CVE-2026-53255

CVE-2026-53255 (Linux kernel) concerns a Bluetooth MGMT TLV parsing bug: tlv_data_is_valid() may read one byte past the advertising data when a malformed field’s length byte is at the buffer end, due to validating element length before verifying the type byte. This can enable local exploitation w...

CVE-2026-53270

The CVE-2026-53270 issue affects the Linux kernel IP Virtual Server (IPVS). During ip_vs_edit_service(), unbinding the old scheduler did not clear the svc->scheduler pointer early enough, so packets could reference freed sched_data after the RCU grace period. The documented fix clears the poin...

CVE-2026-53293

CVE-2026-53293 : In the Linux kernel’s AMDGPU driver, the AMDGPU_INFO_READ_MMR_REG path had multiple issues: an incorrect order between the reset semaphore and the mm_lock (e.g., copy_to_user was called while holding the lock), memory allocation while holding the reset semaphore (risking deadlock...

CVE-2026-53325

CVE-2026-53325 affects the Linux kernel’s AGP AMD64 driver. The root cause is broken error propagation in agp_amd64_probe(): when no AMD northbridges are found, cache_nbs() returns a negative error code (e.g., -ENODEV), but the probe incorrectly checks for exactly -1. This allows initialization t...

CVE-2026-53337

CVE-2026-53337 affects the Linux kernel bonding code. In bond_do_ioctl(), slave_dev is obtained via __dev_get_by_name() and may be NULL, yet slave_dbg(bond_dev, slave_dev, …) dereferences slave_dev->name before the NULL check, causing a NULL pointer dereference and a potential local DoS when a...

CVE-2026-53351

The CVE-2026-53351 entry concerns the Linux kernel, specifically the riscv/ptrace path where REGSET_CFI uses USER_REGSET_NOTE_TYPE. The vulnerability is described as a fix for a warning emitted during core dumps (elf_core_dump) and does not provide details on exploits or affected userland compone...

CVE-2026-63798

This CVE concerns the Linux kernel IRQ subsystem for the irqchip/imgpdc driver. The vulnerability arises because, during probe, the driver allocates domain generic chips and installs chained interrupt handlers, but on removal these resources may not be cleaned up: generic chips stay on the global...

CVE-2026-64050

CVE-2026-64050 affects the Linux kernel DRM MSM DPU teardown path. The vulnerability arises from mixing devm and drmm functions, which can cause a use-after-free when userspace holds a reference to the DRM device during driver teardown; WB connector data allocated with devm_kzalloc() may be destr...

CVE-2026-64098

CVE-2026-64098 affects the Linux kernel’s VirtIO GPU driver. The issue arises when virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() acquire the framebuffer dma_resv via virtio_gpu_array_lock_resv() and ignore the return value. The lock can fail (-EINTR or -ENOMEM), leaving the res...

CVE-2026-64160

CVE-2026-64160 involves a Linux kernel netfs issue where tearing could occur in remote_i_size and zero_point updates. The fix copies i_size_read() and i_size_write() and uses the same seqcount as i_size to prevent i_size_seqcount corruption, and requires netfslib and filesystems using it to hold ...

CVE-2026-64229

Summary: CVE-2026-64229 affects the Linux kernel on x86 with regard to TLB broadcast invalidation and PCID. The issue arises in the global ASID handling path when INVLPGB (invalidations) is used with a non-zero PCID while CR4.PCIDE is not set, which could trigger a #GP (general protection fault) ...

CVE-2026-64252

CVE-2026-64252 - Linux kernel MIPS XKPHYS console buffer truncation : In 64-bit configurations, the initial console output path could place the firmware’s buffer for printf() into the XKPHYS memory segment via the initial kernel thread, causing truncation to a 32-bit address when firmware runs, p...

CVE-2026-64275

CVE-2026-64275 affects the Linux kernel elan_i2c driver. The fault is division by zero when x_traces/y_traces are zero and an unsigned underflow in width calculation; patch adds non-zero checks and clamps width to >=0, with safe defaults (1) to ensure probe/sysfs nodes work and recovery firmwa...

CVE-2026-64362

CVE-2026-64362 is a use-after-free in the Linux kernel's HID lg-g15 driver. The driver allocates lg_g15_data via devm and schedules a work item from input report handlers, but had no remove callback to cancel pending work. When a supported keyboard (G15, G15 v2, or G510) is unplugged, devres free...

CVE-2026-64370

CVE-2026-64370 is a Linux kernel vulnerability in the posix-cpu-timers subsystem. In do_cpu_nanosleep(), the call to posix_cpu_timer_create() acquires a pid reference via get_pid() and stores it in timer.it.cpu.pid. When the subsequent posix_cpu_timer_set() call fails, the function returns withou...

CVE-2026-64381

CVE-2026-64381 is a memory leak in the Linux kernel SMB client (CIFS), specifically in receive_encrypted_standard(). The function allocates next_buffer before checking whether the number of compound PDUs has reached MAX_COMPOUND. When that check fails, the function returns immediately without ass...

CVE-2026-64395

Summary: CVE-2026-64395 in the Linux kernel ksmbd exposes information disclosure via FSCTL_DUPLICATE_EXTENTS_TO_FILE. The source file is passed directly to vfs_clone_file_range() / vfs_copy_file_range() without checking the SMB access mask, enabling a handle opened with attribute access to copy c...

CVE-2026-64421

CVE-2026-64421 is a use-after-free in the Linux kernel's imx8_isi driver (NXP i.MX8 Image Sensor Interface). During module removal (rmmod), mxc_isi_remove() called mxc_isi_crossbar_cleanup() before mxc_isi_v4l2_cleanup(), freeing media entity pads while the subsequent V4L2 cleanup still attempted...

CVE-2026-64428

CVE-2026-64428 affects the SCH GPIO controller (gpio:sch) in the Linux kernel. The root cause is that sch_irq_unmask() acquires sch->lock via spin_lock_irqsave(), which on PREEMPT_RT becomes a sleeping lock. This lock is reached from irq_startup(), a non-sleepable context, triggering a "sleepi...

CVE-2016-8403

CVE-2016-8403 describes an information-disclosure vulnerability in Android’s kernel components, including the ION subsystem, Binder, USB driver, and networking subsystem. The issue could allow a local malicious application to access data outside its permission levels, with confidentiality impact ...

CVE-2016-8415

CVE-2016-8415 describes an elevation-of-privilege flaw in the Qualcomm Wi‑Fi driver that lets a local malicious app execute code in the kernel context. Affected software is Android with kernel versions 3.10 and 3.18; exploitation requires compromising a privileged process. The issue is categorize...

CVE-2022-50064

CVE-2022-50064 involves a use-after-free in the Linux kernel’s virtio-blk path. The issue arises because hctx->user_data is assigned to vq in virtblk_init_hctx(), but vq is freed during suspend and reallocated on resume, making hctx->user_data invalid after resume and capable of causing a k...

CVE-2022-50243

CVE-2022-50243 – Linux kernel SCTP use-after-free (summary from connected advisories) The vulnerability arises in SCTP when an error is returned from sctp_auth_asoc_init_active_key(): the old sh_key could be freed while still in use as the active key, leading to a use-after-free during packet sen...

CVE-2022-50258

CVE-2022-50258 – Linux kernel wifi/brcmfmac stack-out-of-bounds fix The vulnerability is in brcmfmac when handling a non‑null‑terminated firmware version string passed to strsep() via brcmf_c_preinit_dcmds(). The code path writes the firmware version into a buffer via memcpy() and previously coul...

CVE-2022-50265

CVE-2022-50265 pertains to the Linux kernel and concerns data races in the kernel crypto/messaging flow involving kcm->rx_wait and kcm->rx_psock. The description states that kcm->rx_psock can be read locklessly in kcm_rfree(), and the issue was mitigated by annotating the corresponding r...

CVE-2022-50357

CVE-2022-50357 concerns the Linux kernel’s USB dwc3 core. The vulnerability arises in the dwc3_get_properties() path where the code does: dwc->usb_psy = power_supply_get_by_name(usb_psy_name); and, on error, there is insufficient cleanup on those paths, allowing leaks. Several connected adviso...

CVE-2022-50374

CVE-2022-50374 affects the Linux kernel Bluetooth stack (hci_ldisc/hci_serdev). The issue is a missing handling of percpu_init_rwsem() failure, leading to a NULL pointer dereference in hci_uart_tty_close() because rcu_sync_enter() can be called without rcu_sync_init() after hci_uart_tty_open() ig...

CVE-2023-53229

The CVE-2023-53229 entry relates to the Linux kernel wifi/mac80211 subsystem. It fixes invalid calls to drv_sta_pre_rcu_remove for non-uploaded stations, addressing potential data corruption from uninitialized driver private data. The public description confirms the vulnerability in the mac80211 ...

CVE-2023-53315

CVE-2023-53315 pertains to the Linux kernel WiFi driver ath11k, where a long-running traffic load could receive an RX descriptor with value 0 in the REO destination ring. This invalid descriptor could cause the IDR lookup to fetch the wrong SKB (SKB indexed by buffer id 0), leading to SKB memory ...

CVE-2023-53349

CVE-2023-53349 concerns the Linux kernel media driver ov2740. The vulnerability stems from a memleak in ov2740_init_controls() where resources allocated in the failure path are not fully freed, causing a kmemleak when testing media/i2c/ov2740.c with a BPF mock device. The advisory notes an unrefe...

CVE-2023-53382

Concrete CVE-2023-53382 relates to the Linux kernel net/smc CLC handshake. When a server tries SMCRv2 first and then falls back to SMCRv1 due to buffer/RMB registration failures, resource cleanup gaps can leave conn->lnk set to the SMCRv2 link and conn->lgr/conn->lnk mixed, causing smc_c...

CVE-2023-53389

CVE-2023-53389 affects the Linux kernel’s MediaTek DisplayPort bridge (drm/mediatek) where HPD IRQs could fire before the bridge is attached to a DRM device. This could cause a NULL pointer dereference in drm_helper_hpd_irq_event() due to an invalid drm_device being passed. The published fix: ver...

CVE-2023-53394

CVE-2023-53394 affects the Linux kernel mlx5e driver (net/mlx5e) related to the xsk/regular rq path. The issue occurs when reactivating the regular receive queue after an XSK socket is closed, potentially reading stale cqes and corrupting the rq, which can halt traffic and cause a crash on subseq...

CVE-2023-53433

CVE-2023-53433 affects the Linux kernel’s VLAN handling. The issue arises from the change to add a new helper, vlan_get_protocol_and_depth(), to fix callers that relied on skb->head for MAC header data. Before the fix, code paths used pskb_may_pull() instead of skb_header_pointer() in __vlan_g...

CVE-2023-53530

CVE-2023-53530 details a Linux kernel issue in the qla2xxx SCSI driver: code path using smp_processor_id() in preemptible work leads to a bug trace. The patch replaces smp_processor_id() with raw_smp_processor_id() and updates driver scheduling to queue_work() (instead of queue_work_on()) to avoi...

CVE-2023-53577

CVE-2023-53577 affects the Linux kernel in the bpf/cpumap path: the kthread responsible for per-CPU map updates may be stopped prematurely, leading to a warning when XDP frames/skbs remain queued in ptr_ring. The root cause is tied to the prior memory-leak fix in cpu_map_update_elem and the kthre...

CVE-2023-53631

CVE-2023-53631 — In Linux kernel, platform/x86 dell-sysman reference leak: if kset_find_obj() finds a duplicate attribute, a reference to that attribute can be returned and may not be disposed, potentially leaking references. Patch note: use kobject_put() to dispose the duplicate attribute. Affec...

CVE-2023-53642

The CVE-2023-53642 entry relates to the Linux kernel (x86) where the clear_user_rep_good() exception handling annotation was fixed. The issue stemmed from an incorrect exception-table annotation that pointed to the wrong instruction, which could turn a user-space fault into a kernel oops rather t...

CVE-2025-38492

In CVE-2025-38492, the Linux kernel netfs subsystem exposes a race between cache write completion and NETFS_RREQ_ALL_QUEUED being set. When netfslib spawns subrequests (e.g., copy2cache used by Ceph) that finish asynchronously, the collector can be blocked if ALL_QUEUED is set after subrequests a...

CVE-2025-38596

The CVE-2025-38596 entry concerns a Linux kernel UAF in the panthor_gem_create_with_handle() debugfs path. The issue stems from handling drm_gem_object life cycle where an object could be considered initialized or added to debugfs after it was potentially released via drm_gem_object_put(). The fi...

CVE-2025-38598

CVE-2025-38598 : Affected component is the Linux kernel amdgpudriver (AMDGPU) code; the issue is a use-after-free in amdgpu_userq_suspend (addressing a slab-use-after-free). The vulnerability is reported with a read of size 8 during pci_unplug/remove flow, as part of a KASAN report. The entry ind...

CVE-2025-38694

In CVE-2025-38694, the Linux kernel media/dvb-frontends: dib7090p driver could dereference a null pointer in dib7090p_rw_on_apb() when msg[0].buf or msg[1].buf lengths are zero or null, because checks on buf were bypassed if buf was null and len was zero. The fix adds sanity checks on msg[0].len ...

CVE-2025-38729

CVE-2025-38729 relates to the Linux kernel ALSA USB-audio driver and a validation issue with UAC3 power domain descriptors. The root cause is insufficient verification of the descriptor length (bLength), which could allow out-of-bounds accesses via malicious firmware. The vulnerability affects th...

CVE-2025-39676

CVE-2025-39676 affects the Linux kernel in the SCSI qla4xxx path. The issue arises because qla4xxx_ep_connect() can return error pointers, while qla4xxx_get_ep_fwdb() is expected to return NULL on error; propagating error pointers leads to an Oops in the caller. The fix changes error pointers to ...

CVE-2025-39687

CVE-2025-39687 affects the Linux kernel subsystem for the iio: light driver, specifically the as73211 component. The root cause described is that buffer holes were not zeroed when the buffer was copied into a kfifo that user space can read. The documented remediation in the initial description is...

CVE-2025-39689

CVE-2025-39689 affects the Linux kernel’s ftrace filter handling. The issue arose because readers (set_ftrace_filter/set_ftrace_notrace) kept a pointer to the global tracer hash, unlike writers who copy the hash. The pointer could remain static across calls that release locks and update the globa...

CVE-2025-39710

CVE-2025-39710: In the Linux kernel, the Venus media driver adds a packet-size validation after reading the header from shared memory to ensure the reported size cannot exceed the number of available words. This fixes potential out-of-bounds memory accesses by firmware-provided sizes. The fix tar...

CVE-2025-39738

CVE-2025-39738 affects the Linux kernel (btrfs) and is triggered during relocation of partially dropped subvolumes. The root cause is a missing orphan item for a subvolume, causing a delayed-ref transaction abort when relocating, with an offender inside a dropped subvolume. Upstream fixes exist (...

CVE-2025-39763

CVE-2025-39763 affects the Linux kernel and describes an ACPI: APEI path where a synchronous memory error that is not recovered can cause the kernel to queue memory_failure() and poison a page, unmap it, and send SIGBUS to the triggering process to avoid a system-wide panic. The issue arises when...

CVE-2025-39773

CVE-2025-39773 refers to a Linux kernel issue in the bridge/net subsystem where setting multicast_query_interval to a large value can cause a local time overflow in br_multicast_send_query(), making the timer expire immediately and re-arm in a loop, potentially triggering a soft lockup (as shown ...