CVE-2024-57983

The CVE-2024-57983 issue concerns the Linux kernel mailbox support (th1520) for ICU0. The vulnerability arose from an incorrectly sized array used to save and restore interrupt mask registers, leading to memory corruption when accessing all four registers during suspend and resume. The connected ...

CVE-2025-38076

CVE-2025-38076 concerns the Linux kernel vulnerability related to module unloading and allocation tags. The issue arises from a use-after-free risk when memory containing a module’s allocation tags remains alive after unloading, because percpu counters referenced by those tags could be freed by f...

CVE-2025-38196

CVE-2025-38196 affects the Linux kernel io_uring resource (io_uring/rsrc) cloning path. The bug arises when registering clone buffers where the sum of offset and count exceeds the available range, causing an allocation via kmalloc to be too large and potentially triggering a WARN_ON in kmalloc (m...

CVE-2025-38519

The CVE-2025-38519 entry pertains to the Linux kernel (mm/damon) and is supported by multiple sources in the connected documents. The root cause is a divide-by-zero crash in damon_get_intervals_score() when region size is zero. The current patch fixes the bug without disallowing zero-size regions...

CVE-2025-38559

CVE-2025-38559 (Linux kernel) affects the Intel PMT subsystem on x86 platforms. The issue is a NULL pointer dereference in intel_pmt_read() when an ep (endpoint) is missing, leading to kernel oops in crashlog handling. The fix, as described, augments intel_pmt_entry with a pointer to the pcidev t...

CVE-2025-38594

CVE-2025-38594 pertains to the Linux kernel (iommu/vt-d) and fixes a use-after-free (UAF) in sva unbind with pending IOPFs. The root cause was a wrong removal of a device from the IOMMU IOPF queue when the last IOPF-capable domain detaches, occurring before intel_pasid_tear_down_entry() completed...

CVE-2025-38648

CVE-2025-38648 refers to a Linux kernel issue in the stm32 SPI driver. The stm32_spi_probe now validates that the pointer returned by of_device_get_match_data (cfg) is non-NULL before accessing cfg->has_device_mode, preventing a potential NULL pointer dereference and possible system crash. If ...

CVE-2025-38715

Technical details for CVE-2025-38715 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2025-39715

CVE-2025-39715 affects the Linux kernel on Parisc where a read-access check was not triggered for certain user-access memory references, allowing a local attacker to execute a LWS compare-and-swap at an address that is read-protected at PRIV_USER. The issue is fixed by probing read access rights ...

CVE-2025-39734

CVE-2025-39734 affects the Linux kernel component fs/ntfs3 in the NTFS file-system path. The issue stems from a revert of the inode_trylock versus inode_lock handling (commit 69505fe98f198ee813898cbcaf6770949636430b). The description notes that previously conditional lock acquisition was removed ...

CVE-2025-39752

CVE-2025-39752: In the Linux kernel (ARM/rockchip), the SMP initialization hang bug was fixed by moving SRAM initialization to after all secondary CPUs are powered down. The root cause involved the trampoline code being written to SRAM while secondary CPUs were powered on, causing potential kerne...

CVE-2025-39758

In CVE-2025-39758, the Linux kernel RDMA/siw driver had a bug in siw_tcp_sendpages that caused mismatched iov_iter byte counts and tcp_sendmsg_locked size, leading to out-of-bounds scenarios. The fix, linked to commit c2ff29e99a76 and related changes, corrects the iov_iter byte count and the valu...

CVE-2025-39801

CVE-2025-39801 affects the Linux kernel USB subsystem (dwc3) where device endpoint command timeouts could trigger a kernel panic if WARN_ON is hit during connect/disconnect sequences on Exynos platforms. The root cause is a WARN_ON triggered by device endpoint commands in the privileged path duri...

CVE-2025-39811

In CVE-2025-39811, the Linux kernel fixes a local-denial of-service risk in the DRM subsystem (xe) by clearing the scratch_pt error pointer in xe_vm_free_scratch() to prevent dereferencing an error pointer during cleanup. Root cause: potential dereference of an error pointer on error cleanup. Aff...

CVE-2025-39942

The CVE-2025-39942 entry concerns the Linux kernel ksmbd smbdirect path. Affected area: the data length check path that computes remaining_data_length; the fix ensures remaining_data_length respects max_fragmented_recv_size (in addition to the existing data_offset + data_length validation). This ...

CVE-2025-39951

CVE-2025-39951 is a Linux kernel use-after-free issue in virtio_uml during probe, fixed by virtio_uml_probe() logic (vu_dev->registered set only after successful registration). Connected advisories show Debian LTS updates addressing this CVE in linux packages (5.10.247-1 for Debian 11 and linu...

CVE-2025-68223

CVE-2025-68223 concerns the Linux kernel code path for DRM/Radeon fence handling. The fix removes an attempted forward progress on the queue inside is_signaled, preventing a potential self-deadlock when the fence lock also serves as the wait-queue lock. The underlying issue was that dma-fence_ops...

CVE-2026-23126

CVE-2026-23126 affects the Linux kernel netdevsim driver. It describes a race on the bpf_bound_progs list between nsim_bpf_create_prog() (list_add_tail) and nsim_bpf_destroy_prog() (list_del), which can corrupt the list and trigger a kernel crash (kernel BUG at lib/list_debug.c). The proposed rem...

CVE-2026-23158

CVE-2026-23158 (Linux kernel) affects gpio-virtuser: the configfs release path frees the device inside a guard(mutex) region, leading to a use-after-free when mutex_unlock() runs after the guard. The issue is caused by destroying the mutex and freeing the device while still within the lock’s guar...

CVE-2026-23189

CVE-2026-23189 concerns a NULL pointer dereference in ceph_mds_auth_match() within the CephFS kernel client. The patch reworks ceph_mdsmap_decode() and namespace_equals() so that ceph_mdsmap contains an extracted FS name (m_fs_name) and the code path uses this value for strict authorization check...

CVE-2026-23190

Mode C: CVE-2026-23190 affects the Linux kernel ASoC/amd driver; the issue is a memory leak in acp3x PDM DMA ops. Public advisories (Mageia, SUSE/OpenSUSE, Oracle Linux, Debian) confirm upstream fix in kernel. Remediation is applying the upstream patch (memory leak in acp3x pdm dma ops) or upgrad...

CVE-2026-23212

CVE-2026-23212 affects the Linux kernel bonding driver where slave->last_rx (and target_last_arp_rx) data could be read/write locklessly, causing data races. The fix annotates these fields with READ_ONCE() and WRITE_ONCE(), addressing a KCSAN data race in bond_rcv_validate and related paths. C...

CVE-2026-23238

CVE-2026-23238 (Linux kernel — romfs): The romfs implementation in the kernel failed to honor the return value of sb_set_blocksize(), continuing a mount when the requested ROMBSIZE (e.g., 4096) was incompatible with the device’s logical_block_size (e.g., 32768). This could occur by using LOOP_SET...

CVE-2026-23302

Summary (CVE-2026-23302): The Linux kernel patch resolves a data-race in data-path pointers sk->sk_data_ready and sk->sk_write_space, where skmsg and possibly other layers could modify these pointers while others may read them concurrently. The fix adds corresponding READ_ONCE()/WRITE_ONCE(...

CVE-2026-23308

CVE-2026-23308 concerns a Linux kernel pinctrl equilibrium warning trace on load. The issue arises because eqbr_irq_mask() calls gpiochip_disable_irq() and eqbr_irq_ack() is also invoked, causing a warning for every GPIO during load. A fix was implemented by not using eqbr_irq_mask() and eqbr_irq...

CVE-2026-23361

CVE-2026-23361 affects the Linux kernel PCIe design (dwc: ep) where a posted MSI-X write may race with ATU unmapping, potentially corrupting host memory or triggering IOMMU errors. The mitigation described in the public description is to flush the write by performing a readl() on the same address...

CVE-2026-31406

The CVE-2026-31406 issue is a race in the Linux kernel xfrm path during network cleanup. After cancel_delayed_work_sync() is invoked from xfrm_nat_keepalive_net_fini(), xfrm_state_fini() flushes states and __xfrm_state_delete() calls xfrm_nat_keepalive_state_updated(), which can re-schedule nat_k...

CVE-2026-31474

The CVE-2026-31474 issue affects the Linux kernel’s CAN ISO-TP (isotp) path. The bug is a use-after-free involving isotp_sendmsg() and the so->tx.buf buffer: if a signal interrupts wait_event_interruptible() inside close() while tx.state is ISOTP_SENDING, the release path may free so->tx.bu...

CVE-2026-31499

CVE-2026-31499 affects the Linux kernel Bluetooth L2CAP code. The vulnerability stems from l2cap_conn_del() canceling delayed work (info_timer and id_addr_timer) while holding conn->lock, while the corresponding work functions (l2cap_info_timeout() and l2cap_conn_update_id_addr()) also acquire...

CVE-2026-31566

CVE-2026-31566 concerns the Linux kernel amdgpu driver (amdgpu_amdkfd_submit_ib). The issue arises when a fence reference is dma_fence_put()’ed before dma_fence_wait() completes, which can free the fence prematurely and trigger a use-after-free during job completion. Publicly documented fixes sho...

CVE-2026-31605

This CVE concerns the Linux kernel udlfb driver, where FBIOPUT_VSCREENINFO could trigger a divide-by-zero when pixclock is used directly in the udlfb path. The issue mirrors a prior fix in fb_dev paths and has been resolved in the kernel with related commits (e.g., addressing divide-by-zero in si...

CVE-2026-31687

The CVE-2026-31687 issue concerns the Linux kernel GPIO/omap driver: omap_mpuio_driver was registered from omap_gpio_probe() and could deadlock because a device lock may be held during probe, compounded by the driver core changes enforcing device_lock for driver_match_device(). The driver was als...

CVE-2026-31715

In Linux kernel (f2fs), CVE-2026-31715 is a use-after-free triggered by decrementing sbi->nr_pages[] during F2FS_WB_CP_DATA handling. The root cause is that f2fs_put_super() calls iput(sbi->node_inode) and NULLs the node_inode after the counter reaches zero, allowing f2fs_in_warm_node_list(...

CVE-2026-31758

The CVE-2026-31758 entry affects the Linux kernel usbtmc implementation. The vulnerability arises when releasing USB Test & Measurement Channels: pending anchored URBs are not flushed or killed during usbtmc_release, allowing use-after-free conditions (notably in the Host Controller Driver giveba...

CVE-2026-43053

CVE-2026-43053 affects the Linux kernel XFS filesystem. The flaw arises during inode inactivation with node-format extended attributes: xfs_attr3_node_inactive() invalidates child blocks but does not remove their references from the parent, creating a window where the parent can point to cancelle...

CVE-2026-43260

The CVE concerns the bnxt_en driver in the Linux kernel. The vulnerability stems from RSS context deletion logic that could leak VNICs in firmware when deleting RSS contexts with the interface down, leading to failures when re-opening and restoring RSS contexts. The fix removes the netif_running(...

CVE-2026-43283

The CVE-2026-43283 issue is in the Linux kernel's ec_bhf Ethernet driver where error-path handling used priv->rx_buf.alloc_len as the DMA handle in dma_free_coherent(), risking improper unmapping and potential memory corruption or DoS. The fix changes the DMA handle to priv->rx_buf.alloc_ph...

CVE-2026-43302

CVE-2026-43302 affects the Linux kernel with the drm/v3d DMA API debug path. A vulnerability was resolved by ensuring max_seg_size is set to the maximum, preventing debug_dma_map_sg() warnings about SG segment lengths (len=8290304, max=65536) when V3D rendering is used with CONFIG_DMA_API_DEBUG e...

CVE-2026-43337

CVE-2026-43337 concerns the Linux kernel DRM/AMD display path, where a NULL pointer dereference can occur in dcn401_init_hw() when calling update_bw_bounding_box() without validating the callback pointer. The existing condition ((!fams2_enable && update_bw_bounding_box) || freq_changed) can evalu...

CVE-2026-45850

CVE-2026-45850 pertains to the Linux kernel vulnerability where protocol checksum validation for IPv6 could fail if there are extension headers before the IPv6 header. The confirmed fix uses iph->len as the offset to skip extension headers when performing checksum validation. Technical details...

CVE-2026-45860

CVE-2026-45860 affects the Linux kernel netfilter nf_conncount, where tracking more than eight new connections per jiffy could cause the connection list to not be cleaned up promptly, potentially exhausting the connection limit and enabling denial of service. The issue is mitigated by a fix that ...

CVE-2026-45875

The CVE-2026-45875 issue is in the Linux kernel mfd: arizona driver where wm5102_clear_write_sequencer() may fail and bypass cleanup, leaving regulators enabled and causing a resource leak. The fix changes the function to jump to the err_reset cleanup path to properly free resources. Debian/Ubunt...

CVE-2026-45925

CVE-2026-45925 affects the Linux kernel thermal subsystem. In thermal_of_cm_lookup(), a device node pointer (tr_np) obtained via of_parse_phandle() is not released, causing a reference leak. The documented fix is to release the node automatically using the __free(device_node) cleanup attribute to...

CVE-2026-45928

CVE-2026-45928 relates to the Linux kernel media driver (chips-media wave5). In wave5_vpu_open_enc() and wave5_vpu_open_dec(), a vpu instance is kzalloc()-ed; if the subsequent allocation for inst->codec_info fails, the error path returns -ENOMEM without freeing the previously allocated vpu, c...

CVE-2026-45986

The CVE-2026-45986 issue affects the Linux kernel crypto/ccree path, specifically a memory leak in cc_mac_digest. The root cause is a path where cc_map_hash_request_final() failures could leave memory unreleased; the fix adds cc_unmap_result() to prevent leaks. The vulnerability is locally exploi...

CVE-2026-46017

CVE-2026-46017 involves a Linux kernel race in the migration path for folios. The vulnerability stems from a deferred split queue race during migrate_folio_move(): dst can become visible and then be requeued too late, allowing a concurrent rmap-removal path to mark dst partially mapped and trigge...

CVE-2026-46018

CVE-2026-46018 is a Linux kernel issue in ALSA: usb-audio (UAC2) where parse_uac2_sample_rate_range() capped at MAX_NR_RATES but only broke the inner loop; a malformed UAC2 RANGE could continue parsing and flood with "invalid uac2 rates". The fix stops the whole parse at the cap and returns the c...

CVE-2026-46051

CVE-2026-46051 affects the Linux kernel's MD RAID5 path. The vulnerability arises when retry_aligned_read() encounters an overlapped stripe and releases it via raid5_release_stripe(), placing it on the released_stripes list. In a subsequent raid5d loop, release_stripe_list() drains the stripe ont...

CVE-2026-46065

CVE-2026-46065 affects the Linux kernel framebuffer (fbdev) defio mechanism. The issue arises from disconnecting deferred I/O from the lifetime of struct fb_info, by holding state in struct fb_deferred_io_state and freeing the instance only after the final mapping closes. If fb_info/defio are fre...

CVE-2026-46094

CVE-2026-46094 affects the Linux kernel ext4 code. The vulnerability arises from a bounds check in check_xattrs() for the next xattr entry, where the code compared (void*)next >= end. This could allow next to point within sizeof(u32) bytes of end, and on the subsequent loop iteration IS_LAST_E...