CVE-2025-39896

CVE-2025-39896 (Linux kernel, open-source) The vulnerability affects the ivpu driver in the kernel’s accel path. It arises from recovery work being queued during device removal, potentially allowing use-after-free if recovery code accesses freed resources. The fix replaces cancel_work_sync() with...

CVE-2025-39911

CVE-2025-39911 : Linux kernel i40e driver fix for IRQ freeing in i40e_vsi_request_irq_msix error path. If request_irq() fails after the first iteration, the error path frees IRQs with the wrong dev_id, causing IRQs to remain freed incorrectly and triggering a WARNING: “Trying to free already-free...

CVE-2025-39923

CVE-2025-39923 concerns the Linux kernel dmaengine/qcom BAM driver. The root cause was missing error handling in DT parsing for required properties (clock and num-channels), which could allow probing to proceed unsafely and read channels from registers, risking early boot crashes across Qualcomm ...

CVE-2025-39931

The CVE-2025-39931 issue affects the Linux kernel crypto/af_alg path. A bug in af_alg_sendmsg could leave ctx->merge with a garbage value after an error abort, risking a crash on the next entry into af_alg_sendmsg when a merge cannot be performed. The fix sets ctx->merge to zero near the st...

CVE-2025-39952

CVE-2025-39952: In the Linux kernel, the wifi wilc1000 driver had a buffer overflow in WID string configuration (wlan_cfg.c:184) due to __memcpy() with 512 vs 65537. The patch adds length checks before memory access, basing limits on the WID data type from firmware (struct wilc_cfg_str_vals/struc...

CVE-2025-68358

CVE-2025-68358 (Linux kernel, btrfs) : A race condition was fixed in btrfs_clear_space_info_full() that updated bitfield members (full, chunk_alloc, flush) without holding the space_info lock, risking corruption of adjacent fields due to non-atomic read-modify-write sequences on bitfields. The fi...

CVE-2025-71113

The CVE-2025-71113 issue is in the Linux kernel crypto af_alg path. Several crypto user API contexts and requests allocated with sock_kmalloc() were left uninitialized, which could cause uninitialized data to be used in certain error paths or when new fields are added. The root cause is missing z...

CVE-2025-71143

CVE-2025-71143 concerns a Linux kernel issue in clk: samsung: exynos-clkout where .num was initialized after .hws[] was accessed, triggering UBSAN_BOUNDS warnings. The fix moves the .num initialization before the first access of .hws[] (as noted in commit f316cdff8d67 and related annotations) to ...

CVE-2025-71300

CVE-2025-71300 concerns the Linux kernel’s OP-TEE integration with U-Boot on ARM64/ZynqMP. The issue arises when a manually defined OP-TEE node in zynqmp.dtsi interferes with U-Boot’s logic that automatically injects a reserved-memory node and OP-TEE firmware node into the kernel device tree, bre...

CVE-2026-23115

CVE-2026-23115 concerns the Linux kernel serial subsystem. The issue is a race where tty->port may not be linked before uart_configure_port is invoked, allowing user-space to open a console without a linked TTY and risking a crash. The fix notes that tty_port_link_device() is not redundant and...

CVE-2026-23130

CVE-2026-23130 pertains to the Linux kernel’s ath12k wireless driver and describes a deadlock in flushing management frames. The issue arises after a commit converted the management transmission work item into a wiphy work, which must run under wiphy lock protection; if a management frame is queu...

CVE-2026-23141

CVE-2026-23141 affects the Linux kernel (btrfs subsystem) where btrfs: send: check for inline extents in range_is_hole_in_parent() failed to verify inline extents before accessing the disk_bytenr field. The bug could allow an invalid memory access when inline data is accessed, or when the inline ...

CVE-2026-23244

CVE-2026-23244 affects the Linux kernel and stems from nvme_pr_read_keys() allocating memory based on a user-supplied num_keys value. The code uses num_keys to determine the rse allocation size up to an upper limit PR_KEYS_MAX (64K). A malicious or buggy userspace input can cause a kzalloc-based ...

CVE-2026-23255

The connected Amazon Linux advisory confirms CVE-2026-23255 is a Linux kernel vulnerability where /proc/net/ptype lacked proper RCU protection. The fix adds an explicit device pointer tracking and ensures RCU-compliant reads in ptype_seq_show(), with full READ_ONCE protection in ptype_seq_next() ...

CVE-2026-23256

CVE-2026-23256 relates to the Linux kernel and fixes an off-by-one error in the VF setup_nic_devices() cleanup (net: liquidio) that could leak memory. The Root:Ubuntu and Ubuntu OSV entries confirm patches in rootio-linux for Ubuntu 24.04 and 22.04 with multiple fixed kernel versions (e.g., kerne...

CVE-2026-23289

CVE-2026-23289 affects the Linux kernel (IB/mthca path) in which a missed mthca_unmap_user_db() for mthca_create_srq can trigger a leak on a failed system call. The vulnerability, with local attack vector and low privileges required, may lead to privilege escalation, DoS, or information leaks as ...

CVE-2026-31446

CVE-2026-31446 is a Linux kernel/ext4 vulnerability describing a use-after-free in update_super_work during unmount races. The root cause: update_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() after ext4_unregister_sysfs() frees the kobject, leading to a stale kernfs_node access....

CVE-2026-31591

The CVE-2026-31591 entry details a Linux kernel KVM SNP/VMSA issue where vCPU state synchronization and encryption during SNP launch could be interfered with by userspace, risking vCPU state corruption or host kernel crashes. The root cause is insufficient locking around vcpu->mutex during VMS...

CVE-2026-31656

The CVE-2026-31656 issue affects the Linux kernel in the drm/i915/gt path, where a race between the heartbeat worker and intel_engine_park_heartbeat() can cause a refcount underflow and potential use-after-free of engine->heartbeat.systole. Root cause: a non-atomic read of the pointer followed...

CVE-2026-31701

In CVE-2026-31701, the Linux kernel ALSA caiaq driver (USB audio) stored a pointer to the parent usb_device without a reference. The snd_usb_caiaq_card_free() path can run after the USB device is disconnected, dereferencing freed memory (use-after-free). The fix is to take a reference on the USB ...

CVE-2026-31704

CVE-2026-31704 affects the Linux kernel’s ksmbd ACL handling. The vulnerability arises when accumulating ACL entry sizes uses 16-bit counters (u16) in set_posix_acl_entries_dacl() and set_ntacl_dacl(), allowing wraparound past 65535 and causing pointer arithmetic on pndace to land within already-...

CVE-2026-43088

CVE-2026-43088 (Linux kernel) affects PF_KEY export paths in the net: af_key code, where IPv6 sockaddr payloads were not fully initialized in certain export messages (SADB_ACQUIRE, SADB_X_NAT_T_NEW_MAPPING, SADB_X_MIGRATE). The issue arises because pfkey_sockaddr_size() reserves 32 bytes for IPv6...

CVE-2026-43105

The CVE-2026-43105 issue affects the Linux kernel’s DRM VC4 driver. The root cause is a memory leak where the hang state’s BO array is allocated with kzalloc() in vc4_save_hang_state() but is not freed in vc4_free_hang_state(), leaving memory allocated when the hang state is freed. A kfree() for ...

CVE-2026-43168

CVE-2026-43168 concerns the Linux kernel OCFS2 reflink preserve cleanup issue. Multiple connected sources confirm a bug in the cleanup of preserved xattr entries: the last pointer should be shifted by one unit after an array entry cleanup, and the first entry may not be cleaned when xh_count is 1...

CVE-2026-43203

The CVE covers a Linux kernel fore200e ATM driver use-after-free during device removal (PCA-200E/SBA-200E). Vulnerability arises when tx_tasklet/rx_tasklet run or pending after fore200e is freed, risking access to freed memory. The published fixes synchronize tasklets with device shutdown by addi...

CVE-2026-43215

The CVE-2026-43215 issue affects the Linux kernel CIFS implementation: the code used cifs_tcp_ses_lock to guard tcon fields, but this lock protected more than intended. The patch introduces more granular locking (tc_lock) within tcon-related structures (in addition to srv_lock and ses_lock) to re...

CVE-2026-43260

The CVE concerns the bnxt_en driver in the Linux kernel. The vulnerability stems from RSS context deletion logic that could leak VNICs in firmware when deleting RSS contexts with the interface down, leading to failures when re-opening and restoring RSS contexts. The fix removes the netif_running(...

CVE-2026-43270

The CVE-2026-43270 issue affects the Linux kernel media: mtk-mdp module. In mtk_mdp_probe(), vpu_get_plat_device() increases the platform device reference count and is not consistently released in mtk_mdp_remove(), creating a reference-leak vulnerability. Red Hat and Debian OS/tracking entries co...

CVE-2026-43480

In CVE-2026-43480, the Linux kernel ASoC driver for the amd acp3x-rt5682-max9836 (acp3x_5682_init) failed to check the return value of clk_get(), risking dereferencing an error pointer in rt5682_clk_enable(). The fix is to switch to device-managed devm_clk_get() and add IS_ERR() checks for both c...

CVE-2026-43481

The CVE-2026-43481 issue affects the Linux kernel net-shapers component. The vulnerability arises because, on genlmsg_reply() failure, the reply skb could be freed twice (the code path freed or nlmsg_free(msg) after genlmsg_reply() and in all return paths). The root cause is that netlink_unicast(...

CVE-2026-45848

The CVE-2026-45848 issue affects the Linux kernel AppArmor component, where NULL sock or sock-sk can occur during socket setup/teardown, potentially causing a NULL pointer dereference and a kernel oops (DoS) for af_unix sockets. Root cause is dereferencing NULL during socket operations; impact is...

CVE-2026-45899

CVE-2026-45899 is a Linux kernel/ext4 issue where, if a split extent operation fails, stale extent entries may remain in the extent status tree. The fix requires dropping all of the potentially stale extents when the split fails to prevent inconsistent metadata. Exploitation details are not provi...

CVE-2026-45935

The CVE-2026-45935 issue affects the Linux kernel NTFS3 driver, specifically the DeleteIndexEntryRoot path in do_action. The vulnerability arises from insufficient bounds checking on the entry size (esize) read from the log record, where e2 = Add2Ptr(e1, esize) can exceed the used buffer if esize...

CVE-2026-45989

CVE-2026-45989: Linux kernel use-after-free in unittest testdrv_probe() is mitigated in openSUSE/Root environments by updating kernel-devel to 7.0.11-1.1. The initial description explains that testdrv_probe() retrieves a device_node from the PCI device, applies an overlay, and then calls of_node_...

CVE-2026-46007

CVE-2026-46007 targets the Linux kernel hwmon: powerz code, where a DMA transfer buffer may accidentally share a cacheline with a mutex, enabling a cacheline sharing risk for DMA. The issue is mitigated by using the high‑level DMA helpers to ensure no cacheline sharing occurs, and by removing the...

CVE-2026-46066

CVE-2026-46066 pertains to a Linux kernel issue that surfaces as a panic in multi-folio encrypted writes when a bounce buffer allocation fails during fscrypt-enabled CephFS writes. The root cause, described in the CVE entry, is that move_dirty_folio_in_page_array() may fail after the batch has st...

CVE-2026-46070

CVE-2026-46070 pertains to the Linux kernel md/raid5 path where journal metadata blocks could be overrun due to missing validation of on-disk payload sizes. r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() may read or offset beyond a page boundary when payload size...

CVE-2026-46103

CVE-2026-46103 affects the Linux kernel, specifically the USB stack where can: ucan fixes the devres lifetime. The root cause is that resources bound to USB interfaces were not guaranteed to outlive the parent USB device, leading to memory leaks when drivers unbind (e.g., during probe deferrals o...

CVE-2026-46126

CVE-2026-46126 affects the Linux kernel RDMA/mana component. The issue stems from the error unwind flow in mana_ib_create_qp_rss() cleanup of the Work Queue (WQ) table, leading to improper resource cleanup. Reports identify two bugs: (1) a double i-- in the first failure path of the unwinding loo...

CVE-2026-46128

The CVE-2026-46128 issue concerns the Linux kernel IPMI event message handling. The root cause is an insufficiently validated event message buffer/data size occurring when fetching events, with some BMCs returning an empty message instead of an error. This leads to a potential failure in processi...

CVE-2026-46222

In CVE-2026-46222, the Linux kernel’s media: rockchip: rkcif driver was fixed by adding the missing MUST_CONNECT flag to pads, addressing a null-pointer dereference when a media stream is enabled. The issue arose from pads not reliably checking for connected devices, enabling a local attacker to ...

CVE-2026-46232

The CVE-2026-46232 entry concerns the Linux kernel HID PlayStation driver. A flaw allows a device to report more touch_reports than the array can hold, risking an out-of-bounds read in dualshock4_parse_report and potentially exposing up to ~2 KiB of kernel memory when DS4_TOUCH_POINT_INACTIVE is ...

CVE-2026-46236

CVE-2026-46236 affects the Linux kernel media: rc Xbox remote driver, where the IO buffer was placed in the device structure, violating DMA coherency rules. This is a local, low-complexity issue with high availability impact. Publicly documented fixes are present in OSV entries for Root: Debian 1...

CVE-2026-46240

The CVE-2026-46240 issue affects the Linux kernel iris driver. A use-after-free occurs when iris_release_internal_buffers() accesses a buffer after session_release_buf() frees it, caused by a regression from a change that destroys internal buffers after FW releases. The documented fix sets BUF_AT...

CVE-2026-46252

CVE-2026-46252 affects the Linux kernel regulator core. The vulnerability stems from improper locking in regulator_resolve_supply() error handling, where late-failing supply enable paths could trigger a lockdep warning due to holding the regulator_list_mutex while calling _regulator_put(). The fi...

CVE-2026-46264

CVE-2026-46264 addresses a Linux kernel flaw in drm/xe/pf where an error in devm_add_action_or_reset() can cause a cleanup action to run on an uninitialized kobject during sysfs initialization. This use-after-free and kobject_put() on an uninitialized object is mitigated by ensuring proper initia...

CVE-2026-52907

The CVE-2026-52907 entry concerns the Linux kernel component media: rockchip: rkcif. The root cause is off-by-one errors in array handling, where comparisons were made with > instead of >=, risking reads beyond the end of arrays. The fix updates comparisons to use proper bounds checks and s...

CVE-2026-52915

CVE-2026-52915 concerns the Linux kernel netfilter ip6t_hbh module, where ip6t_opts may store at most IP6T_OPTS_OPTSNR (16) option descriptors but hbh_mt6_check() did not reject larger optsnr values from userspace. This allowed a potential out-of-bounds condition (UBSAN: array-index-out-of-bounds...

CVE-2026-53014

CVE-2026-53014 (Linux kernel net/sched: act_mirred) has concrete details across multiple sources. The bug in tcf_blockcast_redir loops over block ports to redirect packets to multiple devices and erroneously queries the mac_header_xmit flag from the NEXT device instead of the device being sent to...

CVE-2026-53073

CVE-2026-53073 affects Linux kernel Bluetooth HCI UART handling. The issue occurs when hci_register_dev() fails in hci_uart_register_dev() and HCI_UART_PROTO_INIT is not cleared before hu->proto->close() and hu->hdev = NULL, potentially allowing protocol recv path to access freed resourc...