CVE-2026-23434

CVE-2026-23434 affects the Linux kernel MTD NAND driver (mtd: rawnand) where nand_lock()/nand_unlock() call into chip->ops.lock_area/unlock_area without holding the NAND device lock. The fix introduces serialisation by wrapping those lock/unlock calls with nand_get_device()/nand_release_device...

CVE-2026-23454

CVE-2026-23454 (Linux kernel, mana subsystem) : A race in mana_hwc_destroy_channel() can free hwc->caller_ctx before CQ/EQ are destroyed, enabling a use-after-free/NULL dereference in mana_hwc_handle_resp(). The root cause is lack of IRQ synchronization and a teardown order that frees resource...

CVE-2026-23465

CVE-2026-23465 affects the Linux kernel (btrfs) where logging the parent directory of a no-longer-existing conflicting inode could skip logging the directory’s new dentries, causing missing dentries after a power loss when an fsync occurs. The issue is resolved by logging new dir dentries wheneve...

CVE-2026-31394

CVE-2026-31394 concerns the Linux kernel mac80211 path where AP_VLAN (4addr) stations can trigger a NULL pointer dereference in __ieee80211_sta_cap_rx_bw() due to sta->sdata pointing to VLAN sdata, which may not participate in chanctx reservations. The root cause is that link->reserved.oper...

CVE-2026-31406

The CVE-2026-31406 issue is a race in the Linux kernel xfrm path during network cleanup. After cancel_delayed_work_sync() is invoked from xfrm_nat_keepalive_net_fini(), xfrm_state_fini() flushes states and __xfrm_state_delete() calls xfrm_nat_keepalive_state_updated(), which can re-schedule nat_k...

CVE-2026-31473

The CVE-2026-31473 affects the Linux kernel media subsystems (mc, v4l2). A race can occur when MEDIA_REQUEST_IOC_REINIT runs concurrently with VIDIOC_REQBUFS queue teardown, risking use-after-free of request objects. The root cause is lack of serialization across these paths; it is addressed by e...

CVE-2026-31489

This CVE (CVE-2026-31489) affects the Linux kernel meson-spicc SPI controller driver. The vulnerability arises from a double-put: meson_spicc_probe() registers the controller with devm_spi_register_controller(), and the removal path erroneously calls spi_controller_put() again in meson_spicc_remo...

CVE-2026-31531

The vulnerability CVE-2026-31531 affects the Linux kernel’s nexthop handling in IPv4 when querying large nexthop groups via RTM_GETNEXTHOP. The fixed issue was a fixed-size NLMSG buffer (NLMSG_GOODSIZE) that could overflow for large groups (e.g., 512 nexthops), causing kernel warnings and potenti...

CVE-2026-31578

CVE-2026-31578: Linux kernel as102_usb driver race leads to use-after-free/double-free when a device is deregistered while an open FD remains. The crash arises from freeing as102_dev_t after usb_register_dev() and before the final FD is closed; the fix defers freeing to the .release() path, ensur...

CVE-2026-31603

CVE-2026-31603 affects the Linux kernel staging: sm750fb driver. The issue occurs when a zero pixclock is passed via FBIOPUT_VSCREENINFO, causing ps_to_hz() to divide by zero in hw_sm750_crtc_set_mode(). The vulnerability is resolved by rejecting zero pixclock in lynxfb_ops_check_var(), aligning ...

CVE-2026-31615

In CVE-2026-31615, the Linux kernel USB gadget code for renesas_usb3 (and related aspeed_udc context) did not validate endpoint indices in standard requests (GET_STATUS, SET/CLEAR_FEATURE). The host-supplied wIndex could be used to dereference a pointer without confirming endpoint count, risking ...

CVE-2026-31638

The CVE-2026-31638 issue affects the Linux kernel rxrpc subsystem. When a client call on a channel has already been torn down, rxrpc_input_packet_on_conn() could still process a to-client packet; rxrpc_try_get_call() could return NULL and there would be no reference to drop. The code path then un...

CVE-2026-31650

The CVE concerns the Linux kernel mmc vub300 driver. The root cause is a use-after-free risk from device-managed controller allocation and a lifetime tie to the parent USB device rather than the interface, which can cause memory leaks if the driver is unbound without a disconnect. A last referenc...

CVE-2026-31651

In CVE-2026-31651, the Linux kernel mmc: vub300 driver is affected by a NULL-deref/use-after-free on disconnect. The root cause is dropping the driver data reference without deregistering the controller, which can lead to NULL-pointer dereferences and a potential system crash (DoS) on local acces...

CVE-2026-31680

The CVE concerns a race in the Linux kernel IPv6 flow label handling. In ip6fl_seq_show(), the global flowlabel hash is read under an RCU read lock, and an option block’s state fl->opt->opt_nflen may be printed when present. The current lifetime of the option state can end with fl->users...

CVE-2026-43043

The CVE describes a Linux kernel vulnerability in the AF_ALG crypto interface where chaining a new af_alg_tsgl structure can leave the end marker of the previous Scatter/Gather List uncleared when a sendmsg exactly fills MAX_SGL_ENTS. This causes sg_next() to return NULL, potentially leading to a...

CVE-2026-43052

CVE-2026-43052 fixes a Linux kernel mac80211 TDLS handling flaw: NL80211_TDLS_ENABLE_LINK could run TDLS-side effects on non‑TDLS peers. A kernel patch adds an early sta->sta.tdls check to ensure only true TDLS peers proceed, preventing unintended channel HT-protection changes. Remediation is ...

CVE-2026-43102

CVE-2026-43102 affects the Linux kernel net/airoha driver: a memory leak in the airoha_qdma_rx_process() when processing subsequent buffers in the non-linear skb portion. If an error occurs, the page_pool fragment may fail to be linked back to the skb, preventing it from being returned to the poo...

CVE-2026-43124

The CVE-2026-43124 issue affects Linux kernel pstore ram_core, where persistent_ram_vmap() could return a non-NULL pointer after vmap() failed, causing persistent_ram_buffer_map() to incorrectly report success and potentially dereference an invalid address on access, leading to a crash (DoS). Roo...

CVE-2026-43134

The CVE-2026-43134 entry affects the Linux kernel Bluetooth stack. The root cause is a missing encryption key size check in the L2CAP_LE_CONN_REQ handling, which could permit a malformed L2CAP LE connection request and trigger a protocol violation. A patch was added to perform the key-size valida...

CVE-2026-43227

CVE-2026-43227 affects the Linux kernel’s clocksource/sh_tmu driver. The vulnerability arises when the TMU is used as both clocksource and clockevent provider and the driver tries to power/clocks state via pm_runtime_() and clk_ () while holding raw spinlocks. This mismatch between spinlock conte...

CVE-2026-43236

The CVE-2026-43236 vulnerability affects the Linux kernel’s drm/atmel-hlcdc component. The atmel_hlcdc_plane_atomic_duplicate_state() callback copied the drm_plane_state without duplicating the base state, leaving state->commit pointing to the old object and enabling a use-after-free in the ne...

CVE-2026-43268

Summary: CVE-2026-43268 concerns the Linux kernel where the hfsplus filesystem may incorrectly treat certain special inodes as regular files. The root cause is a mismatch in inode type handling for VFS operations after the may_open() adjustment, causing some inodes not to be treated as their true...

CVE-2026-43277

The CVE-2026-43277 issue affects the Linux kernel GHES/APEI path. The root cause is a mismatch between CPER-record length and the actual number of pages allocated when ghes_new() validates CPER data, enabling a bad firmware to cause an out-of-bounds write and a kernel OOPs/panic. Public descripti...

CVE-2026-43300

CVE-2026-43300 affects the Linux kernel DRM panel code, specifically a NULL-pointer dereference in jdi_panel_dsi_remove(). When jdi is NULL, the function can proceed to call jdi_panel_disable(), which dereferences jdi unconditionally, causing a crash. The advisory shows the fix: return early from...

CVE-2026-43301

CVE-2026-43301 relates to the Linux kernel driver for the wave5 media component. The issue arises when the driver’s remove path unconditionally calls pm_runtime_put_sync(), which can underflow the PM usage count if autosuspend was already activated during probe. This mismatch prevents proper refe...

CVE-2026-43312

CVE-2026-43312 is a Linux kernel vulnerability in the ov5647 V4L2 I2C driver. The issue arises from calling v4l2_get_subdevdata in ov5647_init_controls() before the subdevice is initialized by v4l2_i2c_subdev_init() during probe, which can dereference i2c_client and cause a segfault if an error p...

CVE-2026-43317

CVE-2026-43317 affects the Linux kernel under the internal module path described as the “most: core” component. The issue is a resource leak that occurs during early registration failures, where resources associated with the interface are not properly released. A recent commit fixes a leak in the...

CVE-2026-43357

The CVE-2026-43357 entry concerns the Linux kernel iio: gyro: mpu3050-core driver. The root cause is incorrect PM runtime error handling: pm_runtime_get_sync() return value isn’t checked and the device usage count is incremented unconditionally, potentially allowing access to hardware that failed...

CVE-2026-43378

CVE-2026-43378 affects the Linux kernel SMB server (smb2_open). A use-after-free arises because the opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is dereferenced after rcu_read_unlock(), creating a use-after-free window. Multiple sources (SUSE, Red Hat, Debian OSV, Ubuntu, Debian t...

CVE-2026-43409

CVE-2026-43409 affects the Linux kernel kprobes subsystem: when ftrace is disabled due to errors, removing a module that uses kprobes can crash the system because kprobes_ftrace_disabled is not correctly handled. Root cause: kprobe_ftrace_disabled flag mishandling in __disarm_kprobe_ftrace(). Mit...

CVE-2026-43432

CVE-2026-43432 relates to the Linux kernel USB xHCI driver. The error path in usb/xhci_disable_slot() previously freed only the command structure (via kfree), leaking the associated completion structure. The patch changes the code to call xhci_free_command() , which frees both the command structu...

CVE-2026-43466

Summary (CVE-2026-43466) : The Linux kernel mlx5e driver had a desync bug in the software DMA FIFO during TX error recovery. Specifically, during recovery, dma_fifo_cc was reset to 0 while dma_fifo_pc was not, causing producer/consumer to operate on misaligned indices. After recovery, new entries...

CVE-2026-43488

CVE-2026-43488 : Linux kernel xHCI driver vulnerability where a Host Controller Error (HCE) on UAS storage plug/unplug could trigger an interrupt storm. The issue occurred as xhci_irq() logged a warning and assumed activity would stop, but storms persisted on some hosts. Mitigation implemented by...

CVE-2026-43492

Technical details about CVE-2026-43492 are not publicly provided in the supplied documents. Monitor for updates from vendors and advisories.

CVE-2026-45902

CVE-2026-45902 is a Linux kernel race-condition use-after-free in the bq256xx power-supply driver. The bug occurs when IRQs are requested before the power_supply handle is fully registered, allowing an interrupt after the handle is freed or before registration, leading to power_supply_changed() o...

CVE-2026-45956

The CVE-2026-45956 entry concerns the Linux kernel DRM Exynos driver (vidi) where vidi_connection_ioctl() incorrectly reads driver_data from drm_dev->dev, which points to the exynos-drm master device rather than the vidi component device. This mismatch can trigger null pointer dereferences, ga...

CVE-2026-46000

CVE-2026-46000 in the Linux kernel: rxrpc vulnerability where security checks decrypt bits of a packet in place while the skb may be shared with a packet sniffer, potentially exposing a decrypted (apparently corrupted) packet. The fix: when a packet was cloned, the kernel now hands a copy of the ...

CVE-2026-46096

CVE-2026-46096 affects the Linux kernel TPM subsystem. The root cause is a leak in tpm2_read_public where tpm_buf_destroy() is missing on two exit paths after tpm_buf_init(), leaking a page allocation. The fix adds missing tpm_buf_destroy() calls on those exit paths, correcting both the error pat...

CVE-2026-46213

The CVE-2026-46213 issue affects the Linux kernel HID Apple keyboard driver (appletb-kbd). A use-after-free (UAF) in the inactivity-timer cleanup path during driver tear-down was fixed by reordering teardown: (1) call hid_hw_close()/hid_hw_stop() before backlight cleanup to prevent late callbacks...

CVE-2026-46329

CVE-2026-46329 refers to a Linux kernel issue in the erofs filesystem. Affected behavior: I/O requests extending beyond the end of a file-backed filesystem should be zeroed out, matching the behavior of loopback devices. The connected sources confirm the vulnerability is resolved by correcting en...

CVE-2026-52930

CVE-2026-52930 (Linux kernel) : The issue is in ipc/shm: orphan cleanup cleanup of shm segments. shm_nattch was updated while holding shm_perm.lock, but shm_destroy_orphaned() traversed shm_ids(ns).rwsem, leading to a race where an orphaned segment could be considered removable before the destina...

CVE-2026-52953

The CVE-2026-52953 issue affects the Linux kernel IOMMU VT-d subsystem, where an out-of-scope memory access could trigger a general protection fault (kernel oops) when a QEMU process is terminated. The triggering path involves domain_remove_dev_pasid and related IOMMU PASID handling, with a dummy...

CVE-2026-52954

The CVE-2026-52954 issue affects the Linux kernel libceph component. A crafted CEPH_MSG_OSD_MAP can carry a CRUSH map with two crush_choose_arg_maps sharing the same index, causing an assertion in insert_choose_arg_map() to trigger a kernel BUG when inserting the second entry. The vulnerability c...

CVE-2026-52963

CVE-2026-52963 affects the Linux kernel ALSA usb-audio code path, specifically the MIDI endpoint handling in snd_usbmidi_get_ms_info. The vulnerability arises when the descriptor walker returns a class-specific MIDI endpoint with bLength larger than the remaining bytes in the endpoint-extra scan,...

CVE-2026-52995

Summary (concrete details from connected docs): CVE-2026-52995 affects the Linux kernel RDS info paths (RDS/IB and RDS6/IB visitors). The root cause is that rds_for_each_conn_info() and rds_walk_conn_path_info() pass a caller-allocated on‑stack u64 buffer to visitors and then copy full item_len b...

CVE-2026-53066

CVE-2026-53066 affects the Linux kernel DRM sun4i backend. The flaw is that drm_atomic_get_plane_state() may return an error pointer which is not checked in sun4i_backend_atomic_check(), allowing a dereference of ERR_PTR() and potential kernel instability. Public details cite a fix in the kernel ...

CVE-2026-53090

The CVE-2026-53090 entry describes a Linux kernel BPF verifier flaw: when using ld_abs/ld_ind in subprogs, the verifier failed to simulate abnormal exits if packet loads failed. This is tied to the code path for bpf_gen_ld_abs() and affects subprograms that are BTF-annotated with scalar return ty...

CVE-2026-53096

CVE-2026-53096 affects Linux kernel code path in BPF dev_map_redirect_multi() where DEVMAP_HASH uses hlist_for_each_entry_safe() under RCU protection. The function iterates hash buckets without rcu_dereference(), exposing risk of partially constructed nodes on weakly-ordered architectures (ARM64,...

CVE-2026-53171

The CVE affects the Linux kernel’s accel/ethosu driver. The dma_length() function can under- or overflow while deriving DMA region usage, causing region_size[] to be under-reported and potentially bypassing bounds checks in ethosu_job.c. The issue arises from arithmetic in len calculations, signe...