CVE-2026-46041

CVE-2026-46041 affects the Linux kernel with a fix for sleeping in an atomic context in the hdlc path used by greybus/gb-beagleplay. The root cause is that hdlc_append() calls usleep_range() while tx_producer_lock (a spinlock) is held, risking a BUG: scheduling while atomic. The workaround is to ...

CVE-2026-46044

CVE-2026-46044 affects the Linux kernel IPMI SSIF path. The vulnerability arises when an error occurs after the ssif kthread is created but before the main IPMI code starts the ssif interface, allowing the kthread to continue running. The issue is resolved by ensuring the kthread is stopped on er...

CVE-2026-46111

The CVE concerns a use-after-free in the Linux kernel Bluetooth stack (hci_conn, BIG creation). The patch adds hci_conn_valid() in create_big_sync() to detect stale connections before BIG creation, handles -ECANCELED in create_big_complete(), and re-validates under hci_dev_lock() before dereferen...

CVE-2026-46129

CVE-2026-46129 concerns the Linux kernel’s btrfs subsystem. In the create_space_info() error path, if kobject_init_and_add() fails, the chain leads to a double free of space_info due to both a direct kfree and a later release via space_info->kobj. The fix changes cleanup so that after kobject_...

CVE-2026-46141

The CVE-2026-46141 entry concerns a Linux kernel kmemleak memory leak in the powerpc/xive interrupt controller. When MSI‑X vectors are allocated for NVMe devices, the kernel stores per‑irq data in irq_data->chip_data. After a commit that untangled XIVE from child interrupt controllers, xive_ir...

CVE-2026-46164

CVE-2026-46164 affects the Linux kernel's btrfs subsystem. The vulnerability is a double-free in create_space_info_sub_group() when kobject_init_and_add() fails, causing the sub_group to be freed twice as the error path unwinds. The call chain is: create_space_info_sub_group() → btrfs_sysfs_add_s...

CVE-2026-46179

In CVE-2026-46179, the Linux kernel ASoC SOF subsystem is vulnerable to a divide-by-zero when reporting the pointer for a compressed stream if stream parameters are unconfigured. The bug arises from dividing the I/O frame position by (channels × container bytes), which defaults to zero until stre...

CVE-2026-46249

The CVE-2026-46249 issue affects the Linux kernel octeontx2-af PF driver. During a kexec reboot, the old AF state may persist if the PF driver probes before AF reinitializes, and if the RVUM block revision is not cleared on shutdown, PF can mis-detect AF readiness and access stale hardware, leadi...

CVE-2026-46254

The CVE-2026-46254 issue concerns the Linux kernel AppArmor module mis-handling unaligned DFA tables (originating from kernel or userspace), which can cause unaligned memory accesses and kernel warnings. The available connected advisories confirm the vulnerability in AppArmor and document an even...

CVE-2026-46260

The CVE-2026-46260 entry is supported by multiple connected sources detailing a kernel IPv6 out-of-bounds read when creating an IPv6 route with RTA_NH_ID, due to fib6_info not containing trailing fib6_nh and an unsafe read of iter->fib6_nh. The fix adds a check of iter->nh before dereferenc...

CVE-2026-46268

The CVE relates to the Linux kernel PCI/P2PDMA subsystem. A warning in p2pmem_alloc_mmap() was triggered by an assertion VM_WARN_ON_ONCE_PAGE(!page_ref_count(page)) after the initial page refcount was changed to zero by a prior patch. The issue arises only when CONFIG_DEBUG_VM is enabled, produci...

CVE-2026-52979

CVE-2026-52979 is a Linux kernel vulnerability in the PSP subsystem. The issue arises in psp_assoc_device_get_locked(): it takes a psp_dev reference via psp_dev_get_for_sock() (which uses psp_dev_tryget() under RCU), then acquires psd->lock and drops the registration reference. If psp_dev_unre...

CVE-2026-53004

Summary of CVE-2026-53004 : In the Linux kernel, sctp_getsockopt_peer_auth_chunks can perform an out-of-bounds write to user space when the caller provides a short optval buffer. The check tests len vs num_chunks but forgets to account for sizeof(struct sctp_authchunks) header (8 bytes), allowing...

CVE-2026-53037

CVE-2026-53037 affects the Linux kernel with a deadlock in HID reset handling when a USB HID device is paired with a storage/UAS component. The issue arises because hid_pre_reset() and hid_post_reset() may perform memory allocations that touch IO, risking deadlock, so the patch switches allocatio...

CVE-2026-53086

The CVE concerns the Linux kernel bcmgenet driver: the bcmgenet_timeout handler erroneously attempts to bring down all TX queues when a single queue times out, creating race conditions with active queues. The fixed behavior restarts only the timed-out queue, mitigating the race. Reported impact i...

CVE-2026-53135

The CVE-2026-53135 issue affects the Linux kernel’s DRM AMD display path, specifically SDP debugfs writes. Root cause: dp_sdp_message_debugfs_write() dereferenced connector->base.state->crtc without NULL checks, potentially crashing when a connected-but-unbound connector exists (e.g., after...

CVE-2026-53137

CVE-2026-53137 concerns the Linux kernel drm/amd display path where, during HDCP2.x repeater authentication over HDMI, the driver reads the sink RxStatus and uses a 10-bit message size field (max 1023) to set the read length for the ReceiverID list. The length was not clamped to the destination b...

CVE-2026-53142

CVE-2026-53142 concerns the Linux kernel DRM XE driver. The issue arises when display probing state (xe->info.probe_display) is not updated after intel_display_device_info_runtime_init(), allowing xe_display_flush_cleanup_work() to dereference a NULL mode config via for_each_intel_crtc() durin...

CVE-2026-53174

CVE-2026-53174 affects the Linux kernel overlay filesystem (ovl). The bug in ovl_iterate_merged() stores PTR_ERR(cache) in err before validating the cache with IS_ERR(cache), so on success err may hold a truncated cache pointer and be returned as a bogus non-zero error. The repro path goes throug...

CVE-2026-53209

The CVE-2026-53209 issue affects the Linux kernel Bluetooth subsystem (hci_sync). When hci_adv_bcast_annoucement() tries to prepend the Broadcast Announcement service data to an already-full extended advertising payload, the combined data could exceed the temporary buffer used to rebuild advertis...

CVE-2026-53223

CVE-2026-53223 (Linux kernel) : A networking timestamping bug in net: guard timestamp cmsgs to real error queue skbs where skb_is_err_queue() incorrectly treated PACKET_OUTGOING as the sole marker for sk_error_queue. This misclassification affects AF_PACKET sockets, allowing timestamp-related con...

CVE-2026-53304

CVE-2026-53304 affects the Linux kernel SCSI generic (sg) driver, specifically the def_reserved_size default buffer size for each /dev/sgX. The root cause is a bypass of sg_proc_write_dressz limits, allowing an invalid value to be written via the module parameter, which can trigger a soft lockup....

CVE-2026-53333

CVE-2026-53333 relates to the Linux kernel mm/mincore path. The issue arises when handling non-swap entries on builds without swap support: mincore_pte_range() could spuriously WARN and report pages as nonresident because the !IS_ENABLED(CONFIG_SWAP) guard was evaluated before the non-swap-entry ...

CVE-2026-53387

In the Linux kernel, the vulnerability CVE-2026-53387 affects the IIO light driver for veml6075. The issue arises in veml6075_it_ms indexing: veml6075_it_ms has 5 elements, but VEML6075_CONF_IT can yield 0–7, which can lead to an out-of-bounds access when the index is >= 5. The fix adds a boun...

CVE-2026-53389

CVE-2026-53389 affects the Linux kernel net/tcp-ao use-after-free in the del_async path when deleting a key. The root cause is that del_async omits current_key and rnext_key validity checks that exist in the synchronous path. If a key is added with set_current=1/set_rnext=1 while the socket is in...

CVE-2026-53401

The CVE-2026-53401 vulnerability affects the Linux kernel fbdev omap2 driver (omapfb_mmap) with a race between mm_lock and fb_info->lock when mapping memory via OMAPFB_SETUP_PLANE. The race can lead to a use-after-free by reading start/len from mismatched region references and incrementing an ...

CVE-2022-49976

CVE-2022-49976 relates to Linux kernel code for x86 Android tablet handling, specifically the Chuwi Hi8 touchscreen issue. The vulnerability stems from the x86_android_tablets path calling x86_acpi_irq_helper_get() which may invoke acpi_unregister_gsi(), leading to touchscreen malfunctions and ke...

CVE-2022-50043

CVE-2022-50043 is a Linux kernel vulnerability in ndisc_router_discovery where, on certain paths after grabbing rt and neigh, a nonzero lifetime with a metric change causes the code to delete the route and potentially reacquire rt/neigh without decrementing the previous neigh reference count, lea...

CVE-2022-50113

The connected sources indicate CVE-2022-50113 affects the Linux kernel ASoc audio-graph-card2 component, where a refcount leak occurred in __graph_get_type() due to not calling of_node_put() before replacement and before return. The root cause is improper refcount management related to of_get_par...

CVE-2022-50182

CVE-2022-50182 concerns a Linux kernel issue in the media: imx-jpeg driver. The flaw involved aligning upwards the buffer size for both encoder and decoder, allowing arbitrary image dimensions (WxH) while leaving the picture resolution unchanged. The documented impact indicates the decoder risk o...

CVE-2022-50195

The CVE-2022-50195 entry concerns the Linux kernel (ARM) where the device tree for Qualcomm clocks declared a fixed-clock pxo_board, replacing the gcc PXO phandle. The gcc driver does not provide PXO_SRC because it’s a fixed clock, which could lead to a kernel panic if a driver tries to use it. T...

CVE-2022-50236

CVE-2022-50236 (Linux kernel, iommu/mediatek) : A crash occurs when rebooting via isr(), where the IRQ handler can fire before the IOMMU domain initialization, leading to an invalid memory access. The fix is in the kernel code path for mtk_iommu_isr, preventing handling before proper domain setup...

CVE-2022-50241

CVE-2022-50241 is a Linux kernel local-use-after-free in NFSD during inter-server copy. The race occurs when a CLOSE may be sent before FREE_STATEID, leaving a freed lock/state entry on the s2s_cp_stateids/sc_cp_list and triggering a BAD_STATEID on subsequent FREE_STATEID. The referenced patches ...

CVE-2022-50242

CVE-2022-50242 pertains to the Linux kernel driver in the qlcnic SR-IOV path. The vulnerability arises in the function qlcnic_sriov_init() when allocating virtual ports (vp); if vp allocation fails, previously allocated vps are not freed, creating a potential memory leak. The connected advisories...

CVE-2022-50243

CVE-2022-50243 – Linux kernel SCTP use-after-free (summary from connected advisories) The vulnerability arises in SCTP when an error is returned from sctp_auth_asoc_init_active_key(): the old sh_key could be freed while still in use as the active key, leading to a use-after-free during packet sen...

CVE-2022-50257

The CVE-2022-50257 issue is in the Linux kernel Xen grant handling (xen/gntdev) where partial grant mapping failures could leak grants. In paravirtualized domains (use_ptemod = true), alloced was not updated for all successful map_ops or kmap_ops, risking incorrect live_grants and leaks. The fix ...

CVE-2022-50280

CVE-2022-50280: In the Linux kernel, propagate_mnt() bug allowed a NULL dereference when terminating peers of a source mount, triggered via mount propagation paths. The issue could be exploited by unprivileged users due to user namespaces. This CVE affects the Linux kernel’s mount propagation han...

CVE-2022-50309

CVE-2022-50309 : Linux kernel vulnerability in media: xilinx: vipp, fixed in the commit that adds balance for refcount in xvip_graph_dma_init. The issue arises because of_get_child_by_name() returns a node pointer with its refcount incremented, and there was no corresponding of_node_put() when th...

CVE-2022-50314

The CVE-2022-50314 issue affects the Linux kernel nbd subsystem. When a signal interrupts nbd_start_device_ioctl() while waiting for inflight I/Os to complete, a hung task could occur. The fix clears the queue (not just shutdown) on signal interruption to nbd_start_device_ioctl(), mitigating the ...

CVE-2022-50325

CVE-2022-50325 (Linux kernel) is detailed in connected documents as an ASoC: Intel avs issue, where firmware may return an invalid RX size for LARGE_CONFIG_GET, causing memcpy_fromio() to copy too many bytes. Root cause: RX size handling overflow in the RX buffer due to missing bounds check. Miti...

CVE-2022-50336

CVE-2022-50336 – Linux kernel (fs/ntfs3) Root cause: a missing null pointer check in attr_load_runs_vcn when parsing certain NTFS metadata before MFT could permit a kernel NULL pointer dereference on malformed images. Impact: kernel crash/free crash (NPD) resulting from NULL dereference in ntfs-r...

CVE-2022-50346

CVE-2022-50346 is a Linux kernel ext4 issue where ext4_rename may modify old.inode’s ctime and trigger quota/extra_isize expansion, potentially allocating blocks and emitting a quota-related warning. The root cause involves ext4_xattr handling during a rename, with syzbot traces showing s_want_ex...

CVE-2022-50348

CVE-2022-50348 affects the Linux kernel’s NFS server (nfsd). The vulnerability is a memory leak in an error-path: if memdup_user() fails, memory allocated earlier is not freed, causing a leak. The connected sources confirm the issue and state that it has been resolved in the kernel, but do not pr...

CVE-2022-50352

CVE-2022-50352 affects the Linux kernel’s net/hns driver (hnae_ae_register). If device_register() fails during probing and the kobject refcount isn’t decremented to 0, the name allocated in dev_set_name() is leaked. The fix calls put_device() so the name can be freed in kobject_cleanup(). The con...

CVE-2022-50354

CVE-2022-50354 pertains to the Linux kernel component drm/amdkfd, where the fix for kfd_process_device_init_vm error handling was applied. The affected code path could lead to a NULL pointer dereference (address 0x10) during process destruction, with a call trace through amdgpu_amdkfd_gpuvm_unmap...

CVE-2022-50372

CVE-2022-50372 pertains to the Linux kernel’s CIFS/SMB client: a memory leak occurs when building the ntlmssp negotiate blob during mount of CIFS shares. The issue manifests as an unreferenced object and can lead to a session setup leak if the negotiate blob construction fails. The vulnerability ...

CVE-2022-50383

The CVE-2022-50383 vulnerability affects the Linux kernel media: mediatek: vcodec path. It describes a fix for a race/NULL pointer dereference when latency decoding errors cause the core thread to call v4l2_m2m_buf_done_and_job_finish and free the dst buffer, potentially triggering a NULL pointer...

CVE-2022-50384

CVE-2022-50384 is a Linux kernel vulnerability in staging/vme_user (tsi148_dma_list_add) where an error path could free an entry without removing it from list->entries, risking use-after-free. The connected documents confirm the root cause is the failure to remove &entry->list from list-&gt...

CVE-2022-50405

The CVE-2022-50405 entry describes a Linux kernel race in the vxlan path (net/tunnel) where deleting a vxlan device during packet reception can release a sock before sk_user_data readers finish. This leads to a NULL pointer dereference in vxlan_ecn_decapsulate() / vxlan_get_sk_family(). The repro...

CVE-2022-50418

CVE-2022-50418 concerns the Linux kernel wifi path, specifically the ath11k MHI workflow. The issue: when mhi_alloc_controller() allocates mhi_ctrl and ath11k_mhi_read_addr_from_dt() fails, the code path returns without freeing the allocated controller, causing a memory leak. The documented fix a...