CVE-2026-53118

CVE-2026-53118 affects the Linux kernel/vdpa driver. During driver probing via __driver_attach(), the bus match() callback could access the driver_override field without holding the device lock, enabling a potential use-after-free. The fix uses the driver-core driver_override infrastructure to en...

CVE-2026-53146

CVE-2026-53146 affects the Linux kernel Thunderbolt XDomain handling. tb_xdomain_copy() copies req->response_size bytes from the received packet buffer regardless of the actual frame size, allowing a short response to read past valid frame data into stale DMA contents. The fixed behavior is to...

CVE-2026-53154

The CVE-2026-53154 issue affects the Linux kernel mm/hugetlb path where, on error during copy of huge pages, the per-VMA reservation can leak despite free_huge_folio() restoring the global pool. Concrete details from connected sources show that two code paths allocate a hugetlb folio (alloc_huget...

CVE-2026-53161

The CVE-2026-53161 entry concerns a use-after-free in the Linux kernel fastrpc subsystem. A race between fastrpc_device_release() (on file close) and the workqueue processing DSP responses can free the fastrpc_user while an in-flight DSP invocation is completing, leading to dereferencing freed co...

CVE-2026-53188

The CVE-2026-53188 entry concerns a Linux kernel RDMA/core flaw where fops passed to ib_get_ucaps() could be spoofed via a block device sharing a dev_t with a character device (char/block alias). The root cause is insufficient validation of f_ops, allowing a local attacker with access to device n...

CVE-2026-53263

CVE-2026-53263 is reported in OSV entries as affecting the rootio-linux package in Ubuntu/Debian environments, with patches available in multiple fixed versions (e.g., Root:Ubuntu:22.04 and Root:Ubuntu:24.04; Debian 11/12 tracks). The Debian/Ubuntu Nessus OSV entries note patches for these distri...

CVE-2026-53265

The CVE-2026-53265 entry describes a Linux kernel race in the dm-cache policy SMQ path. A check-then-act race occurs in smq_invalidate_mapping where an e->allocated check was left outside the mq->lock after the destructive section was serialized; two concurrent invalidators can observe allo...

CVE-2026-53287

CVE-2026-53287 affects the Linux kernel audit CAPSET path. A copy-paste bug in __audit_log_capset() writes cap_pi (inheritable) with cap_effective, corrupting inheritable audit data and enabling privilege-escalation prep in the audit trail. The issue is fixed in the Linux kernel; patches exist in...

CVE-2026-53296

CVE-2026-53296 is addressed in OSV entries for Root OS products, noting that the vulnerability in the rootio-linux component was patched in Ubuntu 22.04, Ubuntu 24.04, and Debian-based Root builds. Multiple fixed versions are available per the OSV records. The Debian/Ubuntu rootio-linux remediati...

CVE-2026-53373

The CVE-2026-53373 issue is in the Linux kernel’s mm/vma path: in certain stacked driver scenarios, mmap_prepare() invoked from the mmap() hook may expose a not-fully-established VMA to the caller, risking unsafe unmapping as the VMA is detached. The fix propagates the context of the mmap action ...

CVE-2026-53376

CVE-2026-53376 fixes an upper bound check in drm/amdkfd (kfd_ioctl_get_process_apertures_new) in the Linux kernel, preventing potential out-of-bounds access. The patch sequence is noted as cherry-picked from commit 98ff46a5ea090c14d2cdb4f5b993b05d74f3949f and has been applied to stable kernels fo...

CVE-2026-64084

Summary: CVE-2026-64084 affects the Linux kernel’s hwmon pmbus/adm1266 driver. The bug occurs in adm1266_gpio_get_multiple() when iterating the PDIO portion of the caller-supplied mask. It uses for_each_set_bit_from with an upper bound of ADM1266_GPIO_NR + ADM1266_PDIO_STATUS (0xE9/233) instead o...

CVE-2026-64090

CVE-2026-64090 affects the Linux kernel’s batman-adv translation table (TT) handling. The issue arises when a TT reply can be generated either directly or via the global TT state, leading to potential inconsistency and the sending of empty VLANs, which can trigger TT request storms and network in...

CVE-2026-64124

CVE-2026-64124 concerns the Linux kernel net: devmem: bind via dma-buf with non-page-aligned size or SG length. The issue arises because net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be multiples of PAGE_SIZE without checking, causing an out-of-bounds access: tx_vec is sized...

CVE-2026-64132

CVE-2026-64132 (Linux kernel IPv6 IOAM): use-after-free in ipv6_hop_ioam caused by stale hdr pointer after skb_ensure_writable() reallocation. Patch recalculates hdr pointer before passing hdr->opt_len to ioam6_event(), preventing UaF. Red Hat notes potential DoS and possible broader impacts (...

CVE-2026-64154

The flaw is in the Linux kernel's Adreno GPU driver (a6xx_gpu_init), where of_parse_phandle() acquires a device node reference that early error returns fail to release via of_node_put(), causing resource accumulation. The fix uses __free(device_node) for automatic cleanup. Red Hat notes it is not...

CVE-2026-64224

CVE-2026-64224 – Linux kernel (OcteonTX2 representor): The vulnerability arises in rvu_rep_rsrc_init(), which allocates queue memory before hw resources are initialized. If otx2_init_hw_resources() fails, it unwinds partially but the representor path may call otx2_free_hw_resources() again, riski...

CVE-2026-64270

CVE-2026-64270 affects the Linux kernel and stems from a stack-based overflow in the MMS114 I2C touch data handling. The code reads an I2C packet into a fixed-size on-stack buffer touch[10], but the device-reported packet_size (0x0F) is not bounded to the buffer, allowing up to 175 bytes to be wr...

CVE-2026-64331

CVE-2026-64331 is a NULL pointer dereference in the Linux kernel's usbip vudc subsystem. The root cause is that vep_alloc_request() never initialized vrequest->udc, so when FunctionFS AIO cancellations arrived in vep_dequeue, a NULL UDC reference caused a kernel oops. The bug reportedly existe...

CVE-2026-64342

CVE-2026-64342 is a use-after-free vulnerability in the Linux kernel's iowarrior USB driver . Submitted write URBs are not stopped on close(), so they must be stopped unconditionally on disconnect() to prevent the completion handler from accessing freed memory. NVD scores it 7.8 HIGH (AV:L/AC:L/P...

CVE-2026-64345

CVE-2026-64345 affects the Linux kernel USB gadget f_printer driver. The function printer_open() increments dev->kref even when it returns -EBUSY (device already open). Because VFS does not call ->release() for a failed open, every rejected second open permanently leaks one reference count ...

CVE-2026-64362

CVE-2026-64362 is a use-after-free in the Linux kernel's HID lg-g15 driver. The driver allocates lg_g15_data via devm and schedules a work item from input report handlers, but had no remove callback to cancel pending work. When a supported keyboard (G15, G15 v2, or G510) is unplugged, devres free...

CVE-2026-64366

CVE-2026-64366 affects the Linux kernel HID wacom driver. The vulnerability stems from wacom_wac_queue_insert() calling kfifo_skip() in a loop even when the FIFO could be empty. When empty, stale data in the kmalloc buffer can be read by __kfifo_peek_n() and treated as a record length, advancing ...

CVE-2026-64443

Summary (CVE-2026-64443): Linux kernel staging: rtl8723bs vulnerable in the update_beacon_info() IE loop, where parsing of IEs could read beyond the received frame. The loop advances by (pIE->length + 2) but only guards on i length extending beyond len. The fix adds two guards at the top of th...

CVE-2026-64446

CVE-2026-64446 is a heap buffer overflow in the Linux kernel's rtl8723bs staging driver . In rtw_cfg80211_set_wpa_ie(), the supplicant_ie array is 256 bytes, but the memcpy for WPA/WPA2 IE copies wpa_ielen + 2 bytes where wpa_ielen is an unsigned 8-bit value (max 255). A local user supplying a cr...

CVE-1999-0781

The CVE-1999-0781 entry concerns KDE: local users can run arbitrary commands by setting the KDEDIR environment variable to alter KDE’s executable search path. This documents the affected component as KDE and the root cause as the KDEDIR env var influencing how KDE locates executables, enabling lo...

CVE-1999-1441

CVE-1999-1441 concerns the Linux kernel (2.0.34) allowing a local user to deliver SIGIO signals to arbitrary processes, leading to denial of service if the target does not catch the signal. The root cause is improper restriction of SIGIO delivery across processes. Public references show a practic...

CVE-2016-6791

CVE-2016-6791 is an elevation-of-privilege vulnerability in the Qualcomm sound driver affecting Android devices. The issue allows a local malicious application to execute arbitrary code in the kernel context, requiring initial compromise of a privileged process. Affected components/versions inclu...

CVE-2022-50071

The CVE-2022-50071 issue affects the Linux kernel’s MPTCP implementation. The vulnerability arises when socket creation fails due to a CGROUP_INET_SOCK_CREATE eBPF program, causing leakage of subflows because cleanup was not invoked in that code path. The fix moves subflow cleanup into the mptcp_...

CVE-2022-50303

CVE-2022-50303 : The Linux kernel’s DRM AMDGPU/AMDKFD path fixes a double release of a compute pasid. When kfd_process_device_init_vm fails after the VM was converted to a compute VM and vm->pasid was set to the compute pasid, KFD could drop the drm_file reference, causing the close path to re...

CVE-2022-50378

CVE-2022-50378 is a Linux kernel issue in the DRM Meson driver where unloading the driver could trigger a use-after-free (observed as a KASAN warning on __list_del_entry_valid). The description attributes the bug to the driver deinit sequence and notes that a reorder of the deinitialization steps...

CVE-2022-50551

CVE-2022-50551 refers to a Linux kernel vulnerability in the brcmfmac wireless driver where a shift-out-of-bounds could occur during firmware allocation due to an oversized chiprev value used in BIT(chiprev). The patch adds a guard so the function brcmf_fw_alloc_request() returns NULL if chiprev ...

CVE-2023-53150

CVE-2023-53150 is a Linux kernel issue reported as resolved, affecting the kernel’s SCSI qla2xxx path. The vulnerability arises when a NULL pointer rport may be dereferenced in fc_bsg_to_rport(); the fix adds a validation step to ensure rport is non-NULL before dereferencing. EulerOS security adv...

CVE-2023-53266

The CVE-2023-53266 issue affects the Linux kernel (arm64) ACPI path involving ffh_ctxt allocation. The vulnerability arises when SMCCC version and conduit checks fail and a -EOPNOTSUPP return occurs without freeing the allocated ffh_ctxt memory, creating a memory leak. The documented fix moves th...

CVE-2023-53305

The CVE-2023-53305 entry refers to a Linux kernel vulnerability in Bluetooth L2CAP that fixes a use-after-free condition in l2cap_le_command_rej. The issue is described as a use-after-free (UAF) in Bluetooth code, leading to potential impact with a CVSSv3.1 score of 7.8 (HIGH) and a LOCAL attack ...

CVE-2023-53322

CVE-2023-53322 in the Linux kernel affects the scsi qla2xxx driver. The issue arises when terminate_rport_io does not wait for all IOs to return, risking a use-after-free and potential resource leakage leading to a system crash. The connected advisories (EulerOS/RHEL) list this CVE among kernel f...

CVE-2023-53368

CVE-2023-53368 – Linux kernel tracing race : A race between writing to the per-CPU tracing buffer and swapping the buffer via per_cpu/cpu0/snapshot can cause a false “committing” state in rb_end_commit(), leading to a WARN and potential commit inconsistencies. The issue manifests in the tracing r...

CVE-2023-53404

CVE-2023-53404 relates to the Linux kernel USBFotg210 driver where a memory leak can occur when using debugfs_lookup() without releasing the result. The memory must be released with dput(), but the patch replaces this with debugfs_lookup_and_remove(), which handles the lookup and cleanup in one s...

CVE-2023-53422

Technical details about CVE-2023-53422 (affected product, root cause, impact, remediation) are not publicly provided in the supplied documents. The description mentions a memory-leak fix in wifi: iwlwifi: fw: debugfs, but contains no vendor/version/patch specifics. Monitor for updates.

CVE-2023-53429

CVE-2023-53429 concerns the Linux kernel's btrfs __extent_writepage path. The issue arises because __extent_writepage could set PageError on any error and the submission context might see that flag if the end I/O handler also touched PageError, risking leakage of error state into the submission c...

CVE-2023-53435

CVE-2023-53435 affects the Linux kernel, addressing a memory leak in the error handling path of cas_init_one(). The vuln is tied to cas_saturn_firmware_init(), which allocates memory with vmalloc() that is freed in the .remove() path but not in error handling. The patch adds a missing vfree() to ...

CVE-2025-38221

CVE-2025-38221 relates to a Linux kernel ext4 punching hole offset vulnerability. The available connected documents describe a fix for out-of-bounds punching: punching a hole with a start offset that exceeds max_end could yield a negative length in truncate_inode_partial_folio during page cache t...

CVE-2025-38252

The CVE-2025-38252 entry concerns a Linux kernel vulnerability in the cxl/ras CPER handler device confusion. The defect stems from cxl_cper_handle_prot_err() making fragile assumptions: it may treat endpoints as CXL-Type-3 devices, assume the device is bound to the cxl_pci driver, and unnecessari...

CVE-2025-38522

CVE-2025-38522 fixes a Linux kernel issue in sched/ext where update_locked_rq() could be called with a NULL runqueue (rq). The patch ensures update_locked_rq() is invoked only when rq is non-NULL, preventing unsafe __this_cpu_write() usage in preemptible contexts. The vulnerability description no...

CVE-2025-38525

CVE-2025-38525 concerns the Linux kernel RXRPC code path where rxrpc_assess_MTU_size() is invoked with IRQs disabled, triggering a warning in the IP layer via local_bh_enable() and potential interrupt handling issues. The issue is resolved by moving the MTU-size assessment out of rxrpc_init_peer(...

CVE-2025-38629

Technical details about CVE-2025-38629 are not publicly available in the provided connected documents. The initial description mentions a NULL check in scarlett2, but no further technical specifics are provided. Monitor for updates.

CVE-2025-38654

CVE-2025-38654 concerns the Linux kernel pinctrl path for canaan k230. The vulnerability arises from the ordering of device-tree parsing and pinctrl registration, where device-tree parsing must complete before devm_pinctrl_register() is called to avoid using uninitialized pin resources. The provi...

CVE-2025-38672

CVE-2025-38672 concerns a Linux kernel issue where the dma_buf field in struct drm_gem_object is not stable over a GEM object’s lifetime, leading to NULL-pointer dereference when the final GEM handle is released. The fix reverts the earlier change by reverting drm/gem-dma: Use dma_buf from GEM ob...

CVE-2025-38693

CVE-2025-38693 is a Linux kernel vulnerability affecting media: dvb-frontends, specifically w7090p tuner code. The issue is a NULL pointer dereference in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar when user-controlled msg[0].buf is null and msg[0].len is zero, allowing a crash if msg[...

CVE-2025-38736

Technical details about CVE-2025-38736 are not provided in the connected documents. The initial description notes a Linux kernel MDIO PHY address masking fix (mask with 0x1f) in net: usb: asix_devices to prevent OOB/invalid MDIO addresses. Connected advisories reference the CVE, but do not supply...