CVE-2025-71202

CVE-2025-71202 affects the Linux kernel IOMMU/SVA path (invalidating stale IOTLB entries in CPU kernel address space) and is mitigated by a patch that flushes IOTLB paging cache before freeing kernel page tables. Connected advisories confirm Debian RootOS patches (ROOT-OS-DEBIAN-13/12) with multi...

CVE-2025-71223

CVE-2025-71223 affects the Linux kernel's ksmbd SMB server path (smb2_open and ksmbd_vfs_getattr). The issue is a refcount leak when ksmbd_vfs_getattr() fails, potentially causing resource leakage and local impact. A kernel update fixing the refcount leak is provided by the referenced advisories ...

CVE-2025-71231

CVE-2025-71231 is addressed by a Linux kernel crypto: iaa fix that prevents an out-of-bounds index in find_empty_iaa_compression_mode and ensures a valid index or -EINVAL is returned. Connected OSV entries show Root patching the issue in rootio-linux for multiple distros (e.g., Root:Ubuntu 24.04,...

CVE-2025-71265

CVE-2025-71265 affects the Linux kernel ntfs3 attribute run parsing. A malformed NTFS image could trigger an infinite loop in attr_load_runs_range when an empty run list is claimed but data is expected, due to the code path leaving runs_tree uninitialized (runs NULL) after a successful return fro...

CVE-2026-22986

CVE-2026-22986 concerns a race in Linux kernel gpiolib where two drivers calling gpiochip_add_data_with_key() can concurrently traverse gpio_name_to_desc() while another adds gdev to the list, creating a window where gdev->srcu is dereferenced before it is initialized. The result is a crash (k...

CVE-2026-23016

The CVE concerns the Linux kernel’s conntrack/frag handling (inet: frags: drop fraglist conntrack references). A bug allows reassembled skb fragments to retain nf_conn references via frag_list, causing conntrack cleanup to block (hangs up to ~60s) when fragmentation/reassembly occurs (UDP/TCP pat...

CVE-2026-23131

CVE-2026-23131 : In the Linux kernel, hp-bioscfg registers kobjects for attributes read from WMI. If the HP BIOS returns attributes with empty names, the registration can trigger kobject warnings and parsing may fail. The fix adds validation in hp_init_bios_buffer_attribute() to skip registration...

CVE-2026-23143

CVE-2026-23143 affects the Linux kernel virtio_net driver. The root cause is a misalignment between struct virtio_net_rss_config_trailer and rss_hash_key_data in struct virtnet_info, causing the RSS key to be shifted by one byte (last byte truncated and an possibly uninitialized byte prepended). ...

CVE-2026-23196

CVE-2026-23196 affects the Linux kernel through the Intel THC HID driver, where a NULL pointer dereference can occur when reading a DMA buffer. The root cause is missing a DMA buffer readiness check before access, potentially crashing the kernel. Red Hat’s advisory explicitly cites this NULL dere...

CVE-2026-23362

CVE-2026-23362 affects the Linux kernel component can/bcm locking during bcm_op runtime updates (bcm_tx_setup/bcm_rx_setup). Connected OSV records show Root (rootio-linux) has patched this CVE in Root:Debian:11/12/13 with multiple fixed versions across Debian/Ubuntu and Mageia advisories, indicat...

CVE-2026-23363

The CVE-2026-23363 issue affects the Linux kernel wifi driver stack, specifically the mt7925 component of the mt76 driver. A missing frame-length check in mt7925_mac_write_txwi_80211() could allow out-of-bounds access to management fields, potentially impacting system stability. The vulnerability...

CVE-2026-23422

CVE-2026-23422 concerns the Linux kernel’s dpaa2-switch component. An out-of-bounds if_id detected in the IRQ handler could leave the interrupt status uncleared, potentially causing an interrupt storm and a DoS-like condition. The technical details in connected documents show the root cause as mi...

CVE-2026-23444

CVE-2026-23444 has been addressed in the Linux kernel by fixing skb ownership handling in wifi/mac80211. The patch adds kfree_skb() in the ieee80211_tx_prepare_skb() failure path to ensure all error paths free the skb, and removes redundant frees in callers (ath9k, mt76, mac80211_hwsim). The func...

CVE-2026-31426

Summary: CVE-2026-31426 concerns the Linux kernel ACPI EC handling. When ec_install_handlers() defers probing on reduced‑hardware platforms, the error path could leave a dangling EC space handler context if acpi_ec_setup() propagates the error, leading to use‑after‑free when AML accesses an OpReg...

CVE-2026-31466

CVE-2026-31466 affects the Linux kernel; root cause is a race in softleaf_to_folio() related to missing memory barrier (smp_rmb) when handling migration/compound pages, leading to potential incorrect folio modification. The issue was addressed by adding the missing memory barrier in softleaf_to_f...

CVE-2026-31536

The vulnerability CVE-2026-31536 affects the Linux kernel SMB direct server implementation. In smb: server: let send_done handle a completion without IB_SEND_SIGNALED, during smbdirect_send_batch processing requests may be processed without IB_SEND_SIGNALED and could be destroyed in the final req...

CVE-2026-31699

Technical details about CVE-2026-31699 are not publicly available in the provided documents. Monitor for updates from OSV, Red Hat, SUSE, Debian and other trackers for affected products and fixes.

CVE-2026-43056

Summary: CVE-2026-43056 affects the Linux kernel net: mana component. A use-after-free can occur in add_adev() when auxiliary_device_add() fails and control falls through to init_fail, accessing adev->id after the release callback frees the containing struct mana_adev. Root cause: the code fre...

CVE-2026-43093

CVE-2026-43093 is a Linux kernel issue in the xsk (AF_XDP) subsystem where headroom validation for UMEM was tightened in xdp_umem_reg(), addressing potential memory corruption of skb_shared_info and insufficient space for minimum-sized Ethernet frames. The fix accounts for 128-byte alignment as a...

CVE-2026-43113

In the Linux kernel, CVE-2026-43113 affects the wl1251 Wi‑Fi driver. The function wl1251_tx_packet_cb() uses the firmware completion ID (a raw u8) to index a fixed 16-entry wl->tx_frames[] array without validating that the ID fits. The callback can dereference out-of-range IDs. The fix rejects...

CVE-2026-43203

The CVE covers a Linux kernel fore200e ATM driver use-after-free during device removal (PCA-200E/SBA-200E). Vulnerability arises when tx_tasklet/rx_tasklet run or pending after fore200e is freed, risking access to freed memory. The published fixes synchronize tasklets with device shutdown by addi...

CVE-2026-43241

CVE-2026-43241 affects the Linux kernel component ntb_hw_switchtec. The root cause is an array-index-out-of-bounds access related to the number of MW LUTs (dependent on NTB configuration) which can access mw_sizes incorrectly. A patch was applied to guard against invalid index accesses and to pri...

CVE-2026-43249

The CVE-2026-43249 entry describes a race in the Linux kernel 9p/xen frontend: xenwatch and backend change notifications can concurrently call xen_9pfs_front_free, causing a double-free and a general protection fault. The fixes guard the teardown path so only a single caller releases the front-en...

CVE-2026-43265

CVE-2026-43265 affects the Linux kernel KVM for x86. The vulnerability arises when a vCPU is put into a blocking state with an already-injected event or nested run, allowing a user or guest to manipulate vCPU state and trigger a spurious userspace exit (often KVM_EXIT_UNKNOWN) that could crash th...

CVE-2026-43273

CVE-2026-43273 concerns the Linux kernel Ceph file system module, where ceph_zero_partial_object() lacked proper snapshot context for OSD write operations. This omission can cause data inconsistencies within snapshots, potentially affecting data integrity of previously snapshotted data. Affected ...

CVE-2026-43314

CVE-2026-43314 affects the Linux kernel device mapper (dm) driver. The issue arises when an I/O timeout failure is injected into a dm device; because dm does not implement its own timeout handler, the request can leak and hang indefinitely. The root cause is the presence of blk_should_fake_timeou...

CVE-2026-43315

CVE-2026-43315 involves the Linux kernel KVM nSVM warning path. Technical details across connected docs show that a user-triggerable WARN is raised in svm_set_nested_state() when nested_svm_load_cr3() succeeds, and the patch removes this WARN. The rationale is that userspace can easily trigger th...

CVE-2026-43365

The CVE-2026-43365 issue affects the Linux kernel XFS filesystem: if the superblock does not specify a log stripe unit, the in-core log roundoff may be set to 512 instead of 4096, leading to log corruption and potentially unmountable filesystems. Authors in connected reports describe the impact o...

CVE-2026-45855

The CVE-2026-45855 issue affects the Linux kernel’s libata-scsi component, where NCQ command traffic could starve non-NCQ commands in multi-queue hosts. Root cause: mixing NCQ and non-NCQ can delay non-NCQ execution when NCQ is in-flight. The fix implements forward progress for non-NCQ commands b...

CVE-2026-45887

CVE-2026-45887 affects the Linux kernel af_unix subsystem's unix_stream_connect() path. Root cause: if prepare_peercred() fails, unix_release_sock() is not called for the new socket (newsk), causing a memory leak. Impact: potential DoS or instability due to unreleased memory. Remediation: move pr...

CVE-2026-45929

In CVE-2026-45929, Linux kernel ovpn: fix possible use-after-free in ovpn_net_xmit. The vulnerability arises when skb_share_check frees the original skb during skb_list construction, but subsequent operations re-use a now-stale skb pointer (peer lookup, skb_dst_drop, and ovpn_peer_stats_increment...

CVE-2026-45932

CVE-2026-45932 – Linux kernel (bpf: Fix tcx/netkit detach permissions when prog fd isn’t given) The issue allows BPF_PROG_DETACH on tcx or netkit devices to be executed by any user when no program FD is provided, bypassing permission checks. A fix was added to require CAP_NET_ADMIN or CAP_SYS_ADM...

CVE-2026-45968

The CVE-2026-45968 issue is in the Linux kernel cpuidle: when only a single idle state is available (e.g., certain PowerNV platforms), the ladder governor can select an out-of-bounds state. The fix adds a bail-out in cpuidle_select() to return state 0 directly when state_count <= 1, bypassing ...

CVE-2026-46009

CVE-2026-46009 – Linux kernel PCIe endpoint ntb teardown issue (mode: normal) The vulnerability arises from epf_ntb_epc_destroy() performing duplicate resource teardown, causing an oops if .allow_link fails or .drop_link is used. The fix removes this helper and also drops pci_epc_put(), tying EPC...

CVE-2026-46010

CVE-2026-46010 affects the Linux kernel's rxrpc component. The root cause is missing error handling in rxgk_extract_token(): if rxgk_decrypt_skb() returns -ENOMEM, the function should return that error instead of proceeding, which can lead to an abort. Several advisories state the vulnerability c...

CVE-2026-46051

CVE-2026-46051 affects the Linux kernel's MD RAID5 path. The vulnerability arises when retry_aligned_read() encounters an overlapped stripe and releases it via raid5_release_stripe(), placing it on the released_stripes list. In a subsequent raid5d loop, release_stripe_list() drains the stripe ont...

CVE-2026-46055

CVE-2026-46055 affects the Linux kernel AppArmor LSM. The issue is a missing string terminator in aa_dfa_match, causing a slab-out-of-bounds read/write during path mounting on ARM64 Ubuntu 26.04 with Linux 7.0-rc4 (Snapdragon X1). Reported impact includes potential DoS or information disclosure. ...

CVE-2026-46076

The CVE-2026-46076 entry concerns the Linux kernel KVM nSVM, where an unhandled VMMCALL can produce an Undefined Opcode (#UD) when L2 is active, L1 does not intercept, nested_svm_l2_tlb_flush_enabled() is true, and the hypercall is not among the supported Hyper-V hypercalls. The vulnerability ari...

CVE-2026-46158

The CVE-2026-46158 issue is in the Linux kernel MPTCP implementation: when ADD_ADDR is retransmitted, the socket reference count may not be released reliably, creating a potential resource leak. The fix adds a proper exit path to call sock_put (__sock_put) at the end of the handling and removes a...

CVE-2026-46163

CVE-2026-46163 concerns the Linux kernel wifi subsystem (b43legacy) where a firmware-controlled key index in b43legacy_rx() could exceed dev->max_nr_keys, allowing an out-of-bounds read of dev->key[]. The fix makes the bounds check enforcing by dropping frames with invalid indices. Patches ...

CVE-2026-46165

CVE-2026-46165 affects the Linux kernel openvswitch vport code, where a self-deadlock could occur on tunnel port release due to improper ordering between RCU callbacks and RTNL/normally synchronized code paths. The root cause: vports are protected by RCU and must have netdev_put() after the RCU g...

CVE-2026-46171

The CVE-2026-46171 issue affects the Linux kernel KVM for RISCV, where a second kzalloc failure in kvm_riscv_vcpu_alloc_vector_context leaks the first allocation (guest_context.vector.datap). The root cause is a vector context allocation leak that can degrade system stability if not freed. A fix ...

CVE-2026-46229

The CVE-2026-46229 issue affects the Linux kernel’s DRM/AMDKFD path: KFD VRAM allocations could leave stale data because AMDGPU_GEM_CREATE_VRAM_CLEARED was not applied in the KFD code path, unlike the GEM/user paths which already set VRAM_CLEARED. This allowed stale page-table remnants to leak in...

CVE-2026-46236

CVE-2026-46236 affects the Linux kernel media: rc Xbox remote driver, where the IO buffer was placed in the device structure, violating DMA coherency rules. This is a local, low-complexity issue with high availability impact. Publicly documented fixes are present in OSV entries for Root: Debian 1...

CVE-2026-52907

The CVE-2026-52907 entry concerns the Linux kernel component media: rockchip: rkcif. The root cause is off-by-one errors in array handling, where comparisons were made with > instead of >=, risking reads beyond the end of arrays. The fix updates comparisons to use proper bounds checks and s...

CVE-2026-52925

CVE-2026-52925 : In the Linux kernel, a VRF port removal could lead to a NULL pointer dereference due to readers assuming a VRF master provides l3mdev operations. The fix adds RCU synchronization after clearing IFF_L3MDEV_SLAVE, and skips it when removing a device from a VRF during deletion or wh...

CVE-2026-53063

CVE-2026-53063 concerns the Linux kernel dm-cache passthrough path, where invalidate_remove() mishandled write hit bios after cache invalidation, causing write hangs. The fix adds an invalidate_committed() continuation to submit remapped writes after metadata commit and uses overwrite_endio for p...

CVE-2026-53087

Summary: CVE-2026-53087 affects the Linux kernel bcmgenet network driver. When reclaiming the transmit queue, the driver advances the write pointer to drop in-flight data but fails to return the dropped frames to the pool of free buffer descriptors (bds), causing a resource leak. This can lead to...

CVE-2026-53125

CVE-2026-53125 affects the Linux kernel. When user-space writes “clear” to /sys/block/md*/md/array_state, md_attr_store() drops the mddev reference before sysfs_unbreak_active_protection(), which can cause the last kobject reference to be dropped while the mddev is still eligible for deletion. Th...

CVE-2026-53142

CVE-2026-53142 concerns the Linux kernel DRM XE driver. The issue arises when display probing state (xe->info.probe_display) is not updated after intel_display_device_info_runtime_init(), allowing xe_display_flush_cleanup_work() to dereference a NULL mode config via for_each_intel_crtc() durin...