CVE-2026-52957

Consolidated details from CVE-2026-52957 show a Linux kernel libceph flaw in processing CEPH_MSG_OSD_MAP: during CRUSH map decoding, bucket indices may reference NULL buckets when decoding crush_choose_arg_map, risking a NULL pointer dereference. A patch extends the validation to only access non-...

CVE-2026-43343

CVE-2026-43343 affects the Linux kernel USB gadget f_subset code. The vulnerability stems from an unbalanced reference count: geth_alloc() increments the refcount, but geth_free() does not decrement it, which can block configuration of attributes via configfs after unlinking the function. The con...

CVE-2026-43379

CVE-2026-43379 affects ksmbd (Linux kernel) with a use-after-free in smb_lazy_parent_lease_break_close. The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is accessed after rcu_read_unlock(), creating a race where the memory could be freed by a concurrent writer before subsequent de...

CVE-2026-43438

CVE-2026-43438 involves a Linux kernel sched_ext issue where a redundant css_put() call in scx_cgroup_init() can trigger a refcount underflow during iterations of css_for_each_descendant_pre(). The iterator walks the cgroup hierarchy under cgroup_lock() and does not acquire references with css_ge...

CVE-2026-43443

CVE-2026-43443 involves the Linux kernel ASoC AMD ACP Mach common driver. The acp_card_rt5682_init() and acp_card_rt5682s_init() functions did not validate clk_get() returns, risking dereferencing invalid pointers and kernel crash. The patch changes clock acquisition to devm_clk_get() and adds IS...

CVE-2026-43453

CVE-2026-43453 is a Linux kernel issue in the netfilter nft_set_pipapo path. The bug is a stack out-of-bounds read in pipapo_drop(), where rulemap[i+1].n is passed to pipapo_unmap() on every iteration, including the last when i == m->field_count-1. This reads past the end of the stack-allocate...

CVE-2026-45860

CVE-2026-45860 affects the Linux kernel netfilter nf_conncount, where tracking more than eight new connections per jiffy could cause the connection list to not be cleaned up promptly, potentially exhausting the connection limit and enabling denial of service. The issue is mitigated by a fix that ...

CVE-2026-45886

CVE-2026-45886: In the Linux kernel, a patch fixes the bpf_xdp_store_bytes prototype for read-only arguments. The issue caused the verifier to treat the third argument as a BPF_WRITE target when NATed map memory was read-only, resulting in a forbidden write to a read-only map. The patch adjusts t...

CVE-2026-45891

CVE-2026-45891: Linux kernel hns3 driver double-free vulnerability. Root cause: in hns3_set_ringparam(), a temporary copy (tmp_rings) is used for rollback, but the tx_spare pointer in the original ring isn’t cleared after backup, leading to a stale non-NULL tx_spare. If allocation fails during hn...

CVE-2026-46007

CVE-2026-46007 targets the Linux kernel hwmon: powerz code, where a DMA transfer buffer may accidentally share a cacheline with a mutex, enabling a cacheline sharing risk for DMA. The issue is mitigated by using the high‑level DMA helpers to ensure no cacheline sharing occurs, and by removing the...

CVE-2026-46016

CVE-2026-46016 is a Linux kernel remoteproc issue for the xlnx driver where the receive callback does not guard against NULL messages, potentially enabling a crash scenario and requiring a fix. The publicly referenced OSV entries indicate patches have been released/applied in some distributions (...

CVE-2026-46017

CVE-2026-46017 involves a Linux kernel race in the migration path for folios. The vulnerability stems from a deferred split queue race during migrate_folio_move(): dst can become visible and then be requeued too late, allowing a concurrent rmap-removal path to mark dst partially mapped and trigge...

CVE-2026-46022

CVE-2026-46022 relates to the Linux kernel code in misc: ibmasm where an OOB MMIO read occurs in ibmasm_handle_mouse_interrupt due to unbounded queue index usage. The root cause is unbounded values from get_queue_reader()/get_queue_writer() fed into get_queue_entry(), producing a potentially inva...

CVE-2026-46081

CVE-2026-46081 is a Linux kernel vulnerability in the crypto/acomp subsystem. The issue arises when an asynchronous hardware implementation (e.g., QAT) completes a request using the DMA virtual address interface, causing acomp_save_req() to store a pointer to the wrong object in req->base.data...

CVE-2026-46100

CVE-2026-46100 concerns the Linux kernel AFS subsystem where a change to mmap_prepare() could leak a refcount when a merge or allocation failure occurs after the call. The public descriptions across multiple sources indicate a partial revert of the change that converted generic_file_mmap() users ...

CVE-2026-46127

CVE-2026-46127 affects the Linux kernel RDMA/ocrdma; the bug is a NULL dereference in ocrdma_copy_pd_uresp() when uctx is uninitialized, potentially causing a crash. Connected sources indicate patches exist in multiple OSV entries (Root:rootio-linux for Ubuntu 24.04 and Debian 11/12, OpenSUSE/ope...

CVE-2026-46208

In the Linux kernel, batman-adv has a vulnerability where tp_meter sessions are not stopped during mesh teardown in batadv_mesh_free(). This allows a running sender thread or late tp_meter packets to keep operating against a mesh instance that is shutting down, potentially causing system instabil...

CVE-2026-46210

The CVE-2026-46210 issue affects the Linux kernel Iris media driver. A race between per-instance locks (inst->lock) and the core list lock (core->lock) allows a use-after-free during MBPF checks: MBPF iterates the core list and reads fields like fmt_src->width/height while iris_close() m...

CVE-2026-46251

The CVE-2026-46251 issue is a Linux kernel Btrfs vulnerability where, when EXTENT_TREE_V2 is enabled, the block_group_tree may be added to switch_commits while still on the dirty_list, causing invalid list manipulation and corruption of block_group_root->dirty_list. This corruption can propaga...

CVE-2026-46305

CVE-2026-46305 affects the Linux kernel, specifically the staging/rtl8723bs path. The issue arises when kzalloc_flex()’s return value is used without checking for allocation failure, leading to a potential NULL pointer dereference when accessing the allocated structure. The fix guards access to t...

CVE-2026-52915

CVE-2026-52915 concerns the Linux kernel netfilter ip6t_hbh module, where ip6t_opts may store at most IP6T_OPTS_OPTSNR (16) option descriptors but hbh_mt6_check() did not reject larger optsnr values from userspace. This allowed a potential out-of-bounds condition (UBSAN: array-index-out-of-bounds...

CVE-2026-52977

Concretely, CVE-2026-52977 affects the Linux kernel futex subsystem, specifically a race between wait-requeue-pi and requeue-PI that could cause a live lock on certain scheduling orders (notably UP). The issue arises when top waiters are handled while a signaled/timeout waiter is removing itself ...

CVE-2026-52979

CVE-2026-52979 is a Linux kernel vulnerability in the PSP subsystem. The issue arises in psp_assoc_device_get_locked(): it takes a psp_dev reference via psp_dev_get_for_sock() (which uses psp_dev_tryget() under RCU), then acquires psd->lock and drops the registration reference. If psp_dev_unre...

CVE-2026-53100

CVE-2026-53100 affects the Linux kernel mt76 wireless driver. The deadlock occurs when remain-on-channel logic calls mt76_set_channel() while dev->mutex is already held by remain_on_channel/roc_complete, since mt76_set_channel() also locks the mutex. The fix replaces mt76_set_channel() with __...

CVE-2026-53143

In the Linux kernel DRM/AMD KFD path, CVE-2026-53143 describes a buffer overflow during CRIU checkpoint/restore for SDMA queues on Navi3x. The v11 MQD manager used the larger v11_compute_mqd buffer (2048 bytes) for KFD_MQD_TYPE_SDMA, instead of the smaller v11_sdma_mqd (512 bytes), causing a 1536...

CVE-2026-53161

The CVE-2026-53161 entry concerns a use-after-free in the Linux kernel fastrpc subsystem. A race between fastrpc_device_release() (on file close) and the workqueue processing DSP responses can free the fastrpc_user while an in-flight DSP invocation is completing, leading to dereferencing freed co...

CVE-2026-53214

The CVE-2026-53214 entry concerns the Linux kernel IPv6 code. The vulnerability occurs when addrconf_get_prefix_route() can return the fib6_null_entry sentinel, which has a NULL fib6_table pointer. Before setting a route’s expiration time, the code must verify that it is not operating on the fib6...

CVE-2026-53280

CVE-2026-53280 relates to the Linux kernel IOMMU path. A NULL dereference of group->domain could occur when a default IOMMU domain fails to allocate during the first probe, causing a crash at domain->ops->attach_dev in __iommu_attach_device() invoked by pci_dev_reset_iommu_done(). The co...

CVE-2026-53300

CVE-2026-53300 – Linux kernel net: enetc DMA use-after-free fix . The connected documents describe concrete fixes: (1) convert cbdr->ring_lock from a spinlock to a mutex to safely reclaim used BDs and release DMA memory within a sleep-capable context; (2) introduce a software shadow BD (netc_s...

CVE-2026-53315

The CVE affects the Linux kernel DRM AMD ras subsystem, specifically ras_core_get_utc_second_timestamp(). The root cause is a potential NULL pointer dereference when ras_core is NULL, as the function may access ras_core->dev to log an error if a conditional check fails. The fix adds an early N...

CVE-2026-53316

CVE-2026-53316 : In the Linux kernel, the DRM/AMD ras subsystem suffers a NULL pointer dereference in ras_core_ras_interrupt_detected() when ras_core is NULL and ras_core->dev is accessed in the error path. This has been fixed in kernel code (see commits referenced by the CVE). The vulnerabili...

CVE-2026-53319

Mode C: Normal (details available) CVE-2026-53319 affects the Linux kernel block writeback throttling (blk-wbt) code. The issue arises in wbt_init_enable_default(), which previously used WARN_ON_ONCE to report failures from wbt_alloc() and wbt_init(). These failure paths are expected: wbt_alloc()...

CVE-2026-53331

CVE-2026-53331 is a Linux kernel vulnerability in the slimbus subsystem (qcom-ngd-ctrl) caused by inverted lock acquisition order between the slim_controller lock and tx_lock during SSR/PDR down notification, risking a deadlock and lockdep splats. The advisory notes this was resolved by stopping ...

CVE-2026-53348

CVE-2026-53348 affects the Linux kernel ASoC SDCA component. The root cause is a NULL pointer dereference in sdca_dev_unregister_functions where func_dev entries may be NULL if a registration failed early or a deferral race occurs during cleanup, leading to a kernel oops (device_del). The issue i...

CVE-2026-53373

The CVE-2026-53373 issue is in the Linux kernel’s mm/vma path: in certain stacked driver scenarios, mmap_prepare() invoked from the mmap() hook may expose a not-fully-established VMA to the caller, risking unsafe unmapping as the VMA is detached. The fix propagates the context of the mmap action ...

CVE-2026-64045

CVE-2026-64045 (Linux kernel, ovpn tcp close race) : The vulnerability stems from ovpn_tcp_close() loading the ovpn_socket pointer under RCU read-lock, then using sock->peer after releasing the lock, while ovpn_socket_release() may detach the socket concurrently. The fix tightens the pattern b...

CVE-2026-64077

The CVE-2026-64077 issue concerns the Linux kernel netfilter ebtables component, resolved by moving to a two-stage removal scheme. The root cause is an incompatibility in ebt_table layout that prevents reusing xt helpers. As a remediation, table->ops assignment is now performed while the ebt m...

CVE-2026-64185

Technical details for CVE-2026-64185 are not publicly available in the provided documents. Monitor for official advisories; no product/vendor/version/root-cause/mitigation information is available here.

CVE-2026-64210

Summary of CVE-2026-64210 (Linux kernel, net/mlx5e/xsk): The vulnerability arises from unlocking writes to the ICOSQ during NAPI polling when CPU affinity changes while XSK work remains. Two races are described: A) mlx5e_trigger_irq() executes on the old CPU after napi_complete_done() while mlx5e...

CVE-2026-64252

CVE-2026-64252 - Linux kernel MIPS XKPHYS console buffer truncation : In 64-bit configurations, the initial console output path could place the firmware’s buffer for printf() into the XKPHYS memory segment via the initial kernel thread, causing truncation to a 32-bit address when firmware runs, p...

CVE-2026-64312

The CVE-2026-64312 vulnerability affects the Linux kernel crypto/pcrypt path. Specifically, when padata_do_parallel() returns -EBUSY and the code falls back to invoking the child AEAD directly, the padata completion callback must not be kept. Otherwise, an asynchronous completion could run pcrypt...

CVE-2026-64326

CVE-2026-64326 is a denial-of-service flaw in the Linux kernel's block subsystem . When bdev_mark_dead() is called with surprise == true (device already gone), the bare block-device path unconditionally invokes sync_blockdev(), which can hang indefinitely in folio_wait_writeback() waiting on I/O ...

CVE-2026-64327

CVE-2026-64327 affects the Linux kernel USB gadget f_fs (FunctionFS) component. The root cause is that epfile->in was only initialized in ffs_func_eps_enable() (triggered on USB host connection), so early userspace ioctls such as FUNCTIONFS_DMABUF_ATTACH executed before host connection would o...

CVE-2026-64335

CVE-2026-64335 affects the digi_acceleport USB serial driver in the Linux kernel. If a serial port is closed while throttled, the read URB is never resubmitted, leaving the port unable to receive any further data until the device is reconnected or the driver is rebound. The fix clears throttle fl...

CVE-2026-64347

CVE-2026-64347 affects the Linux kernel USB gadget composite driver (composite_setup() OTG handler). The root cause is a dead empty check : list_first_entry() never returns NULL on an empty list, so the if (!config) guard is ineffective. When cdev->configs is empty—triggered by a teardown race...

CVE-2026-64366

CVE-2026-64366 affects the Linux kernel HID wacom driver. The vulnerability stems from wacom_wac_queue_insert() calling kfifo_skip() in a loop even when the FIFO could be empty. When empty, stale data in the kmalloc buffer can be read by __kfifo_peek_n() and treated as a record length, advancing ...

CVE-2026-64394

Summary: CVE-2026-64394 relates to the Linux kernel ksmbd SMB2 SET_INFO SECURITY path. The fix adds a per-handle access gate to prevent rewriting security descriptors when the handle lacks WRITE_DAC/WRITE_OWNER. Previously, SMB2_SET_INFO with InfoType SMB2_O_INFO_SECURITY could re-permission a fi...

CVE-2026-64412

The CVE-2026-64412 issue affects the Linux kernel’s netfilter ebtables component, where module names must be null-terminated. The root cause is failing to explicitly check length, which could allow passing a non-null terminated string to request_module(), potentially enabling a local impact as de...

CVE-2022-49939

In CVE-2022-49939, the vulnerability is in the Linux kernel binder code where a race between closing a node reference and binder_deferred_release can cause a use-after-free: a weak_handle transaction may fail to increment a node’s reference, and if the target process is dying, the cleanup is dela...

CVE-2022-49947

CVE-2022-49947: Linux kernel binder null-ptr dereference in alloc->vma_vm_mm. Connected reports confirm a fix: initialize alloc->vma_vm_mm during open() and cache from current->mm to guarantee safe mmap_lock usage when a binder_proc has not mmap’d to set up alloc space. Descriptions deta...