CVE-2026-64418

CVE-2026-64418 is a Linux kernel memory-management race in the shrinker subsystem. The vulnerability arises when the shrinker_info array is freed while still accessible, causing use-after-free or double-free. The root cause is that alloc_shrinker_info() can drop shrinker_mutex before finishing in...

CVE-2026-23290

CVE-2026-23290 affects the Linux kernel’s USB pegasus driver: it validates endpoints before bind, preventing binding if the device lacks expected URBs. Exploitation is LOCAL with LOW PRV requirement; impact is a potential crash/denial due to access to endpoints. The issue has been fixed upstream ...

CVE-2026-23381

CVE-2026-23381 – Linux kernel net/bridge nd_tbl NULL dereference when IPv6 is disabled . When booted with ipv6.disable=1, nd_tbl isn’t initialized because inet6_init() exits early, causing br_do_suppress_nd() to dereference a NULL ipv6_stub->nd_tbl and trigger a kernel NULL pointer dereference...

CVE-2026-23424

The CVE-2026-23424 vulnerability affects the Linux kernel’s accel/amdxdna component, caused by insufficient validation of the command buffer payload count. The count field in the command header determines the payload size, and the data must not exceed the remaining buffer space. If not properly c...

CVE-2026-23438

In the Linux kernel mvpp2 driver, CVE-2026-23438 arises from an unconditional access to CM3 flow control via mvpp2_cm3_read()/mvpp2_cm3_write() in mvpp2_bm_switch_buffers(), when priv->cm3_base is NULL (e.g., CM3 SRAM not present in device tree). This can crash the kernel on MTU changes that c...

CVE-2026-31481

CVE-2026-31481 affects the Linux kernel tracing code. The issue arises from boot-time trigger frees not being drained when kthread creation fails, causing boot-time deferred entries to leak and a NULL pointer dereference that crashes the system. The fix drains the entire queued list synchronously...

CVE-2026-31505

The CVE-2026-31505 issue affects the Linux kernel iavf driver: out-of-bounds writes occur because iavf_get_ethtool_stats() uses real_num_tx_queues for ETH_SS_STATS while other paths use num_tx_queues, enabling memory corruption when ethtool -L and ethtool -S run concurrently. The fix is to use im...

CVE-2026-31614

MODE C: CVE-2026-31614 is a kernel SMB client vulnerability (Linux kernel). The issue is an out-of-bounds read in check_wsl_eas() that can leak up to 8 bytes of kernel heap via the EA name/value handling, potentially affecting how WSL ext attributes are interpreted. Patches have been released/mer...

CVE-2026-31619

The CVE-2026-31619 vulnerability affects the Linux kernel ALSA fireworks driver where a 32-bit status value from a FireWire device could be looked up in a 17-entry efr_status_names[] array, potentially indexing outside the array and causing incorrect string formatting. The issue could interpret E...

CVE-2026-43088

CVE-2026-43088 (Linux kernel) affects PF_KEY export paths in the net: af_key code, where IPv6 sockaddr payloads were not fully initialized in certain export messages (SADB_ACQUIRE, SADB_X_NAT_T_NEW_MAPPING, SADB_X_MIGRATE). The issue arises because pfkey_sockaddr_size() reserves 32 bytes for IPv6...

CVE-2026-43105

The CVE-2026-43105 issue affects the Linux kernel’s DRM VC4 driver. The root cause is a memory leak where the hang state’s BO array is allocated with kzalloc() in vc4_save_hang_state() but is not freed in vc4_free_hang_state(), leaving memory allocated when the hang state is freed. A kfree() for ...

CVE-2026-43260

The CVE concerns the bnxt_en driver in the Linux kernel. The vulnerability stems from RSS context deletion logic that could leak VNICs in firmware when deleting RSS contexts with the interface down, leading to failures when re-opening and restoring RSS contexts. The fix removes the netif_running(...

CVE-2026-43283

The CVE-2026-43283 issue is in the Linux kernel's ec_bhf Ethernet driver where error-path handling used priv->rx_buf.alloc_len as the DMA handle in dma_free_coherent(), risking improper unmapping and potential memory corruption or DoS. The fix changes the DMA handle to priv->rx_buf.alloc_ph...

CVE-2026-43339

CVE-2026-43339 affects the Linux kernel. The issue is a use-after-free scenario in the IPv6 address configuration path: within addrconf_permanent_addr(), a warning message could be produced after the ipv6 object could be deleted, leading to UaF when accessed. The fix reorders the statement to avo...

CVE-2026-43429

CVE-2026-43429 (Linux kernel, USB usbtmc): The vulnerability arises from the usbtmc driver accepting user-specified timeouts that can be arbitrarily long for usb_bulk_msg() calls, potentially causing kernel threads to hang indefinitely. The issue is resolved by using usb_bulk_msg_killable() with ...

CVE-2026-45845

The CVE-2026-45845 issue affects the Linux kernel net/sched taprio code. When deleting a TAPRIO child qdisc via RTM_DELQDISC, taprio_graft() could store NULL in q->qdiscs[] and later RTM_GETTCLASS dump paths could dereference a NULL pointer during taprio_dump_class(), causing a kernel NULL poi...

CVE-2026-45901

The CVE-2026-45901 issue affects the Linux kernel netfilter nf_tables implementation. The root cause is a circular lock dependency among commit_mutex, nfnl_subsys_ipset, and nlk_cb_mutex that can occur when nft reset, ipset list, and iptables-nft with a -m set rule run concurrently, potentially l...

CVE-2026-45973

CVE-2026-45973 affects the Linux kernel’s RDMA/mlx5 driver. A race during firmware reset in LAG mode could cause the driver to hang indefinitely while waiting for UMR completion on device unload, because the master/bond device would miss slave sys_error events. The fix adds a sys_error notifier r...

CVE-2026-46027

The CVE-2026-46027 fix targets the Linux kernel net/smc path, addressing a race where a CLC decline during an early handshake could trigger updates to link-group level sync state before the link group is fully initialized. The mitigation guards the link-group state update in smc_clc_wait_msg() so...

CVE-2026-46064

CVE-2026-46064 affects the Linux kernel’s ibmasm_send_i2o_message, where the copy size is derived from user-controlled dot_command_header fields and not validated against allocation size. This can let an attacker perform a heap over-read by memcpy_toio(), reaching up to ~65 KB beyond the allocate...

CVE-2026-46066

CVE-2026-46066 pertains to a Linux kernel issue that surfaces as a panic in multi-folio encrypted writes when a bounce buffer allocation fails during fscrypt-enabled CephFS writes. The root cause, described in the CVE entry, is that move_dirty_folio_in_page_array() may fail after the batch has st...

CVE-2026-46101

CVE-2026-46101 — Linux kernel netfilter nft_bitwise : The issue arises in the carry-propagation for 32-bit words when a zero shift operand is used in nft_bitwise left/right shift expressions, causing undefined behaviour. The fix rejects zero shift operands during initialization and extends the ex...

CVE-2026-46188

CVE-2026-46188 affects the Linux kernel in the octeon_ep_vf driver. The vulnerability arises because napi_build_skb() can return NULL on allocation failure and __octep_vf_oq_process_rx() uses the result without checking for NULL in both the single-buffer and multi-fragment paths, causing a NULL p...

CVE-2026-46204

CVE-2026-46204 affects the Linux kernel DRM_AMDGPU driver (drm/amdgpu/vcn4). The root cause is an out-of-bounds read when parsing an Instruction Buffer (IB). The patch rewrites the IB parsing to use amdgpu_ib_get_value(), ensuring bounds checks are performed and preventing OOB reads. Public descr...

CVE-2026-46222

In CVE-2026-46222, the Linux kernel’s media: rockchip: rkcif driver was fixed by adding the missing MUST_CONNECT flag to pads, addressing a null-pointer dereference when a media stream is enabled. The issue arose from pads not reliably checking for connected devices, enabling a local attacker to ...

CVE-2026-46223

The CVE-2026-46223 issue concerns the Linux kernel cgroup subsystem: rmdir defers percpu_ref kill of CSS until the cgroup is depopulated. A chain of commits reworked rmdir behavior to ensure ->css_offline() does not run while tasks are still doing kernel work in the cgroup. The core problem wa...

CVE-2026-46264

CVE-2026-46264 addresses a Linux kernel flaw in drm/xe/pf where an error in devm_add_action_or_reset() can cause a cleanup action to run on an uninitialized kobject during sysfs initialization. This use-after-free and kobject_put() on an uninitialized object is mitigated by ensuring proper initia...

CVE-2026-46314

CVE-2026-46314 affects the Linux kernel drm/v3d path. A local attacker can craft a self-referential multisync extension with in_sync_count=0 and out_sync_count=0, causing an infinite loop in v3d_get_extensions() because the existing guard (if (se->in_sync_count || se->out_sync_count)) never...

CVE-2026-46318

CVE-2026-46318 concerns a Linux kernel hugetlbfs issue: a revert of the mmap_prepare-related change due to a potential VMA lock leak after a failed allocation. The fix reverts the change to allow rework, while attempting to preserve VMA flag changes. Connected sources consistently describe the ro...

CVE-2026-53010

The CVE-2026-53010 vulnerability is in the Linux kernel ksmbd component. In smb2_open during a durable reconnect, a reference to the durable file descriptor is dropped too early (ksmbd_put_durable_fd(fp)), risking a use-after-free when error handling or scavenger access occurs (fp fields like cre...

CVE-2026-53120

CVE-2026-53120 is a Linux kernel PCI subsystem Use-After-Free in which a driver being probed via __driver_attach() may access driver_override without proper locking, leading to instability or potential privilege escalation. The fix is to adopt the driver-core driver_override infrastructure to ens...

CVE-2026-53146

CVE-2026-53146 affects the Linux kernel Thunderbolt XDomain handling. tb_xdomain_copy() copies req->response_size bytes from the received packet buffer regardless of the actual frame size, allowing a short response to read past valid frame data into stale DMA contents. The fixed behavior is to...

CVE-2026-53226

The CVE-2026-53226 issue affects the Linux kernel GPIO Rockchip driver: generic IRQ chips allocated via irq_alloc_domain_generic_chips() are not freed on driver removal, leaving domain generic chips and the global gc_list leaked and potentially visited later by suspend/resume/shutdown callbacks, ...

CVE-2026-53238

CVE-2026-53238 affects the Linux kernel netlabel/privacy path in netlbl_unlabel_addrinfo_get, where the address attribute length was used to infer IPv4/IPv6 data but the corresponding mask length was not independently validated. A crafted Generic Netlink request could supply a valid IPv4/IPv6 add...

CVE-2026-53255

CVE-2026-53255 (Linux kernel) concerns a Bluetooth MGMT TLV parsing bug: tlv_data_is_valid() may read one byte past the advertising data when a malformed field’s length byte is at the buffer end, due to validating element length before verifying the type byte. This can enable local exploitation w...

CVE-2026-53296

CVE-2026-53296 is addressed in OSV entries for Root OS products, noting that the vulnerability in the rootio-linux component was patched in Ubuntu 22.04, Ubuntu 24.04, and Debian-based Root builds. Multiple fixed versions are available per the OSV records. The Debian/Ubuntu rootio-linux remediati...

CVE-2026-53322

CVE-2026-53322 affects the Linux kernel’s vfio/pci subsystem. The issue occurs during device shutdown when vfio_pci_core_close_device() disables a function before calling vfio_pci_dma_buf_cleanup(), allowing a small window where the function’s MSE is cleared while DMABUF-access to BARs may still ...

CVE-2026-53344

CVE-2026-53344 affects the Linux kernel in the pinctrl: mcp23s08 driver. The issue occurs during regmap initialization when SPI reads run before critical mcp->dev and mcp->addr are set, causing a NULL pointer dereference during probe. The fix moves the initialization of mcp->dev and mcp-...

CVE-2026-53381

The CVE-2026-53381 issue affects the Linux kernel’s virtiofs path for submount umount. The root cause is a use-after-free (UAF) in iput() invoked from fuse_release_end() when the superblock has already been destroyed; the existing safeguard (wait for num_waiting to drop to zero) only covered the ...

CVE-2026-64061

The CVE-2026-64061 entry concerns a use-after-free in the Linux kernel netfs layer (netfs_read_gaps) where the sink page is prematurely released during a network read, enabling memory corruption. The issue was observed via KASAN in a cifsd-based trace and is described across multiple vendors (Red...

CVE-2026-64111

The CVE-2026-64111 issue affects the Linux kernel where lsm_set_self_attr() did not hold cred_guard_mutex in the same way as proc_pid_attr_write() before calling the LSM hook. The fix ensures the mutex is held, reducing risk related to SELinux and AppArmor decisions based on whether a process is ...

CVE-2026-64138

CVE-2026-64138 affects the ksmbd component in the Linux kernel, addressing a vulnerability in ACL inheritance where the Owner/Group SIDs from the NT Security Descriptor could be unsafe when retrieved from a parent directory. The fix introduces the helper smb_validate_ntsd_sid() to safely validate...

CVE-2026-64249

CVE-2026-64249 affects the Linux kernel FPGA region code. The issue is a use-after-free in region handling for child regions with firmware, fixed by moving of_node_put(child_region) after the error print to avoid dereferencing freed memory. Affected/patch status is reflected across multiple advis...

CVE-2026-64272

Summary of CVE-2026-64272 : A bug in the Linux kernel MMS114 touch screen driver misreads touch data because it assumed 8-byte events, while MMS134S/MMS136 report 6-byte events. The driver loops over events using an 8-byte step (sizeof(struct mms114_touch)) but the actual packet size is 6 bytes p...

CVE-2026-64287

CVE-2026-64287 affects the Linux kernel’s KVM on arm64. The issue stems from flush_hyp_vcpu() copying host vgic_v3 state to the hyp’s vCPU and not enforcing the expected bound on list registers, which can lead to out-of-bounds access to ICH_LR_EL2 when host values exceed the number of implemented...

CVE-2026-64318

Summary (CVE-2026-64318) : In the Linux kernel, the partitions code for AIX on the PPC/IBM layout could read past the end of the ppe[] array. The function aix_partition() loads a fixed-size pvd and iterates up to the on-disk pp_count, which could exceed the allocated 1016 entries, leading to pote...

CVE-2026-64348

CVE-2026-64348 is a memory leak in the Linux kernel's USB subsystem affecting EHCI and FOTG210 isochronous submit paths. When usb_hcd_link_urb_to_ep() fails or the controller becomes inaccessible, the staged ehci_iso_sched is leaked on urb->hcpriv because the done_not_linked error path skips t...

CVE-2026-64424

CVE-2026-64424 is a use-after-free in the Linux kernel's netpoll subsystem on the shutdown path. When __netpoll_cleanup() runs, it schedules an RCU callback that calls kfree(npinfo), but the TX worker (queue_process) is only cancelled via cancel_delayed_work(), which does not guarantee the worker...

CVE-2016-8469

CVE-2016-8469 is an information-disclosure vulnerability in the Android camera driver affecting Kernel-3.10-based Android devices. The issue could allow a local malicious app to access data outside its permission levels by exploiting a privileged-process assumption; impact is data disclosure with...

CVE-2022-49975

CVE-2022-49975 affects the Linux kernel’s BPF path, where a redirect of packets with invalid pkt_len could occur. The root cause is described as a BPF program test/run path (bpf_prog_test_run_skb) redirecting empty skbs, leading to a potential flow handling issue in fq_codel_drop(). The vulnerabi...