CVE-2026-64256

CVE-2026-64256 affects the Linux kernel XFS quota handling in the dqiterate path. An unsigned 32-bit quota id (q_id) can wrap to zero when it accidentally hits XFS_DQ_ID_MAX, causing the iteration over quotas to restart. The fix casts the value to a 64-bit integer (u64) to prevent wraparound. Pub...

CVE-2026-52938

CVE-2026-52938 concerns a race in Linux kernel BPF storage: bpf_selem_unlink_nofail() clears smap before removal, allowing a concurrent reader in bpf_sk_storage_clone() to observe a NULL smap and dereference a NULL pointer, potentially crashing the kernel (DoS). Reports describe a null-ptr-deref ...

CVE-2026-52952

Summary: CVE-2026-52952 affects the Linux kernel IOMMU subsystem. A race occurs during device recovery when multiple memory domains are attached concurrently, which can trigger a Use-After-Free (UAF) due to concurrent domain detachment and re-attachment in a multi-device group sharing the same RI...

CVE-2026-53011

The CVE-2026-53011 issue affects the Linux kernel net/sched taprio code. In advance_sched(), when should_change_schedules() is true, switch_schedules() promotes the admin schedule to oper and queues the old oper for RCU freeing, but next may still point into the old oper. The subsequent end_time ...

CVE-2026-53015

The CVE-2026-53015 issue concerns the Linux kernel‑erofs filesystem where the lcn variable was 32‑bit on 32‑bit platforms, risking truncation when calculating large offsets (lcn <

CVE-2026-53024

Summary: CVE-2026-53024 affects the Linux kernel Greybus raw subsystem. A use-after-free can occur when a user writes to a chardev after disconnect, because gb_connection_destroy frees the connection object during disconnect and a subsequent write may access that freed object, potentially trigger...

CVE-2026-53033

CVE-2026-53033 affects the Linux kernel’s BPF sockmap path, causing a race in unix_stream_bpf_update_proto() that can yield a Use-After-Free when a BPF iterator updates a sockmap during a TCP state transition. The issue is resolved by taking the state lock for AF_UNIX iterations to keep the unix ...

CVE-2026-53066

CVE-2026-53066 affects the Linux kernel DRM sun4i backend. The flaw is that drm_atomic_get_plane_state() may return an error pointer which is not checked in sun4i_backend_atomic_check(), allowing a dereference of ERR_PTR() and potential kernel instability. Public details cite a fix in the kernel ...

CVE-2026-53095

CVE-2026-53095 concerns the Linux kernel BPF subsystem. The issue arises from abuse of the kprobe_write_ctx setting via freplace: an uprobe/kprobe combination can attach a freplace program to a kprobe, enabling modification of kernel function arguments (notably the first argument in struct pt_reg...

CVE-2026-53096

CVE-2026-53096 affects Linux kernel code path in BPF dev_map_redirect_multi() where DEVMAP_HASH uses hlist_for_each_entry_safe() under RCU protection. The function iterates hash buckets without rcu_dereference(), exposing risk of partially constructed nodes on weakly-ordered architectures (ARM64,...

CVE-2026-53102

The CVE-2026-53102 issue affects the Linux kernel wifi MT76 driver. It describes a memory leak in skb handling inside mt76_connac_mcu_alloc_sta_req(): if mt76_connac_mcu_sta_wed_update() or mt76_connac_mcu_sta_key_tlv() fail before mt76_mcu_skb_send_msg() completes, the allocated skb is leaked. T...

CVE-2026-53110

The CVE-2026-53110 entry concerns the Linux kernel s390/s390x BPF JIT: the ABI requires zero-extending unsigned arguments and return values, but the JIT historically performed only sign-extension. The connected Red Hat, Debian/Ubuntu OSV entries and the NVD description confirm the issue and its r...

CVE-2026-53121

CVE-2026-53121 affects the Linux kernel’s amd-pstate driver. The issue is a memory leak in amd_pstate_epp_cpu_init(): when failing to set the Energy Performance Preference (EPP), the function returns an error without freeing the cpudata object allocated at the start. This could lead to resource e...

CVE-2026-53207

The CVE-2026-53207 issue affects the Linux kernel mm/memory-failure path, where concurrent MADV_HWPOISON calls on the same hugetlb page can deadlock the non-recursive hugetlb_lock. The root cause is a sequence where a GUP reference is dropped under the hugetlb_lock, allowing free_huge_folio to re...

CVE-2026-53231

CVE-2026-53231 (Linux kernel) : The issue affects the PHY subsystem where PHY-driven SFP cages are not supported with the genphy code. Investigations show that sfp_bus_add_upstream() for genphy can deadlock because PHY probing runs under RTNL for genphy while non-genphy drivers do not. The root c...

CVE-2026-53289

Summary of CVE-2026-53289 (Linux kernel, ice driver). The vulnerability arises in ice_reset_all_vfs() where the return value of ice_vf_rebuild_vsi() is ignored. If VSI rebuild fails (for example during NVM firmware update via nvmupdate64e), ice_vsi_rebuild() tears down the VSI on its error path, ...

CVE-2026-53378

CVE-2026-53378 – Linux kernel DRM colorop blob reference handling fix Affects: Linux kernel DRM colorop component (drm/colorop) across affected kernel releases as described in multiple sources (NVD, Red Hat, Debian, UBUNTU OSV records). Root cause: The colorop state blob property handling leaked ...

CVE-2026-53395

Summary (concrete details from provided documents): CVE-2026-53395 affects the Linux kernel NFS server (nfsd). In nfsd4_create, the code steals create->cr_dpacl/cr_pacl into a local nfsd_attrs via a designated initializer and then nils the source pointers. The subsequent conflict guard tests t...

CVE-2026-63806

CVE-2026-63806 relates to the Linux kernel KVM ioeventfd datamatch bug. The issue occurs when a guest store spans multiple pages and hits MMIO on the second page, potentially triggering a datamatch IO event due to an alignment check in a 32-byte destination pointer; the code used a BUG_ON() with ...

CVE-2026-63807

CVE-2026-63807 concerns the Linux kernel KVM: x86/mmu path. The issue arises when recovering hugepages in the shadow MMU, where the base guest frame number (gfn) of a shadow page must be verified to be within the target memslot before querying the max mapping level. If the gfn is not pre-checked,...

CVE-2026-64063

CVE-2026-64063 affects the Linux kernel's netfslib (network file systems library) subsystem. The bug is in netfs_perform_write(): when a partially written streaming-write folio is overwritten by a subsequent write(), the function fails to discard the attached netfs_folio struct and mishandles par...

CVE-2026-64080

Summary: CVE-2026-64080 affects Linux kernel firmware: arm_ffa snapshot notifier callbacks under lock. The issue arises when notification handlers look up a notifier entry under notify_lock, then drop the lock and dereference the entry, allowing a concurrent unregister to free the entry and cause...

CVE-2026-64092

The CVE-2026-64092 issue affects the Linux kernel’s batman-adv module (tp_meter). The root cause is flawed coordination between receiver shutdown and batadv_tp_stop_all(), allowing a tp_vars reference leak when batadv_tp_receiver_shutdown() fails to release its reference if a timer had already ex...

CVE-2026-64258

CVE-2026-64258 — Linux kernel (fuse-uring) : A NULL pointer dereference could occur in the fuse_uring path when a copy to the userspace ring buffer fails. The root cause is that, after fuse_uring_req_end() sets ent->fuse_req to NULL, the ent_w_req_queue entry remained in FRRS_FUSE_REQ, risking...

CVE-2026-64284

CVE-2026-64284 — Linux kernel (KVM/x86): The vulnerability involves moving the handling of fastpath userspace exits into vendor code so KVM can run vendor-specific operations before userspace gains control of the vCPU. The description notes that, for VMX (and soon SVM), KVM must flush the PML buf...

CVE-2026-64360

CVE-2026-64360 affects the Linux kernel's hfs and hfsplus filesystem drivers. The function hfs_bnode_read() can return early—when is_bnode_offset_valid() fails or check_and_correct_requested_length() zeroes the length—without writing to the caller's stack-allocated output buffer. Callers such as ...

CVE-2026-64368

The CVE-2026-64368 issue affects the Linux kernel’s slab allocator: when red zoning is enabled, zeroing was overly broad and could affect krealloc()’s __GFP_ZERO contract. The root cause is an imprecise check for the tracked requested size; fixes switch to slub_debug_orig_size() to determine if t...

CVE-2026-64409

CVE-2026-64409 is a denial-of-service vulnerability in the Linux kernel's btmtksdio Bluetooth SDIO driver. The root cause is an incorrect time_is_before_jiffies() check in btmtksdio_txrx_work(): the timeout condition is inverted, so once the 5-second limit is exceeded the loop condition becomes a...

CVE-2026-64440

CVE-2026-64440 (Linux kernel) : The vulnerability affects the rtl8723bs HT_capabilities handling in staging. HT_caps_handler() reads pIE->length bytes and writes into a fixed 26-byte HT_cap[]; since pIE->length is from an unvalidated 802.11 AssocResponse, an AP can set it to 255, causing up...

CVE-2022-49955

Summary of CVE-2022-49955 : This vulnerability concerns the Linux kernel’s powerpc/rtas code, where MSR[HV] handling for IBM Cell during RTAS entry could crash the system. The root cause, as described across sources, is a mismatch in how MSR[HV] is treated when RTAS is invoked (firmware/RTAS inte...

CVE-2022-50205

The CVE-2022-50205 entry corresponds to a Linux kernel vulnerability in ext2 that adds validity checks for inode counts. The root cause is that inodes stored in the superblock must match the computed value from inodes-per-group, and there must be at least one block worth of inodes per group; thes...

CVE-2022-50253

CVE-2022-50253 is a Linux kernel issue where bpf code did not ensure skb->len was non-zero when redirecting to a tunneling device, leading to a length underflow/invalid skb handling path after __skb_pull in certain redirect paths. The vulnerability is exploited via BPF/XDP filtering paths that...

CVE-2022-50257

The CVE-2022-50257 issue is in the Linux kernel Xen grant handling (xen/gntdev) where partial grant mapping failures could leak grants. In paravirtualized domains (use_ptemod = true), alloced was not updated for all successful map_ops or kmap_ops, risking incorrect live_grants and leaks. The fix ...

CVE-2022-50259

CVE-2022-50259 : In the Linux kernel, the bpf sock_map_free() path can trigger use-after-free because sock_map_free() calls release_sock(sk) without holding a socket reference. This race is evidenced by syzbot tracing and mirrors a related issue fixed in sock_hash_free() (commit referenced). The ...

CVE-2022-50263

CVE-2022-50263 concerns the Linux kernel component vdpasim. The vulnerability stems from a memory leak when freeing IOTLBs: after the commit that added control virtqueue support, vdpasim->iommu became an array of IOTLBs, and mappings must be cleaned for each free IOTLB rather than deleting onl...

CVE-2022-50271

CVE-2022-50271 affects the Linux kernel’s vhost/vsock code. The issue arises when copying large files over SFTP over vsock, where data sizes commonly reach 32 kB and kmalloc may allocate many 32 kB chunks, leading to a page allocation failure (example: vhost-5837). The root cause is an inefficien...

CVE-2022-50278

CVE-2022-50278 : In the Linux kernel, a memory leak was introduced in the PNP path by deferring the dynamic allocation of the device name until after pnp_add_id() (the fix was to move dev_set_name() after pnp_add_id()) following commit 1fa5ae857bb1. The vulnerability affects the PNP device naming...

CVE-2022-50296

CVE-2022-50296 affects the Linux kernel where cpu_max_bits_warn() would warn when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled while displaying /proc/cpuinfo. The root cause is using NR_CPUS to iterate CPUs instead of the runtime limit nr_cpu_ids, which leads to a runtime war...

CVE-2022-50393

The CVE-2022-50393 issue affects the Linux kernel DRM/AMDGPU SDMA path where dma_resv_iter_next may be invoked from an unlocked context during SDMA page-table updates, leading to a potential misuse warning and race conditions. Affected component: amdgpu driver within the kernel's DMA-BUF handling...

CVE-2022-50463

In the Linux kernel, CVE-2022-50463 is due to a resource leak in the mpc52xx_lpbfifo_probe() error path on powerpc/52xx where a request_irq() is not balanced by a free_irq(). The patch adds the missing free_irq() call (matching behavior already present in the remove path). This affects the error-...

CVE-2022-50476

The CVE-2022-50476 issue concerns ntb_netdev in the Linux kernel where TX/RX callback handlers can run in interrupt context via the DMA framework. The root cause was calling the interrupt-unsafe dev_kfree_skb() from ntb_netdev_tx_handler() and ntb_netdev_rx_handler(); the fix uses the interrupt-c...

CVE-2022-50486

The CVE-2022-50486 issue affects the Linux kernel TI Ethernet driver (net: ethernet: ti) where netcp_ndo_start_xmit() returns int but the net_device_ops field .ndo_start_xmit expects netdev_tx_t. This mismatch can trigger runtime failures (kernel panic or thread termination) when kCFI (clang, CON...

CVE-2022-50504

CVE-2022-50504 (Linux kernel, powerpc/rtas) : Root cause is unsafe handling of a busy status from the ibm,os-term RTAS function via rtas_busy_delay(), which can cause a kernel panic and invalid-context sleep. The fix (as stated in the description) is to stop using rtas_busy_delay() and instead ca...

CVE-2022-50525

The CVE-2022-50525 issue affects the Linux kernel, specifically the iommu/fsl_pamu path. The root cause was in fsl_pamu_probe(): on create_csd() failure, the function returned early, leaving IRQs and memory unreleased. The patch fixes this by jumping to an error-handling path when create_csd() fa...

CVE-2023-53164

CVE-2023-53164 concerns a Linux kernel issue in the TI-SCI IRQ domain handling. The vulnerability arises from a refcount leak in ti_sci_intr_irq_domain_probe: of_irq_find_parent() returns a node pointer with an incremented refcount, and a missing of_node_put() could prevent proper release. The pr...

CVE-2023-53176

CVE-2023-53176 concerns the Linux kernel serial driver stack. When unbinding a port-specific 8250 driver, control passes to the generic serial8250 driver while port->pm may still reference the now-destroyed driver, causing an oops roughly 10 seconds later. The connected documents confirm the r...

CVE-2023-53187

CVE-2023-53187 pertains to the Linux kernel’s btrfs code. The vulnerability arises when a task creates a new block group that later becomes unused during the creation window. In btrfs_create_pending_block_groups(), if btrfs_mark_bg_unused() runs and moves the group out of the ‘new’ list into ‘unu...

CVE-2023-53192

The CVE-2023-53192 issue affects the Linux kernel vxlan nexthop code where a 32-bit hash returned by skb_get_hash() is used where a 31-bit hash is expected. This can cause int hash to become negative and trigger incorrect nexthop selection or out-of-bounds access in nh_buckets[], risking a kernel...

CVE-2023-53242

CVE-2023-53242 affects the Linux kernel thermal/hisi driver for hi3660: in the hi3660_thermal_probe function, memory was allocated for one sensors entry but a second access was attempted, causing a BRK handler: Fatal exception. The fix is to remove the unneeded second access (via the commit 74c8e...

CVE-2023-53267

The CVE-2023-53267 issue affects the Linux kernel driver for Xilinx SoC where memory allocated for cb_data in xlnx_add_cb_for_notify_event() could leak if kfree() is not invoked on allocation failure. The connected documents confirm a fix was applied to ensure kfree() is called to prevent leaks. ...