CVE-2026-46210

The CVE-2026-46210 issue affects the Linux kernel Iris media driver. A race between per-instance locks (inst->lock) and the core list lock (core->lock) allows a use-after-free during MBPF checks: MBPF iterates the core list and reads fields like fmt_src->width/height while iris_close() m...

CVE-2026-46140

CVE-2026-46140 affects the Linux kernel Bluetooth btmtk driver. The wmt event handling in btmtk_usb_hci_wmt_sync() casts SKB data to btmtk_hci_wmt_evt structures (7/9 bytes) without ensuring sufficient payload, risking out-of-bounds reads from SKB tailroom when a short firmware response is receiv...

CVE-2026-46144

The CVE-2026-46144 entry concerns the Linux kernel RDMA mana driver. A resource leak occurs during error unwind in mana_ib_create_qp_rss(), where mana_ib_cfg_vport_steering() is not properly cleaned up; this could cause resource exhaustion (DoS). The issue has been fixed in the kernel (patched), ...

CVE-2026-46223

The CVE-2026-46223 issue concerns the Linux kernel cgroup subsystem: rmdir defers percpu_ref kill of CSS until the cgroup is depopulated. A chain of commits reworked rmdir behavior to ensure ->css_offline() does not run while tasks are still doing kernel work in the cgroup. The core problem wa...

CVE-2026-46287

CVE-2026-46287 concerns the Linux kernel net: txgbe driver. The issue occurs on copper NICs with external PHY where phylink_connect_phy() is called during probe and phylink_disconnect_phy() during removal, triggering an RTNL assertion warning on module removal. The root cause is lack of proper RT...

CVE-2026-52928

CVE-2026-52928 affects the Linux kernel af_unix implementation. In non-stream sockets (e.g., SOCK_DGRAM, SOCK_SEQPACKET), SIOCATMARK is incorrectly handled for MSG_OOB and should be rejected; the fix returns -EOPNOTSUPP before inspecting the receive queue. Multiple advisories note the issue is re...

CVE-2026-53025

Summary of CVE-2026-53025 : The Linux kernel’s Greybus raw subsystem is affected by a use-after-free when a raw bundle is disconnected while its chardev remains open, leading to a kernel panic and potential DoS. The issue occurs because the cdev can be released after freeing memory, creating an i...

CVE-2026-53037

CVE-2026-53037 affects the Linux kernel with a deadlock in HID reset handling when a USB HID device is paired with a storage/UAS component. The issue arises because hid_pre_reset() and hid_post_reset() may perform memory allocations that touch IO, risking deadlock, so the patch switches allocatio...

CVE-2026-53265

The CVE-2026-53265 entry describes a Linux kernel race in the dm-cache policy SMQ path. A check-then-act race occurs in smq_invalidate_mapping where an e->allocated check was left outside the mq->lock after the destructive section was serialized; two concurrent invalidators can observe allo...

CVE-2026-53277

CVE-2026-53277 – Linux kernel (arm64 KVM) : A flaw where certain page-table walk operations (walk_s1 and kvm_walk_nested_s2) did not acquire the Sleepable RCU lock (SRCU) via kvm->srcu, risking memslot changes and potential instability during fault injection and Address Translation emulation. ...

CVE-2026-53316

CVE-2026-53316 : In the Linux kernel, the DRM/AMD ras subsystem suffers a NULL pointer dereference in ras_core_ras_interrupt_detected() when ras_core is NULL and ras_core->dev is accessed in the error path. This has been fixed in kernel code (see commits referenced by the CVE). The vulnerabili...

CVE-2026-53344

CVE-2026-53344 affects the Linux kernel in the pinctrl: mcp23s08 driver. The issue occurs during regmap initialization when SPI reads run before critical mcp->dev and mcp->addr are set, causing a NULL pointer dereference during probe. The fix moves the initialization of mcp->dev and mcp-...

CVE-2026-53380

CVE-2026-53380 affects the Linux kernel media component rzv2h-ivc. The vulnerability arises from concurrent access to the internal buffer list rzv2h_ivc::buffers.queue: in rzv2h_ivc_transfer_buffer(), a list_del() occurs without holding the spinlock rzv2h_ivc::buffers.lock, allowing concurrent mo...

CVE-2026-53389

CVE-2026-53389 affects the Linux kernel net/tcp-ao use-after-free in the del_async path when deleting a key. The root cause is that del_async omits current_key and rnext_key validity checks that exist in the synchronous path. If a key is added with set_current=1/set_rnext=1 while the socket is in...

CVE-2026-53391

CVE-2026-53391 affects the Linux kernel NFSv4/pNFS code. The nfs4_decode_mp_ds_addr decoder can dereference NULL when an on-wire r_addr opaque has zero length, because xdr_stream_decode_string_dup() may yield NULL and the code then calls strrchr(NULL, '.') leading to a kernel NULL pointer derefer...

CVE-2026-64215

The CVE affects the Linux kernel’s drm/msm/a6xx component. A NULL pointer dereference could occur in a8xx_hfi_send_perf_table because kzalloc() return value is not checked. The vulnerability is resolved by a patch that adds the necessary check of kzalloc()’s return before use. Patchwork reference...

CVE-2026-64265

The CVE-2026-64265 issue affects the Linux kernel fuse subsystem. When fuse_resend() moves a request from fpq->processing back to fiq->pending, it marks FR_PENDING and clears FR_SENT but fails to remove the request’s intr_entry from fiq->interrupts. If FR_INTERRUPTED was set previously, ...

CVE-2026-64299

CVE-2026-64299 (Linux kernel) fixes an out-of-bounds read in glob matching within tracing at xfs_lookup tracepoints by introducing a length-bounded glob_match_len() and using it in regex_match_glob(). String event fields may not be NUL-terminated, so previous length handling was inconsistent; the...

CVE-2026-64306

CVE-2026-64306 affects the Linux kernel 's crypto subsystem, specifically the CTR_DRBG (Counter-mode Deterministic Random Bit Generator) implementation. The function drbg_ctr_generate() sometimes returns success when it actually fails, leaving the output buffer uninitialized. This can lead to den...

CVE-2026-64363

CVE-2026-64363 is a use-after-free in the Linux kernel's HID appleir driver (Apple IR remote). The appleir_remove() path calls hid_hw_stop() before draining the key_up_timer, allowing the timer callback to dereference an already-freed input_dev. A USB URB completion racing during teardown can add...

CVE-2026-64405

CVE-2026-64405 is a null pointer dereference in the Linux kernel's Bluetooth subsystem, specifically in hci_abort_conn() within the hci_conn module. When a connection is pending, the function reads hci_skb_event(hdev->sent_cmd), but hdev->sent_cmd can be NULL while req_status remains HCI_RE...

CVE-2026-64418

CVE-2026-64418 is a Linux kernel memory-management race in the shrinker subsystem. The vulnerability arises when the shrinker_info array is freed while still accessible, causing use-after-free or double-free. The root cause is that alloc_shrinker_info() can drop shrinker_mutex before finishing in...

CVE-2006-6333

The CVE-2006-6333 issue affects Linux kernel 2.6.19: the tr_rx function in ibmtr.c can assign the wrong flag to ip_summed, enabling remote attackers to trigger a memory-corruption DoS by crafting packets that mislead the kernel to treat a field as an offset. The vulnerability is supported by mult...

CVE-2016-8394

CVE-2016-8394 describes an elevation-of-privilege vulnerability in the Synaptics touchscreen driver on Android. The issue could allow a local malicious application to execute arbitrary code in the kernel context by exploiting the Synaptics driver, requiring initial compromise of a privileged proc...

CVE-2016-8450

CVE-2016-8450 is an elevation-of-privilege flaw in the Qualcomm sound driver affecting Android kernel space (Kernel-3.10). The NVD entry describes a local attacker compromising a privileged process to gain code execution in the kernel context. The vulnerability is tied to the Qualcomm sound drive...

CVE-2022-50114

CVE-2022-50114 affects the Linux kernel 9p subsystem. The root cause is a refcount leak in p9_read_work() error handling when m->rreq->rc.sdata is NULL; p9_req_put must be called to avoid the leak. Affected component: net/9p (p9_read_work). The fix is documented in kernel commits (e.g., 34b...

CVE-2022-50230

In the Linux kernel (arm64), the idmap access problem occurred on systems implementing FEAT_EPAN where UXN was not set on swapper page tables, causing idmap_kpti_install_ng_mappings to panic when accessing __idmap_kpti_flag. The issue was fixed upstream by applying UXN to the swapper PTEs as part...

CVE-2022-50234

CVE-2022-50234 concerns the Linux kernel’s io_uring/af_unix subsystem. The vulnerability arises from deferring the garbage-collection of registered files to the io_uring release path rather than performing it via unix_gc(), coupled with using these registered files for cycle-detection without act...

CVE-2022-50246

CVE-2022-50246 involves a refcount leak in the Linux kernel’s usb: typec: tcpci subsystem. The vulnerability stems from tcpci_register_port()’s use of the fwnode-derived node in tcpci_parse_config(), where the node’s refcount is increased by device_get_named_child_node() but not balanced in all e...

CVE-2022-50328

CVE-2022-50328 affects the Linux kernel component jbd2. It describes a use-after-free in jbd2_fc_wait_bufs caused by using bh after releasing the buffer head reference, with the recommended fix: validate uptodate status of the buffer before putting the buffer head reference count. The incident is...

CVE-2022-50363

CVE-2022-50363 relates to the Linux kernel skmsg path: alloc_sk_msg() could be invoked from a non-sleepable context. The root cause is missing gfp_t argument passing, with sk_psock_verdict_recv() using rcu_read_lock(). The provided documents trace a call path from sk_psock_verdict_recv through al...

CVE-2022-50419

CVE-2022-50419 concerns the Linux kernel Bluetooth subsystem, specifically the hci_sysfs path. The public description states that the issue arises from attempting to call device_add multiple times for a single device structure, violating documented expectations that device_add() (and device_regis...

CVE-2022-50527

CVE-2022-50527 concerns the Linux kernel patch for amdgpu memory size validation. The description states that amdgpu_bo_validate_size() was fixed to verify that the TTM domain manager for the requested memory exists, preventing a kernel oops when dereferencing the manager pointer. The lineage sho...

CVE-2023-53194

CVE-2023-53194 is a Linux kernel vulnerability in fs/ntfs3 related to an insufficient length check in indx_get_root, which can lead to a use-after-free condition observed via KASAN during mounting operations. The provided reports describe a use-after-free read (size 2) on a page accessed by the m...

CVE-2023-53290

CVE-2023-53290 affects the Linux kernel in the samples/bpf path, where fout was opened with fopen but not closed, leading to a leak in hbm's run_bpf_prog. The issue is resolved by a patch that ensures fout is closed (fclose’d) before scope exit. The provided sources confirm the fixed state and li...

CVE-2023-53324

CVE-2023-53324 affects the Linux kernel DRM MSM MDP5: it fixes a leak of plane_state state (plane_state->commit refcount) that could degrade availability. The root cause was plane_state reference counting; the patch uses the correct helpers to prevent leakage. Affected component: drm/msm/mdp5....

CVE-2023-53351

CVE-2023-53351 concerns the Linux kernel drm/sched subsystem. The vulnerability arises from using the scheduler’s ready flag to decide whether to call drm_sched_fault, which could lead to GPU reset or a fault depending on timing between IRQ handling and gfx engine startup. The root cause is that ...

CVE-2023-53363

Conclusive details show CVE-2023-53363 is a Linux kernel PCI subsystem use-after-free in pci_bus_release_domain_nr() caused by the sequence in bus removal: pci_remove_root_bus()/pci_remove_bus frees the pci_bus struct, then pci_bus_release_domain_nr() dereferences it. Root cause: after Commit c14...

CVE-2023-53413

CVE-2023-53413 concerns a memory leak in the Linux kernel USB isp116x driver triggered by debugfs_lookup() usage. The issue arises because the result from debugfs_lookup() must be released with dput(), and if not, memory leaks accrue over time. The referenced fix replaces the call path with debug...

CVE-2023-53587

The CVE-2023-53587 issue is in the Linux kernel ring-buffer handling where IRQ work can run after the ring buffer is destructed. The vulnerability description shows a use-after-free path in irq_work_run_list (KASAN report) when data is written to the buffer just before destruction, potentially le...

CVE-2023-53589

CVE-2023-53589 affects the Linux kernel’s wireless stack: the iwlwifi mvm driver may mishandle a corrupted MCC response from firmware if n_channels is larger than the command response can contain. This can lead to copying excessive (uninitialized) memory and, in extreme cases, a crash due to memo...

CVE-2023-54207

CVE-2023-54207 affects the Linux kernel HID: uclogic driver. The root cause is using the input_dev name’s devm allocation instead of referencing the HID device, which could lead to a use-after-free when the input_dev is unregistered and a uevent depending on its name fires. The fix switches to re...

CVE-2025-38431

The CVE-2025-38431 entry concerns the Linux kernel SMB client regression related to native SMB symlinks. The available connected document details indicate the vulnerability was addressed by restoring the ability of the client to perform lstat(2) and readlink(2) operations even when the symlink ta...

CVE-2025-38536

CVE-2025-38536 affects the Linux kernel in the net:airoha path, where np->name could be used after a call to of_node_put(np). This release-after-check pattern could cause a use-after-free if pdev is NULL. The documented fix moves of_node_put(np) to execute only after both the error and success...

CVE-2025-38719

The CVE-2025-38719 entry concerns the Linux kernelnet hibmcge: when the network port is down, a released queue can yield ring->len = 0, triggering a division by zero in hbg_get_queue_used_num() called from debugfs. The provided patch adds a guard: if ring->len is 0, hbg_get_queue_used_num()...

CVE-2025-39707

Technical details for CVE-2025-39707 (affected component, root cause, impact, or fix) are not publicly provided in the connected documents. Monitor for updates from vendor advisories and security feeds.

CVE-2025-39772

CVE-2025-39772 affects the Linux kernel HibMC driver for Hisilicon GPUs (drm/hisilicon/hibmc). Description: when hibmc loading fails, the driver attempted to free resources via hibmc_unload, but mode.config mutexes were uninitialized, risking a NULL-pointer dereference. The fix replaces a goto cl...

CVE-2025-39781

CVE-2025-39781 concerns the Linux kernel on the PA-RISC (parisc) architecture. The issue is described as the removal of a WARN_ON_ONCE() from flush_cache_vmap in the parisc code path, with observed warnings that could occasionally trigger. The available documents do not detail any exploit vectors...

CVE-2025-39789

The CVE-2025-39789 issue affects the Linux kernel crypto/x86 aegis path. Specifically, functions in the aegis128-aesni glue (and related skcipher_walk usage) can allocate memory and may fail, but error handling was missing. This underlies a potential for memory allocation failures that could impa...

CVE-2025-39857

CVE-2025-39857 affects the Linux kernel net/smc component and is a NULL pointer dereference in smc_ib_is_sg_need_sync(). The issue occurs when ibdev->dma_device is NULL for the software RoCE device, triggering a kernel crash. A NULL pointer check has been added to prevent the problem. Remediat...