CVE-2025-71080

CVE-2025-71080 concerns a race in Linux kernel IPv6 PREEMPT_RT code. On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, a preemption can allow another task on the same CPU to install a pcpu_rt entry; when the first task resumes, the cmpxchg() in rt6_make_pcpu_route() may fail and tri...

CVE-2023-53388

Summary of CVE-2023-53388 : In the Linux kernel, the DRM/Mediatek driver had a dangling pointer in the error path of the bind sequence. When mtk_drm_bind() fails, the code previously called drm_dev_put() to destroy the drm_device, but a private object still held a pointer to that device. If a sus...

CVE-2023-53402

CVE-2023-53402 affects the Linux kernel, specifically the printk debugfs path. The root cause is a memory leak in kernel/printk/index.c when using debugfs_lookup() without a matching dput(). The documented fix replaces the sequence with debugfs_lookup_and_remove(), handling the logic and preventi...

CVE-2023-53428

CVE-2023-53428 affects the Linux kernel powercap subsystem, specifically the arm_scmi implementation. The issue arises when powercap zones are retrieved from platforms and registered in a hierarchical tree; the current recursive walk can cause kernel stack overflow for large trees. The fix replac...

CVE-2023-53487

CVE-2023-53487 concerns the Linux kernel under POWERPC: the powerpc/rtas_flash path allowed a user to copy memory into flash_block_cache objects when hardened usercopy is enabled (CONFIG_HARDENED_USERCOPY=y). The flaw is triggered via the /proc/powerpc/rtas/firmware_update interface, causing a ke...

CVE-2023-53492

The CVE-2023-53492 entry describes a Linux kernel nf_tables issue: when adding a rule that refers to a chain by ID, Genmask was ignored if the chain had been deleted in the same batch, causing the rule to reference a deleted chain and trigger a warning. The root cause is nf_tables_lookup_byid ign...

CVE-2023-53518

CVE-2023-53518 — Linux kernel vulnerability fixed: leak in PM / devfreq path during devfreq_dev_release() and resources allocated by srcu_init_notifier_head() must be released via srcu_cleanup_notifier_head(). Connected advisories confirm the issue in the kernel and KMEMLEAK reporting. Exploitati...

CVE-2023-53581

CVE-2023-53581 affects the Linux kernel mlx5 core (net/mlx5e). The issue is a race: NOT_READY flag is checked before acquiring the necessary lock, allowing a flow to be concurrently removed from unready_flows by a workqueue, which can cause a double removal and a crash (as shown by the crash trac...

CVE-2023-53582

Concrete details found: CVE-2023-53582 affects the Linux kernel’s brcmfmac wifi driver. The issue is a stack-out-of-bounds read that occurs when a CLM version string, filled via memcpy() in brcmf_fil_iovar_data_get(), is passed as an argument to strreplace() in brcmf_c_preinit_dcmds() without bei...

CVE-2023-53624

The CVE-2023-53624 issue affects the Linux kernel’s net/sched implementation, specifically sch_fq. It arises when the initial quantum (configured for sch_fq) exceeds INT_MAX, causing the first assignment to the credit field to overflow to a very negative value. This can trigger a CPU soft-lockup ...

CVE-2023-53648

The CVE CVE-2023-53648 fixes a NULL pointer dereference in ALSA: ac97 in snd_ac97_mixer() within the Linux kernel. The issue occurred because rac97 could be NULL; the patch removes a redundant assignment and returns an error if rac97 is NULL. The documented impact is a local denial of service due...

CVE-2023-53665

CVE-2023-53665 : Linux kernel vulnerability in md/mdadm handling where after export_rdev(), mddev may be dereferenced via rdev->kobject; if the last rdev is freed, mddev might be invalid. This is caused by mddev->kobject being referenced by rdev->kobject and using mddev after export_rdev...

CVE-2023-53666

CVE-2023-53666 relates to the Linux kernel ASoC codecs (snd_soc_wcd_mbhc, wcd938x) where MBHC initialisation could fail and lead to a NULL/error pointer dereference while configuring the jack. The patch fixes missing error handling to prevent dereferencing an error pointer, addressing an issue th...

CVE-2025-38504

Summary: CVE-2025-38504 relates to the Linux kernel, specifically the io_uring/zcrx component. The connected documents describe a code-level fix in the destruction path for page pools, where a misplaced warning could trigger during destruction and affect niovs handling. The root cause is that nio...

CVE-2025-38592

CVE-2025-38592 affects the Linux kernel Bluetooth subsystem. The issue arises in hci_devcd_dump where dev_coredumpv and skb_put_data both use hdev->dump.head, allowing a freed vmalloc buffer to be accessed and causing vmalloc-out-of-bounds access. The documented root cause is that dev_coredump...

CVE-2025-39908

CVE-2025-39908 concerns a Linux kernel issue in the hwtstamp path under netdev lock during ioctl handling (net: dev_ioctl: take ops lock in hwtstamp lower paths). The vulnerability stems fromndo hwtstamp callbacks not consistently running under the per-device ops lock in lower get/set paths, with...

CVE-2025-39917

Summary (CVE-2025-39917) : Linux kernel bug in bpf_crypto_crypt allowed an out-of-bounds write when the destination dynptr size was smaller than the source, due to missing validation before crypto backend calls with len = src_len. The issue arises in the bpf_dynptr_data usage for src and the writ...

CVE-2025-39934

CVE-2025-39934: Linux kernel drm: bridge: anx7625 fixes a NULL pointer dereference when an IRQ fires before resource initialization, potentially accessing uninitialized I2C tcpc_client data. The NVD entry notes a MEDIUM base score (5.5) with LOCAL attack vector and LOW PR, HIGH impact on availabi...

CVE-2025-71071

In CVE-2025-71071, the Linux kernel iommu/mediatek driver had a use-after-free risk during probe deferral when larb devices were not yet bound. The issue arose from dropping references to larb devices taken during probe on success and on errors, potentially allowing a use-after-free if probe is d...

CVE-2025-71184

CVE-2025-71184 affects the Linux kernel’s btrfs subsystem. The issue is a NULL dereference in btrfs_evict_inode() when tracing inode eviction because the root may be NULL. The fix ensures root is treated as 0 or delays tracing until the root is non-NULL, preventing a NULL dereference during evict...

CVE-2025-71232

CVE-2025-71232 details (Linux kernel, qla2xxx): The vulnerability stems from freeing an sp pointer in the error path of the qla2xxx SCSI driver, which could cause a system crash during load/unload loops. The provided evidence shows a crash trace and a fix in the kernel code path (free sp in the e...

CVE-2025-71302

CVE-2025-71302 relates to the Linux kernel drm/panthor: a race in dma-fence safe access rules, potentially between drm_sched_fence_get_timeline_name and group_free_queue. The fix is implemented in commit 506aa8b02a8d6 (“dma-fence: Add safe access helpers and document the rules”). Public advisorie...

CVE-2026-23075

CVE-2026-23075 affects the Linux kernel CAN networking support. The issue arises from the esd_usb_read_bulk_callback() path where URBs for USB-in transfers are unanchored by the USB core after completion, leading to a memory leak if esd_usb_close() frees URBs that are no longer anchored. The fix ...

CVE-2026-23090

The CVE-2026-23090 entry concerns a Slimbus core device reference leak in the Linux kernel. The root cause is improper handling of device references when processing report-present messages, allowing dynamic Slimbus device allocations without correctly dropping references for previously registered...

CVE-2026-23091

CVE-2026-23091 concerns the Linux kernel intel_th subsystem, where a device-leak was reported during output open(). The description states to drop the reference taken when looking up the th device on errors and on close(). It notes that a recent commit fixed the leak in some open() error paths bu...

CVE-2026-23093

Summary (CVE-2026-23093) : In the Linux kernel, the ksmbd: smbd DMA unmapping path uses dma_unmap_sg() with a different number of entries than dma_map_sg(), which is the root cause of the vulnerability. The fix ensures dma_unmap_sg() is called with the same nents as dma_map_sg(). According to the...

CVE-2026-23129

Technical details for CVE-2026-23129 are not publicly available in the provided documents. The materials note a fix in Linux kernel dpll duplicate registrations and enforcing a single registration, but no further technical specifics are included. Monitor vendor advisories for updates.

CVE-2026-23157

CVE-2026-23157 is a Linux kernel vulnerability affecting the btrfs metadata writeback path. The issue occurs in the balance between dirty pages and a cgroup/global dirty limit, where an internal 32 MiB threshold for btrfs btree inode writeback prevents progress when the cgroup’s dirty pages excee...

CVE-2026-23164

CVE-2026-23164 affects the Linux kernel rocker subsystem. The root cause is a memory leak: rocker_world_port_pre_init() allocates rocker_port->wpriv with kzalloc, but rocker_world_port_post_fini() frees it only if wops->port_post_fini is set. Since rock­er_ofdpa_ops provides port_post_fini ...

CVE-2026-23250

CVE-2026-23250 is a Linux kernel vulnerability in the XFS code path. The issue arises from not checking the return value of xchk_scrub_create_subord, which could yield an ENOMEM mangling the flow. The fix updates xchk_scrub_create_subord to return NULL on allocation failure and adjusts callers to...

CVE-2026-23317

The CVE-2026-23317 entry describes a Linux kernel vulnerability in drm/vmwgfx, specifically vmw_translate_ptr. The root cause was a previous change where a pointer-returning lookup was replaced by an error-code-returning lookup with the pointer as an out parameter; the error path was not updated,...

CVE-2026-23362

CVE-2026-23362 affects the Linux kernel component can/bcm locking during bcm_op runtime updates (bcm_tx_setup/bcm_rx_setup). Connected OSV records show Root (rootio-linux) has patched this CVE in Root:Debian:11/12/13 with multiple fixed versions across Debian/Ubuntu and Mageia advisories, indicat...

CVE-2026-23364

CVE-2026-23364 concerns the Linux kernel’s ksmbd path, where MAC comparisons were not performed in constant time. The underlying issue is a timing-attack-prone memcmp() usage; the recommended fix is to replace memcmp() with crypto_memneq() to ensure constant-time comparisons. The vulnerability is...

CVE-2026-23374

CVE-2026-23374 affects the Linux kernel blktrace path. The root cause is tracing_record_cmdline() using __this_cpu_read()/__this_cpu_write() on a per-CPU variable while preemption is enabled, which is unsafe and triggers a kernel BUG in preemptible code through __blk_add_trace() paths. Public wri...

CVE-2026-23376

CVE-2026-23376 affects the Linux kernel nvmet-fcloop component. The vulnerability arises from not checking remoteport port_state before freeing resources in the fcloop_t2h_xmt_ls_rsp path, where lsrsp resources may be freed incorrectly if the remote port is not online. The fix updates fcloop_t2h_...

CVE-2026-23404

CVE-2026-23404 affects the Linux kernel AppArmor profile management. The issue arises from recursive profile removal in the AppArmor code path; nested profiles could trigger deep recursion, risking kernel stack exhaustion and system crashes. The connected documents confirm the root cause is the r...

CVE-2026-23454

CVE-2026-23454 (Linux kernel, mana subsystem) : A race in mana_hwc_destroy_channel() can free hwc->caller_ctx before CQ/EQ are destroyed, enabling a use-after-free/NULL dereference in mana_hwc_handle_resp(). The root cause is lack of IRQ synchronization and a teardown order that frees resource...

CVE-2026-23464

CVE-2026-23464 concerns the Linux kernel vulnerability in the Microchip PolarFire SoC mpfs driver. The issue is a memory leak in mpfs_sys_controller_probe(): if of_get_mtd_device_by_node() fails, the function returns early without freeing allocated memory for sys_controller. The fix routes error ...

CVE-2026-31403

CVE-2026-31403 is a Linux kernel vulnerability affecting NFSD where a proc entry (/proc/fs/nfs/exports) captured the caller’s network namespace without holding a reference. If the namespace is torn down after opening the exports fd (e.g., container destruction with setns), nfsd_net_exit() may fre...

CVE-2026-31406

The CVE-2026-31406 issue is a race in the Linux kernel xfrm path during network cleanup. After cancel_delayed_work_sync() is invoked from xfrm_nat_keepalive_net_fini(), xfrm_state_fini() flushes states and __xfrm_state_delete() calls xfrm_nat_keepalive_state_updated(), which can re-schedule nat_k...

CVE-2026-31422

CVE-2026-31422 affects the Linux kernel’s net/sched subsystem. The vulnerability occurs in flow_change() where tcf_block_q() dereferences q->handle to derive a default baseclass for shared blocks, while block->q can be NULL for shared blocks. The fix adds a check of tcf_block_shared() befor...

CVE-2026-31433

CVE-2026-31433 affects the Linux kernel ksmbd module. A vulnerability arises when processing a compound SMB request of QUERY_DIRECTORY + QUERY_INFO (FILE_ALL_INFORMATION): the code lacked a validation check on the client-provided OutputBufferLength before copying a filename into the smb2_file_all...

CVE-2026-31447

CVE-2026-31447 affects the Linux kernel ext4, where mounting a filesystem with bigalloc and s_first_data_block != 0 is rejected. The root cause is that this configuration is not supported, leading to a mount-time denial of access (DoS potential). Connected records show patches in Root: Debian 11/...

CVE-2026-31453

The CVE-2026-31453 issue affects the Linux kernel XFS path. The root cause is use-after-free-like behavior: after xfsaild_push_item() calls iop_push(), the log item could be freed if the AIL lock is dropped, allowing a freed log item to be dereferenced by tracepoints in the switch that follow. Th...

CVE-2026-31476

In the Linux kernel component ksmbd, CVE-2026-31476 describes a logic flaw where a multichannel session binding request that fails (for example, due to a wrong password) could cause the targeted session to be marked SMB2_SESSION_EXPIRED. Because the failed binding may reference a session from ano...

CVE-2026-31483

CVE-2026-31483 affects the s390 architecture in the Linux kernel. The root cause is a missing array_index_nospec() boundary in the syscall dispatch table, allowing a user-controlled syscall number to exceed the function pointer table and potentially read kernel memory via speculative execution (S...

CVE-2026-31515

CVE-2026-31515 affects the Linux kernel and is resolved by validating address families in pfkey_send_migrate(); the flaw allowed overfilling the skb when processing requests due to truncation of the @family argument in set_ipsecrequest. SYZBOT demonstrated a crash in skb_put(), leading to a kerne...

CVE-2026-31518

CVE-2026-31518 affects the Linux kernel espintcp path when using asynchronous crypto. If the TX queue for espintcp is full, esp_output_tail_tcp returns an error and the skb is not freed under earlier synchronous handling; with async crypto (esp_output_done) the skb must be dropped when esp_output...

CVE-2026-31542

CVE-2026-31542 affects the Linux kernel x86/platform/uv component. When a socket is deconfigured, it is mapped to SOCK_EMPTY (0xffff) instead of NUMA_NO_NODE, causing a panic during allocation of UV hub info structures and potentially DoS. The fixes patch the behavior to allocate on valid NUMA no...

CVE-2026-31579

The CVE-2026-31579 issue affects the Linux kernel’s WireGuard integration where wg_netns_pre_exit() manually acquired rtnl_lock(), risking a hung task when another thread holds the RTNL mutex. The vulnerability is mitigated by moving the cleanup to the .exit_rtnl hook (which the framework already...