CVE-2026-23160

CVE-2026-23160 affects the Linux kernel octep (octeon_ep) path. The vulnerability arises when octep_ctrl_net_init() fails inside octep_device_setup(): resources remain mapped and configuration memory isn’t freed, causing a memory leak. A patch introduces a cleanup jump to the unsupported_dev labe...

CVE-2026-23258

CVE-2026-23258 is acknowledged in OSV entries as a vulnerability present in the Linux kernel context via the Root:Ubuntu rootio-linux package. Ubuntu security advisories indicate patches are available for Ubuntu 22.04 LTS and 24.04 LTS (Root:Ubuntu:22.04 and Root:Ubuntu:24.04) with multiple fixed...

CVE-2026-23343

CVE-2026-23343 involves the Linux kernel XDP tailroom calculation. Docked fixes describe that many ethernet drivers expose rx queue frag size, while xdp_frags_increase_tail() expects a truesize, causing unsigned tailroom to drift toward UINT_MAX and potentially grow tail space, leading to memory ...

CVE-2026-23374

CVE-2026-23374 affects the Linux kernel blktrace path. The root cause is tracing_record_cmdline() using __this_cpu_read()/__this_cpu_write() on a per-CPU variable while preemption is enabled, which is unsafe and triggers a kernel BUG in preemptible code through __blk_add_trace() paths. Public wri...

CVE-2026-23393

CVE-2026-23393 – Linux kernel (bridge/cfm) race fix : A race during peer MEP deletion could occur because br_cfm_frame_rx() could re-schedule ccm_rx_dwork while peer_mep is freed under RCU, risking use-after-free. The fix replaces cancel_delayed_work_sync() with disable_delayed_work_sync() in bot...

CVE-2026-23408

The CVE-2026-23408 issue affects the Linux kernel AppArmor module. The root cause was a double free of ns_name in aa_replace_profiles(): ns_name could be NULLed after it had been transferred from ent->ns_name, but ent->ns_name was freed later, and then freed again when kfree(ns_name). The p...

CVE-2026-23414

CVE-2026-23414 is addressed in the Linux kernel TLS code. The vulnerability involved the async_hold queue that pins encrypted input skbs while AEAD operations reference scatterlist data. The fix centralizes purge of async_hold in tls_decrypt_async_wait(), ensuring all callers (recvmsg drain path,...

CVE-2026-23454

CVE-2026-23454 (Linux kernel, mana subsystem) : A race in mana_hwc_destroy_channel() can free hwc->caller_ctx before CQ/EQ are destroyed, enabling a use-after-free/NULL dereference in mana_hwc_handle_resp(). The root cause is lack of IRQ synchronization and a teardown order that frees resource...

CVE-2026-31393

CVE-2026-31393 affects the Linux kernel Bluetooth L2CAP code. The vulnerability arises in l2cap_information_rsp() where the code checks the fixed L2CAP_INFO_RSP header length but may read rsp->data without verifying payload presence, allowing a truncatd RSP with result==L2CAP_IR_SUCCESS to tri...

CVE-2026-31397

CVE-2026-31397 relates to the Linux kernel memory management path mm/huge_memory move_pages_huge_pmd(), where the huge zero page branch used a NULL src_folio, causing a bogus PFN (or NULL dereference on some memory models) when constructing PMDs. The fix uses page_folio(src_page) to obtain a vali...

CVE-2026-31427

The CVE-2026-31427 issue in Linux kernel netfilter/nf_conntrack_sip was fixed by initializing the rtp_addr before calling nf_nat_sip SDP hooks and tracking via a have_rtp_addr flag. If SDP has no m= lines, or contains only inactive/unrecognized media, the code now avoids calling sdp_session with ...

CVE-2026-31433

CVE-2026-31433 affects the Linux kernel ksmbd module. A vulnerability arises when processing a compound SMB request of QUERY_DIRECTORY + QUERY_INFO (FILE_ALL_INFORMATION): the code lacked a validation check on the client-provided OutputBufferLength before copying a filename into the smb2_file_all...

CVE-2026-31447

CVE-2026-31447 affects the Linux kernel ext4, where mounting a filesystem with bigalloc and s_first_data_block != 0 is rejected. The root cause is that this configuration is not supported, leading to a mount-time denial of access (DoS potential). Connected records show patches in Root: Debian 11/...

CVE-2026-31451

CVE-2026-31451: In the Linux kernel ext4_read_inline_folio, BUG_ON was replaced with proper error handling when inline data size exceeds PAGE_SIZE. The fix prevents kernel panics, logs the filesystem corruption via ext4_error_inode(), releases the buffer head to avoid leaks, and returns -EFSCORRU...

CVE-2026-31510

CVE-2026-31510: Linux kernel Bluetooth L2CAP vulnerability due to a null pointer dereference in l2cap_sock_ready_cb. The issue arises because sk is used without verifying it’s non-null, leading to a kernel panic/DoS. Multiple OS advisories (Debian roots, Ubuntu, Red Hat, SUSE, etc.) report the pa...

CVE-2026-31539

The CVE-2026-31539 entry describes a race condition in the Linux kernel smbdirect module where credits for receive buffers can be granted to a peer that has already consumed them. This could enable resource exhaustion and a DoS condition. The root cause is improper counting of posted recv_io cred...

CVE-2026-31540

CVE-2026-31540 affects the Linux kernel i915 graphics driver. The vulnerability occurs when the i915 firmware binaries are absent and the set_default_submission pointer is not initialized, which can be dereferenced during suspend, causing a kernel NULL pointer dereference and a potential DoS. The...

CVE-2026-31579

The CVE-2026-31579 issue affects the Linux kernel’s WireGuard integration where wg_netns_pre_exit() manually acquired rtnl_lock(), risking a hung task when another thread holds the RTNL mutex. The vulnerability is mitigated by moving the cleanup to the .exit_rtnl hook (which the framework already...

CVE-2026-31609

CVE-2026-31609 affects the Linux kernel SMB client; the double-free occurs in smbd_free_send_io() after smbd_send_batch_flush() because smbd_send_batch_flush() already frees via smbd_free_send_io() and has been moved to the batch list. The issue has been addressed in multiple advisories and patch...

CVE-2026-31611

CVE-2026-31611 affects the Linux kernel's ksmbd path. The flaw occurs in parse_dacl() when comparing ACE SIDs to sid_unix_NFS_mode and subsequently reading sid.sub_auth[2] as the file mode. If the SID has only two sub-authorities, an ACE placed at the end of the ACL can cause sid.sub_auth[2] to r...

CVE-2026-31650

The CVE concerns the Linux kernel mmc vub300 driver. The root cause is a use-after-free risk from device-managed controller allocation and a lifetime tie to the parent USB device rather than the interface, which can cause memory leaks if the driver is unbound without a disconnect. A last referenc...

CVE-2026-31667

CVE-2026-31667 concerns the Linux kernel’s uinput and ff-core, where a circular locking dependency could cause a local deadlock when a force-feedback gamepad is used. The concrete sequence involves four lock paths that form a cycle: ff->mutex, udev->mutex, input_mutex, dev->mutex, and ba...

CVE-2026-31673

The connected sources describe a Linux kernel vulnerability CVE-2026-31673 in the af_unix/UNIX_DIAG_VFS path. A race condition can occur when reading inode and device numbers for UNIX_DIAG_VFS without holding unix_state_lock consistently while u->path may be cleared by unix_release_sock(). The...

CVE-2026-31675

CVE-2026-31675 — Linux kernel netem out-of-bounds in packet corruption The issue arises in net/sched: sch_netem where the packet corruption logic selects an index into skb->data using get_random_u32_below(skb_headlen(skb)). For AF_PACKET TX_RING sending fully non-linear packets over an IPIP tu...

CVE-2026-31698

CVE-2026-31698 affects the Linux kernel crypto CCP Sev driver. The issue arises when retrieving the PDH certificate: if a firmware command fails with an invalid length, the driver may copy data to userspace, causing a kernel-allocated buffer overflow and potential data leakage to the local user. ...

CVE-2026-31743

In the Linux kernel, CVE-2026-31743 affects the nvmem subsystem, specifically the zynqmp_nvmem module, where an incorrect buffer size is used during DMA allocation and memcpy. The resulting undersized DMA buffer access can cause memory corruption, potentially triggering system instability or deni...

CVE-2026-43043

The CVE describes a Linux kernel vulnerability in the AF_ALG crypto interface where chaining a new af_alg_tsgl structure can leave the end marker of the previous Scatter/Gather List uncleared when a sendmsg exactly fills MAX_SGL_ENTS. This causes sg_next() to return NULL, potentially leading to a...

CVE-2026-43055

The CVE-2026-43055 issue affects the Linux kernel SCSI target: file implementation. The root cause is that target_core_file does not initialize aio_cmd->iocb for ki_write_stream, which can yield a bogus ki_write_stream value during fd_execute_rw_aio() and lead to unintended write failure statu...

CVE-2026-43115

The CVE-2026-43115 entry documents a Linux kernel fix for Tiny SRCU: srcu_gp_start_if_needed() previously called schedule_work(), acquiring pool->lock and triggering a lockdep splat when call_srcu() runs with a scheduler lock held. The remediation adds irq_work_sync() to cleanup_srcu_struct() ...

CVE-2026-43145

The CVE-2026-43145 issue is in the Linux kernel remoteproc imx_rproc driver. The function imx_rproc_elf_find_loaded_rsc_table() could incorrectly report a loaded resource table when the firmware provided no resource table, because it returning priv->rsc_table even if rproc->table_ptr was NU...

CVE-2026-43227

CVE-2026-43227 affects the Linux kernel’s clocksource/sh_tmu driver. The vulnerability arises when the TMU is used as both clocksource and clockevent provider and the driver tries to power/clocks state via pm_runtime_() and clk_ () while holding raw spinlocks. This mismatch between spinlock conte...

CVE-2026-43242

CVE-2026-43242 concerns a leak in the Linux kernel’s driver for TI K3 SoC (soc: ti: k3-socinfo). The vulnerability arises when an mmio regmap is allocated during probe but not freed on probe failure, risking resource exhaustion and potential system instability. The fix uses a device-managed alloc...

CVE-2026-43288

Summary: CVE-2026-43288 relates to the Linux kernel ext4 filesystem. The root cause is a per-CPU counter accessed before it is initialized during block bitmap validation, which can cause a kernel panic and potential DoS when mounting a specially crafted ext4 filesystem with quota/project options....

CVE-2026-43308

CVE-2026-43308 affects the Linux kernel’s Btrfs code path, where an unexpected delayed ref type could previously trigger a BUG() in run_one_delayed_ref(). The issue could enable a local attacker to induce a system crash/DoS by triggering the faulty delay path. The advisory notes that the code can...

CVE-2026-43312

CVE-2026-43312 is a Linux kernel vulnerability in the ov5647 V4L2 I2C driver. The issue arises from calling v4l2_get_subdevdata in ov5647_init_controls() before the subdevice is initialized by v4l2_i2c_subdev_init() during probe, which can dereference i2c_client and cause a segfault if an error p...

CVE-2026-43313

CVE-2026-43313 relates to a NULL-pointer dereference in the ACPI processor driver (acpi_processor_errata_piix4) of the Linux kernel. The code first assigns an IDE device to dev, then overwrites it with an ISA device using two successive pci_get_subsys lookups. If the first lookup succeeds but the...

CVE-2026-43331

Summary of details (CVE-2026-43331): In the Linux kernel, a KCOV instrumentation issue in the x86/kexec path is resolved by disabling KCOV for the affected areas. The root cause is that load_segments() changes segment registers and invalidates the GS base KCOV relies on for per-CPU data, causing ...

CVE-2026-43351

The CVE-2026-43351 issue affects the Linux kernel’s KVM on arm64 when creating a virtual GIC. If vgic_allocate_private_irqs_locked() fails, kvm_vgic_create() can exit before vgic dist regions are initialised, and kvm_vgic_dist_destroy() may then attempt to free uninitialised data, risking a crash...

CVE-2026-43357

The CVE-2026-43357 entry concerns the Linux kernel iio: gyro: mpu3050-core driver. The root cause is incorrect PM runtime error handling: pm_runtime_get_sync() return value isn’t checked and the device usage count is incremented unconditionally, potentially allowing access to hardware that failed...

CVE-2026-43358

CVE-2026-43358 affects the Linux kernel's btrfs filesystem. The vulnerability is a missing RCU unlock in the error path of try_release_subpage_extent_buffer(), where rcu_read_lock() should be held before exiting the loop because an rcu_read_unlock() occurs past the loop. The issue was identified ...

CVE-2026-43362

CVE-2026-43362 affects the Linux kernel SMB client by an in-place encryption flaw in SMB2_write(), where the write payload could be replaced with ciphertext during retries on unstable connections. The root cause is that smb3_init_transform_rq() shares rq_iov, causing crypt_message() to in-place-e...

CVE-2026-43379

CVE-2026-43379 affects ksmbd (Linux kernel) with a use-after-free in smb_lazy_parent_lease_break_close. The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is accessed after rcu_read_unlock(), creating a race where the memory could be freed by a concurrent writer before subsequent de...

CVE-2026-43409

CVE-2026-43409 affects the Linux kernel kprobes subsystem: when ftrace is disabled due to errors, removing a module that uses kprobes can crash the system because kprobes_ftrace_disabled is not correctly handled. Root cause: kprobe_ftrace_disabled flag mishandling in __disarm_kprobe_ftrace(). Mit...

CVE-2026-43435

CVE-2026-43435 relates to the Linux kernel rust_binder component where the oneway spam-detection logic in TreeRange (and missing logic in ArrayRange) could allow large spamming transactions to go undetected. The fix moves the spam-check after the new range is inserted and adds an equivalent low_o...

CVE-2026-43465

CVE-2026-43465: Linux kernel mlx5e XDP multi-buf frag counting flaw. When XDP programs modify the XDP buffer layout (via bpf_xdp_pull_data/bpf_xdp_adjust_tail), the driver failed to count dropped fragments, risking negative page fragment reference counting and potential instability. Public report...

CVE-2026-43472

The CVE describes a Linux kernel unshare(2) bug: when CLONE_NEWNS is requested and current->fs wasn’t previously shared, copy_mnt_ns() could receive a non-private fs_struct. If copy_mnt_ns() succeeds but a subsequent copy_cgroup_ns() fails, the destroyed namespace can leave current->fs->...

CVE-2026-43492

Technical details about CVE-2026-43492 are not publicly provided in the supplied documents. Monitor for updates from vendors and advisories.

CVE-2026-45847

CVE-2026-45847 concerns the Linux kernel networking path: removing WARN_ON_ONCE when accessing the forward path array to mitigate a potential issue with overly long forward paths via IPIP tunnels. The vulnerability is local in scope and is not described as exploitable via remote vectors in the pr...

CVE-2026-45895

Mode C: The CVE-2026-45895 issue affects the Linux kernel quota handling when a filesystem is frozen. quotactl_block() retries while the freezer holds SB_FREEZE_WRITE, leading to a livelock with synchronize_rcu() and causing a freezer hang and 100% CPU on the quota task. The documented fix adds c...

CVE-2026-45948

CVE-2026-45948 (Linux kernel): The issue is a memory leak in ext4_ext_shift_extents() where a NULL extent in the while loop causes an early return without releasing the ext4_find_extent() path. The fix adds a jump to the out label to ensure proper path release, preventing leaked memory. Affected ...