CVE-2025-39725

CVE-2025-39725 affects the Linux kernel, specifically the hwpoison handling path in mm/vmscan shrink_folio_list. The issue occurs when a hwpoisoned large folio (THP) cannot be mapped/unmapped properly; without TTU_SPLIT_HUGE_PMD, a null-ptr dereference can occur in pvmw.pte, and even with the fla...

CVE-2025-39742

CVE-2025-39742 - RDMA: hfi1 divide-by-zero in find_hw_thread_mask() (Linux kernel) Affects: Linux kernel RDMA hfi1 path; vulnerability arises from dividing the number of online CPUs by num_core_siblings, followed by a zero-division check. Root cause: division performed before validating the divis...

CVE-2025-39792

Technical details for CVE-2025-39792 are not provided in the connected documents. Open updates may appear; monitor SUSE/openSUSE advisories and vendor bulletins for affected products, impact, and fixes.

CVE-2025-39831

The CVE-2025-39831 entry describes a Linux kernel issue in the fbnic driver where phylink resume was invoked under an RTNL locking condition during PM resume, causing a locking assertion in phylink.c and a kernel warning. The root cause is moving phylink resume out of the service_task and into op...

CVE-2025-39834

CVE-2025-39834 : In the Linux kernel, a memory leak occurs in the mlx5 HWS path under the error flow of hws_action_get_shared_stc_nic when an invalid stc_type is provided. The function allocates memory for shared_stc but jumps to unlock_and_out without freeing it, causing a leak. The patch fixes ...

CVE-2025-39836

CVE-2025-39836 is a Linux kernel issue described as resolved: the EFI stmm path allocated a communication buffer with kmalloc(), while the consumer expects contiguous pages, risking corruptions/BUGs. The fix switches from kmalloc() to alloc_pages_exact() in setup_mm_hdr() so buffers passed to tee...

CVE-2025-39907

Technical details about CVE-2025-39907 are not publicly provided in the supplied connected documents. Monitor for updates from vendors/security advisories; the initial description mentions a Linux kernel fix related to overlapping ECC buffer mappings in stm32_fmc2.

CVE-2025-39931

The CVE-2025-39931 issue affects the Linux kernel crypto/af_alg path. A bug in af_alg_sendmsg could leave ctx->merge with a garbage value after an error abort, risking a crash on the next entry into af_alg_sendmsg when a merge cannot be performed. The fix sets ctx->merge to zero near the st...

CVE-2025-39938

The CVE-2025-39938 issue is a NULL pointer dereference in ASoC/qcom: q6apm-lpass-dais when the source graph fails (e.g., ADSP/topology rejection). The bug can cause a crash during snd_soc_pcm_dai_prepare due to dai_data->graph[dai->id] being NULL. The Linux kernel has been updated to fix th...

CVE-2025-40251

CVE-2025-40251 affects the Linux kernel devlink rate code. The root cause was devl_rate_nodes_destroy not clearing devlink_rate->parent (only calling rate_leaf_parent_set/rate_node_parent_set and decrementing the parent’s refcount), leaving a dangling pointer. This could trigger refcount warni...

CVE-2025-71072

CVE-2025-71072 concerns a Linux kernel issue affecting shmem rename recovery when memory pressure causes MapleTree insertions to fail and simple_offset_rename/simple_offset_rename_exchange to not recover properly. The fix prevents post-success failures (e.g., after shmem_whiteout) by preinserting...

CVE-2025-71096

Summary (CVE-2025-71096) : The Linux kernel RDMA core netlink path handling RDMA_NL_LS_OP_IP_RESOLVE could return a DGID-less response, risking an uninitialized read on the stack. The fix ensures the LS_NLA_TYPE_DGID attribute is present, uses nla_parse_deprecated() to populate nlattrs, and then ...

CVE-2025-71111

CVE-2025-71111 (Linux kernel) : A TOCTOU race in hwmon w83791d caused by a macro, FAN_FROM_REG, evaluating arguments multiple times in lockless contexts, potentially triggering divide-by-zero. The fix converts the macro to a static function (arguments evaluated once, by-value). Additionally, stor...

CVE-2025-71185

CVE-2025-71185 concerns the Linux kernel DMA engine TI dma-crossbar, specifically a leak of a crossbar device reference during am335x route allocation. The description states the fix is to drop the reference taken when looking up the crossbar platform device during am335x route allocation, addres...

CVE-2026-22996

CVE-2026-22996 affects the Linux kernel mlx5e subsystems. The issue arises from storing the unstable mlx5e_priv in mlx5e_dev devlink priv, which could lead to a kernel NULL dereference during profile changes and an oops in mlx5e_remove. The fix stores netdev directly into mlx5e_dev and derives md...

CVE-2026-23017

CVE-2026-23017 affects the Linux kernel idpf driver. Root cause: if init_task fails during driver load, vports/netdevs are not created and a reset can crash while service/mailbox tasks run. Fix: in the init_task error path, disable service/mailbox tasks and stop PTP callbacks; ensures proper clea...

CVE-2026-23084

CVE-2026-23084 affects the Linux kernel be2net driver. The vulnerability arises when be_cmd_get_mac_from_list() is called with pmac_id_valid == false and pmac_id == NULL, which can cause a NULL pointer dereference. The fix, per the description, is to pass the address of a stub variable to the fun...

CVE-2026-23093

Summary (CVE-2026-23093) : In the Linux kernel, the ksmbd: smbd DMA unmapping path uses dma_unmap_sg() with a different number of entries than dma_map_sg(), which is the root cause of the vulnerability. The fix ensures dma_unmap_sg() is called with the same nents as dma_map_sg(). According to the...

CVE-2026-23107

CVE-2026-23107 describes a Linux kernel issue in arm64/fpsimd where restoring a ZA (Streaming/SME) context could leave sve_state NULL if allocated late, causing a NULL pointer dereference when the kernel stores register state if TIF_SME is set. The root cause is that restore_za_context() failed t...

CVE-2026-23113

CVE-2026-23113 affects the Linux kernel io-uring/io-wq component. The issue stems from not checking IO_WQ_BIT_EXIT in the io_worker_handle_work() loop, causing long exits when processing large pending reads (e.g., 2GB reads from /dev/msr* with >16MB per read). Evidence in the advisory shows th...

CVE-2026-23115

CVE-2026-23115 concerns the Linux kernel serial subsystem. The issue is a race where tty->port may not be linked before uart_configure_port is invoked, allowing user-space to open a console without a linked TTY and risking a crash. The fix notes that tty_port_link_device() is not redundant and...

CVE-2026-23119

The CVE-2026-23119 issue in the Linux kernel concerns the bonding driver where a net pointer was not always provided to __skb_flow_dissect() after plumb­ing the network namespace. The lack of a valid net pointer (via skb->dev, skb->sk, or a user pointer) allowed a syzbot-created bare skb to...

CVE-2026-23140

CVE-2026-23140 is a Linux kernel vulnerability resolved in kernel patches related to BPF/XDP handling. The issue arises in bpf_test_run where the metadata size isn’t constrained by the actual xdp_frame headroom, allowing a userspace-supplied metadata size that can exhaust headroom. In live packet...

CVE-2026-23142

CVE-2026-23142 affects the Linux kernel component mm/damon/sysfs-scheme. The root cause is in the cleanup path when a DAMOS-scheme DAMON sysfs directory setup fails after creating access_pattern/; subdirectories under access_pattern/ are not cleaned up, leaving the DAMON sysfs interface partially...

CVE-2026-23254

CVE-2026-23254 (Linux kernel): The issue affects UDP GRO in the net/ gro path, where the complete stage incorrectly uses the inner network offset when the encapsulation flag is not reliably zeroed by hardware offloads. The root cause is an assumption that all RX-inserted packets have encapsulatio...

CVE-2026-23318

CVE-2026-23318 affects the Linux kernel ALSA USB-audio UAC3 header validation. The validator table for UAC3 AC header descriptors used UAC_VERSION_2 instead of UAC_VERSION_3, so real UAC3 devices were not validated and could trigger out-of-bounds reads when the driver accesses unvalidated descrip...

CVE-2026-23417

CVE-2026-23417 affects the Linux kernel BPF component where PROBE_MEM32 immediate stores (BPF_ST|BPF_PROBE_MEM32) were not blinded by the JIT constant-blinding path. The root cause is that convert_ctx_accesses() rewrites BPF_ST|BPF_MEM to BPF_ST|BPF_PROBE_MEM32 during verification, but the blindi...

CVE-2026-31429

Summary (supported): CVE-2026-31429 affects the Linux kernel, specifically a KFENCE interaction that caused a cross-cache free of KFENCE-allocated skb heads. The root cause was that kfence_ksize() could return the exact allocation size, leading to skb_end_offset matching SKB_SMALL_HEAD_HEADROOM a...

CVE-2026-31594

The CVE-2026-31594 issue is in the Linux kernel PCI endpoint framework (pci-epf-vntb). The root cause is a duplicate resource teardown in epf_ntb_epc_destroy(), causing an oops/kernel crash when .allow_link fails or .drop_link runs. The documented fix removes the helper and drops pci_epc_put(), t...

CVE-2026-31597

The CVE-2026-31597 vulnerability affects the Linux kernel OCFS2 code. A use-after-free occurs in ocfs2_fault() when VM_FAULT_RETRY triggers after filemap_fault() drops mmap_lock, allowing a concurrent munmap() to free the vm_area_struct and causing ocfs2_fault() to dereference a dangling vma. The...

CVE-2026-31642

The CVE-2026-31642 entry concerns the Linux kernel rxrpc module, where a flaw in call removal was fixed by using list_del_rcu() instead of list_del_init() to prevent infinite loops when reading /proc/net/rxrpc/calls. The underlying issue is that improperly deleting calls could disrupt list handli...

CVE-2026-31648

Summary of CVE-2026-31648 (Linux kernel) • Affects the kernel vulnerability in filemap handling: nr_pages overflow in filemap_map_pages() can cause set_pte_range() to map beyond the size of a large folio, potentially corrupting page metadata. • Root cause (as documented): race condition between f...

CVE-2026-31686

CVE-2026-31686 concerns the Linux kernel kasan double-free in kasan_remove_zero_shadow related to kasan_free_pxd() handling of pxd_page() vs start of the pxd table on architectures like PowerPC with 64K pages. The issue arises when the PUD table is not page-aligned, risking double-free during mem...

CVE-2026-31701

In CVE-2026-31701, the Linux kernel ALSA caiaq driver (USB audio) stored a pointer to the parent usb_device without a reference. The snd_usb_caiaq_card_free() path can run after the USB device is disconnected, dereferencing freed memory (use-after-free). The fix is to take a reference on the USB ...

CVE-2026-31729

CVE-2026-31729 affects the Linux kernel USB Type-C Unified Connector and Switch Interface (UCSI) path. A malicious or malfunctioning USB‑C device can report an out‑of‑range connector number in the CCI, which is used to index ucsi_connector_change(); the underlying array is allocated for the devic...

CVE-2026-31762

CVE-2026-31762 affects the Linux kernel iio gyro mpu3050 driver. The root cause is an IRQ resource leak: during iio_trigger_register() failure, the interrupt handler is not properly released, leading to unreleased IRQ resources. The patch adds a cleanup goto to release the handler on error. Affec...

CVE-2026-43068

Linux kernel ext4: CVE-2026-43068 stems from a bug that could cause allocation of blocks from a corrupted block group, leading to repeated delayed block allocation failures and potential data loss. The issue arises in ext4_mb_find_by_goal() through ext4_mb_load_buddy and related bitmap checks, wh...

CVE-2026-43117

CVE-2026-43117 affects the Linux kernel’s btrfs tracepoints: when overlay is layered on btrfs, dentry->d_sb may reference the overlay superblock, causing a crash during fsid assignment. The root cause is deriving the wrong superblock for the event btrfs_sync_file(); the fix is to use file_inod...

CVE-2026-43212

The CVE-2026-43212 entries involve the Linux kernel on LoongArch where cpumask_of_node() failed to handle NUMA_NO_NODE, which is a valid index. The root cause is an insufficient check in the arch-specific cpumask_of_node() implementation, leading to potential instability or incorrect behavior if ...

CVE-2026-43220

The CVE-2026-43220 entry concerns the Linux kernel iommu/amd component. The issue arises under concurrent TLB invalidations when CMD_COMPL_WAIT sequencing can be broken because cmd_sem_val was incremented outside the IOMMU spinlock, causing out-of-sequence command queuing and a disrupted completi...

CVE-2026-43228

The CVE-2026-43228 entry concerns the Linux kernel hfs component where 64-bit CNID counts (next_id, folder_count, file_count) triggered kernel panics when MDB was corrupted. Root cause: BUG_ON-based overflow checks replaced by proper error handling. Impact: local DoS via kernel panic with a corru...

CVE-2026-43234

CVE-2026-43234 concerns the Linux kernel team driver. The issue arises when unregistering a slave from a team interface while a NETDEV_CHANGEMTU event is pending, potentially causing a deadlock/resource exhaustion and system unresponsiveness as shown by reproduction steps involving creating a tea...

CVE-2026-43250

CVE-2026-43250 affects the Linux kernel ChipIdea USB Device Controller (UDC) driver. The vulnerability arises when a USB device is reconnected during an active transfer, because _ep_nuke() returns requests without unmapping DMA buffers or cleaning bounce buffers, leaving stale DMA state (num_mapp...

CVE-2026-43270

The CVE-2026-43270 issue affects the Linux kernel media: mtk-mdp module. In mtk_mdp_probe(), vpu_get_plat_device() increases the platform device reference count and is not consistently released in mtk_mdp_remove(), creating a reference-leak vulnerability. Red Hat and Debian OS/tracking entries co...

CVE-2026-43327

CVE-2026-43327 affects the Linux kernel USB dummy-hcd code. The race involves usb_gadget_udc_reset() being invoked with a NULL second argument (driver) due to a race between USB reset and driver unbind, enabling a potential crash. The root cause was that stop_activity() could drop and re-acquire ...

CVE-2026-43489

The CVE-2026-43489 issue concerns the Linux kernel liveupdate code path for LUO files, specifically luo_file.retrieve_status. The bug arises because on a failed retrieve, luo_retrieve_file() returns an error without recording that a retrieve was attempted or its error code. This can cause an erro...

CVE-2026-45858

The CVE-2026-45858 entry concerns the Linux kernel ext4 behavior: when allocating initialized blocks from a large unwritten extent or splitting an unwritten extent during end I/O, a stale data issue could occur if a split happens in the middle. The published details explain that ext4_split_extent...

CVE-2026-45869

CVE-2026-45869 affects the Linux kernel wm97xx power supply driver. A race between request_irq() and power_supply_register() can cause a NULL pointer dereference in power_supply_changed() if an interrupt fires before the power_supply handle is registered. Fix: ensure the IRQ is requested after re...

CVE-2026-45871

CVE-2026-45871 affects the Linux kernel TPM subsystem (st33zp24 driver). A failure in get_burstcount() can return -EBUSY on timeout, causing st33zp24_send() to exit without releasing the previously acquired locality, risking resource exhaustion and local DoS by making the TPM device unavailable. ...

CVE-2026-45877

CVE-2026-45877 concerns the Linux kernel HID driver for Intel ISH. The issue is a NULL-pointer dereference in ishtp_bus_remove_all_clients during a warm reset when cl->device may be NULL while clients are enumerated, leading to a kernel panic. Multiple sources (NVD, Red Hat, SUSE, Debian/OSV, ...