CVE-2023-53589

CVE-2023-53589 affects the Linux kernel’s wireless stack: the iwlwifi mvm driver may mishandle a corrupted MCC response from firmware if n_channels is larger than the command response can contain. This can lead to copying excessive (uninitialized) memory and, in extreme cases, a crash due to memo...

CVE-2023-53634

CVE-2023-53634 (bpf, arm64 BTI) : Technical details across multiple feeds show a Linux kernel BTI-related flaw in BPF trampoline handling. When BPF_TRAMP_F_CALL_ORIG is set, trampolines jump back to the patched function via BLR. In BTI-enabled kernels, the instruction after the call site is typic...

CVE-2023-54207

CVE-2023-54207 affects the Linux kernel HID: uclogic driver. The root cause is using the input_dev name’s devm allocation instead of referencing the HID device, which could lead to a use-after-free when the input_dev is unregistered and a uevent depending on its name fires. The fix switches to re...

CVE-2025-38247

CVE-2025-38247 concerns the Linux kernel: a leak of user namespaces and possibly mnt_idmap in open_tree_attr(2) due to not releasing ->mnt_userns after a positive result from want_mount_setattr(). The root cause is that finish_mount_kattr() must release the namespace, and if do_mount_setattr()...

CVE-2025-38266

CVE-2025-38266 affects the Linux kernel pinctrl/mediatek EINT path. The root cause was an invalid dereference: a function (mtk_eint_do_init) could be called with a version of struct mtk_pinctrl that lacks the required soc field when using v1 drivers, leading to a potential crash on certain boards...

CVE-2025-38309

CVE-2025-38309 affects the Linux kernel’s drm/xe/vm path. The root cause is that during vm creation, the code may call xe_svm_fini() on the error path before the SVM state is initialised, causing kernel splats and a fatal NPD. A fix moves xe_svm_init() earlier in xe_svm lifecycle to ensure proper...

CVE-2025-38370

CVE-2025-38370 concerns a Linux kernel issue in the BTRFS free-space-tree rebuild path. When rebuilding the free-space tree, allocating a new metadata block group could trigger multiple transactions; during the rebuild, btrfs_rebuild_free_space_tree() may encounter newly inserted block groups and...

CVE-2025-38625

The CVE-2025-38625 issue concerns the Linux kernel vfio/pds driver. When CONFIG_IOMMUFD is enabled and a device is bound to the pds_vfio_pci driver, probe fails with a WARN_ON trace because vfio_device_ops.detach_ioas isn’t set. The vuln is resolved by applying a fix that uses the generic vfio_io...

CVE-2025-38658

CVE-2025-38658 affects the Linux kernel nvmet PCI-EPF path. The issue occurs when nvmet_req_init() fails (e.g., on an unsupported opcode), because __nvmet_req_complete() can trigger queue_response which may call nvmet_pci_epf_complete_iod(), and nvmet_pci_epf_exec_iod_work() may also invoke the s...

CVE-2025-38673

CVE-2025-38673 impacts the Linux kernel. The issue arises from the stability of the dma_buf field in struct drm_gem_object across a GEM object’s lifetime, which can become NULL after the final GEM handle is released, leading to a NULL-pointer dereference. Public documents indicate that prior work...

CVE-2025-38696

CVE-2025-38696 (Linux kernel, MIPS) : The issue occurs in stack_top() for tasks without an ABI or vDSO mapping (e.g., kthreads). If such a task calls stack_top(), it can dereference a NULL ABI pointer and crash. Affected area is the MIPS support in the Linux kernel; the advisory notes the crash c...

CVE-2025-38716

CVE-2025-38716 affects the Linux kernel and relates to the hfs_find_init() code path. The vulnerability arises when the tree pointer is NULL, potentially triggering a general protection fault / null pointer dereference during HFS operations (e.g., ext_read_extent, get_block, and subsequent file m...

CVE-2025-38720

The CVE-2025-38720 entry describes a Linux kernel issue in hibmcge where two devices could sequentially acquire rtnl_lock during PCI reset, risking deadlock. The provided description explains that the hibmcge netdev previously acquired rtnl_lock in reset_prepare() and released it in reset_done(),...

CVE-2025-38722

CVE-2025-38722: Linux kernel HABANA Labs export_dmabuf() UAF due to race between descriptor table fd_install() and object destruction in ->release(). Root cause: a descriptor in dma_buf_fd() may be installed and used while the referenced file/object could be freed, leading to use-after-free. M...

CVE-2025-38726

CVE-2025-38726 affects the Linux kernel driver net ftgmac100. The issue arises in ftgmac100_phy_disconnect: after phy_disconnect(), netdev->phydev is reset to NULL, which could cause fixed_phy_unregister() to be invoked with a NULL pointer. The connected documents confirm this NULL-pointer use...

CVE-2025-39709

CVE-2025-39709 : In the Linux kernel, the Venus media driver risked a NULL dereference if an IRQ fired before the interrupt handler was fully initialized. The fix ensures the interrupt handler is initialized before the IRQ is registered, preventing spurious interrupts during probe (noted on Rb3Ge...

CVE-2025-39745

CVE-2025-39745 relates to the Linux kernel rcutorture code path in PREEMPT_RT builds. The issue manifests as a splat in rcutorture_one_extend_check() during RT testing due to an interaction with preempt_count/softirq handling; Debian/OSS and OSV/NVD records indicate the vulnerability has been res...

CVE-2025-39790

CVE-2025-39790 : In the Linux kernel, the bus: mhi: host implementation could mis-handle completion events when a device points a TRE pointer ahead of the host’s ring read pointer, enabling a window where a stale TRE is read and its buffer freed twice. The published description documents that thi...

CVE-2025-39872

CVE-2025-39872 concerns the Linux kernel function hsr_get_port_ndev. The issue arises because hsr_get_port_ndev calls hsr_for_each_port and requires both the RCU lock and a device reference, but returning the port device without proper synchronization could yield use-after-free in the caller. The...

CVE-2025-39908

CVE-2025-39908 concerns a Linux kernel issue in the hwtstamp path under netdev lock during ioctl handling (net: dev_ioctl: take ops lock in hwtstamp lower paths). The vulnerability stems fromndo hwtstamp callbacks not consistently running under the per-device ops lock in lower get/set paths, with...

CVE-2025-39958

CVE-2025-39958 concerns the Linux kernel IOMMU on s390: when a PCI device is surprise-removed, teardown may still attempt to attach to the default domain, causing zpci_register_ioat() to fail and s390_iommu_attach_device() to error out. The fix changes the attach path to proceed as if registratio...

CVE-2025-68358

CVE-2025-68358 (Linux kernel, btrfs) : A race condition was fixed in btrfs_clear_space_info_full() that updated bitfield members (full, chunk_alloc, flush) without holding the space_info lock, risking corruption of adjacent fields due to non-atomic read-modify-write sequences on bitfields. The fi...

CVE-2025-71086

Technical details for CVE-2025-71086 are not publicly available in the provided documents. Monitor for updates from official advisories; the initial description mentions a Linux kernel fix in net rose_kill_by_device but no product/version specifics are provided here.

CVE-2025-71121

CVE-2025-71121 relates to the Linux kernel’s parisc/ASP chip handling: attempting to reprogram CPU affinity on HP 730 hardware could crash with an HPMC because registers aren’t at the expected location. The fix avoids the crash by checking the sversion, and notes that reprogramming isn’t needed f...

CVE-2025-71137

CVE-2025-71137 relates to the Linux kernel, where the octeontx2-pf driver patch fixes a UBSAN shift-out-of-bounds error by ensuring the RX ring size (rx_pending) is not set below the permitted length. This prevents UBSAN faults when users pass small or zero ring sizes via ethtool -G. The fix is a...

CVE-2025-71191

Technical details for CVE-2025-71191 are not publicly available in the provided documents; monitor for official advisories for affected products and fixes.

CVE-2026-23013

CVE-2026-23013 pertains to the Linux kernel: in the octeon_ep_vf IRQ handling, the rollback path frees IRQs with a mismatched dev_id, using the literal 'oct' instead of the original ioq_vector. This can leave irqaction registrations alive, causing a use-after-free or crash when the interrupt fire...

CVE-2026-23096

CVE-2026-23096 affects the Linux kernel UACCE accelerator framework (uacce). The issue is in the cleanup path: if cdev_device_add fails, the kernel releases the cdev memory, and later a cdev_device_del could hang. The fix adds a check on the return value of cdev_device_add and clears uacce->cd...

CVE-2026-23131

CVE-2026-23131 : In the Linux kernel, hp-bioscfg registers kobjects for attributes read from WMI. If the HP BIOS returns attributes with empty names, the registration can trigger kobject warnings and parsing may fail. The fix adds validation in hp_init_bios_buffer_attribute() to skip registration...

CVE-2026-23267

The CVE-2026-23267 issue is a Linux kernel f2fs race where an IS_CHECKPOINTED flag inconsistency during atomic commits could cause an -EINVAL in f2fs_recover_inode_page. The root cause is a race between f2fs_ioc_commit_atomic_write and f2fs_write_checkpoint, with the last_folio’s nat_entry flag n...

CVE-2026-23289

CVE-2026-23289 affects the Linux kernel (IB/mthca path) in which a missed mthca_unmap_user_db() for mthca_create_srq can trigger a leak on a failed system call. The vulnerability, with local attack vector and low privileges required, may lead to privilege escalation, DoS, or information leaks as ...

CVE-2026-23301

The CVE-2026-23301 issue affects the Linux kernel ASoC SDCA component, specifically the find_sdca_entity_iot() path that allocates a string for an Entity name but does not verify the allocation result. Red Hat and Debian-family advisories describe this as a local vulnerability that could enable a...

CVE-2026-23319

Summary (CVE-2026-23319) : In the Linux kernel, a use-after-free (UAF) vulnerability in bpf_trampoline_link_cgroup_shim was fixed. The root cause was a race window where, after bpf_link_put reduces the refcount of shim_link->link.link to zero, the resource is considered released but may still ...

CVE-2026-23427

Summary: CVE-2026-23427 affects ksmbd in the Linux kernel and has been fixed to address a use-after-free in durable v2 replay of active SMB file handles. The root cause is that parse_durable_handle_context() unconditionally assigns dh_info->fp->conn to the current connection when handling D...

CVE-2026-31397

CVE-2026-31397 relates to the Linux kernel memory management path mm/huge_memory move_pages_huge_pmd(), where the huge zero page branch used a NULL src_folio, causing a bogus PFN (or NULL dereference on some memory models) when constructing PMDs. The fix uses page_folio(src_page) to obtain a vali...

CVE-2026-31495

The CVE-2026-31495 entry concerns the Linux kernel’s netfilter ctnetlink path. The issue stems from missing netlink policy range checks, allowing invalid values to slip through due to manual range validation in CTA_PROTOINFO_TCP_STATE, WSCALE, and related flags. The documented impact notes that c...

CVE-2026-31510

CVE-2026-31510: Linux kernel Bluetooth L2CAP vulnerability due to a null pointer dereference in l2cap_sock_ready_cb. The issue arises because sk is used without verifying it’s non-null, leading to a kernel panic/DoS. Multiple OS advisories (Debian roots, Ubuntu, Red Hat, SUSE, etc.) report the pa...

CVE-2026-31540

CVE-2026-31540 affects the Linux kernel i915 graphics driver. The vulnerability occurs when the i915 firmware binaries are absent and the set_default_submission pointer is not initialized, which can be dereferenced during suspend, causing a kernel NULL pointer dereference and a potential DoS. The...

CVE-2026-31625

CVE-2026-31625 concerns the Linux kernel HID alps driver, where a NULL pointer dereference could occur when processing raw events. The root cause was insufficient verification of device claiming before handling a raw event, which could lead to system instability. The fixed trajectory includes com...

CVE-2026-31683

The CVE-2026-31683 issue affects the Linux kernel’s batman-adv module. When the Optimized Global Messaging (OGM) aggregation state is toggled at runtime, a forwarded packet that was allocated with insufficient tailroom may be appended to by a later packet, leading to skb_put overflow conditions. ...

CVE-2026-31690

CVE-2026-31690 affects the Linux kernel TH1520 AON firmware protocol driver. The issue combined a potential buffer overflow from unsafe pointer arithmetic when accessing the 'mode' field via a resource offset, and the use of custom RPC_SET_BE*/RPC_GET_BE* macros replaced with standard endianness ...

CVE-2026-31788

The CVE-2026-31788 entry describes a vulnerability in the Linux kernel related to the Xen privcmd driver. The privcmd interface could allow a user-space process to issue hypercalls that affect other domains, which is normally restricted to root. In secure-boot scenarios, an unprivileged domU coul...

CVE-2026-43009

The CVE-2026-43009 family concerns the Linux kernel BPF verifier. Connected sources describe a bug where backtrack_insn did not correctly account for atomic fetch variants (BPF_ATOMIC with BPF_FETCH) during memory-precision tracking, causing the verifier to prune paths incorrectly. The fix extend...

CVE-2026-43033

The CVE-2026-43033 issue affects the Linux kernel crypto: authencesn module, where out-of-place decryption (src != dst) incorrectly saves high-order sequence bits in dst, requiring reordering before hashing. The vulnerability is linked to privilege escalation/DoS/info-leak risks as described in m...

CVE-2026-43184

CVE-2026-43184 affects the Linux kernel component rnbd-srv. The root cause is failing to clear the response buffer before sending data, which could allow a remote client to receive unintended data when exchanging messages across protocol versions. Multiple vendors have patched this vulnerability ...

CVE-2026-43276

Summary: CVE-2026-43276 is a Linux kernel issue in the mana network driver causing a use-after-free during PCI service rescan. The crash occurs when mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup() frees gc->service_wq, and a subsequent resume path leads to a second removal via man...

CVE-2026-43281

CVE-2026-43281 affects the Linux kernel mailbox subsystem. The flaw is an out-of-bounds access in fw_mbox_index_xlate() that can occur when #mbox-cells is

CVE-2026-43297

The CVE-2026-43297 issue affects the Linux kernel rockchip: rga driver. rga_get_frame() can return ERR_PTR(-EINVAL) for unsupported/invalid buffer types, and rga_buf_init() may dereference that pointer without checking the error, leading to a crash. The fix adds proper ERR_PTR checking in rga_buf...

CVE-2026-43299

Consolidated details show CVE-2026-43299 affects the Linux kernel btrfs filesystem. When ENOSPC can cause the filesystem to flip to read‑only in a critical path, a pending read repair may trigger an assertion failure inside btrfs_repair_io_failure(), leading to a kernel crash. The issue is docume...

CVE-2026-43313

CVE-2026-43313 relates to a NULL-pointer dereference in the ACPI processor driver (acpi_processor_errata_piix4) of the Linux kernel. The code first assigns an IDE device to dev, then overwrites it with an ISA device using two successive pci_get_subsys lookups. If the first lookup succeeds but the...