CVE-2026-23438

In the Linux kernel mvpp2 driver, CVE-2026-23438 arises from an unconditional access to CM3 flow control via mvpp2_cm3_read()/mvpp2_cm3_write() in mvpp2_bm_switch_buffers(), when priv->cm3_base is NULL (e.g., CM3 SRAM not present in device tree). This can crash the kernel on MTU changes that c...

CVE-2026-23126

CVE-2026-23126 affects the Linux kernel netdevsim driver. It describes a race on the bpf_bound_progs list between nsim_bpf_create_prog() (list_add_tail) and nsim_bpf_destroy_prog() (list_del), which can corrupt the list and trigger a kernel crash (kernel BUG at lib/list_debug.c). The proposed rem...

CVE-2026-23158

CVE-2026-23158 (Linux kernel) affects gpio-virtuser: the configfs release path frees the device inside a guard(mutex) region, leading to a use-after-free when mutex_unlock() runs after the guard. The issue is caused by destroying the mutex and freeing the device while still within the lock’s guar...

CVE-2026-23189

CVE-2026-23189 concerns a NULL pointer dereference in ceph_mds_auth_match() within the CephFS kernel client. The patch reworks ceph_mdsmap_decode() and namespace_equals() so that ceph_mdsmap contains an extracted FS name (m_fs_name) and the code path uses this value for strict authorization check...

CVE-2026-23190

Mode C: CVE-2026-23190 affects the Linux kernel ASoC/amd driver; the issue is a memory leak in acp3x PDM DMA ops. Public advisories (Mageia, SUSE/OpenSUSE, Oracle Linux, Debian) confirm upstream fix in kernel. Remediation is applying the upstream patch (memory leak in acp3x pdm dma ops) or upgrad...

CVE-2026-23202

The CVE-2026-23202 issue is in the Linux kernel SPI driver for Tegra210-quad (tegra_qspi_combined_seq_xfer). The root cause is that curr_xfer is read by the IRQ handler without the spinlock, and is cleared without proper synchronization, allowing a race that could yield a NULL pointer dereference...

CVE-2026-23212

CVE-2026-23212 affects the Linux kernel bonding driver where slave->last_rx (and target_last_arp_rx) data could be read/write locklessly, causing data races. The fix annotates these fields with READ_ONCE() and WRITE_ONCE(), addressing a KCSAN data race in bond_rcv_validate and related paths. C...

CVE-2026-23218

CVE-2026-23218 affects the Linux kernel (loongson-64bit GPIO). The root cause is an incorrect NULL check in loongson_gpio_init_irqchip() after devm_kcalloc(), where chip->parent was checked instead of chip->irq.parents. This mischeck can lead to a NULL dereference during IRQ chip init. The ...

CVE-2026-23227

CVE-2026-23227 is addressed across several OSV records indicating patches in rootio-linux for Root:Debian/Ubuntu/OpenSUSE platforms, with multiple fixed versions available. The initial Linux kernel Vidi/Exynos memory-alloc race issue is fixed by ensuring proper locking around memory-alloc/free st...

CVE-2026-23244

CVE-2026-23244 affects the Linux kernel and stems from nvme_pr_read_keys() allocating memory based on a user-supplied num_keys value. The code uses num_keys to determine the rse allocation size up to an upper limit PR_KEYS_MAX (64K). A malicious or buggy userspace input can cause a kzalloc-based ...

CVE-2026-23255

The connected Amazon Linux advisory confirms CVE-2026-23255 is a Linux kernel vulnerability where /proc/net/ptype lacked proper RCU protection. The fix adds an explicit device pointer tracking and ensures RCU-compliant reads in ptype_seq_show(), with full READ_ONCE protection in ptype_seq_next() ...

CVE-2026-23279

CVE-2026-23279 concerns the Linux kernel’s wifi/mac80211 mesh code. The issue is a NULL pointer dereference in mesh_rx_csa_frame() when the Mesh Channel Switch Parameters IE (IE 118) is absent; elems->mesh_chansw_params_ie can be NULL after mesh_matches_local(), yet code dereferences it uncond...

CVE-2026-23312

CVE-2026-23312 concerns the Linux kernel: the net: usb: kaweth driver did not validate USB endpoint counts/types when probing a device. The root cause is lack of validation before binding, which could allow a malicious device to cause a crash by accessing endpoints that aren’t present or correctl...

CVE-2026-23395

CVE-2026-23395 affects the Linux kernel Bluetooth L2CAP handling of ECRED connection requests. The issue stems from accepting multiple L2CAP_ECRED_CONN_REQs regardless of the command identifier, which can cause multiple requests to be marked pending (FLAG_DEFER_SETUP) and may lead to allocating m...

CVE-2026-23419

CVE-2026-23419 affects the Linux kernel’ s RDS implementation. The issue is a circular locking dependency in net/rds: a memory allocation performed inside the socket lock during the call to sk_net_refcnt_upgrade() creates a deadlock with fs_reclaim. The root cause is that sk_net_refcnt_upgrade() ...

CVE-2026-23450

CVE-2026-23450 (Linux kernel): The issue stems from a race in the SMC TCP path (net/smc) where, during close of an SMC listen socket, sk_user_data can be NULL or the smc_sock freed, causing a NULL dereference or use-after-free in smc_tcp_syn_recv_sock() when accessed under rcu/protected context. ...

CVE-2026-23461

CVE-2026-23461: In the Linux kernel Bluetooth L2CAP, l2cap_register_user() and l2cap_unregister_user() did not consistently acquire conn->lock, creating a race with l2cap_conn_del() that can access conn->users and conn->hchan concurrently. This caused use-after-free and list corruption. ...

CVE-2026-31446

CVE-2026-31446 is a Linux kernel/ext4 vulnerability describing a use-after-free in update_super_work during unmount races. The root cause: update_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() after ext4_unregister_sysfs() frees the kobject, leading to a stale kernfs_node access....

CVE-2026-31450

CVE-2026-31450 describes a race in ext4 where ei->jinode was published to concurrent readers before jbd2_journal_init_jbd_inode() completed, allowing a non-NULL jinode to be observed with i_vfs_inode still NULL. The mitigated issue could lead to a crash when a reader passes jinode to jbd2_wait...

CVE-2026-31503

CVE-2026-31503 concerns a Linux kernel UDP hash2-based wildcard-bind conflict check that can miss an in-use port when many sockets bind to the same port. The issue arises because UDP uses two hashes (hash and hash2) for collision detection and switches to hash2 only when hslot->count > 10, ...

CVE-2026-31506

The CVE-2026-31506 issue concerns the Linux kernel bcmasp component where the Wake-on-LAN (WoL) IRQ handler could be double-freed. The problem stems from handling of the WoL irq; the patch indicates wol_irq does not need explicit freeing because it is allocated with devm_request_irq, and devres h...

CVE-2026-31576

CVE-2026-31576 affects the Linux kernel hackrf driver. A race condition allows use-after-free and double-free when memory for the hackrf device is freed on the error path after probe() has registered the device. Open file descriptors and in-flight I/O can still reference the device while v4l2/vid...

CVE-2026-31628

CVE-2026-31628 concerns the Linux kernel on Zen1 CPUs, where the x86/CPU FPDSS issue could allow a local attacker to leak partial results from prior operations via the hardware divider. Patches fix the vulnerability by applying a kernel change (the “chicken bit”) to prevent leakage. Connected adv...

CVE-2026-31704

CVE-2026-31704 affects the Linux kernel’s ksmbd ACL handling. The vulnerability arises when accumulating ACL entry sizes uses 16-bit counters (u16) in set_posix_acl_entries_dacl() and set_ntacl_dacl(), allowing wraparound past 65535 and causing pointer arithmetic on pndace to land within already-...

CVE-2026-31714

The CVE-2026-31714 issue affects the Linux kernel F2FS component, where a memory leak occurs in f2fs_rename() due to an unpaired call to f2fs_free_filename() after f2fs_setup_filename() was added in commit 40b2d55e0452. Exploitation details are local (AV:L/AC:L) with a high availability impact (A...

CVE-2026-31755

Rooted in the Linux kernel usb cdns3 gadget: when an endpoint is disabled or unconfigured, ep->desc can be NULL and __cdns3_gadget_ep_queue() may dereference it, causing a kernel crash. A patch adds a check and returns -ESHUTDOWN for unconfigured endpoints. Upstream fixes exist (commit referen...

CVE-2026-31768

The CVE-2026-31768 issue affects the Linux kernel driver iio: adc: ti-adc161s626, where SPI read operations used non-DMA-safe stack memory. The mitigation is to allocate a DMA-safe buffer and perform spi_read() into that buffer, replacing stack-based buffers. Since the read would require only up ...

CVE-2026-43073

CVE-2026-43073 stems from a misnamed x86-64 kernel routine __copy_user_nocache(), a non-temporal destination copy with exception handling that is not actually a pure user-kernel copy and has complex alignment behavior. The fix renames the function and normalizes the prototype so callers perform p...

CVE-2026-43101

The CVE-2026-43101 entry refers to a Linux kernel IPv6 IOAM issue: __ioam6_fill_trace_data() could dereference NULL if __in6_dev_get() returns NULL. The fix replaces skb_dst_dev() with skb_dst_dev_rcu() and adds two missing READ_ONCE() checks; it also enforces that @dev cannot be NULL. Patches ar...

CVE-2026-43168

CVE-2026-43168 concerns the Linux kernel OCFS2 reflink preserve cleanup issue. Multiple connected sources confirm a bug in the cleanup of preserved xattr entries: the last pointer should be shifted by one unit after an array entry cleanup, and the first entry may not be cleaned when xh_count is 1...

CVE-2026-43309

The CVE-2026-43309 issue affects the Linux kernel’s md raid and device-mapper (dm-raid) components. When stopping a RAID array managed by dm-raid, the system could hang because md_stop() attempted to flush the write-intent bitmap to metadata sub-devices that were already suspended. The fix preven...

CVE-2026-43408

CVE-2026-43408 concerns the Linux kernel Ceph path handling: a missing zero-initialization of ceph_path_info before ceph_mdsc_build_path() calls can lead to crashes when ceph_mdsc_free_path_info() is invoked on error paths. Multiple code paths lacked proper initializers; the recommended fix is to...

CVE-2026-43421

The CVE affects the Linux kernel USB gadget for Network Control Model (NCM) where a net_device could outlive its parent gadget during disconnection, causing dangling sysfs links and potential null dereference. The root cause was lifecycle mismanagement of net_device during USB bind/unbind, addres...

CVE-2026-43445

CVE-2026-43445 is a Linux kernel vulnerability in the e1000/e1000e drivers (and potentially igbvf) where a DMA mapping error cleanup leak could occur. The root cause was an off-by-one condition in the dma_error path: count was decremented before the loop, so if any TX buffer mappings succeeded be...

CVE-2026-43460

In the Linux kernel rockchip-sfc driver, CVE-2026-43460 is caused by a double-free of an SPI controller: the driver uses devm_spi_register_controller(), which auto-unregisters on device removal, but remove() also calls spi_unregister_controller(), creating a double-free. The mitigation implemente...

CVE-2026-45848

The CVE-2026-45848 issue affects the Linux kernel AppArmor component, where NULL sock or sock-sk can occur during socket setup/teardown, potentially causing a NULL pointer dereference and a kernel oops (DoS) for af_unix sockets. Root cause is dereferencing NULL during socket operations; impact is...

CVE-2026-45914

CVE-2026-45914 affects the Linux kernel hwmon ibmpex driver, where a race during sensor deletion can race with userspace access to a freed sensor data structure, causing a use-after-free and potential crash. The description notes that the patch reverting the previous fix (6946c726…) may introduce...

CVE-2026-45925

CVE-2026-45925 affects the Linux kernel thermal subsystem. In thermal_of_cm_lookup(), a device node pointer (tr_np) obtained via of_parse_phandle() is not released, causing a reference leak. The documented fix is to release the node automatically using the __free(device_node) cleanup attribute to...

CVE-2026-45940

The CVE-2026-45940 issue affects the Linux kernel stmmac Ethernet driver (GMAC4) where, when split header is enabled, the hardware may not fill buf2 in the first descriptor, causing incorrect buf2 length calculation for the next descriptor and triggering a kernel oops. The root cause is not fully...

CVE-2026-45949

CVE-2026-45949 details from connected OSV/NVD entries confirm a race in the Linux kernel hwrng core where concurrent unregister/start calls may cause use-after-free due to hwrng_fill not being cleared reliably. The patch serializes access with rng_mutex, moves cleanup to a work_struct, and conver...

CVE-2026-45958

The CVE-2026-45958 vulnerability affects the Linux kernel, specifically the drm/exynos vidi driver. In vidi_connection_ioctl(), the code dereferenced a user pointer directly (vidi->edid(user pointer)), enabling arbitrary kernel memory access from user space and potentially leading to privilege...

CVE-2026-45969

The CVE concerns the Linux kernel HID PlayStation driver. In ps_gamepad_create(), the call to input_ff_create_memless() is made without verifying its return value, which can cause incorrect behavior or crashes when Force Feedback effects are triggered. Multiple connected sources indicate the issu...

CVE-2026-45989

CVE-2026-45989: Linux kernel use-after-free in unittest testdrv_probe() is mitigated in openSUSE/Root environments by updating kernel-devel to 7.0.11-1.1. The initial description explains that testdrv_probe() retrieves a device_node from the PCI device, applies an overlay, and then calls of_node_...

CVE-2026-46013

Technical details about CVE-2026-46013 are not publicly provided in the supplied connected documents. Available sources reference the CVE at a high level only. Monitor for updates.

CVE-2026-46021

The CVE-2026-46021 entry concerns the Linux kernel thermal subsystem. A defect in thermal_zone_device_register_with_trips() could leave a governor attached to a zone after failure, causing a memory leak, while thermal_zone_device_unregister() could race with governor updates via sysfs and trigger...

CVE-2026-46029

In the Linux kernel, CVE-2026-46029 describes a race within the slab allocator where kmalloc_nolock() called from NMI on uniprocessor (UP) configurations can re-enter the allocator and acquire n->list_lock that the interrupted context already holds, corrupting slab state and potentially causin...

CVE-2026-46065

CVE-2026-46065 affects the Linux kernel framebuffer (fbdev) defio mechanism. The issue arises from disconnecting deferred I/O from the lifetime of struct fb_info, by holding state in struct fb_deferred_io_state and freeing the instance only after the final mapping closes. If fb_info/defio are fre...

CVE-2026-46070

CVE-2026-46070 pertains to the Linux kernel md/raid5 path where journal metadata blocks could be overrun due to missing validation of on-disk payload sizes. r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() may read or offset beyond a page boundary when payload size...

CVE-2026-46078

Summary: CVE-2026-46078 affects the Linux kernel EROFS filesystem, where trailing dirents can trigger an out-of-bounds read due to incorrect nameoff handling. The root cause is that namelen calculations for trailing dirents use strnlen with unchecked nameoffs, allowing underflow when nameoff >...

CVE-2026-46080

CVE-2026-46080 : In the Linux kernel, the ocfs2 code path is fixed to prevent credit-exhaustion during direct I/O (dio) by splitting transactions in dio completion and batching extent handling. The patch relocates removing inodes from the orphan list until the extent tree update completes, reduci...