CVE-2026-53012

CVE-2026-53012 affects the Linux kernel: when an IPv6 nexthop is replaced with an IPv4 nexthop, the has_v4 flag in groups containing that nexthop is not updated. The reverse direction (AF_INET6 to AF_INET) is missed, enabling a stale has_v4=false to bypass fib6_check_nexthop and may cause a NULL ...

CVE-2026-53033

CVE-2026-53033 affects the Linux kernel’s BPF sockmap path, causing a race in unix_stream_bpf_update_proto() that can yield a Use-After-Free when a BPF iterator updates a sockmap during a TCP state transition. The issue is resolved by taking the state lock for AF_UNIX iterations to keep the unix ...

CVE-2026-53058

CVE-2026-53058 affects the Linux kernel DRM Cadence CDNS-MHDP8546 core in atomic_enable paths. The fault occurs when errors in cdns_mhdp_link_up() or cdns_mhdp_reg_read() cause a NULL pointer in modeset_retry_fn() because the connector isn’t initialised. The fix adds a connector_ptr to the mhdp d...

CVE-2026-53100

CVE-2026-53100 affects the Linux kernel mt76 wireless driver. The deadlock occurs when remain-on-channel logic calls mt76_set_channel() while dev->mutex is already held by remain_on_channel/roc_complete, since mt76_set_channel() also locks the mutex. The fix replaces mt76_set_channel() with __...

CVE-2026-53113

The CVE-2026-53113 entry concerns the Linux kernel Wi‑Fi driver ath11k. The issue is a memory leak in beacon template setup: ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid() allocate memory for beacon templates but do not free it on error, risking resource exhaustion. The do...

CVE-2026-53115

Technical details about CVE-2026-53115 are not publicly provided in the supplied documents; no affected products, impacts, or fixes are specified beyond the generic Linux kernel fix. Monitor for updates.

CVE-2026-53122

CVE-2026-53122: Linux kernel bug in btrfs where flushoncommit can deadlock a reflink with a pending transaction commit when copying an inline extent beyond i_size. The issue arises from locking sequences between reflink/commit paths and delalloc/ordered extents, leading to a cycle where two tasks...

CVE-2026-53129

CVE-2026-53129 affects the Linux kernel mbcache shrink path. The bug occurs when mb_cache_destroy() frees memory without canceling the pending c_shrink_work, allowing mb_cache_shrink_worker() to access freed memory if mb_cache_entry_create() scheduled work via schedule_work() and the work item is...

CVE-2026-53136

The CVE-2026-53136 issue affects the Linux kernel in the DRM AMD display driver. It arises from VBIOS info fields HdmiRegNum and Hdmi6GRegNum being used as loop bounds to copy retimer I2C settings into fixed-size arrays without validation, enabling an out-of-bounds heap write during driver probe....

CVE-2026-53145

Summary of CVE-2026-53145 (Linux kernel drm/gem change_handle race) : A race between gem_close and gem_change_handle ioctls in the DRM GEM subsystem was addressed but not cleanly fixed initially. The root cause involved confusion around the local handle variable (which is the new handle) and seve...

CVE-2026-53155

In Linux kernels, CVE-2026-53155 relates to mm/huge_memory and device-private PMD entries. A commit (65edfda6f3f2) updated set_pmd_migration_entry() to use pmdp_huge_get_and_clear() in the softleaf case but did not adjust the function fully, causing incorrect use of pmd_write(), pmd_soft_dirty(),...

CVE-2026-53233

CVE-2026-53233 concerns the Linux kernel: a double-free in netdev_nl_bind_rx_doit() linked to how genlmsg_reply() consumes the skb. The error path calls nlmsg_free(rsp) and the code should not unbind; instead the error is propagated to the user. This aligns with the description that such issues s...

CVE-2026-53271

CVE-2026-53271 affects the Linux kernel ksmbd component. The vulnerability is a NULL-deref in oplock/lease break notifiers: smb2_oplock_break_noti() and smb2_lease_break_noti() read opinfo->conn into a local buffer without READ_ONCE and without a NULL check. After opinfo_get_list() drops ci-&g...

CVE-2026-53294

Technical details for CVE-2026-53294 are not publicly available in the provided documents. Monitor for updates from Debian/Ubuntu OSV entries and kernel advisories for affected components, versions, and fixes.

CVE-2026-53379

Technical details for CVE-2026-53379 are not provided in the supplied documents. Monitor for updates.

CVE-2026-64218

CVE-2026-64218 affects the Linux kernel’s batman-adv subsystem. The bug in batadv_bla_purge_backbone_gw() could leak or misuse report_work structures when purging stale backbone gateway entries. The root cause: a previous loop held entries under spin_lock_bh() and called cancel_work_sync(), which...

CVE-2026-64296

The CVE concerns the Linux kernel exFAT driver: in exfat_find_dir_entry(), processing directory NAME entries (TYPE_EXTEND) advances the output buffer by a fixed amount while the guard tracks name length, allowing an out-of-bounds read/write when name fragments are long/short. The bug arises becau...

CVE-2022-50122

CVE-2022-50122 covers a Linux kernel vulnerability in the ASoC Mediatek MT8173-rt5650 driver. The root cause is a refcount leak where of_parse_phandle() returns a node pointer with an incremented refcount; the correct fix is to call of_node_put() when the reference is no longer needed. The provid...

CVE-2022-50234

CVE-2022-50234 concerns the Linux kernel’s io_uring/af_unix subsystem. The vulnerability arises from deferring the garbage-collection of registered files to the io_uring release path rather than performing it via unix_gc(), coupled with using these registered files for cycle-detection without act...

CVE-2022-50245

CVE-2022-50245 concerns a Linux kernel issue in the rapidio driver where a UAF can occur if kfifo_alloc() fails during mport_cdev_open(). The fix removes priv from the chdev->file_list before freeing it to prevent traversal from accessing a freed object (the smatch warning reference). Affected...

CVE-2022-50247

CVE-2022-50247 concerns a Linux kernel USB xHCI MTK driver issue: if wakeup IRQ setup fails, the shared HCD is leaked because usb_put_hcd() may not NULL the @shared_hcd before decreasing usage. The patch (referenced in the description) fixes leakage by ensuring shared_hcd is NULLed prior to decre...

CVE-2022-50261

Summary (CVE-2022-50261) : Linux kernel drivers for STI DRM (sti_hda.c, sti_dvo.c, sti_hdmi.c) used an int return type for mode_valid(), but the drm_connector_helper_funcs prototype requires returning an enum drm_mode_status. This mismatch can trigger a CFI (kCFI) failure and runtime problems (ke...

CVE-2022-50274

CVE-2022-50274 : In the Linux kernel, a use-after-free in dvb_unregister_device() was mitigated by adding a reference counter to struct dvb_device and delaying deallocation until no pointers reference the object. The vulnerability stemmed from cleanup releasing the dvb_device while file->priva...

CVE-2022-50291

CVE-2022-50291 pertains to the Linux kernel KCM subsystem. Connected advisories describe a data-race in kcm_rfree() related to kcm->rx_psock and an analogous race for kcm->rx_wait, fixed by annotating reads/writes around these fields. The patches address lockless reads in kcm_rfree and ensu...

CVE-2022-50293

CVE-2022-50293 affects the Linux kernel btrfs subsystem. When dropping file extent items for a range, ENOMEM could trigger a BUG_ON() path in btrfs_drop_extents(); the fix replaces those BUG_ON()s with proper transaction abort and error return handling. This means that instead of halting the tran...

CVE-2022-50299

CVE-2022-50299 is a Linux kernel issue in the md (multiple device) module where snprintf() could wrap around when the total length of the block device names with slashes exceeds 200, leading to incorrect buffer sizing. The vulnerability arises from using snprintf; the fix is to replace snprintf w...

CVE-2022-50304

CVE-2022-50304 affects the Linux kernel mtd/core with a resource leak in init_mtd() that could impact systems registering MTD devices. The issue was fixed in the kernel code (references include commits such as 26c304a3f136009c5a2a04e2bf3ac6aa25aabcb4 and 1aadf01e5076b9ab6bf294b9622335c651314895)....

CVE-2022-50321

CVE-2022-50321 corresponds to a Linux kernel wifi flaw in brcmfmac where brcmf_netdev_start_xmit() could leak memory when pskb_expand_head() fails, returning NETDEV_TX_OK without freeing the skb. The fix adds dev_kfree_skb() to properly free skb and was compile-tested; multiple Unity/Linux adviso...

CVE-2022-50330

CVE-2022-50330 (Linux kernel Cavium crypto driver) : The vulnerability occurs in the Cavium firmware loading path (drivers/crypto/cavium/cpt/cptpf_main.c) where the code_length field is read from the firmware file. The calculation ntohl(ucode->code_length) * 2 can overflow an integer, potentia...

CVE-2022-50349

The connected advisories for CVE-2022-50349 describe a Linux kernel memory-leak fix in tifm: tifm_7xx1_switch_media. If device_register() fails, the kobject name allocated in dev_set_name() during device_add() is leaked. The recommended remediation is not to free @dev after device_register(), and...

CVE-2022-50379

CVE-2022-50379 involves the Linux kernel btrfs quota handling. The issue occurs during quota enabling: after committing the transaction, the quota_root is assigned and BTRFS_FS_QUOTA_ENABLED is set, then the code starts the qgroup rescan worker via qgroup_rescan_init(). If that init fails, the qu...

CVE-2022-50423

CVE-2022-50423 affects the Linux kernel ACPICA code path where acpi_ut_copy_ipackage_to_ipackage() can free an acpi_operand_object and later reuse it due to a failed acpi_ut_walk_package_tree() path. The root cause is use-after-free from a memory-management sequence that repeatedly released the s...

CVE-2022-50448

CVE-2022-50448 involves the Linux kernel mm/uffd path where PTE_MARKER_UFFD_WP was not guarded, allowing a reachable warning when PTE_MARKER_UFFD_WP was not configured. The fix adds CONFIG_PTE_MARKER_UFFD_WP specific ifdefs to ensure the code is not executed in builds without the option. Impact d...

CVE-2022-50449

CVE-2022-50449 : In the Linux kernel, the Samsung clock driver fix addresses a memory leak in _samsung_clk_register_pll(). If clk_register() fails, pll->rate_table may be allocated by kmemdup() and is not freed, leaking memory. The patch adds proper cleanup to free the allocated memory on fail...

CVE-2022-50454

CVE-2022-50454 affects the Linux kernel’s DRM Nouveau driver. The vulnerability arises in nouveau_gem_prime_import_sg_table() due to a use-after-free: on failure of nouveau_bo_init(), the associated gem object is released by ttm_bo_init(), but the code later calls nouveau_bo_ref() which dereferen...

CVE-2022-50466

CVE-2022-50466 affects the Linux kernel, specifically the fs/binfmt_elf path in the load_elf_binary() function. The issue is a memory leak reported by kmemleak involving an unreferenced file object that can persist if memory allocation for the interpreter fails. The documented remediation in the ...

CVE-2022-50486

The CVE-2022-50486 issue affects the Linux kernel TI Ethernet driver (net: ethernet: ti) where netcp_ndo_start_xmit() returns int but the net_device_ops field .ndo_start_xmit expects netdev_tx_t. This mismatch can trigger runtime failures (kernel panic or thread termination) when kCFI (clang, CON...

CVE-2022-50513

CVE-2022-50513 affects Linux kernel staging/rtl8723bs: in the rtw_init_cmd_priv() error paths, pcmdpriv->cmd_allocated_buf was not freed when rsp_allocated_buf was allocated, causing a memory leak. The fix adds kfree(pcmdpriv->cmd_allocated_buf) on the error path and simplifies the return l...

CVE-2022-50514

CVE-2022-50514 concerns the Linux kernel’s usb gadget f_hid path. The vulnerability arises from a refcount leak on the error path when report_desc allocation fails: opts->refcnt has already been incremented and must be decremented to avoid leaving the options structure permanently locked. The ...

CVE-2022-50524

CVE-2022-50524 affects the Linux kernel in the iommu/mediatek path: if platform_get_resource() returns NULL and its value isn’t checked, a NULL pointer dereference can occur in resource_size(). The vulnerability has concrete fixes in kernel updates; SUSE’s SUSE-SU-2025:4320-1 (SLES15 SP5 kernel u...

CVE-2022-50532

CVE-2022-50532 concerns the Linux kernel SCSI MPT3sas driver. The vulnerability occurs in mpt3sas_transport_port_add(): if sas_rphy_add() returns an error, the resource allocated in sas_end_device_alloc() must be freed via sas_rphy_free(); otherwise a NULL pointer dereference can occur during dev...

CVE-2022-50545

CVE-2022-50545 concerns the Linux kernel where kmemleak reported leaks during the r6040 driver probe/remove flow. The root cause was a phy_device not being disconnected when removing an r6040 device or during error handling after a successful r6040_mii_probe, causing reference counts to stay elev...

CVE-2023-53147

The CVE-2023-53147 entry maps to a Linux kernel vulnerability in the IPsec XFRM subsystem: a NULL pointer dereference via xfrm_new_ae that could crash the kernel. The root cause is a missing NULL check when updating AE parameters; xfrm_update_ae_params could dereference a NULL x->replay_esn/x-...

CVE-2023-53148

In CVE-2023-53148, the Linux kernel igb driver had a task-hang vulnerability when a Thunderbolt hub is unplugged. The igb_down path could be invoked twice (via igb_io_error_detected and igb_remove), causing a hang at napi_synchronize and breaking Ethernet. The patch prevents the non-fatal PCIe er...

CVE-2023-53165

CVE-2023-53165 is a Linux kernel vulnerability in the UDF filesystem code. The issue is an uninitialized array read in the UDF charset conversion when processing filenames that begin with a dot and are 2–5 characters long, which can cause the output name to be prepended with a “unification hash” ...

CVE-2023-53174

CVE-2023-53174 is a Linux kernel local vulnerability affecting the SCSI core: memory leak on the error path from device_add() when allocation of the device name fails. The root cause is that the name allocated by dev_set_name() is not freed and reference counting is mishandled; the fix adds a put...

CVE-2023-53182

Technical details about CVE-2023-53182 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2023-53205

CVE-2023-53205 affects the Linux kernel KVM on s390, specifically the diag 9c handler where a race exists around the target CPU value (-1). The fix stores the physical target CPU in a local variable to prevent out-of-bounds accesses to CPU arrays. The CVE’s risk is described as high (CVSS v3.1: A...

CVE-2023-53233

CVE-2023-53233 is associated with a Linux kernel issue related to the net/smc deadlock: cancel_delayed_work_syn() deadlock detected via lockdep in the smc path. The connected Nessus/OSV entries (Unity Linux UTSA advisories UTSA-2025-993266 and UTSA-2025-992554; Debian Ubuntu OSVs) confirm a fix h...

CVE-2023-53234

The CVE-2023-53234 entry relates to the Linux kernel watchdog subsystem. The attached description and connected Nessus advisories confirm a root-cause: put_device is not called in all code paths when cdev_device_add fails and wdd->id != 0, leading to leaks in watchdog_dev_register paths. The f...