CVE-2026-23290

CVE-2026-23290 affects the Linux kernel’s USB pegasus driver: it validates endpoints before bind, preventing binding if the device lacks expected URBs. Exploitation is LOCAL with LOW PRV requirement; impact is a potential crash/denial due to access to endpoints. The issue has been fixed upstream ...

CVE-2026-31610

CVE-2026-31610 affects ksmbd in the Linux kernel. The issue is a memory-leak in the SPNEGO decode path: during ksmbd_decode_negTokenInit, the code allocates conn->mechToken and may fail parsing later elements, leaving the previously allocated token. If the continuation path marks use_spnego fa...

CVE-2026-45968

The CVE-2026-45968 issue is in the Linux kernel cpuidle: when only a single idle state is available (e.g., certain PowerNV platforms), the ladder governor can select an out-of-bounds state. The fix adds a bail-out in cpuidle_select() to return state 0 directly when state_count <= 1, bypassing ...

CVE-2026-23130

CVE-2026-23130 pertains to the Linux kernel’s ath12k wireless driver and describes a deadlock in flushing management frames. The issue arises after a commit converted the management transmission work item into a wiphy work, which must run under wiphy lock protection; if a management frame is queu...

CVE-2026-23131

CVE-2026-23131 : In the Linux kernel, hp-bioscfg registers kobjects for attributes read from WMI. If the HP BIOS returns attributes with empty names, the registration can trigger kobject warnings and parsing may fail. The fix adds validation in hp_init_bios_buffer_attribute() to skip registration...

CVE-2026-23140

CVE-2026-23140 is a Linux kernel vulnerability resolved in kernel patches related to BPF/XDP handling. The issue arises in bpf_test_run where the metadata size isn’t constrained by the actual xdp_frame headroom, allowing a userspace-supplied metadata size that can exhaust headroom. In live packet...

CVE-2026-23146

Technical details for CVE-2026-23146 are not provided in the supplied connected documents; the materials only reference the vulnerability as part of Ubuntu/Mageia/Oracle advisories. Monitor for updates.

CVE-2026-23150

Technical details about CVE-2026-23150 are not publicly provided in the supplied documents. The description mentions a memory leak fix in NFC LLCP, but no vendor/product/version specifics or remediation steps are included here. Monitor for updates.

CVE-2026-23185

In the Linux kernel vulnerability CVE-2026-23185, the issue is in the wifi: iwlwifi: mld: cancel mlo_scan_start_wk. The work mlo_scan_start_wk is not canceled on disconnection and is not canceled elsewhere except in restart cleanup. This can cause an init-after-queue issue if the work was queued ...

CVE-2026-23190

Mode C: CVE-2026-23190 affects the Linux kernel ASoC/amd driver; the issue is a memory leak in acp3x PDM DMA ops. Public advisories (Mageia, SUSE/OpenSUSE, Oracle Linux, Debian) confirm upstream fix in kernel. Remediation is applying the upstream patch (memory leak in acp3x pdm dma ops) or upgrad...

CVE-2026-23217

CVE-2026-23217 relates to the Linux kernel on RISC-V where tracing the sbi_ecall functions can cause a deadlock in the snapshot path. The root cause is that sbi_ecall triggers a ringbuffer snapshot which may re-enter __sbi_ecall via an IPI, creating an endless loop when initial __sbi_ecall is pre...

CVE-2026-23218

CVE-2026-23218 affects the Linux kernel (loongson-64bit GPIO). The root cause is an incorrect NULL check in loongson_gpio_init_irqchip() after devm_kcalloc(), where chip->parent was checked instead of chip->irq.parents. This mischeck can lead to a NULL dereference during IRQ chip init. The ...

CVE-2026-23321

CVE-2026-23321 relates to the Linux kernel MPTCP subsystem (mptcp: pm: in-kernel: always mark signal+subflow endp as used). The vulnerability was addressed in the upstream kernel by patching endp handling in the PM code, reducing warning/usage inconsistencies when signaling ADD_ADDRs and subflows...

CVE-2026-23326

The CVE-2026-23326 issue is a Linux kernel XSK fragment handling flaw that caused a buffer leak. After commit b692bf9a..., the xskb_list_node reuse between the xskb pool list and the buffer free list meant xp_free() could skip adding a freed buffer to the free list because list_del() did not rein...

CVE-2026-23422

CVE-2026-23422 concerns the Linux kernel’s dpaa2-switch component. An out-of-bounds if_id detected in the IRQ handler could leave the interrupt status uncleared, potentially causing an interrupt storm and a DoS-like condition. The technical details in connected documents show the root cause as mi...

CVE-2026-23438

In the Linux kernel mvpp2 driver, CVE-2026-23438 arises from an unconditional access to CM3 flow control via mvpp2_cm3_read()/mvpp2_cm3_write() in mvpp2_bm_switch_buffers(), when priv->cm3_base is NULL (e.g., CM3 SRAM not present in device tree). This can crash the kernel on MTU changes that c...

CVE-2026-31394

CVE-2026-31394 concerns the Linux kernel mac80211 path where AP_VLAN (4addr) stations can trigger a NULL pointer dereference in __ieee80211_sta_cap_rx_bw() due to sta->sdata pointing to VLAN sdata, which may not participate in chanctx reservations. The root cause is that link->reserved.oper...

CVE-2026-31435

Summary: CVE-2026-31435 affects the Linux kernel netfs read-abandonment path during retries. The root cause is an uninitialized/invalid subreq pointer used in the abandonment flow, which can lead to abandoning remaining subrequests incorrectly and may cause a kernel oops/DoS. Several connected ad...

CVE-2026-31451

CVE-2026-31451: In the Linux kernel ext4_read_inline_folio, BUG_ON was replaced with proper error handling when inline data size exceeds PAGE_SIZE. The fix prevents kernel panics, logs the filesystem corruption via ext4_error_inode(), releases the buffer head to avoid leaks, and returns -EFSCORRU...

CVE-2026-31473

The CVE-2026-31473 affects the Linux kernel media subsystems (mc, v4l2). A race can occur when MEDIA_REQUEST_IOC_REINIT runs concurrently with VIDIOC_REQBUFS queue teardown, risking use-after-free of request objects. The root cause is lack of serialization across these paths; it is addressed by e...

CVE-2026-31480

CVE-2026-31480 concerns a Linux kernel deadlock in CPU hotplug when tracing with osnoise. The vulnerability arises from a lock-ordering issue: a mutex_lock on interface_lock is taken while osnoise_sleep() and subsequent actions hold cpu hotplug state, followed by cpus_read_lock(), which can cause...

CVE-2026-31489

This CVE (CVE-2026-31489) affects the Linux kernel meson-spicc SPI controller driver. The vulnerability arises from a double-put: meson_spicc_probe() registers the controller with devm_spi_register_controller(), and the removal path erroneously calls spi_controller_put() again in meson_spicc_remo...

CVE-2026-31527

The CVE-2026-31527 issue affects the Linux kernel’s driver core platform path, where during __driver_attach() the bus match() callback could access the driver_override field without proper locking, causing a Use-After-Free. Root cause: lack of locking around driver_override in match(); fix implem...

CVE-2026-31540

CVE-2026-31540 affects the Linux kernel i915 graphics driver. The vulnerability occurs when the i915 firmware binaries are absent and the set_default_submission pointer is not initialized, which can be dereferenced during suspend, causing a kernel NULL pointer dereference and a potential DoS. The...

CVE-2026-31595

CVE-2026-31595 affects the Linux kernel PCI endpoint driver for the vntb (pci-epf-vntb) where the cleanup path epf_ntb_epc_cleanup does not disable the delayed work before clearing BAR mappings and doorbells. The referenced details describe that if the delayed work isn’t disabled, the cmd_handler...

CVE-2026-31628

CVE-2026-31628 concerns the Linux kernel on Zen1 CPUs, where the x86/CPU FPDSS issue could allow a local attacker to leak partial results from prior operations via the hardware divider. Patches fix the vulnerability by applying a kernel change (the “chicken bit”) to prevent leakage. Connected adv...

CVE-2026-31704

CVE-2026-31704 affects the Linux kernel’s ksmbd ACL handling. The vulnerability arises when accumulating ACL entry sizes uses 16-bit counters (u16) in set_posix_acl_entries_dacl() and set_ntacl_dacl(), allowing wraparound past 65535 and causing pointer arithmetic on pndace to land within already-...

CVE-2026-31711

CVE-2026-31711 concerns the Linux kernel ksmbd server where a leak of active_num_conn occurs during transport allocation failure. The issue lets an unauthenticated remote attacker exacerbate memory pressure by holding connections with large RFC1002 lengths, causing the max_connections pool to be ...

CVE-2026-43021

CVE-2026-43021 affects the Linux kernel Bluetooth hci_sync path. A failure in hci_cmd_sync_queue_once() can skip calling the destroy callback, causing leaks of references/memory. The issue manifests during error paths, potentially leaving resources allocated for the hci_sync queue. Public discuss...

CVE-2026-43025

CVE-2026-43025 affects the Linux kernel netfilter component. A local attacker can trigger a slab-out-of-bounds read when creating new expectations by supplying a non-master conntrack helper, potentially enabling information disclosure from kernel memory. The issue is described across multiple sou...

CVE-2026-43052

CVE-2026-43052 fixes a Linux kernel mac80211 TDLS handling flaw: NL80211_TDLS_ENABLE_LINK could run TDLS-side effects on non‑TDLS peers. A kernel patch adds an early sta->sta.tdls check to ensure only true TDLS peers proceed, preventing unintended channel HT-protection changes. Remediation is ...

CVE-2026-43133

Summary: CVE-2026-43133 affects Linux kernel KVM’s nested virtualization (nSVM). When an L2 guest executes VMSAVE/VMLOAD and is not intercepted by L1, KVM may incorrectly use vmcb02 instead of vmcb01 for guest state handling due to an oversight in VMLOAD/VMSAVE emulation after a patch. The root c...

CVE-2026-43156

The CVE-2026-43156 entry affects the Linux kernel USB Pegasus driver. The root cause is that pegasus_probe() built URBs using hardcoded endpoint pipes (RX bulk 1, TX bulk 2, status interrupt 3) without validating endpoint descriptors, allowing a malformed USB device to present endpoints with mism...

CVE-2026-43197

CVE-2026-43197 concerns a Linux kernel netconsole vulnerability where messages from the console subsystem could be read out-of-bounds due to missing null-termination. The root cause is a netconsole write path that could access memory beyond the allocated buffer, observable as a slab-out-of-bounds...

CVE-2026-43258

CVE-2026-43258 concerns the Linux kernel: on Alpha systems, memory compaction can trigger user-space crashes and heap corruption due to insufficient TLB shootdown during page migration. Root cause involves ASN rollover and stale instruction translations surviving migration. The fix introduces a m...

CVE-2026-43299

Consolidated details show CVE-2026-43299 affects the Linux kernel btrfs filesystem. When ENOSPC can cause the filesystem to flip to read‑only in a critical path, a pending read repair may trigger an assertion failure inside btrfs_repair_io_failure(), leading to a kernel crash. The issue is docume...

CVE-2026-43306

CVE-2026-43306 affects the Linux kernel due to bpf: crypto: Use the correct destructor kfunc type. With CONFIG_CFI enabled, indirect calls must match the target function’s pointer type. In the reported case, a CFI failure occurred at bpf_obj_free_fields while freeing a BPF crypto context, signali...

CVE-2026-43308

CVE-2026-43308 affects the Linux kernel’s Btrfs code path, where an unexpected delayed ref type could previously trigger a BUG() in run_one_delayed_ref(). The issue could enable a local attacker to induce a system crash/DoS by triggering the faulty delay path. The advisory notes that the code can...

CVE-2026-43354

CVE-2026-43354 affects the Linux kernel hx9023s proximity sensor driver (iio). The root cause is a division-by-zero in set_samp_freq when the sampling frequency is unspecified. The vulnerability was addressed by a fix in the kernel to protect against this division by zero. Multiple vendor advisor...

CVE-2026-43358

CVE-2026-43358 affects the Linux kernel's btrfs filesystem. The vulnerability is a missing RCU unlock in the error path of try_release_subpage_extent_buffer(), where rcu_read_lock() should be held before exiting the loop because an rcu_read_unlock() occurs past the loop. The issue was identified ...

CVE-2026-43443

CVE-2026-43443 involves the Linux kernel ASoC AMD ACP Mach common driver. The acp_card_rt5682_init() and acp_card_rt5682s_init() functions did not validate clk_get() returns, risking dereferencing invalid pointers and kernel crash. The patch changes clock acquisition to devm_clk_get() and adds IS...

CVE-2026-43453

CVE-2026-43453 is a Linux kernel issue in the netfilter nft_set_pipapo path. The bug is a stack out-of-bounds read in pipapo_drop(), where rulemap[i+1].n is passed to pipapo_unmap() on every iteration, including the last when i == m->field_count-1. This reads past the end of the stack-allocate...

CVE-2026-43472

The CVE describes a Linux kernel unshare(2) bug: when CLONE_NEWNS is requested and current->fs wasn’t previously shared, copy_mnt_ns() could receive a non-private fs_struct. If copy_mnt_ns() succeeds but a subsequent copy_cgroup_ns() fails, the destroyed namespace can leave current->fs->...

CVE-2026-43479

CVE-2026-43479 concerns the Linux kernel’s lan78xx USB Ethernet driver. The issue is a WARN triggered during USB device disconnect in __netif_napi_del_locked when NAPI is still enabled, caused by an unnecessary netif_napi_del() call in the disconnect path. The provided documents consistently stat...

CVE-2026-43485

CVE-2026-43485 is a Linux kernel issue where WARN_ON checks in the nouveau/gsp ACPI probe were dropped to avoid noisy warnings. The advisory notes this is likely harmless and does not describe a functional vulnerability. Multiple OSV entries indicate patches and available fixed versions in rootio...

CVE-2026-45849

The CVE-2026-45849 issue affects the Linux kernel’s mscc: ocelot network driver. The vulnerability occurred because ocelot_port_xmit_inj() invoked ocelot_can_inject() and ocelot_port_inject_frame() without holding the injection group lock, despite lockdep_assert_held() checks in those functions. ...

CVE-2026-45851

CVE-2026-45851 targets the Linux kernel EFI subsystem. The vulnerability arises in the reserve_unaccepted() memblock reservation: it aligns the table size but does not account for cases where the table’s start (efi.unaccepted) is not page-aligned. If the table begins mid-page and ends across the ...

CVE-2026-45870

CVE-2026-45870 affects the Linux kernel’s SUNRPC auth_gss path. The issue is memory leaks in XDR decoding error paths caused by gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() allocating buffers via gssx_dec_buffer()/kmemdup() and returning on error without freeing previously allocated mem...

CVE-2026-45876

CVE-2026-45876 affects the Linux kernel (arm64 architecture) in the arch_set_shadow_stack_status flow. The bug arises from error handling in alloc_gcs(), which can return an error-encoded pointer from do_mmap() instead of NULL. A NULL-based check fails to detect these errors, risking use of an in...

CVE-2026-45976

Summary: CVE-2026-45976 affects the Linux kernel’s drm/amdgpu driver, where amdgpu_nbio_ras_sw_init() failing inside amdgpu_ras_init() could leak memory because the allocated con structure wasn’t freed. The fix makes the function jump to release_con to properly clean up before returning the error...