CVE-2026-46077

CVE-2026-46077 involves a Linux kernel crypto module (atmel-tdes) where DMA sync direction was incorrect. The issue occurs when DMA output was consumed by the CPU and the address_out was not synced with the CPU correctly, risking stale data on non‑coherent platforms. The published fixes switch to...

CVE-2026-45873

CVE-2026-45873 concerns Linux kernel netfilter nft_set_rbtree. The issue arises from partial overlap detection for anonymous sets where adjacent intervals omit end elements, allowing overlaps such as A-B and A-C with C

CVE-2026-45877

CVE-2026-45877 concerns the Linux kernel HID driver for Intel ISH. The issue is a NULL-pointer dereference in ishtp_bus_remove_all_clients during a warm reset when cl->device may be NULL while clients are enumerated, leading to a kernel panic. Multiple sources (NVD, Red Hat, SUSE, Debian/OSV, ...

CVE-2026-45915

CVE-2026-45915 — FAT filesystem rmdir link-count underflow (Linux kernel) Root cause: When FAT images are corrupted, a directory inode’s i_nlink can be incorrect (e.g., 2) while subdirectories exist, causing rmdir to call drop_nlink(dir) unconditionally and potentially drive i_nlink to 0, trigger...

CVE-2026-45932

CVE-2026-45932 – Linux kernel (bpf: Fix tcx/netkit detach permissions when prog fd isn’t given) The issue allows BPF_PROG_DETACH on tcx or netkit devices to be executed by any user when no program FD is provided, bypassing permission checks. A fix was added to require CAP_NET_ADMIN or CAP_SYS_ADM...

CVE-2026-45968

The CVE-2026-45968 issue is in the Linux kernel cpuidle: when only a single idle state is available (e.g., certain PowerNV platforms), the ladder governor can select an out-of-bounds state. The fix adds a bail-out in cpuidle_select() to return state 0 directly when state_count <= 1, bypassing ...

CVE-2026-45969

The CVE concerns the Linux kernel HID PlayStation driver. In ps_gamepad_create(), the call to input_ff_create_memless() is made without verifying its return value, which can cause incorrect behavior or crashes when Force Feedback effects are triggered. Multiple connected sources indicate the issu...

CVE-2026-45981

CVE-2026-45981 (Linux kernel, s390/cio): The vulnerability stems from device lifecycle mismanagement in css_alloc_subchannel() where, if dma_set_coherent_mask() or dma_set_mask() fails, the error path frees the subchannel without proper device model reference counting. After device_initialize() i...

CVE-2026-46009

CVE-2026-46009 – Linux kernel PCIe endpoint ntb teardown issue (mode: normal) The vulnerability arises from epf_ntb_epc_destroy() performing duplicate resource teardown, causing an oops if .allow_link fails or .drop_link is used. The fix removes this helper and also drops pci_epc_put(), tying EPC...

CVE-2026-46016

CVE-2026-46016 is a Linux kernel remoteproc issue for the xlnx driver where the receive callback does not guard against NULL messages, potentially enabling a crash scenario and requiring a fix. The publicly referenced OSV entries indicate patches have been released/applied in some distributions (...

CVE-2026-46019

CVE-2026-46019 concerns the Linux kernel crypto/atmel-aes path. The issue: atmel_aes_buff_init() allocates 4 pages (ATMEL_AES_BUFFER_ORDER) but atmel_aes_buff_cleanup() frees only the first page via free_page(), leaking 3 pages. Resolution: use free_pages() with ATMEL_AES_BUFFER_ORDER to properly...

CVE-2026-46023

CVE-2026-46023 is a Linux kernel vulnerability in dm-mirror where create_dirty_log() could bypass argc checks due to an unsigned add of 2 + param_count, allowing an out-of-bounds read in argv when param_count is near UINT_MAX. The root cause is an overflow in argument count calculation before val...

CVE-2026-46026

CVE-2026-46026 concerns a bound-check omission in the Linux kernel’s net: qrtr: ns path, allowing a local attacker to flood LOOKUP messages; fix clamps the global maximum lookups to 64. Affected component is the qrtr ns logic, with local-privilege abuse leading to potential denial or resource exh...

CVE-2026-46036

The CVE covers a race in the Linux kernel vfio/cdx driver where concurrent VFIO_DEVICE_SET_IRQS ioctls can observe inconsistent state of config_msi and cdx_irqs, leading to use-after-free of the cdx_irqs array. A per-device mutex (cdx_irqs_lock) is added to struct vfio_cdx_device and is acquired ...

CVE-2026-46044

CVE-2026-46044 affects the Linux kernel IPMI SSIF path. The vulnerability arises when an error occurs after the ssif kthread is created but before the main IPMI code starts the ssif interface, allowing the kthread to continue running. The issue is resolved by ensuring the kthread is stopped on er...

CVE-2026-46076

The CVE-2026-46076 entry concerns the Linux kernel KVM nSVM, where an unhandled VMMCALL can produce an Undefined Opcode (#UD) when L2 is active, L1 does not intercept, nested_svm_l2_tlb_flush_enabled() is true, and the hypercall is not among the supported Hyper-V hypercalls. The vulnerability ari...

CVE-2026-46186

Summary: CVE-2026-46186 affects the Linux kernel Bluetooth virtio_bt driver. The vulnerability arises in virtbt_rx_handle(), which reads the leading pkt_type byte from RX skb and forwards the rest to hci_recv_frame() for multiple packet types without validating that the remaining payload is large...

CVE-2026-46192

CVE-2026-46192 concerns the Linux kernel spi: microchip-core-qspi driver, where transmitting garbage data during emulated read-only dual/quad operations could brick the QSPI transfer. The issue was resolved in the kernel, with reads handled by the core via clock cycles, removing the need to emit ...

CVE-2026-46201

CVE-2026-46201 affects the Linux kernel drm/xe: an error path in xe_gem_prime_import() leaks a dma_buf attachment when xe_dma_buf_init_obj() fails, because the attachment from dma_buf_dynamic_attach() is not detached. The fix explicitly detaches via dma_buf_detach() before returning an error, avo...

CVE-2026-46248

CVE-2026-46248 pertains to the Linux kernel ath12k Wi‑Fi driver. When an arvif (Access Point Virtual Interface) is initialized in non-AP STA mode and MLO connection setup fails before arvif->is_created becomes true, the error path can leave a stale ahvif->links_map entry and, on reusing the...

CVE-2026-52916

CVE-2026-52916 affects the Linux kernel’s BATMAN-adv frag handling. A crafted BATADV_UNICAST_FRAG packet can defragment into another BATADV_UNICAST_FRAG, causing unbounded recursion in batadv_batman_skb_recv() and leading to kernel stack exhaustion. The published description specifies that refrag...

CVE-2026-52920

The CVE-2026-52920 involves the Linux kernel netfilter xt_policy module, where strict inbound policy matching previously consumed info->pol[] in an incorrect order when multiple transforms were applied. Root cause: match_policy_in() iterates sec_path entries from last to first, violating the f...

CVE-2026-52953

The CVE-2026-52953 issue affects the Linux kernel IOMMU VT-d subsystem, where an out-of-scope memory access could trigger a general protection fault (kernel oops) when a QEMU process is terminated. The triggering path involves domain_remove_dev_pasid and related IOMMU PASID handling, with a dummy...

CVE-2026-52979

CVE-2026-52979 is a Linux kernel vulnerability in the PSP subsystem. The issue arises in psp_assoc_device_get_locked(): it takes a psp_dev reference via psp_dev_get_for_sock() (which uses psp_dev_tryget() under RCU), then acquires psd->lock and drops the registration reference. If psp_dev_unre...

CVE-2026-53058

CVE-2026-53058 affects the Linux kernel DRM Cadence CDNS-MHDP8546 core in atomic_enable paths. The fault occurs when errors in cdns_mhdp_link_up() or cdns_mhdp_reg_read() cause a NULL pointer in modeset_retry_fn() because the connector isn’t initialised. The fix adds a connector_ptr to the mhdp d...

CVE-2026-53070

The CVE-2026-53070 issue affects the Linux kernel SCTP over UDP path. It concerns the IPv4/IPv6 sctp_udp_xmit code where xmit_skb() execution must occur with BH disabled; after a recursion-limit change, the context could migrate between CPUs, upsetting the dev_xmit_recursion pairing and potential...

CVE-2026-53149

CVE-2026-53149 affects the Linux kernel Thunderbolt code path, where __tb_property_parse_dir() may read beyond the root directory block due to missing bounds checks on content_offset/content_len. The issue could allow reading past a directory block, with high impact to confidentiality and availab...

CVE-2026-53158

The CVE-2026-53158 issue affects the Linux kernel misc: fastrpc subsystem, where a NULL pointer dereference could occur in rpmsg callback if fastrpc_rpmsg_probe() hasn’t completed or if the callback fires before dev_set_drvdata(). The fault trace points to a NULL cctx in fastrpc_channel_ctx when ...

CVE-2026-53168

The CVE-2026-53168 issue affects the Linux kernel FUSE implementation. It concerns fuse_notify() pagecache operations on directories, where FUSE_NOTIFY_STORE/RETRIEVE could allow the FUSE daemon to access pagecache contents in kernel-internal storage for directories using FOPEN_CACHE_DIR. The fix...

CVE-2026-53200

The CVE refers to the Linux kernel KVM on ARM64 where the XN bit handling was broken when FEAT_XNX is not enabled. Specifically, a FIELD_PREP() mask used to clear XN[0] manipulated the wrong bit, unconditionally granting execute permissions. The issue is resolved by correcting the bit manipulatio...

CVE-2026-53201

CVE-2026-53201 affects the Linux kernel, with multiple sources (NVD, OSV, Debian security tracker, Ubuntu, etc.) describing a fix that reverts a prior optimization. The issue arises because the idle-skip optimization in the DRM/xe path can bypass GuC suspend, potentially skipping the context-swit...

CVE-2026-53203

CVE-2026-53203 affects the Linux kernel’s accel/ivpu component. A buffer overflow can occur when the firmware returns a metric-stream info size larger than the allocated buffer during get_info_ioctl; if this happens, the operation could copy beyond the buffer. Remediation implemented in the publi...

CVE-2026-53272

The CVE-2026-53272 issue affects the Linux kernel’s erofs subsystem. A use-after-free on sbi->sync_decompress can occur when z_erofs_endio() queues z_erofs_decompressqueue_work() and, after folios are unlocked, the unmount path completes with sbi freed before sbi->sync_decompress is accesse...

CVE-2026-53284

CVE-2026-53284 (Linux kernel, btrfs): The issue arises in btrfs_write_and_wait_transaction() where, after an error from btrfs_write_marked_extent(), the code still calls btrfs_extent_io_tree_release() to clear the dirty_pages io tree. This tree may contain records not yet submitted, and subsequen...

CVE-2026-53291

CVE-2026-53291 affects the Linux kernel ALSA hda/conexant driver. The root cause is the ignored return value from snd_hda_jack_detect_enable_callback() in cx_probe(); if the call fails, an error pointer is returned and not checked, potentially leading to a crash when jack events are handled. The ...

CVE-2026-53300

CVE-2026-53300 – Linux kernel net: enetc DMA use-after-free fix . The connected documents describe concrete fixes: (1) convert cbdr->ring_lock from a spinlock to a mutex to safely reclaim used BDs and release DMA memory within a sleep-capable context; (2) introduce a software shadow BD (netc_s...

CVE-2026-53331

CVE-2026-53331 is a Linux kernel vulnerability in the slimbus subsystem (qcom-ngd-ctrl) caused by inverted lock acquisition order between the slim_controller lock and tx_lock during SSR/PDR down notification, risking a deadlock and lockdep splats. The advisory notes this was resolved by stopping ...

CVE-2026-64047

The CVE-2026-64047 issue is in the Linux kernel’s net: tls code, specifically an off-by-one in sg_chain entry counting for the wrapped sk_msg scatterlist ring. When sg.end

CVE-2026-64071

CVE-2026-64071 is a use-after-free in the Linux kernel's nvme-pci driver. The function nvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous() but fails to NULL the pointer. When nvme_probe() triggers an I/O error during HMB setup, the error path calls nvme_free_host_mem() a secon...

CVE-2026-64077

The CVE-2026-64077 issue concerns the Linux kernel netfilter ebtables component, resolved by moving to a two-stage removal scheme. The root cause is an incompatibility in ebt_table layout that prevents reusing xt helpers. As a remediation, table->ops assignment is now performed while the ebt m...

CVE-2026-64185

Technical details for CVE-2026-64185 are not publicly available in the provided documents. Monitor for official advisories; no product/vendor/version/root-cause/mitigation information is available here.

CVE-2026-64231

CVE-2026-64231 affects the Linux kernel component DRM MSM DSI on DSI 6G platforms. The issue arises from improper adjustment of memory-dump size after the IO address space is offset by io_offset, which could allow access to unmapped regions. The stated remediation is to lower the ctrl_size by the...

CVE-2026-64434

The provided reports (Linux kernel CVE-2026-64434) detail a use-after-free in Bluetooth L2CAP channel timeout (l2cap_chan_timeout) where chan->conn could be freed while a timer is pending. The effective fix is to have the channel hold a reference to the associated l2cap_conn (via l2cap_conn_ge...

CVE-2022-50043

CVE-2022-50043 is a Linux kernel vulnerability in ndisc_router_discovery where, on certain paths after grabbing rt and neigh, a nonzero lifetime with a metric change causes the code to delete the route and potentially reacquire rt/neigh without decrementing the previous neigh reference count, lea...

CVE-2022-50057

CVE-2022-50057 affects the Linux kernel ntfs3 file system. The vulnerability is a NULL dereference in ntfs_update_mftmirr where, if ntfs_fill_super() wasn’t called, sbi->sb could be NULL and dereferenced. The failure path is triggered by certain mount parameters (e.g., an invalid or unexpected...

CVE-2022-50210

CVE-2022-50210 concerns the Linux kernel on MIPS where a warning is produced in /proc/cpuinfo due to cpu_max_bits_warn() iterating CPUs with NR_CPUS when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled. The root cause is using NR_CPUS as the iteration limit; the fix switches to ...

CVE-2022-50241

CVE-2022-50241 is a Linux kernel local-use-after-free in NFSD during inter-server copy. The race occurs when a CLOSE may be sent before FREE_STATEID, leaving a freed lock/state entry on the s2s_cp_stateids/sc_cp_list and triggering a BAD_STATEID on subsequent FREE_STATEID. The referenced patches ...

CVE-2022-50242

CVE-2022-50242 pertains to the Linux kernel driver in the qlcnic SR-IOV path. The vulnerability arises in the function qlcnic_sriov_init() when allocating virtual ports (vp); if vp allocation fails, previously allocated vps are not freed, creating a potential memory leak. The connected advisories...

CVE-2022-50261

Summary (CVE-2022-50261) : Linux kernel drivers for STI DRM (sti_hda.c, sti_dvo.c, sti_hdmi.c) used an int return type for mode_valid(), but the drm_connector_helper_funcs prototype requires returning an enum drm_mode_status. This mismatch can trigger a CFI (kCFI) failure and runtime problems (ke...

CVE-2022-50272

CVE-2022-50272 affects the Linux kernel’s media: dvb-usb az6027 driver. In az6027_i2c_xfer(), a null-ptr-deref can occur when an I2C message has addr 0x99 with len=0 and buf=NULL, allowing a kernel crash. The fix is to validate msg[i].len before accessing msg[i].buf. Unity Linux advisories (UTSA-...