CVE-2026-43228

The CVE-2026-43228 entry concerns the Linux kernel hfs component where 64-bit CNID counts (next_id, folder_count, file_count) triggered kernel panics when MDB was corrupted. Root cause: BUG_ON-based overflow checks replaced by proper error handling. Impact: local DoS via kernel panic with a corru...

CVE-2026-43450

CVE-2026-43450 affects the Linux kernel nfnetlink_cthelper code. The issue is an out-of-bounds read (8 bytes) in nfnl_cthelper_dump_table() caused when a previously saved “last” helper is deleted between dump rounds, allowing a faulty goto restart to bypass bounds checks. The problem was fixed by...

CVE-2026-46308

CVE-2026-46308 affects the Linux kernel: a use-after-free in mediatek’s pmdomain code, within scpsys_get_bus_protection_legacy(). The bug stems from of_find_node_with_property() returning a device node with an incremented refcount, followed by of_node_put(node) before validating the result of sys...

CVE-2026-52945

The CVE-2026-52945 entry describes a Linux kernel vulnerability in the WireGuard component where enabling threaded NAPI can cause the decryption path for a WireGuard peer to stall under heavy network load (notably with Cilium), effectively causing a DoS for that peer while other peers remain func...

CVE-2026-23427

Summary: CVE-2026-23427 affects ksmbd in the Linux kernel and has been fixed to address a use-after-free in durable v2 replay of active SMB file handles. The root cause is that parse_durable_handle_context() unconditionally assigns dh_info->fp->conn to the current connection when handling D...

CVE-2026-31397

CVE-2026-31397 relates to the Linux kernel memory management path mm/huge_memory move_pages_huge_pmd(), where the huge zero page branch used a NULL src_folio, causing a bogus PFN (or NULL dereference on some memory models) when constructing PMDs. The fix uses page_folio(src_page) to obtain a vali...

CVE-2026-31426

Summary: CVE-2026-31426 concerns the Linux kernel ACPI EC handling. When ec_install_handlers() defers probing on reduced‑hardware platforms, the error path could leave a dangling EC space handler context if acpi_ec_setup() propagates the error, leading to use‑after‑free when AML accesses an OpReg...

CVE-2026-31510

CVE-2026-31510: Linux kernel Bluetooth L2CAP vulnerability due to a null pointer dereference in l2cap_sock_ready_cb. The issue arises because sk is used without verifying it’s non-null, leading to a kernel panic/DoS. Multiple OS advisories (Debian roots, Ubuntu, Red Hat, SUSE, etc.) report the pa...

CVE-2026-31582

CVE-2026-31582 affects the Linux kernel hwmon powerz driver. A use-after-free occurs when a USB disconnect frees the URB and mutex, and a subsequent powerz_read() can dereference the freed URB in powerz_read_data(). The fix, as described across sources, is to set priv->urb to NULL in powerz_di...

CVE-2026-31594

The CVE-2026-31594 issue is in the Linux kernel PCI endpoint framework (pci-epf-vntb). The root cause is a duplicate resource teardown in epf_ntb_epc_destroy(), causing an oops/kernel crash when .allow_link fails or .drop_link runs. The documented fix removes the helper and drops pci_epc_put(), t...

CVE-2026-31612

The CVE-2026-31612 entry concerns ksmbd in the Linux kernel. The vulnerability arises in smb2_get_ea(): the code reads EaNameLength from the client request and passes it directly to strncmp() as the comparison length without validating that the name length matches the input buffer size. The publi...

CVE-2026-31697

The CVE-2026-31697 entry concerns the Linux kernel crypto: ccp driver. The issue arises when retrieving the CPU ID: if the firmware command fails (notably with an invalid length), copying the firmware ID to userspace can overflow a kernel buffer and leak data to userspace. Public reports describe...

CVE-2026-31701

In CVE-2026-31701, the Linux kernel ALSA caiaq driver (USB audio) stored a pointer to the parent usb_device without a reference. The snd_usb_caiaq_card_free() path can run after the USB device is disconnected, dereferencing freed memory (use-after-free). The fix is to take a reference on the USB ...

CVE-2026-31758

The CVE-2026-31758 entry affects the Linux kernel usbtmc implementation. The vulnerability arises when releasing USB Test & Measurement Channels: pending anchored URBs are not flushed or killed during usbtmc_release, allowing use-after-free conditions (notably in the Host Controller Driver giveba...

CVE-2026-31785

Summary: CVE-2026-31785 affects the Linux kernel DRM XE pagefault path. The issue was that the page fault handler could permit write/atomic access to read-only VMAs. Root cause: xe_pagefault_service did not reject writes to read-only VMAs after the VMA lookup. Impact (as described): restoration o...

CVE-2026-43080

Summary of CVE-2026-43080 (Linux kernel) : The issue resides in the L2TP/PPP over L2TP code path where an oversized PPPoL2TP packet sent with UDP encapsulation can trigger an overflow of the 16‑bit UDP length field, causing the length to be trimmed and potentially sending malformed packets. The p...

CVE-2026-43136

The CVE-2026-43136 issue affects the Linux kernel HID subsystem (logitech-hidpp) where fake USB devices could craft HID report descriptors without valid fields, potentially crashing the kernel over USB. The root cause is a missing validation in hidpp_get_report_length() that allowed reports with ...

CVE-2026-43150

The CVE-2026-43150 issue affects the Linux kernel’s perf/arm-cmn component, where the kernel now rejects unsupported CMN hardware configurations. The root cause is the kernel’s prior assumptions about maximum sizes and counts for CMN models and revisions, which could allow larger or unknown confi...

CVE-2026-43216

Summary of CVE-2026-43216 : In the Linux kernel, skb_may_tx_timestamp() could acquire sock::sk_callback_lock in IRQ context, risking a deadlock if the lock was already write-locked on the same CPU. The fix drops the lock and uses READ_ONCE() / WRITE_ONCE() to safely access and clear the pointers ...

CVE-2026-43234

CVE-2026-43234 concerns the Linux kernel team driver. The issue arises when unregistering a slave from a team interface while a NETDEV_CHANGEMTU event is pending, potentially causing a deadlock/resource exhaustion and system unresponsiveness as shown by reproduction steps involving creating a tea...

CVE-2026-43239

The CVE-2026-43239 issue concerns the Linux kernel SMB client where two concurrent operations could race while updating network interfaces via query_interfaces(), risking an inconsistent state. The root cause is improper synchronization of iface_last_update under iface_lock. Public advisories con...

CVE-2026-43281

CVE-2026-43281 affects the Linux kernel mailbox subsystem. The flaw is an out-of-bounds access in fw_mbox_index_xlate() that can occur when #mbox-cells is

CVE-2026-43300

CVE-2026-43300 affects the Linux kernel DRM panel code, specifically a NULL-pointer dereference in jdi_panel_dsi_remove(). When jdi is NULL, the function can proceed to call jdi_panel_disable(), which dereferences jdi unconditionally, causing a crash. The advisory shows the fix: return early from...

CVE-2026-43342

CVE-2026-43342 concerns the Linux kernel USB gadget RNDIS driver (f_rndis). The issue arises from race conditions when RNDIS options (class/subclass/protocol) are accessed concurrently via configfs, enabling unsafe concurrent access. The remediation implemented is to protect these options using a...

CVE-2026-43405

CVE-2026-43405 affects the Linux kernel libceph component, specifically ceph_monmap_decode(). The root cause is signedness mishandling: blob_len and num_mon are int, used to hold non-negative values that should be unsigned, leading to potential large allocations when an incoming num_mon is very l...

CVE-2026-43438

CVE-2026-43438 involves a Linux kernel sched_ext issue where a redundant css_put() call in scx_cgroup_init() can trigger a refcount underflow during iterations of css_for_each_descendant_pre(). The iterator walks the cgroup hierarchy under cgroup_lock() and does not acquire references with css_ge...

CVE-2026-43495

CVE-2026-43495 concerns the Linux kernel net/wwan/t7xx subsystem. The issue arises in t7xx_port_enum_msg_handler, which uses a modem-provided port_count to loop over port_msg->data[] without ensuring the message buffer is long enough, enabling a potential slab-out-of-bounds read when port_coun...

CVE-2026-45847

CVE-2026-45847 concerns the Linux kernel networking path: removing WARN_ON_ONCE when accessing the forward path array to mitigate a potential issue with overly long forward paths via IPIP tunnels. The vulnerability is local in scope and is not described as exploitable via remote vectors in the pr...

CVE-2026-45850

CVE-2026-45850 pertains to the Linux kernel vulnerability where protocol checksum validation for IPv6 could fail if there are extension headers before the IPv6 header. The confirmed fix uses iph->len as the offset to skip extension headers when performing checksum validation. Technical details...

CVE-2026-45853

The CVE-2026-45853 issue is in the Linux kernel drm/amdgpu component. The function amdgpu_discovery_get_nps_info() allocates memory for ranges with kvcalloc() (potentially vmalloc), but frees it with kfree(), which may corrupt vmalloc memory. The documented fix is to use kvfree() to safely handle...

CVE-2026-45858

The CVE-2026-45858 entry concerns the Linux kernel ext4 behavior: when allocating initialized blocks from a large unwritten extent or splitting an unwritten extent during end I/O, a stale data issue could occur if a split happens in the middle. The published details explain that ext4_split_extent...

CVE-2026-45872

The CVE-2026-45872 issue affects Linux kernel SCSI smartpqi: pqi_report_phys_luns() where the rpl_list buffer could leak if an unsupported data format is encountered or rpl_16byte_wwid_list allocation fails. The root cause is early returns bypassing cleanup logic. The fix consolidates error handl...

CVE-2026-45873

CVE-2026-45873 concerns Linux kernel netfilter nft_set_rbtree. The issue arises from partial overlap detection for anonymous sets where adjacent intervals omit end elements, allowing overlaps such as A-B and A-C with C

CVE-2026-45895

Mode C: The CVE-2026-45895 issue affects the Linux kernel quota handling when a filesystem is frozen. quotactl_block() retries while the freezer holds SB_FREEZE_WRITE, leading to a livelock with synchronize_rcu() and causing a freezer hang and 100% CPU on the quota task. The documented fix adds c...

CVE-2026-45905

CVE-2026-45905 is a Linux kernel networking vulnerability in the xfrm/icmp_route_lookup reverse path. The race occurs during ICMP error handling when a concurrent address change may cause ip_route_input() to return a LOCAL route with a dst that can trigger a WARN_ON in ip_rt_bug. The fix checks t...

CVE-2026-45916

CVE-2026-45916 affects the Linux kernel power_supply (sbs-battery) driver. The issue is a race between IRQ handling and power_supply handle lifecycle: requesting IRQ with devm_ before allocating/registering the power_supply handle can cause an interrupt after the handle is freed but before IRQ un...

CVE-2026-45925

CVE-2026-45925 affects the Linux kernel thermal subsystem. In thermal_of_cm_lookup(), a device node pointer (tr_np) obtained via of_parse_phandle() is not released, causing a reference leak. The documented fix is to release the node automatically using the __free(device_node) cleanup attribute to...

CVE-2026-45940

The CVE-2026-45940 issue affects the Linux kernel stmmac Ethernet driver (GMAC4) where, when split header is enabled, the hardware may not fill buf2 in the first descriptor, causing incorrect buf2 length calculation for the next descriptor and triggering a kernel oops. The root cause is not fully...

CVE-2026-45985

CVE-2026-45985 affects the Linux kernel/ext4: during within-EOF direct I/O and writeback with dioread_nolock, unwritten extents could be converted incorrectly when splitting before submitting I/O, potentially exposing stale data. Root cause: EXT4_GET_BLOCKS_CONVERT was set during ext4_split_conve...

CVE-2026-46016

CVE-2026-46016 is a Linux kernel remoteproc issue for the xlnx driver where the receive callback does not guard against NULL messages, potentially enabling a crash scenario and requiring a fix. The publicly referenced OSV entries indicate patches have been released/applied in some distributions (...

CVE-2026-46021

The CVE-2026-46021 entry concerns the Linux kernel thermal subsystem. A defect in thermal_zone_device_register_with_trips() could leave a governor attached to a zone after failure, causing a memory leak, while thermal_zone_device_unregister() could race with governor updates via sysfs and trigger...

CVE-2026-46074

CVE-2026-46074 is addressed in openSUSE openSUSE Tumbleweed via kernel-devel-7.0.11-1.1. The issue is in the Linux kernel SPI ch341 driver, where memory leaks occur on probe failures due to improper cleanup. The patch requests deregistration of the controller, disabling pins, and killing/freeing ...

CVE-2026-46097

CVE-2026-46097: Linux kernel use-after-free in edt-ft5x06 debugfs teardown is fixed by protecting raw_buffer freeing with the device mutex and NULLing raw_buffer. The fix is described in the commit 68743c500c6e and related changes; applied so far to kernel components referenced in public advisori...

CVE-2026-46127

CVE-2026-46127 affects the Linux kernel RDMA/ocrdma; the bug is a NULL dereference in ocrdma_copy_pd_uresp() when uctx is uninitialized, potentially causing a crash. Connected sources indicate patches exist in multiple OSV entries (Root:rootio-linux for Ubuntu 24.04 and Debian 11/12, OpenSUSE/ope...

CVE-2026-46188

CVE-2026-46188 affects the Linux kernel in the octeon_ep_vf driver. The vulnerability arises because napi_build_skb() can return NULL on allocation failure and __octep_vf_oq_process_rx() uses the result without checking for NULL in both the single-buffer and multi-fragment paths, causing a NULL p...

CVE-2026-46223

The CVE-2026-46223 issue concerns the Linux kernel cgroup subsystem: rmdir defers percpu_ref kill of CSS until the cgroup is depopulated. A chain of commits reworked rmdir behavior to ensure ->css_offline() does not run while tasks are still doing kernel work in the cgroup. The core problem wa...

CVE-2026-46251

The CVE-2026-46251 issue is a Linux kernel Btrfs vulnerability where, when EXTENT_TREE_V2 is enabled, the block_group_tree may be added to switch_commits while still on the dirty_list, causing invalid list manipulation and corruption of block_group_root->dirty_list. This corruption can propaga...

CVE-2026-46267

CVE-2026-46267 affects the Linux kernel NFC HCI SHDLC subsystem. The root cause is that timers and state-machine work can remain active during llc_shdlc_deinit(), which purges SHDLC skb queues and frees the llc_shdlc structure while callbacks may still access SHDLC state and queues. If teardown r...

CVE-2026-46305

CVE-2026-46305 affects the Linux kernel, specifically the staging/rtl8723bs path. The issue arises when kzalloc_flex()’s return value is used without checking for allocation failure, leading to a potential NULL pointer dereference when accessing the allocated structure. The fix guards access to t...

CVE-2026-53027

CVE-2026-53027 affects the Linux kernel's fs/ntfs3 component. A missing load of the vcn0 runs when a compressed/sparse attribute is frame-aligned can leave vcn0 in a different attribute segment than vcn, causing run_lookup_entry() to return SPARSE_LCN and triggering WARN_ON(1). The documented fix...