CVE-2026-31779

The CVE-2026-31779 issue is in the Linux kernel’s wifi iw lwifi mvm path, specifically iwl_mvm_nd_match_info_handler(). A memcpy may copy more bytes than the dynamic notif->matches array can safely hold, enabling an out-of-bounds read and potential information disclosure. Debian and Red Hat ad...

CVE-2026-43007

The CVE-2026-43007 entry relates to the Linux kernel accel/qaic component. Root cause: when a DBC is released, QAIC sends QAIC_TRANS_DEACTIVATE_FROM_DEV and resources are freed via decode_deactivate() in qaic_manage_ioctl() context. If the initiating user process terminates before the deactivatio...

CVE-2026-43058

The CVE covers a Linux kernel issue in media: vidtv where vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() take their argument structs by value, triggering MSAN warnings for uninitialized data. The root cause is stack-copy of the structs; the patch changes the functions to accept them by ...

CVE-2026-43059

CVE-2026-43059 affects the Linux kernel Bluetooth MGMT path. A change introducing mgmt_pending_valid() caused completion handlers to unlink commands from the pending list, which could lead to list corruption and potential memory safety issues. The patch fixes two issues: (1) in mgmt_add_adv_patte...

CVE-2026-43060

The CVE-2026-43060 issue affects the Linux kernel netfilter component (nft_ct). When the nft_ct module is removed, packets enqueued in nfqueue may retain stale references to conntrack zone templates or timeout policies, risking instability or DoS. The root cause is references that can outlive the...

CVE-2026-43076

The vulnerability CVE-2026-43076 affects the ocfs2 filesystem in the Linux kernel. When reading an inode from disk, ocfs2_validate_inode_block() did not validate the i_size of inline data against the inline data capacity (id_count). A corrupted filesystem could make i_size exceed id_count, causin...

CVE-2026-43101

The CVE-2026-43101 entry refers to a Linux kernel IPv6 IOAM issue: __ioam6_fill_trace_data() could dereference NULL if __in6_dev_get() returns NULL. The fix replaces skb_dst_dev() with skb_dst_dev_rcu() and adds two missing READ_ONCE() checks; it also enforces that @dev cannot be NULL. Patches ar...

CVE-2026-43130

The CVE-2026-43130 issue affects the Linux kernel iommu/vt-d path, where flushing the dev-IOTLB can occur during resource release in scalable PCIe mode. The root cause is a path that attempted ATS invalidation without adequately verifying whether the PCIe device is still accessible after a link-d...

CVE-2026-43134

The CVE-2026-43134 entry affects the Linux kernel Bluetooth stack. The root cause is a missing encryption key size check in the L2CAP_LE_CONN_REQ handling, which could permit a malformed L2CAP LE connection request and trigger a protocol violation. A patch was added to perform the key-size valida...

CVE-2026-43141

Summary : CVE-2026-43141 affects the Linux kernel ntb_hw_switchtec code, where the number of MW LUTs can be configured to zero. In that scenario, a call to rounddown_pow_of_two could trigger undefined behavior. The patch ensures rounddown_pow_of_two is only applied to a valid value. Impact : Unde...

CVE-2026-43148

The CVE-2026-43148 issue concerns the Linux kernel, specifically the powerpc/smp code path for parse_thread_groups(). A missing check for the return value of kcalloc() could allow a NULL pointer dereference when the allocation result is later used by of_property_read_u32_array(). The vulnerabilit...

CVE-2026-43151

CVE-2026-43151 : Linux kernel issue resolved by reverting the Iris video driver stop streaming sanity check. The revert re-enabled stop_streaming when the IRIS_INST_ERROR path, correcting prior regressions where buffers were not returned to vb2 and teardown could fail, leaving firmware in an inco...

CVE-2026-43184

CVE-2026-43184 affects the Linux kernel component rnbd-srv. The root cause is failing to clear the response buffer before sending data, which could allow a remote client to receive unintended data when exchanging messages across protocol versions. Multiple vendors have patched this vulnerability ...

CVE-2026-43206

Summary: CVE-2026-43206 affects the Linux kernel’s drm/amdkfd component. The function kfd_event_page_set() writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes using memset without validating the destination buffer size, allowing an unprivileged local user to trigger an out-of-bounds memory write and potentia...

CVE-2026-43227

CVE-2026-43227 affects the Linux kernel’s clocksource/sh_tmu driver. The vulnerability arises when the TMU is used as both clocksource and clockevent provider and the driver tries to power/clocks state via pm_runtime_() and clk_ () while holding raw spinlocks. This mismatch between spinlock conte...

CVE-2026-43268

Summary: CVE-2026-43268 concerns the Linux kernel where the hfsplus filesystem may incorrectly treat certain special inodes as regular files. The root cause is a mismatch in inode type handling for VFS operations after the may_open() adjustment, causing some inodes not to be treated as their true...

CVE-2026-43313

CVE-2026-43313 relates to a NULL-pointer dereference in the ACPI processor driver (acpi_processor_errata_piix4) of the Linux kernel. The code first assigns an IDE device to dev, then overwrites it with an ISA device using two successive pci_get_subsys lookups. If the first lookup succeeds but the...

CVE-2026-43321

The CVE-2026-43321 issue is in the Linux kernel BPF subsystem, where indirect jumps did not correctly mark the live registers for a gotox rX, leaving the affected register state unchecked. When the kernel fails to mark registers as used, it can enable manipulation of kernel state and potentially ...

CVE-2026-43349

The CVE-2026-43349 entry concerns the Linux kernel’s Flash-Friendly File System (f2fs). The issue arises when f2fs_finish_read_bio() may access uninitialized data in a folio if a read from the device fails, triggering an uninitialized-value access in f2fs_sanity_check_node_footer. The root cause,...

CVE-2026-43352

This CVE concerns the Linux kernel i3c mipi-i3c-hci driver DMA ring abort handling. The root cause is flawed abort logic that could disrupt the controller state: the code could issue an abort even when the ring is stopped, the abort completion is not re-initialized, aborts could clear RING_CTRL_E...

CVE-2026-43382

Summary: CVE-2026-43382 affects the Linux kernel batman-adv component. The issue arises when batadv_v_elp_get_throughput() runs with the RTNL lock already held, which could cause a deadlock during cancellation of a work item. The fix switches to rtnl_trylock to skip ethtool retrieval if the RTNL ...

CVE-2026-43451

Summary of CVE-2026-43451 (Linux kernel): The nfnetlink_queue entry leak occurs in the bridge verdict error path. When nfqnl_recv_verdict() dequeues an entry for PF_BRIDGE packets and nfqa_parse_bridge() returns an error (for example VLAN TCI missing when VLAN is present), the code returns withou...

CVE-2026-43488

CVE-2026-43488 : Linux kernel xHCI driver vulnerability where a Host Controller Error (HCE) on UAS storage plug/unplug could trigger an interrupt storm. The issue occurred as xhci_irq() logged a warning and assumed activity would stop, but storms persisted on some hosts. Mitigation implemented by...

CVE-2026-45846

CVE-2026-45846 affects the Linux kernel bareudp code path. The vulnerability arises in bareudp_fill_metadata_dst(), which passes bareudp->sock to udp_tunnel6_dst_lookup() in the IPv6 path without a NULL check. If the bareudp device is down (socket not created or already NULLed in bareudp_stop)...

CVE-2026-45857

The CVE-2026-45857 issue affects the Linux kernel, specifically the SCSI subsystem in the csiostor path. The root cause is a NULL pointer dereference of rn in the error exit path, caused by the use of CSIO_INC_STATS after rn may be NULL. A fix was introduced that adds a dedicated error-return pat...

CVE-2026-45875

The CVE-2026-45875 issue is in the Linux kernel mfd: arizona driver where wm5102_clear_write_sequencer() may fail and bypass cleanup, leaving regulators enabled and causing a resource leak. The fix changes the function to jump to the err_reset cleanup path to properly free resources. Debian/Ubunt...

CVE-2026-45881

The CVE-2026-45881 issue affects the Linux kernel’s MediaTek SVS driver (svs_enable_debug_write). The bug is a memory leak where a buffer allocated by memdup_user_nul() is not freed if kstrtoint() fails. The cited fix changes the cleanup to use __free(kfree) to automatically free the buffer, elim...

CVE-2026-45890

The CVE-2026-45890 issue affects the Linux kernel xen-netback in Xen environments. The backend validated the upper bound of multi-queue config but did not reject zero, allowing a guest to set multi-queue-num-queues to 0. This leads to vzalloc(array_size(0, sizeof(struct xenvif_queue))) and WARN_O...

CVE-2026-45901

The CVE-2026-45901 issue affects the Linux kernel netfilter nf_tables implementation. The root cause is a circular lock dependency among commit_mutex, nfnl_subsys_ipset, and nlk_cb_mutex that can occur when nft reset, ipset list, and iptables-nft with a -m set rule run concurrently, potentially l...

CVE-2026-45908

The CVE-2026-45908 issue affects the Linux kernel’s accel/amdxdna component, specifically amdxdna_ubuf_map. The function allocates memory for sg and internal sg table structures but does not free them if subsequent operations (sg_alloc_table_from_pages or dma_map_sgtable) fail, resulting in a mem...

CVE-2026-45918

CVE-2026-45918 concerns a race condition in the Linux kernel related to OpenVPN TCP handling. When a peer is kept alive and later removed, the kernel temporarily places the peer in a release list and detaches from the socket by restoring its proto and socket callbacks. If userspace closes the soc...

CVE-2026-45941

CVE-2026-45941 concerns the Linux kernel tpm_i2c_infineon locality handling. The root cause is a timeout in get_burstcount() that can return -EBUSY and cause the function to exit without releasing the locality acquired earlier in tpm_tis_i2c_send(), risking resource exhaustion. The mitigation acr...

CVE-2026-45958

The CVE-2026-45958 vulnerability affects the Linux kernel, specifically the drm/exynos vidi driver. In vidi_connection_ioctl(), the code dereferenced a user pointer directly (vidi->edid(user pointer)), enabling arbitrary kernel memory access from user space and potentially leading to privilege...

CVE-2026-45961

CVE-2026-45961 in the Linux kernel’s GFS2 filesystem is fixed: memory leaks occur on gfs2_fill_super() error paths when transitioning to read-write mode. Two leaks are addressed: (1) kernel thread objects (logd, quotad) not destroyed after init_threads() if failure occurs; (2) a quota bitmap buff...

CVE-2026-45966

CVE-2026-45966 concerns a Linux kernel/AppArmor regression. When receiving file descriptors via SCM_RIGHTS, both sock and sock->sk can be NULL, leading to NULL pointer dereferences in __unix_needs_revalidation() and a crash. The issue stems from added NULL checks in a new function without ensu...

CVE-2026-46007

CVE-2026-46007 targets the Linux kernel hwmon: powerz code, where a DMA transfer buffer may accidentally share a cacheline with a mutex, enabling a cacheline sharing risk for DMA. The issue is mitigated by using the high‑level DMA helpers to ensure no cacheline sharing occurs, and by removing the...

CVE-2026-46018

CVE-2026-46018 is a Linux kernel issue in ALSA: usb-audio (UAC2) where parse_uac2_sample_rate_range() capped at MAX_NR_RATES but only broke the inner loop; a malformed UAC2 RANGE could continue parsing and flood with "invalid uac2 rates". The fix stops the whole parse at the cap and returns the c...

CVE-2026-46029

In the Linux kernel, CVE-2026-46029 describes a race within the slab allocator where kmalloc_nolock() called from NMI on uniprocessor (UP) configurations can re-enter the allocator and acquire n->list_lock that the interrupted context already holds, corrupting slab state and potentially causin...

CVE-2026-46041

CVE-2026-46041 affects the Linux kernel with a fix for sleeping in an atomic context in the hdlc path used by greybus/gb-beagleplay. The root cause is that hdlc_append() calls usleep_range() while tx_producer_lock (a spinlock) is held, risking a BUG: scheduling while atomic. The workaround is to ...

CVE-2026-46044

CVE-2026-46044 affects the Linux kernel IPMI SSIF path. The vulnerability arises when an error occurs after the ssif kthread is created but before the main IPMI code starts the ssif interface, allowing the kthread to continue running. The issue is resolved by ensuring the kthread is stopped on er...

CVE-2026-46111

The CVE concerns a use-after-free in the Linux kernel Bluetooth stack (hci_conn, BIG creation). The patch adds hci_conn_valid() in create_big_sync() to detect stale connections before BIG creation, handles -ECANCELED in create_big_complete(), and re-validates under hci_dev_lock() before dereferen...

CVE-2026-46129

CVE-2026-46129 concerns the Linux kernel’s btrfs subsystem. In the create_space_info() error path, if kobject_init_and_add() fails, the chain leads to a double free of space_info due to both a direct kfree and a later release via space_info->kobj. The fix changes cleanup so that after kobject_...

CVE-2026-46141

The CVE-2026-46141 entry concerns a Linux kernel kmemleak memory leak in the powerpc/xive interrupt controller. When MSI‑X vectors are allocated for NVMe devices, the kernel stores per‑irq data in irq_data->chip_data. After a commit that untangled XIVE from child interrupt controllers, xive_ir...

CVE-2026-46164

CVE-2026-46164 affects the Linux kernel's btrfs subsystem. The vulnerability is a double-free in create_space_info_sub_group() when kobject_init_and_add() fails, causing the sub_group to be freed twice as the error path unwinds. The call chain is: create_space_info_sub_group() → btrfs_sysfs_add_s...

CVE-2026-46179

In CVE-2026-46179, the Linux kernel ASoC SOF subsystem is vulnerable to a divide-by-zero when reporting the pointer for a compressed stream if stream parameters are unconfigured. The bug arises from dividing the I/O frame position by (channels × container bytes), which defaults to zero until stre...

CVE-2026-46249

The CVE-2026-46249 issue affects the Linux kernel octeontx2-af PF driver. During a kexec reboot, the old AF state may persist if the PF driver probes before AF reinitializes, and if the RVUM block revision is not cleared on shutdown, PF can mis-detect AF readiness and access stale hardware, leadi...

CVE-2026-46254

The CVE-2026-46254 issue concerns the Linux kernel AppArmor module mis-handling unaligned DFA tables (originating from kernel or userspace), which can cause unaligned memory accesses and kernel warnings. The available connected advisories confirm the vulnerability in AppArmor and document an even...

CVE-2026-46260

The CVE-2026-46260 entry is supported by multiple connected sources detailing a kernel IPv6 out-of-bounds read when creating an IPv6 route with RTA_NH_ID, due to fib6_info not containing trailing fib6_nh and an unsafe read of iter->fib6_nh. The fix adds a check of iter->nh before dereferenc...

CVE-2026-46268

The CVE relates to the Linux kernel PCI/P2PDMA subsystem. A warning in p2pmem_alloc_mmap() was triggered by an assertion VM_WARN_ON_ONCE_PAGE(!page_ref_count(page)) after the initial page refcount was changed to zero by a prior patch. The issue arises only when CONFIG_DEBUG_VM is enabled, produci...

CVE-2026-52979

CVE-2026-52979 is a Linux kernel vulnerability in the PSP subsystem. The issue arises in psp_assoc_device_get_locked(): it takes a psp_dev reference via psp_dev_get_for_sock() (which uses psp_dev_tryget() under RCU), then acquires psd->lock and drops the registration reference. If psp_dev_unre...