNP path. When populating a guest’s initial CPUID data, KVM may pin a source page as writable and write back data if the userspace-provided CPUID data is rejected by trusted firmware, risking clobbering read-only memory due to kernel mappings. Multi...

CVE-2026-64344

CVE-2026-64344 is a use-after-free in the Linux kernel's USB idmouse driver triggered by a disconnect race. The root cause is that mutex_unlock() is non-atomic and may still access the mutex structure after release, making it unsafe for managing object lifetime. The fix replaces direct mutex-base...

CVE-2026-64406

CVE-2026-64406 affects the Linux kernel Bluetooth subsystem. Multiple vendors report a use-after-free in bt_accept_dequeue() where a temporary reference to the accept queue is dropped too early, causing sock_hold() to access freed memory during listening L2CAP socket cleanup. The fix retains the ...

CVE-2026-64432

Summary: CVE-2026-64432 affects the Linux kernel, specifically the ntfs3 filesystem code path used during NTFS image replay. The issue stems from validating the Dirty Page Table (DPT) capacity in log_replay() when copying LCNs; if dp->lcns_follow (capacity) is smaller than lrh->lcns_follow,...

CVE-2002-0046

The CVE-2002-0046 vulnerability affects the Linux kernel (and possibly other OS) where remote attackers can read memory by sending fragmented ICMP packets that trigger an ICMP TTL Exceeded response containing memory fragments. This exposes partial confidentiality and relies on ICMP handling in th...

CVE-2004-0058

The CVE-2004-0058 entry affects Antivir for Linux 2.0.9-9 and potentially earlier versions. It describes a local privilege issue where a symlink race on the temporary file .pid_antivir_$$ allows a local user to overwrite arbitrary files. The underlying cause is a symlink attack on a daemon-relate...

CVE-2006-3634

The CVE-2006-3634 entry describes a vulnerability in Linux kernel 2.6.17-rc4 through 2.6.18-rc2 where two futex helper functions, __futex_atomic_op and futex_atomic_cmpxchg_inatomic, perform the atomic futex operation in kernel address space instead of user space. This misplacement can allow a lo...

CVE-2013-3236

The CVE-2013-3236 issue affects the Linux kernel component vmci_transport_dgram_dequeue in net/vmw_vsock/vmci_transport.c; it fails to initialize a length variable, allowing local attackers to read kernel stack memory via crafted recvmsg/recvfrom. Affects kernels before 3.9-rc7. Multiple advisori...

CVE-2016-6757

CVE-2016-6757 describes an information-disclosure vulnerability affecting Qualcomm components used in Android devices, specifically the camera driver and video driver. The issue could allow a local malicious application to access data beyond its permissions after compromising a privileged process...

CVE-2017-0580

CVE-2017-0580 is an elevation-of-privilege flaw in the Synaptics Touchscreen driver within Android’s kernel (3.18). A local malicious process could exploit the driver to run arbitrary code in kernel context. The issue is described as High severity, contingent on compromising a privileged process ...

CVE-2022-50319

CVE-2022-50319 affects the Linux kernel’s coresight/trbe path. The vulnerability stems from cpuhp_state_add_instance() and cpuhp_state_remove_instance() not being used in proper pairs, which can trigger a warning in cpuhp_remove_multi_state() due to a non-empty cpuhp_step list, potentially leavin...

CVE-2022-50408

The CVE-2022-50408 entry concerns a use-after-free in brcmfmac within the Linux kernel when handling wifi transmission in brcmf_netdev_start_xmit(). The vulnerability can allow a schedule race between brcmf_proto_tx_queue_data and updating skb stats, leading to a use-after-free observed by KASAN....

CVE-2022-50543

In CVE-2022-50543, Linux kernel RDMA/rxe has a double free of mr->map when rxe_mr_init_user() fails and rxe_mr_cleanup() is called. The root cause involved freeing mr->map twice in the error path, traced through prior commits and a revert, and has been fixed by making rxe_mr_cleanup() free ...

CVE-2023-53149

CVE-2023-53149 concerns the Linux kernel ext4 filesystem. The issue arises from a filesystem-wide lock protecting ext4_writepages() that can deadlock during fs reclaim initiated by page writeback, due to a recursion scenario where ext4_writepages() attempts to acquire sbi->s_writepages_rwsem w...

CVE-2023-53173

In CVE-2023-53173, the Linux kernel tty pcn_uart driver had a memory leak when using debugfs_lookup() because the returned object wasn’t always released with dput(). The recommended fix is to call debugfs_lookup_and_remove() to perform the lookup and cleanup in one step, mitigating the leak.

CVE-2023-53210

CVE-2023-53210 affects Linux kernel md/raid5-cache code: a null pointer dereference can occur in r5l_flush_stripe_to_raid() when io completion is processed after the log end clears the list. The root cause is r5l_log_flush_endio() clearing the list before handling bio cleanup, which can lead to a...

CVE-2023-53213

The CVE-2023-53213 issue affects the Linux kernel brcmfmac driver, causing a slab-out-of-bounds read in kmemdup called from brcmf_get_assoc_ies when assoc_info->req_len (from a USB URB) exceeds WL_EXTRA_BUF_MAX. The advisory states this was fixed by adding a size check for req_len/resp_len in ...

CVE-2023-53226

The CVE-2023-53226 entry concerns the Linux kernel mwifiex wifi driver. The vulnerability is a possible out-of-bounds access to the skb->data buffer during RX packet processing (OOB and integer underflow) affecting functions: mwifiex_process_mgmt_packet, mwifiex_process_sta_rx_packet, mwifiex_...

CVE-2023-53232

CVE-2023-53232 affects the Linux kernel MT7921/MT76 stack. The vulnerability arises from a kernel panic due to accessing unallocated eeprom.data, leading to a NULL dereference in mt7921_mcu_parse_response. A fix is present: the MT7921 driver no longer uses eeprom.data, and the code referencing it...

CVE-2023-53319

CVE-2023-53319 (Linux kernel, KVM arm64) : The issue arises from a race between finalize_pkvm() and kvm_arm_init() initcalls, where finalize_pkvm() proceeds even if kvm_arm_init() fails, causing warnings and a potential HYP panic. The connected Astra/SUSE OSV entries confirm this vulnerability in...

CVE-2023-53321

CVE-2023-53321 affects the Linux kernel wireless stack, specifically wifi: mac80211_hwsim. The issue arises when short frames are processed in ways that could forward incomplete 3-address headers, risking access to invalid memory if shorter frames slip through (even though some control frames lik...

CVE-2023-53358

CVE-2023-53358 relates to the Linux kernel’s ksmbd component, where a race condition during concurrent smb2 tree disconnect led to a use-after-free (UAF). The issue is addressed by a patch that adds TREE_CONN_EXPIRE flags for tcon to prevent concurrent access. The connected documents confirm the ...

CVE-2023-53414

The CVE-2023-53414 entry affects the Linux kernel scsi: snic driver. The root cause is a memory leak when using debugfs_lookup() because the returned object required a dput(), which could leak over time. The advisory notes a fix by using debugfs_lookup_and_remove() instead, which handles the look...

CVE-2023-53432

CVE-2023-53432 : Linux kernel vulnerability in the FireWire net path (firewire: net: fix use after free in fwnet_finish_incoming_packet()). The netif_rx() path frees the skb, so dereferencing skb->len could use freed memory. The incident is reported as resolved in the provided description; no ...

CVE-2023-53440

CVE-2023-53440 concerns the nilfs2 sysfs interface lifetime in the Linux kernel. Multiple connected advisories confirm a race in sysfs entry creation/deletion for per-filesystem metadata files (cpfile, sufile, dat), where attributes may be accessed outside the intended lifetime, risking inode NUL...