CVE-2025-38629

Technical details about CVE-2025-38629 are not publicly available in the provided connected documents. The initial description mentions a NULL check in scarlett2, but no further technical specifics are provided. Monitor for updates.

CVE-2025-38654

CVE-2025-38654 concerns the Linux kernel pinctrl path for canaan k230. The vulnerability arises from the ordering of device-tree parsing and pinctrl registration, where device-tree parsing must complete before devm_pinctrl_register() is called to avoid using uninitialized pin resources. The provi...

CVE-2025-38672

CVE-2025-38672 concerns a Linux kernel issue where the dma_buf field in struct drm_gem_object is not stable over a GEM object’s lifetime, leading to NULL-pointer dereference when the final GEM handle is released. The fix reverts the earlier change by reverting drm/gem-dma: Use dma_buf from GEM ob...

CVE-2025-38693

CVE-2025-38693 is a Linux kernel vulnerability affecting media: dvb-frontends, specifically w7090p tuner code. The issue is a NULL pointer dereference in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar when user-controlled msg[0].buf is null and msg[0].len is zero, allowing a crash if msg[...

CVE-2025-38736

Technical details about CVE-2025-38736 are not provided in the connected documents. The initial description notes a Linux kernel MDIO PHY address masking fix (mask with 0x1f) in net: usb: asix_devices to prevent OOB/invalid MDIO addresses. Connected advisories reference the CVE, but do not supply...

CVE-2025-39692

CVE-2025-39692 is a Linux kernel vulnerability related to the SMB ksmbd path where ksmbd_rdma_stop_listening() must be called before stop_sessions() to avoid using the smb_direct_wq pointer after destroy. The issue arises when the order is not respected, allowing existing connections to reference...

CVE-2025-39737

CVE-2025-39737 corresponds to a Linux kernel kmemleak issue where soft lockups occurred during cleanup of a large kmemleak object set (e.g., ~40k objects). The provided Astra Linux bulletin notes the fix: in kmemleak_do_cleanup(), periodically call cond_resched() inside the cleanup loop to avoid ...

CVE-2025-39792

Technical details for CVE-2025-39792 are not provided in the connected documents. Open updates may appear; monitor SUSE/openSUSE advisories and vendor bulletins for affected products, impact, and fixes.

CVE-2025-39804

CVE-2025-39804 pertains to the Linux kernel (arm64) where lib/crypto/poly1305 could corrupt SIMD/general-purpose registers in no-SIMD contexts, potentially producing incorrect MACs. The fix restores a safety check to ensure Poly1305 calls do not rely on unusable SIMD state, using may_use_simd() i...

CVE-2025-39836

CVE-2025-39836 is a Linux kernel issue described as resolved: the EFI stmm path allocated a communication buffer with kmalloc(), while the consumer expects contiguous pages, risking corruptions/BUGs. The fix switches from kmalloc() to alloc_pages_exact() in setup_mm_hdr() so buffers passed to tee...

CVE-2025-39842

CVE-2025-39842 : In the Linux kernel, the ocfs2 path could dereference a NULL journal pointer when releasing an inode during journal shutdown. The root cause was calling jbd2_journal_release_jbd_inode() with osb->journal potentially NULL after ocfs2_journal_shutdown(). The fix is to add explic...

CVE-2025-39873

CVE-2025-39873 (Linux kernel) : The vulnerability concerns the xilinx_can driver where xcan_write_frame() may use a previously freed skb. The root cause is that can_put_echo_skb() can take ownership of the SKB, which may be freed during or after the call, while xcan_write_frame() continues to tou...

CVE-2025-39944

CVE-2025-39944 affects the Linux kernel OcteonTX2 PCI device driver (octeontx2-pf). It fixes a use-after-free in otx2_sync_tstamp() caused by a race with a running delayed work item; cancel_delayed_work() could leave synctstamp_work dereferencing a freed otx2_ptp. The mitigation in the fix is to ...

CVE-2025-39965

The CVE-2025-39965 vulnerability affects the Linux kernel XFRM stack: xfrm_alloc_spi may create states with SPI set to 0 (meaning “no SPI assigned”) due to the behavior change from commit 94f39804d891, and __xfrm_state_delete fails to remove those states from the byspi list. This leads to a use-a...

CVE-2025-71234

CVE-2025-71234: Linux kernel rtl8xxxu slab-out-of-bounds in rtl8xxxu_sta_add fixed by setting hw->sta_data_size to sizeof(struct rtl8xxxu_sta_info) during probe to correctly allocate per-station data. Issue caused mac80211 to access sta->drv_priv beyond allocated space; KASAN showed a slab-...

CVE-2026-22996

CVE-2026-22996 affects the Linux kernel mlx5e subsystems. The issue arises from storing the unstable mlx5e_priv in mlx5e_dev devlink priv, which could lead to a kernel NULL dereference during profile changes and an oops in mlx5e_remove. The fix stores netdev directly into mlx5e_dev and derives md...

CVE-2026-23000

CVE-2026-23000 concerns the Linux kernel mlx5e driver. The issue occurs when mlx5e_netdev_change_profile fails to attach a new profile and then cannot rollback to the old one, leaving a dangling netdev with a reset priv. A second change-profile attempt (e.g., via switchdev) can crash when derefer...

CVE-2026-23021

CVE-2026-23021 affects the Linux kernel component: net: usb: pegasus. The memory leak occurs in update_eth_regs_async() when usb_submit_urb() fails, failing to release resources allocated up to that point. Public advisories indicate upstream kernel fixes (e.g., 6.6.130 lineage and related patches...

CVE-2026-23061

Summary (CVE-2026-23061) : The Linux kernel CAN subsystem can: kvaser_usb_read_bulk_callback() leak URBs in kvaser_usb, leading to a memory leak. Root cause: the URBs for USB-in transfers are anchored to dev->rx_submitted when created and submitted, but the USB framework unanchors URBs before ...

CVE-2026-23084

CVE-2026-23084 affects the Linux kernel be2net driver. The vulnerability arises when be_cmd_get_mac_from_list() is called with pmac_id_valid == false and pmac_id == NULL, which can cause a NULL pointer dereference. The fix, per the description, is to pass the address of a stub variable to the fun...

CVE-2026-23093

Summary (CVE-2026-23093) : In the Linux kernel, the ksmbd: smbd DMA unmapping path uses dma_unmap_sg() with a different number of entries than dma_map_sg(), which is the root cause of the vulnerability. The fix ensures dma_unmap_sg() is called with the same nents as dma_map_sg(). According to the...

CVE-2026-23113

CVE-2026-23113 affects the Linux kernel io-uring/io-wq component. The issue stems from not checking IO_WQ_BIT_EXIT in the io_worker_handle_work() loop, causing long exits when processing large pending reads (e.g., 2GB reads from /dev/msr* with >16MB per read). Evidence in the advisory shows th...

CVE-2026-23165

CVE-2026-23165 affects the Linux kernel sfc (Solarflare) network driver. The issue is a deadlock when reading RSS config with ethtool -x because the driver locks the net_device rss_lock that is already held by the core; the fix is to remove the driver-side lock acquisition (deadlock avoidance). P...

CVE-2026-23169

CVE-2026-23169 is a Linux kernel vulnerability where a race in mptcp_pm_nl_flush_addrs_doit() could crash the kernel. Root cause: list_splice_init() is not RCURED and cannot be called while holding pernet->lock spinlock; list_splice_init_rcu() was misusefully invoked in that context. The issue...

CVE-2026-23170

CVE-2026-23170 affects the Linux kernel's DRM IMX TVE path; the root cause is a device reference leak to the DDC device during probe (including probe deferral) and on driver unbind. The trusted sources show the issue resolved in kernel updates, with Ubuntu/rootio-root packages (e.g., ROOT-OS-UBUN...

CVE-2026-23235

CVE-2026-23235 (Linux kernel, f2fs) is a local, in-kernel vulnerability where certain f2fs sysfs attributes permit out-of-bounds memory access and misinterpretation of integer sizes. The root causes are: __sbi_store() and f2fs_sbi_show() incorrectly treat all default values as unsigned int, causi...

CVE-2026-23239

CVE-2026-23239 concerns the Linux kernel espintcp subsystem. A race condition was introduced where, after cancel_work_sync() is called from espintcp_close(), espintcp_tx_work() could still be scheduled from paths like the Delayed ACK handler or ksoftirqd. This could allow the worker to dereferenc...

CVE-2026-23266

CVE-2026-23266 : In the Linux kernel fbdev rivafb driver, nv3_arb() can divide by state->mclk_khz (derived from PRAMDAC MCLK PLL) if an attacker exposes a zero value, causing a divide error and kernel crash. The fix adds a zero-check for state->mclk_khz before division. Affected: fbdev/riva...

CVE-2026-23359

CVE-2026-23359 stems from a Linux kernel bug in BPF devmap handling. get_upper_ifindexes() could write upper-device indices beyond the allocated stack, because the code assumed MAX_NEST_DEV (8) bounds, but the number of upper devices (e.g., many macvlan) could exceed that. The result is a stack-o...

CVE-2026-23450

CVE-2026-23450 (Linux kernel): The issue stems from a race in the SMC TCP path (net/smc) where, during close of an SMC listen socket, sk_user_data can be NULL or the smc_sock freed, causing a NULL dereference or use-after-free in smc_tcp_syn_recv_sock() when accessed under rcu/protected context. ...

CVE-2026-31416

CVE-2026-31416 (Linux kernel) : Affected component is netfilter nfnetlink_log. The issue is caused by not accounting for the netlink header size when processing NL messages, which can lead to a WARN splat and potential drop of the affected netlink message, with no other ill effects reported in th...

CVE-2026-31478

The CVE-2026-31478 issue affects ksmbd in the Linux kernel. The root cause is an incorrect calculation of the response buffer length in smb2_calc_max_out_buf_len(), where a hardcoded hdr2_len was used instead of the correct offset to the Buffer field. The security advisories describe that after a...

CVE-2026-31503

CVE-2026-31503 concerns a Linux kernel UDP hash2-based wildcard-bind conflict check that can miss an in-use port when many sockets bind to the same port. The issue arises because UDP uses two hashes (hash and hash2) for collision detection and switches to hash2 only when hslot->count > 10, ...

CVE-2026-31505

The CVE-2026-31505 issue affects the Linux kernel iavf driver: out-of-bounds writes occur because iavf_get_ethtool_stats() uses real_num_tx_queues for ETH_SS_STATS while other paths use num_tx_queues, enabling memory corruption when ethtool -L and ethtool -S run concurrently. The fix is to use im...

CVE-2026-31628

CVE-2026-31628 concerns the Linux kernel on Zen1 CPUs, where the x86/CPU FPDSS issue could allow a local attacker to leak partial results from prior operations via the hardware divider. Patches fix the vulnerability by applying a kernel change (the “chicken bit”) to prevent leakage. Connected adv...

CVE-2026-31699

Technical details about CVE-2026-31699 are not publicly available in the provided documents. Monitor for updates from OSV, Red Hat, SUSE, Debian and other trackers for affected products and fixes.

CVE-2026-31714

The CVE-2026-31714 issue affects the Linux kernel F2FS component, where a memory leak occurs in f2fs_rename() due to an unpaired call to f2fs_free_filename() after f2fs_setup_filename() was added in commit 40b2d55e0452. Exploitation details are local (AV:L/AC:L) with a high availability impact (A...

CVE-2026-43061

CVE-2026-43061 (Linux kernel): The serial8250 TX DMA deadlock was fixed. The root cause was that dmaengine_terminate_async did not guarantee the __dma_tx_complete callback would run, and that callback is the only place where dma->tx_running is cleared. If a TX DMA transaction is canceled and t...

CVE-2026-43113

In the Linux kernel, CVE-2026-43113 affects the wl1251 Wi‑Fi driver. The function wl1251_tx_packet_cb() uses the firmware completion ID (a raw u8) to index a fixed 16-entry wl->tx_frames[] array without validating that the ID fits. The callback can dereference out-of-range IDs. The fix rejects...

CVE-2026-43233

CVE-2026-43233 affects the Linux kernel nf_conntrack_h323 decoder (decode_choice), where a boundary check incorrectly used an uninitialized length and may read past the bitstream end, enabling a remote heap-buffer-overflow via a crafted Q.931 SETUP message to port 1720. The public disclosures des...

CVE-2026-43336

CVE-2026-43336 – linux kernel ChaCha secret handling : The vulnerability arises in lib/crypto: chacha where the permuted_state is not zeroized before leaving scope, allowing the original state (and thus the key) to be inferred after the permutation. The documented fix is to explicitly zeroize per...

CVE-2026-43349

The CVE-2026-43349 entry concerns the Linux kernel’s Flash-Friendly File System (f2fs). The issue arises when f2fs_finish_read_bio() may access uninitialized data in a folio if a read from the device fails, triggering an uninitialized-value access in f2fs_sanity_check_node_footer. The root cause,...

CVE-2026-43421

The CVE affects the Linux kernel USB gadget for Network Control Model (NCM) where a net_device could outlive its parent gadget during disconnection, causing dangling sysfs links and potential null dereference. The root cause was lifecycle mismanagement of net_device during USB bind/unbind, addres...

CVE-2026-45846

CVE-2026-45846 affects the Linux kernel bareudp code path. The vulnerability arises in bareudp_fill_metadata_dst(), which passes bareudp->sock to udp_tunnel6_dst_lookup() in the IPv6 path without a NULL check. If the bareudp device is down (socket not created or already NULLed in bareudp_stop)...

CVE-2026-45858

The CVE-2026-45858 entry concerns the Linux kernel ext4 behavior: when allocating initialized blocks from a large unwritten extent or splitting an unwritten extent during end I/O, a stale data issue could occur if a split happens in the middle. The published details explain that ext4_split_extent...

CVE-2026-45879

The CVE-2026-45879 entry describes a race condition in the Linux kernel power subsystem (bq25980) where a devm_ IRQ request and devm_ power_supply handle registration order can lead to use-after-free in power_supply_changed(), potentially triggering a crash or memory corruption. The root cause is...

CVE-2026-45951

The CVE-2026-45951 issue affects the Linux kernel BPF subsystem, caused by incorrect reference counting in check_pseudo_btf_id() that could cause a use-after-free of a BTF object. The mitigation is a kernel patch that fixes the refcount handling (and related code). RedHat notes potential privileg...

CVE-2026-45957

CVE-2026-45957 documents a Linux kernel RCU bug: missing recursion protection in rcu_read_unlock() can cause a deadloop when softirq handling runs under ftrace, as shown in the call stack involving raise_softirq_irqoff() and rcu_read_unlock_special(). The issue was fixed by commits that adjust ir...

CVE-2026-45962

The CVE affects the Linux kernel ublk driver, where ublk_ctrl_cmd_dump() could access (header *)sqe->cmd before checking IO_URING_F_SQE128, enabling out-of-bounds memory access. The mitigation is to check the SQE128 flag earlier in ublk_ctrl_uring_cmd() and return -EINVAL if not set. Several s...

CVE-2026-45973

CVE-2026-45973 affects the Linux kernel’s RDMA/mlx5 driver. A race during firmware reset in LAG mode could cause the driver to hang indefinitely while waiting for UMR completion on device unload, because the master/bond device would miss slave sys_error events. The fix adds a sys_error notifier r...