CVE-2026-23236

Technical details about CVE-2026-23236 are not publicly provided in the supplied documents; advisories reference kernel fixes but do not specify affected components, versions, or impact. Monitor for updates.

CVE-2026-23349

CVE-2026-23349 concerns the Linux kernel HID subsystem, specifically the pidff module. The issue arises from not clearing all conditional effect bits, which can lead to NULL pointer dereferences and potential system instability. The root cause is improper handling of the ffbit flag where some con...

CVE-2026-23373

CVE-2026-23373 affects the Linux kernel wifi: rsi driver. The issue arises in rsi_mac80211_config where it should default to a zero value but instead uses -EOPNOTSUPP, triggering a WARN_ON in ieee80211_hw_conf_init and diverging from other drivers’ behavior. Multiple sources describe the vulnerab...

CVE-2026-23375

CVE-2026-23375 (Linux kernel THP for anonymous inodes) – concrete details in connected docs : The issue arises from file_thp_enabled() incorrectly allowing/thp collapse for anonymous inodes created via alloc_file_pseudo() (e.g., guest_memfd, secretmem), enabling khugepaged/MADV_COLLAPSE exploits ...

CVE-2026-23393

CVE-2026-23393 – Linux kernel (bridge/cfm) race fix : A race during peer MEP deletion could occur because br_cfm_frame_rx() could re-schedule ccm_rx_dwork while peer_mep is freed under RCU, risking use-after-free. The fix replaces cancel_delayed_work_sync() with disable_delayed_work_sync() in bot...

CVE-2026-23408

The CVE-2026-23408 issue affects the Linux kernel AppArmor module. The root cause was a double free of ns_name in aa_replace_profiles(): ns_name could be NULLed after it had been transferred from ent->ns_name, but ent->ns_name was freed later, and then freed again when kfree(ns_name). The p...

CVE-2026-23411

CVE-2026-23411 corresponds to a Linux kernel AppArmor race condition: freeing i_private data can race with filesystem access because the inode may outlive references. The issue is resolved by moving the put of i_private referenced data to the correct place during inode eviction. Affects AppArmor ...

CVE-2026-31422

CVE-2026-31422 affects the Linux kernel’s net/sched subsystem. The vulnerability occurs in flow_change() where tcf_block_q() dereferences q->handle to derive a default baseclass for shared blocks, while block->q can be NULL for shared blocks. The fix adds a check of tcf_block_shared() befor...

CVE-2026-31447

CVE-2026-31447 affects the Linux kernel ext4, where mounting a filesystem with bigalloc and s_first_data_block != 0 is rejected. The root cause is that this configuration is not supported, leading to a mount-time denial of access (DoS potential). Connected records show patches in Root: Debian 11/...

CVE-2026-31454

Summary: CVE-2026-31454 affects the Linux kernel's XFS code. In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock is dropped to perform buffer IO, which can allow a log item to be freed during reclaim. A subsequent spin_lock() may dereference lip->li_ailp, causing a use-after...

CVE-2026-31473

The CVE-2026-31473 affects the Linux kernel media subsystems (mc, v4l2). A race can occur when MEDIA_REQUEST_IOC_REINIT runs concurrently with VIDIOC_REQBUFS queue teardown, risking use-after-free of request objects. The root cause is lack of serialization across these paths; it is addressed by e...

CVE-2026-31491

In the Linux kernel’s RDMA/irdma component, CVE-2026-31491 stems from depth calculation functions that fail to properly guard against U32_MAX inputs for SQ/RQ/SRQ sizes. The issue can cause integer overflow and truncation, leading to the function returning success when it should fail. Public repo...

CVE-2026-31539

The CVE-2026-31539 entry describes a race condition in the Linux kernel smbdirect module where credits for receive buffers can be granted to a peer that has already consumed them. This could enable resource exhaustion and a DoS condition. The root cause is improper counting of posted recv_io cred...

CVE-2026-31580

CVE-2026-31580 affects the Linux kernel (bcache component). The issue is a use-after-free in cached_dev.sb_bio when a device is stopped while a superblock write is in progress, which can cause a crash/DoS through libceph I/O paths. Public reports align on this being resolved by patching bcache to...

CVE-2026-31598

Summary of CVE-2026-31598 (ocfs2 deadlock) : In the Linux kernel OCFS2, a potential deadlock arises from ABBA lock ordering between unlink and dio_end_io_write. The path in unlink acquires inode_lock (orphan_dir_inode) before ip_alloc_sem, while dio_end_io_write acquires ip_alloc_sem first, then ...

CVE-2026-31678

CVE-2026-31678 – Linux kernel Open vSwitch tunnel netdev handling fix. The issue arose when ovs_netdev_tunnel_destroy() could run after NETDEV_UNREGISTER detached the device, risking a race as it dropped the netdev reference while readers still observed vport->dev. The resolution is to not rel...

CVE-2026-31690

CVE-2026-31690 affects the Linux kernel TH1520 AON firmware protocol driver. The issue combined a potential buffer overflow from unsafe pointer arithmetic when accessing the 'mode' field via a resource offset, and the use of custom RPC_SET_BE*/RPC_GET_BE* macros replaced with standard endianness ...

CVE-2026-31743

In the Linux kernel, CVE-2026-31743 affects the nvmem subsystem, specifically the zynqmp_nvmem module, where an incorrect buffer size is used during DMA allocation and memcpy. The resulting undersized DMA buffer access can cause memory corruption, potentially triggering system instability or deni...

CVE-2026-31788

The CVE-2026-31788 entry describes a vulnerability in the Linux kernel related to the Xen privcmd driver. The privcmd interface could allow a user-space process to issue hypercalls that affect other domains, which is normally restricted to root. In secure-boot scenarios, an unprivileged domU coul...

CVE-2026-43025

CVE-2026-43025 affects the Linux kernel netfilter component. A local attacker can trigger a slab-out-of-bounds read when creating new expectations by supplying a non-master conntrack helper, potentially enabling information disclosure from kernel memory. The issue is described across multiple sou...

CVE-2026-43033

The CVE-2026-43033 issue affects the Linux kernel crypto: authencesn module, where out-of-place decryption (src != dst) incorrectly saves high-order sequence bits in dst, requiring reordering before hashing. The vulnerability is linked to privilege escalation/DoS/info-leak risks as described in m...

CVE-2026-43103

CVE-2026-43103 affects the Linux kernel net/lapbether driver: lapbeth_data_transmit() assumes the underlying device type is ARPHRD_ETHER, and returning NOTIFY_BAD from lapbeth_device_event() prevents the bonding driver from violating this expectation. The vulnerability is resolved in upstream ker...

CVE-2026-43137

Summary: CVE-2026-43137 affects the Linux kernel ASoC SOF Intel HDA subsystem. A mismatch between DAI links in the machine driver and the topology can leave the playback/capture widget unset, which may trigger a null pointer dereference. The issue is fixed in the reported OSV entries (Ubuntu root...

CVE-2026-43276

Summary: CVE-2026-43276 is a Linux kernel issue in the mana network driver causing a use-after-free during PCI service rescan. The crash occurs when mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup() frees gc->service_wq, and a subsequent resume path leads to a second removal via man...

CVE-2026-43281

CVE-2026-43281 affects the Linux kernel mailbox subsystem. The flaw is an out-of-bounds access in fw_mbox_index_xlate() that can occur when #mbox-cells is

CVE-2026-43343

CVE-2026-43343 affects the Linux kernel USB gadget f_subset code. The vulnerability stems from an unbalanced reference count: geth_alloc() increments the refcount, but geth_free() does not decrement it, which can block configuration of attributes via configfs after unlinking the function. The con...

CVE-2026-43427

The CVE covers a Linux kernel issue in the usb: class: cdc-wdm read path. Due to compiler optimization or CPU out-of-order execution, desc->length could be updated after a memmove, causing wdm_read() to observe a new length and copy_to_user() from uninitialized memory, violating LKMM data race...

CVE-2026-45954

CVE-2026-45954 concerns the Linux kernel fbdev driver (au1200fb). The issue arises when au1200fb_drv_probe fails at platform_get_irq: it returns an error without freeing allocated memory, causing a memory leak. A patch adds proper cleanup via a goto label to release resources. Red Hat notes the f...

CVE-2026-46025

CVE-2026-46025 relates to a kernel race between damon_call()/damos_walk() and kdamond termination that could leak memory or deadlock. The connected openSUSE advisory confirms openSUSE Tumbleweed users should upgrade to kernel-devel-7.0.11-1.1 (and mentions the CVE in their 2026-10954 advisory). T...

CVE-2026-46060

CVE-2026-46060 : In the Linux kernel crypto: qat path, IRQ cleanup on 6xxx probe failure can race during partial adf_dev_up() completion. When adf_isr_resource_alloc() has registered IRQ handlers (eg qat0-bundle0) and then probe fails, devres may tear down MSI-X vectors via pci_free_irq_vectors w...

CVE-2026-46069

CVE-2026-46069 affects the Linux kernel mwifiex driver (wifi) where mwifiex_adapter_cleanup() used timer_delete() on wakeup_timer before freeing the adapter, risking a use-after-free if wakeup_timer_fn is running. The issue is resolved by replacing timer_delete() with timer_delete_sync() to ensur...

CVE-2026-46107

In Linux kernel dm-thin, a metadata refcount underflow in rebalance_children has been resolved. If an internal btree node with a single entry is shared (refcount > 1), downgrading the child without updating grandchildren leads to mismatched reference counts and can produce device mapper: space...

CVE-2026-46134

CVE-2026-46134 affects the Linux kernel cros_ec_typec component. The root cause is that cros_typec_register_thunderbolt() failed to initialize the adata->lock mutex, leading to a NULL dereference when the mutex is later acquired (for example in cros_typec_altmode_work). The issue is mitigated ...

CVE-2026-46141

The CVE-2026-46141 entry concerns a Linux kernel kmemleak memory leak in the powerpc/xive interrupt controller. When MSI‑X vectors are allocated for NVMe devices, the kernel stores per‑irq data in irq_data->chip_data. After a commit that untangled XIVE from child interrupt controllers, xive_ir...

CVE-2026-46162

CVE-2026-46162 affects the Linux kernel ice driver. The vulnerability is a double free in the error path of ice_sf_eth_activate() : when auxiliary_device_add() fails, execution jumps to the auxiliary device uninit path, the device release callback frees the device, but the code then falls through...

CVE-2026-46213

The CVE-2026-46213 issue affects the Linux kernel HID Apple keyboard driver (appletb-kbd). A use-after-free (UAF) in the inactivity-timer cleanup path during driver tear-down was fixed by reordering teardown: (1) call hid_hw_close()/hid_hw_stop() before backlight cleanup to prevent late callbacks...

CVE-2026-52990

The CVE-2026-52990 issue affects the Linux kernel fsnotify subsystem, where fsnotify_recalc_mask() can leak an inode reference if the HAS_IREF flag transitions from true to false and the returned inode pointer is not released. A race between adding and detaching marks may skip proper cleanup, cau...

CVE-2026-53014

CVE-2026-53014 (Linux kernel net/sched: act_mirred) has concrete details across multiple sources. The bug in tcf_blockcast_redir loops over block ports to redirect packets to multiple devices and erroneously queries the mac_header_xmit flag from the NEXT device instead of the device being sent to...

CVE-2026-53024

Summary: CVE-2026-53024 affects the Linux kernel Greybus raw subsystem. A use-after-free can occur when a user writes to a chardev after disconnect, because gb_connection_destroy frees the connection object during disconnect and a subsequent write may access that freed object, potentially trigger...

CVE-2026-53110

The CVE-2026-53110 entry concerns the Linux kernel s390/s390x BPF JIT: the ABI requires zero-extending unsigned arguments and return values, but the JIT historically performed only sign-extension. The connected Red Hat, Debian/Ubuntu OSV entries and the NVD description confirm the issue and its r...

CVE-2026-53155

In Linux kernels, CVE-2026-53155 relates to mm/huge_memory and device-private PMD entries. A commit (65edfda6f3f2) updated set_pmd_migration_entry() to use pmdp_huge_get_and_clear() in the softleaf case but did not adjust the function fully, causing incorrect use of pmd_write(), pmd_soft_dirty(),...

CVE-2026-53177

CVE-2026-53177 affects bnxt_en in the Linux kernel. A NULL pointer dereference can occur in bnxt_io_error_detected() when PCIe error recovery runs for a NIC that is closed, due to bp->bnapi being freed on NIC close. The fix is to check bp->bnapi for NULL before disabling and synchronizing I...

CVE-2026-53184

The CVE-2026-53184 issue affects the Linux kernel UDP sockmap path. On UDP receive, skb->dev is repurposed as dev_scratch; when a SK_SKB verdict program uses BPF socket-lookup helpers (bpf_sk_lookup_tcp/udp, bpf_skc_lookup_tcp), skb->dev may still hold the dev_scratch value, and dev_net(skb...

CVE-2026-53213

In the Linux kernel drm/vc4 component, CVE-2026-53213 is a memory-leak fix related to krealloc(): if krealloc() returns NULL, the original pointer may be overwritten, leaking memory. The recommended pattern is to assign krealloc() to a temporary variable, check for NULL, then update the original ...

CVE-2026-53231

CVE-2026-53231 (Linux kernel) : The issue affects the PHY subsystem where PHY-driven SFP cages are not supported with the genphy code. Investigations show that sfp_bus_add_upstream() for genphy can deadlock because PHY probing runs under RTNL for genphy while non-genphy drivers do not. The root c...

CVE-2026-53285

The CVE-2026-53285 issue concerns the Linux kernel drm/amd/display path, where dcn32_enable_phantom_plane() allocates ~335 KiB via kvzalloc() within an FPU-enabled, softirq-disabled region. This vmalloc flow can trigger BUG_ON(in_interrupt()), causing a kernel crash (DoS). The root cause is the l...

CVE-2026-53286

CVE-2026-53286 affects the Linux kernel IDPF driver: when auxiliary_device_add() fails in idpf_plug_vport_aux_dev() or idpf_plug_core_aux_dev(), the error path uninitializes the auxiliary device in a way that can trigger a use-after-free and a double free of the iadev object. The issue arises bec...

CVE-2026-53304

CVE-2026-53304 affects the Linux kernel SCSI generic (sg) driver, specifically the def_reserved_size default buffer size for each /dev/sgX. The root cause is a bypass of sg_proc_write_dressz limits, allowing an invalid value to be written via the module parameter, which can trigger a soft lockup....

CVE-2026-53372

CVE-2026-53372 affects the Linux kernel IOMMU VT-d: nested domain attachments to PASID could fail to attach or lose dirty pages due to missing dirty-tracking for the nested domain. The issue occurs when a PASID-enabled domain attaches to a nested parent domain configured for dirty-tracking; lack ...

CVE-2026-64060

CVE-2026-64060 is a reference-counting bug in the Linux kernel's netfs subsystem . The function netfs_write_begin() fails to drop its reference on a request object when netfs_wait_for_read() returns an error, resulting in a resource leak (memory/pointer leak) on each failed write path. The NVD-as...