CVE-2026-53203

CVE-2026-53203 affects the Linux kernel’s accel/ivpu component. A buffer overflow can occur when the firmware returns a metric-stream info size larger than the allocated buffer during get_info_ioctl; if this happens, the operation could copy beyond the buffer. Remediation implemented in the publi...

CVE-2026-53207

The CVE-2026-53207 issue affects the Linux kernel mm/memory-failure path, where concurrent MADV_HWPOISON calls on the same hugetlb page can deadlock the non-recursive hugetlb_lock. The root cause is a sequence where a GUP reference is dropped under the hugetlb_lock, allowing free_huge_folio to re...

CVE-2026-53223

CVE-2026-53223 (Linux kernel) : A networking timestamping bug in net: guard timestamp cmsgs to real error queue skbs where skb_is_err_queue() incorrectly treated PACKET_OUTGOING as the sole marker for sk_error_queue. This misclassification affects AF_PACKET sockets, allowing timestamp-related con...

CVE-2026-53231

CVE-2026-53231 (Linux kernel) : The issue affects the PHY subsystem where PHY-driven SFP cages are not supported with the genphy code. Investigations show that sfp_bus_add_upstream() for genphy can deadlock because PHY probing runs under RTNL for genphy while non-genphy drivers do not. The root c...

CVE-2026-53272

The CVE-2026-53272 issue affects the Linux kernel’s erofs subsystem. A use-after-free on sbi->sync_decompress can occur when z_erofs_endio() queues z_erofs_decompressqueue_work() and, after folios are unlocked, the unmount path completes with sbi freed before sbi->sync_decompress is accesse...

CVE-2026-53292

Summary (CVE-2026-53292): The Linux kernel phonet subsystem contains a flaw in pn_socket_autobind() where, if pn_socket_bind() returns -EINVAL while the socket was never bound (pn_port() == 0) and sk states are not TCP_CLOSE, a BUG_ON() triggers a kernel panic from a user-triggerable path. The pa...

CVE-2026-53378

CVE-2026-53378 – Linux kernel DRM colorop blob reference handling fix Affects: Linux kernel DRM colorop component (drm/colorop) across affected kernel releases as described in multiple sources (NVD, Red Hat, Debian, UBUNTU OSV records). Root cause: The colorop state blob property handling leaked ...

CVE-2026-64074

The CVE-2026-64074 issue affects the Linux kernel, specifically a slab out-of-bounds write in statmount_mnt_idmap inside fs/statmount. When building a string with seq_printf(), an overflow may occur and manual increment of seq->count can push it to size+1, causing seq_has_overflowed() to miss ...

CVE-2026-64084

Summary: CVE-2026-64084 affects the Linux kernel’s hwmon pmbus/adm1266 driver. The bug occurs in adm1266_gpio_get_multiple() when iterating the PDIO portion of the caller-supplied mask. It uses for_each_set_bit_from with an upper bound of ADM1266_GPIO_NR + ADM1266_PDIO_STATUS (0xE9/233) instead o...

CVE-2026-64116

Summary: CVE-2026-64116 fixes a NULL pointer dereference in the Linux kernel IOAM path for IPv6 Hop-by-Hop processing. What was affected: The function ipv6_hop_ioam() could read __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. During interface teardow...

CVE-2026-64186

CVE-2026-64186 relates to the Linux kernel AMD IOMMU debugfs handling. The issue arises from using int-typed dbg_mmio_offset and dbg_cap_offset populated via kstrtou32_from_user(), which can wrap to a negative value for large inputs, risking out-of-bounds access in read/write paths. The patch fix...

CVE-2026-64258

CVE-2026-64258 — Linux kernel (fuse-uring) : A NULL pointer dereference could occur in the fuse_uring path when a copy to the userspace ring buffer fails. The root cause is that, after fuse_uring_req_end() sets ent->fuse_req to NULL, the ent_w_req_queue entry remained in FRRS_FUSE_REQ, risking...

CVE-2026-64317

CVE-2026-64317 affects the Linux kernel isofs Rock Ridge SL handling. A crafted Rock Ridge SL record can declare a component length that runs past the SL record, causing an out-of-bounds read of up to 255 bytes during parsing in get_symlink_chunk() and parse_rock_ridge_inode_internal(). This can ...

CVE-2026-64330

CVE-2026-64330 is an out-of-bounds read in the Linux kernel's USB Type-C TCPM driver, specifically in svdm_consume_modes(). The SVID index (pmdata->svid_index) is used to index into pmdata->svids without bounds validation against pmdata->nsvids. A malicious USB-C partner can drive the in...

CVE-2026-64409

CVE-2026-64409 is a denial-of-service vulnerability in the Linux kernel's btmtksdio Bluetooth SDIO driver. The root cause is an incorrect time_is_before_jiffies() check in btmtksdio_txrx_work(): the timeout condition is inverted, so once the 5-second limit is exceeded the loop condition becomes a...

CVE-2022-50239

CVE-2022-50239 refers to a Linux kernel issue in the cpufreq: qcom driver where a string literal stored in read-only memory was used as a destination for snprintf, causing an oops by writing into RO memory. The root cause was using a char *pvs_name pointing to a RO string and attempting snprintf(...

CVE-2022-50240

CVE-2022-50240 concerns the Linux kernel Android binder subsystem. The issue arises from saving a pointer to a VMA outside of the mmap_lock, which could become stale or be freed, leading to fragile behavior in various failure paths. The documented fix changes the binder_alloc structure to record ...

CVE-2022-50248

CVE-2022-50248 is a Linux kernel vulnerability affecting the iwlwifi/iwl mvm TX path where a double-free of skb can occur. The issue arises when iwl_mvm_tx_skb_sta returns non-zero and the skb is freed, but a TSO skb buffer may also be freed in an error path; the fix is to return 0 in that error ...

CVE-2022-50276

CVE-2022-50276 is a Linux kernel issue: when kmalloc() fails in kasprintf(), propname becomes NULL and a strcmp() dereferences it in of_get_property(), causing a NULL pointer dereference. The fix is to return ENOMEM when kasprintf() returns NULL. The vulnerability affects the kernel's power suppl...

CVE-2022-50315

CVE-2022-50315: Linux kernel ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS. The issue arises when sata_pmp_init_links() initializes link->pmp up to SATA_PMP_MAX_PORTS while em_priv is an 8-element array, causing a UBSAN array-index-out-of-bounds in libahci.c. The patch aligns EM_MAX_SL...

CVE-2022-50323

CVE-2022-50323 (Linux kernel) : The vulnerability stems from skb_append_pagefrags() sensing pfmemalloc status for pages owned by user space, triggering a data race reported by KCSAN in the swap/LRU paths. The fix/mitigation is to stop sensing pfmemalloc status for these pages and to use skb_fill_...

CVE-2022-50328

CVE-2022-50328 affects the Linux kernel component jbd2. It describes a use-after-free in jbd2_fc_wait_bufs caused by using bh after releasing the buffer head reference, with the recommended fix: validate uptodate status of the buffer before putting the buffer head reference count. The incident is...

CVE-2022-50349

The connected advisories for CVE-2022-50349 describe a Linux kernel memory-leak fix in tifm: tifm_7xx1_switch_media. If device_register() fails, the kobject name allocated in dev_set_name() during device_add() is leaked. The recommended remediation is not to free @dev after device_register(), and...

CVE-2022-50354

CVE-2022-50354 pertains to the Linux kernel component drm/amdkfd, where the fix for kfd_process_device_init_vm error handling was applied. The affected code path could lead to a NULL pointer dereference (address 0x10) during process destruction, with a call trace through amdgpu_amdkfd_gpuvm_unmap...

CVE-2022-50359

CVE-2022-50359 affects Linux kernel media driver cx88: null-ptr-deref in buffer_prepare() when cx88_risc_buffer() fails, leading to empty buffer and null-ptr-deref in buffer_queue(). The issue is fixed by validating the return value of cx88_risc_buffer() before use. Affected reports in connected ...

CVE-2022-50362

CVE-2022-50362 is a Linux kernel issue in dmaengine for Hisilicon DMA channels. The vulnerability arises when a DMA channel is used concurrently across multiple threads, causing an oops and system hang due to a data race in descriptor handling. The root cause is described as threads rewriting the...

CVE-2022-50365

CVE-2022-50365 is a Linux kernel issue where tail adjustment during pull operations could cause side effects when using helpers like BPF_FUNC_skb_pull_data. The vulnerability affects the handling of sk_buff tail growth in gso fragment scenarios and could lead to crashes if not mitigated. The publ...

CVE-2022-50384

CVE-2022-50384 is a Linux kernel vulnerability in staging/vme_user (tsi148_dma_list_add) where an error path could free an entry without removing it from list->entries, risking use-after-free. The connected documents confirm the root cause is the failure to remove &entry->list from list-&gt...

CVE-2022-50398

The CVE-2022-50398 entry affects the Linux kernel DRM MSM display path (drm/msm/dp). A race in commit_tail/drm_release could allow an extra frame to be pushed downstream when the display interface is down, causing dp_bridge_disable() to access the main link register with clocks disabled and trigg...

CVE-2022-50405

The CVE-2022-50405 entry describes a Linux kernel race in the vxlan path (net/tunnel) where deleting a vxlan device during packet reception can release a sock before sk_user_data readers finish. This leads to a NULL pointer dereference in vxlan_ecn_decapsulate() / vxlan_get_sk_family(). The repro...

CVE-2022-50439

CVE-2022-50439 is a Linux kernel vulnerability in ASoC: mediatek mt8173 where IRQs could fire before pdata is ready, causing memory read errors and kernel instability. Connected advisories (SUSE, Astra Linux, OSV) indicate the issue was resolved in the kernel by enabling IRQ once pdata is ready. ...

CVE-2022-50476

The CVE-2022-50476 issue concerns ntb_netdev in the Linux kernel where TX/RX callback handlers can run in interrupt context via the DMA framework. The root cause was calling the interrupt-unsafe dev_kfree_skb() from ntb_netdev_tx_handler() and ntb_netdev_rx_handler(); the fix uses the interrupt-c...

CVE-2022-50510

CVE-2022-50510 affects the Linux kernel’s perf/smmuv3 component. The issue is a hotplug callback leak in arm_smmu_pmu_init(): when platform_driver_register() fails, the callback added by cpuhp_setup_state_multi() is not removed, potentially leaking a hotplug callback. The fix removes the callback...

CVE-2022-50521

The CVE-2022-50521 issue affects the Linux kernel (platform/x86 mxm-wmi) with a memleak in mxm_wmi_call_mx[ds|mx]. The ACPI buffer (out.pointer) returned by wmi_evaluate_method() was not freed after the call, causing a memory leak. The patch fixes this by passing NULL to wmi_evaluate_method(), pr...

CVE-2022-50531

The CVE-2022-50531 issue is in the Linux kernel Tipc subsystem where an 4-byte portion of sub.usr_handle remained uninitialized when handling setsockopt for SOL_TIPC, causing a kernel infoleak detected by KMSAN. The fixed version initializes sub.usr_handle with an 8-byte write in tipc_topsrv_kern...

CVE-2022-50536

CVE-2022-50536 affects the Linux kernel’s BPF sockmap path. In tcp_bpf_send_verdict() redirection, the eval variable is set to __SK_REDIRECT after sending apply_bytes data; if msg.has_more_data, sock_put() can be called multiple times, risking a use-after-free via refcount misuse. The issue is fi...

CVE-2022-50538

CVE-2022-50538 pertains to the Linux kernel VME subsystem. In fake_init(), __root_device_register() may fail and the error is not handled, which can cause unregistering vme_root during exit to fail, potentially yielding a general protection fault and a null-ptr-deref (non-canonical address 0xdfff...

CVE-2022-50539

In the Linux kernel, CVE-2022-50539 concerns the ARM OMAP2+ platform, specifically omap4-common. The issue arises in omap4_sram_init() where of_find_compatible_node() can return a node pointer with its refcount already incremented. The underlying root cause is a refcount leak related to node hand...

CVE-2023-53164

CVE-2023-53164 concerns a Linux kernel issue in the TI-SCI IRQ domain handling. The vulnerability arises from a refcount leak in ti_sci_intr_irq_domain_probe: of_irq_find_parent() returns a node pointer with an incremented refcount, and a missing of_node_put() could prevent proper release. The pr...

CVE-2023-53204

CVE-2023-53204 affects the Linux kernel af_unix subsystem. The root cause is a data race on the unix_inflight field: user->unix_inflight is modified under spin_lock(unix_gc_lock), while too_many_unix_fds() reads it locklessly, enabling a race between unix_attach_fds and the unix_inflight acces...

CVE-2023-53211

The CVE-2023-53211 issue affects the Linux kernel’s driver core, where a struct acpi_pld_info *pld was not freed before returning on allocation failure, risking a memory leak. The fix adds ACPI_FREE() calls to release the allocated memory before the function exits. Connected documents confirm thi...

CVE-2023-53220

CVE-2023-53220 affects the Linux kernel, specifically the media/az6007 driver. The vulnerability arises in az6007_i2c_xfer where user-controlled msg[i].buf could be dereferenced if msg[i].buf is null and msg[i].len is zero, bypassing previous checks and potentially crashing. The root cause is mis...

CVE-2023-53263

CVE-2023-53263 : In the Linux kernel, the drm/nouveau/disp path fixes a use-after-free in error handling of nouveau_connector_create. The bug arises because freeing the connector could happen before cleaning up the DRM side, potentially causing memory corruption when an error path is taken after ...

CVE-2023-53267

The CVE-2023-53267 issue affects the Linux kernel driver for Xilinx SoC where memory allocated for cb_data in xlnx_add_cb_for_notify_event() could leak if kfree() is not invoked on allocation failure. The connected documents confirm a fix was applied to ensure kfree() is called to prevent leaks. ...

CVE-2023-53272

CVE-2023-53272 relates to the Linux kernel ENA driver (net: ena) where a UBSAN shift-out-of-bounds in the exponential backoff was observed during device reset. The issue stems from exponent calculations that could overflow 32-bit types, causing UBSAN panics when backoff delays grow large. The adv...

CVE-2023-53289

The CVE-2023-53289 issue affects the Linux kernel, specifically the media/bdisp component. The root cause is a missing check for the return value of create_workqueue, which could lead to a NULL pointer dereference. The publicly available connected documents confirm a fix that adds the necessary c...

CVE-2023-53300

The CVE-2023-53300 issue is in the Linux kernel media hi846 driver: hi846_init_controls allocated a ctrl_hdlr but failed to free it on error, causing a memory leak. The fix adds v4l2_ctrl_handler_free to properly release the allocated resources when initialization fails. Affected area: kernel med...

CVE-2023-53308

The CVE-2023-53308 issue is in the Linux kernel net: fec driver handling of pm_runtime_get() failures during removal. When pm_runtime_get() (as pm_runtime_resume_and_get()) fails, the remove callback may return an error, but the driver core ignores it and continues removing the device, causing a ...

CVE-2023-53316

Technical details about CVE-2023-53316 are not publicly available in the provided documents. Monitor for updates.

CVE-2023-53320

CVE-2023-53320 (Linux kernel) relates to scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info(). The patch fixes four issues in mpi3mr_get_all_tgt_info(): (1) valid entry length now uses the correct header size (sizeof(u64) instead of sizeof(u32)); (2) kern_entrylen no longer subtracts one from nu...