CVE-2023-53491

CVE-2023-53491 – Linux kernel : The advisory notes that start_kernel now uses an __no_stack_protector function attribute to selectively disable stack canaries on specific functions. The root cause is a per-function control of stack protector usage; prior to this, boot_init_stack_canary relied on ...

CVE-2023-53509

CVE-2023-53509 : In the Linux kernel qed_mcp_trace_dump() path, the code previously slept due to a 10µs-delayed loop in qed_mcp_cmd_and_union() which can spin up to 500k iterations, potentially blocking a thread for several seconds. The vulnerability description states that sleeping is permitted ...

CVE-2023-53510

CVE-2023-53510 : Linux kernel SCSI UFS core vulnerability. The issue is that ufshcd_queuecommand() could be invoked twice for a SCSI command before completion, caused by improper handling of lrbp->cmd in command submission paths. The fix, per the description, disables checking/clearing of the ...

CVE-2023-53515

CVE-2023-53515 affects the Linux kernel virtio-mmio subsystem. The issue stems from allocating vm_dev with devres, which breaks the vm_dev lifecycle tied to a struct device; when the platform_device is removed, the memory is freed before vm_dev release, causing a use-after-free when the release c...

CVE-2023-53527

CVE-2023-53527: In the Linux kernel Thunderbolt code, tb_handle_dp_bandwidth_request() leaks memory allocated in tb_queue_dp_bandwidth_request() if not freed after the request, with a fix that ensures memory is released. References point to kernel commits 596a5123cc... and 0752bb32ae... (no explo...

CVE-2023-53558

CVE-2023-53558 affects the Linux kernel. Details from the initial document show a bug in rcu-tasks: pr_info() was called while holding rtp->cbs_gbl_lock, which could sleep and trigger a BUG; the vulnerability is resolved by moving pr_info() so it runs without the lock. The patch is described a...

CVE-2023-53612

CVE-2023-53612 affects the Linux kernel hwmon subsystem, specifically the coretemp platform driver. The vulnerability arises from unconventional platform-device handling where work is done globally by initcalls and CPU hotplugnotifiers, while the driver mainly wraps allocation and hwmon interface...

CVE-2023-53616

CVE-2023-53616 affects the Linux kernel’s JFS IMAP unmount path. The issue is a double-free during diUnmount in jfs_imap.c where JFS_IP(ipimap)->i_imap is freed but not nulled, risking a subsequent free if remounts fail at diMount. The root cause is i_imap not being set to NULL after free, pot...

CVE-2023-53631

CVE-2023-53631 — In Linux kernel, platform/x86 dell-sysman reference leak: if kset_find_obj() finds a duplicate attribute, a reference to that attribute can be returned and may not be disposed, potentially leaking references. Patch note: use kobject_put() to dispose the duplicate attribute. Affec...

CVE-2025-38358

CVE-2025-38358 relates to a race in Linux kernel’s btrfs async reclaim path. The bug occurs when an ordered iput is delayed while BTRFS_FS_STATE_NO_DELAYED_IPUT is already set, triggering an assertion in btrfs_add_delayed_iput during close_ctree. The described scenario: async reclaim schedules wr...

CVE-2025-38378

CVE-2025-38378 affects the Linux kernel HID path for appletb-kbd. The defect is a slab use-after-free caused when a timer (kbd->inactivity_timer) is armed after probe failure and later expires, accessing memory (kbd) that has been freed. Root cause: failure paths do not disarm the timer. Fixes...

CVE-2025-38398

CVE-2025-38398 affects the Linux kernel driver for spi-qpic-snand. Memory corruption arises from out-of-bounds access in BAM transaction handling: the BAM transaction structure is sized for one codeword during probe, but the required space depends on the NAND chip page size. As a result, flash op...

CVE-2025-38600

The CVE-2025-38600 entry concerns the Linux kernel driver for Mediatek MT7925 (mt76 mt7925) where an off-by-one in mt7925_mcu_hw_scan() could trigger an out-of-bounds access. The bug arises from ssid->ssids[] and sreq->ssids[] sized with MT7925_RNR_SCAN_MAX_BSSIDS, with a comparison that mu...

CVE-2025-38607

CVE-2025-38607 refers to a Linux kernel issue in the BPF verifier where BPF_JSET (conditional jump) was not handled correctly in CFG/live register/SCC computation. The described flaw could cause incorrect live-register tracking and SCC analysis due to can_jump() not accounting for jset, potential...

CVE-2025-38620

The CVE-2025-38620 vulnerability affects the Linux kernel’s zloop (zoned loop) device. It arises from a use-after-free in blk_mq_free_tag_set() during zloop removal: zloop_ctl_remove() frees zlo memory (via zloop_free_disk()) and then accesses zlo->tag_set, which now points to freed memory. Th...

CVE-2025-38726

CVE-2025-38726 affects the Linux kernel driver net ftgmac100. The issue arises in ftgmac100_phy_disconnect: after phy_disconnect(), netdev->phydev is reset to NULL, which could cause fixed_phy_unregister() to be invoked with a NULL pointer. The connected documents confirm this NULL-pointer use...

CVE-2025-39695

CVE-2025-39695 affects the Linux kernel RDMA/rxe path. The issue arises when skb packets that depend on RXE resources (e.g., QP, sk) are destroyed while RXE resources are being released, causing call traces. The patch adds a timestamp when skb packets are created to avoid skb packets hanging in s...

CVE-2025-39745

CVE-2025-39745 relates to the Linux kernel rcutorture code path in PREEMPT_RT builds. The issue manifests as a splat in rcutorture_one_extend_check() during RT testing due to an interaction with preempt_count/softirq handling; Debian/OSS and OSV/NVD records indicate the vulnerability has been res...

CVE-2025-39827

CVE-2025-39827 affects the Linux kernel’s rose networking path. The issue arises from two separate reference counting paths for rose_neigh: a numeric count from rose_node structures and a use/refcount_t from rose_sock. The patch merges these into a single lifecycle by incrementing/decrementing ro...

CVE-2025-39846

CVE-2025-39846 : In the Linux kernel, a NULL pointer dereference could occur in PCMCIΑ code during resource allocation. Specifically, __iodyn_find_io_region() assigns pcmcia_make_resource() to res and uses it in pci_bus_alloc_resource(); if pcmcia_make_resource() fails, a dereference of res could...

CVE-2025-39895

CVE-2025-39895: Linux kernel sched_numa_find_nth_cpu() could dereference a null pointer when the CPU mask used by sched_domains_numa_masks does not intersect with the cpus offline. The fix makes the function bail out when bsearch returns NULL instead of dereferencing, preventing a kernel Oops. Af...

CVE-2025-39899

CVE-2025-39899 concerns the Linux kernel mm/userfaultfd path where, on 32-bit ARM with CONFIG_HIGHPTE, move_pages_pte() maps PTE pages using kmap_local_page() and must unmap them in LIFO order. The current code unmapped dst_pte then src_pte in the same sequence, violating LIFO and triggering a ku...

CVE-2025-39905

The CVE-2025-39905 issue affects the Linux kernel phylink path: the race arises from phylink_resolve() manipulating pl->phydev under pl->state_mutex, creating a lock-order inversion with pl->phydev->lock. The fix introduces an explicit lock to serialize concurrent writes to pl->phy...

CVE-2025-39951

CVE-2025-39951 is a Linux kernel use-after-free issue in virtio_uml during probe, fixed by virtio_uml_probe() logic (vu_dev->registered set only after successful registration). Connected advisories show Debian LTS updates addressing this CVE in linux packages (5.10.247-1 for Debian 11 and linu...

CVE-2025-68725

CVE-2025-68725 affects the Linux kernel. A patch adds validation to gso_type in GSO handlers to prevent BPF test infra from emitting invalid GSO types to the stack (triggered via BPF programs, e.g., when redirecting to loopback). The issue could allow a local attacker using the BPF test infra to ...

CVE-2025-71143

CVE-2025-71143 concerns a Linux kernel issue in clk: samsung: exynos-clkout where .num was initialized after .hws[] was accessed, triggering UBSAN_BOUNDS warnings. The fix moves the .num initialization before the first access of .hws[] (as noted in commit f316cdff8d67 and related annotations) to ...

CVE-2025-71163

CVE-2025-71163: In the Linux kernel DMA Engine idxd, the fix addresses device leaks by dropping the reference taken when looking up the idxd device during the compat bind/unbind sysfs interface. This is a kernel-level issue affecting the idxd component; the root cause is not detailed beyond the n...

CVE-2025-71182

CVE-2025-71182 is a Linux kernel vulnerability in the CAN j1939 subsystem where j1939_session_activate() could succeed after a netdevice unregister, due to race conditions around NETDEV_UNREGISTER handling. The issue is addressed by a kernel patch that ensures ndev->reg_state is checked with t...

CVE-2025-71285

Summary of the CVE-2025-71285 cluster: The Linux kernel’s net/qrtr MHI auto_queue feature for IPCR DL channels is being removed. The race occurs when the MHI stack can call the DL path callback before the QRTR client driver is fully initialized, risking NULL pointer dereferences. The fix disables...

CVE-2025-71308

CVE-2025-71308 affects the Linux kernel accel/amdxdna module. The vulnerability arises when error handling in aie2_create_context() calls aie_destroy_context() with a NULL mailbox channel pointer, causing a potential NULL pointer dereference and system crash. The fix replaces the call to aie_dest...

CVE-2026-23015

CVE-2026-23015 relates to the Linux kernel gpio_mpsse driver: a reference leak in gpio_mpsse_probe() error paths due to usb_get_dev() not being released. The fix uses device-managed helper functions and removes the usb_put_dev() call in the disconnect path, allowing automatic release of the refer...

CVE-2026-23135

CVE-2026-23135 affects the Linux kernel in the wifi ath12k driver. The issue arises in dma_free_coherent() pointer handling: dma_alloc_coherent() stores addresses in XXX_unaligned fields, but those addresses are not consistently reused when freeing the buffer. The vulnerability is resolved by pat...

CVE-2026-23262

CVE-2026-23262 affects the Linux kernel gve driver when queue counts are changed. The NIC and driver share a region in memory for stats reporting; the NIC calculates its offset into this region using the total stats size and the NIC’s own stats size. When the queue count increases, the driver res...

CVE-2026-23279

CVE-2026-23279 concerns the Linux kernel’s wifi/mac80211 mesh code. The issue is a NULL pointer dereference in mesh_rx_csa_frame() when the Mesh Channel Switch Parameters IE (IE 118) is absent; elems->mesh_chansw_params_ie can be NULL after mesh_matches_local(), yet code dereferences it uncond...

CVE-2026-23308

CVE-2026-23308 concerns a Linux kernel pinctrl equilibrium warning trace on load. The issue arises because eqbr_irq_mask() calls gpiochip_disable_irq() and eqbr_irq_ack() is also invoked, causing a warning for every GPIO during load. A fix was implemented by not using eqbr_irq_mask() and eqbr_irq...

CVE-2026-23313

CVE-2026-23313 : In the Linux kernel, a preempt-count leak was fixed in the i40e driver by replacing get_cpu() with smp_processor_id() in the napi poll tracepoint assignment. The leak occurred because put_cpu() was not invoked to undo the cpu reference, as illustrated by preempt_count traces. The...

CVE-2026-23415

The CVE-2026-23415 issue affects the Linux kernel futex subsystem. A race occurs between futex_key_to_node_opt() reading vma->vm_policy under speculative mmap lock/RCU and mbind() calling vma_replace_policy(), which can free the old mempolicy via kmem_cache_free(). This leads to a use-after-fr...

CVE-2026-23420

CVE-2026-23420 affects the Linux kernel wlcore Wi‑Fi driver. The issue is a locking-order bug where wl->mutex could be unlocked without being held, as identified by a Clang thread-safety analyzer. This is associated with potential synchronization instability; patches exist in Rootio‑Linux pack...

CVE-2026-23460

CVE-2026-23460 (Linux kernel) affects the Rose (net/rose) path. The bug occurs when a second connect() is issued while a first connect is in progress (state TCP_SYN_SENT); rose_get_neigh() may return NULL, leaving rose->state ROSE_STATE_1 with neighbour NULL, and on socket close rose_transmit_...

CVE-2026-31389

CVE-2026-31389 affects the Linux kernel SPI subsystem. The vulnerability is a use-after-free that can occur during controller registration if per-CPU statistics allocation fails, potentially leading to access of freed driver resources and unclocked register accesses. The issue is mitigated by a p...

CVE-2026-31392

CVE-2026-31392 concerns the Linux kernel SMB client and Kerberos username handling. The issue was fixed by ensuring the username mount option is respected when sec=krb5 is used, preventing reuse of an SMB session across mounts with different usernames. Connected OSV records show Debian/Ubuntu/roo...

CVE-2026-31454

Summary: CVE-2026-31454 affects the Linux kernel's XFS code. In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock is dropped to perform buffer IO, which can allow a log item to be freed during reclaim. A subsequent spin_lock() may dereference lip->li_ailp, causing a use-after...

CVE-2026-31481

CVE-2026-31481 affects the Linux kernel tracing code. The issue arises from boot-time trigger frees not being drained when kthread creation fails, causing boot-time deferred entries to leak and a NULL pointer dereference that crashes the system. The fix drains the entire queued list synchronously...

CVE-2026-31492

The CVE-2026-31492 entry concerns the Linux kernel RDMA irdma driver. Root cause: in irdma_create_qp, if ib_copy_to_udata fails, irdma_destroy_qp cleanup waits on free_qp completion that has not been initialized yet. The fix is to initialize the free_qp completion before the ib_copy_to_udata call...

CVE-2026-31506

The CVE-2026-31506 issue concerns the Linux kernel bcmasp component where the Wake-on-LAN (WoL) IRQ handler could be double-freed. The problem stems from handling of the WoL irq; the patch indicates wol_irq does not need explicit freeing because it is allocated with devm_request_irq, and devres h...

CVE-2026-31539

The CVE-2026-31539 entry describes a race condition in the Linux kernel smbdirect module where credits for receive buffers can be granted to a peer that has already consumed them. This could enable resource exhaustion and a DoS condition. The root cause is improper counting of posted recv_io cred...

CVE-2026-31593

CVE-2026-31593 is a Linux kernel KVM SEV SNP issue. The vulnerability arises when updating an already-launched and encrypted vCPU state: attempting to sync the vCPU's VMSA can trigger an SEV-SNP cryptographic memory protection (RMP) violation, causing a host panic/DoS. Technical details across mu...

CVE-2026-31617

Technical details are not publicly available in the provided documents. No vendor/product/version specifics are given beyond the general description. Monitor for updates in the connected sources.

CVE-2026-31638

The CVE-2026-31638 issue affects the Linux kernel rxrpc subsystem. When a client call on a channel has already been torn down, rxrpc_input_packet_on_conn() could still process a to-client packet; rxrpc_try_get_call() could return NULL and there would be no reference to drop. The code path then un...

CVE-2026-31738

CVE-2026-31738 concerns the Linux kernel vxlan code (vxlan_na_create) where ND option lengths are not properly validated. The flaw can cause the parser to advance beyond the option span or read an undersized LLADDR payload, enabling source address reading only when the option is large enough; imp...