CVE-2026-23442

The CVE-2026-23442 issue affects the Linux kernel’s IPv6 SRv6 handling. Specifically, __in6_dev_get() may return NULL when a device has no IPv6 configuration (e.g., MTU too small or after NETDEV_UNREGISTER), which could lead to NULL pointer dereferences in seg6_hmac_validate_skb() and ipv6_srh_rc...

CVE-2026-43139

The CVE-2026-43139 entry concerns the Linux kernel xfrm6 subsystem. The issue arises in xfrm6_get_saddr() which does not check the return value of ipv6_dev_get_saddr(); when ipv6_dev_get_saddr() fails with -EADDRNOTAVAIL, saddr->in6 remains uninitialized and xfrm6_get_saddr() incorrectly retur...

CVE-2026-23377

CVE-2026-23377 affects the Linux kernel in the ice network driver under XDP. The root cause is an incorrect use of frag_size in XDP RxQ info, which should reflect the whole buffer size but was treated as a DMA write length, causing negative tailroom and potential kernel panic when crafting packet...

CVE-2026-23474

CVE-2026-23474 concerns a Linux kernel issue related to RedBoot partition table parsing that could trigger a buffer overflow when Fortify-derived checks mis-handle dynamic allocation sizing. The connected OSV/Nessus data indicate this vulnerability has been addressed in multiple distros via patch...

CVE-2026-31428

CVE-2026-31428 — In the Linux kernel, nfnetlink_log’s __build_packet_message() previously built NFULA_PAYLOAD attributes manually via skb_put()/skb_copy_bits(), bypassing nla_reserve()/nla_put(). This caused trailing padding to remain uninitialized, leaking stale heap data to userspace over NFLOG...

CVE-2026-31440

CVE-2026-31440 affects the Linux kernel’s dmaengine idxd driver. The issue arises during device removal when a reset clears configuration registers, causing the prior check for event log support to fail if evl is no longer valid. The propagated fixes remove the check for “evl” enabled state and i...

CVE-2026-31521

The CVE-2026-31521 issue is in the Linux kernel module loader’s simplify_symbols() where an out-of-bounds st_shndx (eg SHN_XINDEX) could cause a kernel panic. The patch adds validation of st_shndx against the valid range before using it, preventing the potential crash. Several OSV entries (Debian...

CVE-2026-31586

Summary: CVE-2026-31586 is a Linux kernel use-after-free in blk-cgroup during cgwb_release_workfn. The vulnerability occurs when css_put(wb->blkcg_css) is followed by accessing wb->blkcg_css via blkcg_unpin_online(), which can free the blkcg asynchronously (css_free_rwork_fn -> kfree) if...

CVE-2026-31609

CVE-2026-31609 affects the Linux kernel SMB client; the double-free occurs in smbd_free_send_io() after smbd_send_batch_flush() because smbd_send_batch_flush() already frees via smbd_free_send_io() and has been moved to the batch list. The issue has been addressed in multiple advisories and patch...

CVE-2026-31615

In CVE-2026-31615, the Linux kernel USB gadget code for renesas_usb3 (and related aspeed_udc context) did not validate endpoint indices in standard requests (GET_STATUS, SET/CLEAR_FEATURE). The host-supplied wIndex could be used to dereference a pointer without confirming endpoint count, risking ...

CVE-2026-31624

CVE-2026-31624) affects the Linux kernel HID core. The vulnerability arises when a HID device supplies a report descriptor with a large report_size, causing s32ton() to shift by n-1 with n > 32. The issue is resolved by clamping n to the same maximum used by snto32(), per commit ec61b41918587,...

CVE-2026-31631

The CVE-2026-31631 issue concerns the Linux kernel’s rxrpc path, specifically a buffer overread in rxgk_do_verify_authenticator(). The vulnerability arises because the function checks the nonce before validating the buffer size, potentially reading beyond the allocated memory. A fix has been appl...

CVE-2026-31641

The CVE-2026-31641 entry relates to the Linux kernel rxrpc token parsing bug. A heap buffer overflow could occur when rxrpc_preparse_xdr_yfs_rxgk() reads raw key and ticket lengths from an XDR token, applies round_up(x,4), and then uses the rounded values for validation/allocation, while the unro...

CVE-2026-31651

In CVE-2026-31651, the Linux kernel mmc: vub300 driver is affected by a NULL-deref/use-after-free on disconnect. The root cause is dropping the driver data reference without deregistering the controller, which can lead to NULL-pointer dereferences and a potential system crash (DoS) on local acces...

CVE-2026-31656

The CVE-2026-31656 issue affects the Linux kernel in the drm/i915/gt path, where a race between the heartbeat worker and intel_engine_park_heartbeat() can cause a refcount underflow and potential use-after-free of engine->heartbeat.systole. Root cause: a non-atomic read of the pointer followed...

CVE-2026-31710

CVE-2026-31710 — Linux kernel CIFS SMB1 UNIX mounts: A fix addresses incorrect dir separators caused by not updating @cifs_sb->mnt_cifs_flags after reset_cifs_unix_caps() when mounting SMB1 UNIX shares. The root cause is that the POSIX ACLs/paths flags (CIFS_MOUNT_POSIXACL, CIFS_MOUNT_POSIX_PA...

CVE-2026-31725

CVE-2026-31725 affects the Linux kernel’s USB gadget f_ecm functionality. The vulnerability arises during function unbinds when the net_device is created and registered under the gadget device, but is not de-parented correctly, leaving dangling sysfs links under /sys/class/net and /sys/devices/pl...

CVE-2026-31726

Technical details for CVE-2026-31726 are not publicly available in the provided Connected documents. The Initial Description outlines a Linux kernel UVC unbind race fix, but no vendor/product/version specifics are given here. Monitor for updates from OSV/Mageia/Debian advisories.

CVE-2026-43035

The CVE affects the Linux kernel net: sched: cls_api code path tc_chain_fill_node, where tcm_info in struct tcmsg was not initialized, leaking heap memory to userspace via a 4-byte field. The fix zeros tcm_info alongside other initialized fields. Affected/patched details from connected docs: upst...

CVE-2026-43081

The CVE-2026-43081 issue lies in the Linux kernel IPA driver where GENERIC_CMD register field masks for IPA v5.0+ were incorrectly configured, risking system instability. The description across multiple connected sources states this could produce a WARN when sending commands (e.g., to the MPSS re...

CVE-2026-43100

CVE-2026-43100 covers a Linux kernel bridge issue where, if CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and nbp_vlan_group() may return NULL and the code path in br_fdb_delete_locals_per_vlan_port() / br_fdb_insert_locals_per_vlan_port() dereferences a NULL vlan group pointer. Connec...

CVE-2026-43115

The CVE-2026-43115 entry documents a Linux kernel fix for Tiny SRCU: srcu_gp_start_if_needed() previously called schedule_work(), acquiring pool->lock and triggering a lockdep splat when call_srcu() runs with a scheduler lock held. The remediation adds irq_work_sync() to cleanup_srcu_struct() ...

CVE-2026-43127

CVE-2026-43127 concerns the Linux kernel ntfs3 component, where a circular locking dependency between wnd->rw_lock and ni->file.run_lock creates an AB-BA deadlock. The deadlock scenario: ntfs_extend_mft() acquires ni->file.run_lock then wnd->rw_lock; run_unpack_ex() acquires wnd->r...

CVE-2026-43137

Summary: CVE-2026-43137 affects the Linux kernel ASoC SOF Intel HDA subsystem. A mismatch between DAI links in the machine driver and the topology can leave the playback/capture widget unset, which may trigger a null pointer dereference. The issue is fixed in the reported OSV entries (Ubuntu root...

CVE-2026-43146

CVE-2026-43146 relates to the Linux kernel iris media driver. The root cause was that internal buffers were enqueued in buffers->list before a DMA allocation completed. If dma_alloc_attrs() failed with -ENOMEM, a partially initialized buffer remained in the list, risking inconsistent state and...

CVE-2026-43152

The CVE-2026-43152 issue is in the Linux kernel HID subsystem (hid-pl): if probe errors during device init are not handled, a NULL pointer dereference can occur when a device using Force Feedback is interacted with. Exploitation details are not provided in the documents, but the vulnerability is ...

CVE-2026-43161

CVE-2026-43161 is a Linux kernel IOMMU VT-d vulnerability related to ATS invalidation when a PCIe endpoint loses connection. In scalable-mode-disabled/unsupported systems, an endpoint link drop can cause the IOMMU to wait indefinitely for an ATS invalidation, leading to a host hard-lock (notably ...

CVE-2026-43186

The CVE-2026-43186 issue affects the Linux kernel IOAM code path for IPv6 (IOAM6). A crafted packet could cause a heap-buffer overflow in __ioam6_fill_trace_data() on the receive path by setting nodelen inconsistently with trace->type, leading to writes beyond the allocated region and possible...

CVE-2026-43199

CVE-2026-43199 affects the Linux kernel net/mlx5e component. A scheduling-while-atomic bug occurred when mlx5e_ipsec_init_macs() queried hardware MAC via mlx5_query_mac_address() from an atomic context (mlx5e_ipsec_handle_event/workqueue), which can sleep. The fix uses the MAC address already pre...

CVE-2026-43207

The vulnerability CVE-2026-43207 affects the Linux kernel mtk-mdp media driver. Root cause: improper error handling in the probe function can cause resource leaks; a missing check for vpu_get_plat_device() may dereference a NULL and the function increases the platform device reference count, risk...

CVE-2026-43213

The CVE-2026-43213 issue centers on the Linux kernel WiFi driver rtw89_pci, where an abnormal TX release report sequence number can cause an out-of-bounds access to wd_ring->pages, leading to a NULL pointer dereference and kernel crash (DoS). Public reports confirm this affects the rtw89_pci c...

CVE-2026-43233

CVE-2026-43233 affects the Linux kernel nf_conntrack_h323 decoder (decode_choice), where a boundary check incorrectly used an uninitialized length and may read past the bitstream end, enabling a remote heap-buffer-overflow via a crafted Q.931 SETUP message to port 1720. The public disclosures des...

CVE-2026-43271

CVE-2026-43271 involves the Linux kernel md-cluster module where a race during MD array startup can cause a NULL pointer dereference in process_metadata_update when a METADATA_UPDATED message arrives before mddev->thread is initialized. The root cause is the code path that dereferences the thr...

CVE-2026-43294

The CVE-2026-43294 entry concerns Linux kernel’s MIPI-DSI driver for Renesas rz-du/rzg2l panels. Root cause: in reboot/unprepare paths, the MIPI-DSI interface could be stopped too late, causing a kernel panic via rzg2l_mipi_dsi_host_transfer(). Fix: move rzg2l_mipi_dsi_stop() to the new callback ...

CVE-2026-43360

CVE-2026-43360 affects the Linux kernel Btrfs file system. A hash-collision during multi-file creation can force multiple entries into a single dir item and, once a leaf size limit is reached, abort the transaction and leave the filesystem read-only, enabling a local DoS without admin privileges....

CVE-2026-43377

CVE-2026-43377 affects ksmbd in the Linux kernel where, under KSMBD_DEBUG_AUTH logging, generate_smb3signingkey() and generate_smb3encryptionkey() log session, signing, encryption, and decryption key bytes. The issue allows potential information disclosure by exposing credentials through verbose ...

CVE-2026-43392

Summary (CVE-2026-43392) : In the Linux kernel, the sched_ext vulnerability causes a potential DoS by starving the enable path in scx_enable() when fair-class workloads saturate the system. The root cause is a switch of the calling thread’s sched_class from fair to ext during the READY→ENABLED lo...

CVE-2026-43398

The CVE-2026-43398 entry concerns the Linux kernel amdgpu driver. A vulnerability arises from improper input validation in the userq_wait ioctl (amdgpu_userq_wait_ioctl), where excessively large input values can cause an Out-Of-Memory (OOM) situation, leading to Denial of Service. The root cause ...

CVE-2026-43410

Summary: CVE-2026-43410 affects the Linux kernel firmware driver for Stratix 10 RSU. When RSU is not enabled in the FSBL, the driver can NULL-dereference via svc_normal_to_secure_thread(), causing a kernel panic. The root cause is rsu_send_async_msg() freeing the channel on failure, while the pro...

CVE-2026-43411

CVE-2026-43411: Linux kernel TIPc divide-by-zero in tipc_sk_filter_connect() when conn_timeout is 0–3, triggering a kernel oops/panic on certain overload retry paths. The public docs state that an attacker can set conn_timeout via setsockopt(TIPC_CONN_TIMEOUT) to values below 4, causing delay %= ...

CVE-2026-43412

CVE-2026-43412 pertains to the Linux kernel ASoC Qualcomm qdsp6 driver. The root cause is an incorrect removal order during ADSP stop/start, where q6apm-audio teardown can delete RTDs containing q6apm DAI components before their removal pass, leaving components linked to the card and causing a cr...

CVE-2026-43415

CVE-2026-43415 describes a race in the Linux kernel’s UFS host controller driver (scsi: ufs: core) during UFS suspend. The issue arises because cancel_delayed_work_sync() is invoked after ufshcd_vops_suspend(..., POST_CHANGE), allowing ufshcd_rtc_work() to race with suspend operations and potenti...

CVE-2026-43446

CVE-2026-43446 affects the Linux kernel in the accel/amdxdna driver. A runtime suspend deadlock could occur if a running job calls pm_runtime_resume_and_get() while the system is suspending; the deadlock arises between the runtime suspend path and the job execution flow. The fix moves pm_runtime_...

CVE-2026-43455

In CVE-2026-43455, multiple sources confirm a race in the Linux kernel MCTP module: mctp_flow_prepare_output() checks key->dev and may call mctp_dev_set_key() without holding key->lock, while both mctp_dev_set_key() and mctp_dev_release_key() require the lock. This can allow concurrent path...

CVE-2026-43465

CVE-2026-43465: Linux kernel mlx5e XDP multi-buf frag counting flaw. When XDP programs modify the XDP buffer layout (via bpf_xdp_pull_data/bpf_xdp_adjust_tail), the driver failed to count dropped fragments, risking negative page fragment reference counting and potential instability. Public report...

CVE-2026-43486

CVE-2026-43486 – Linux kernel (arm64 contpte) details: The issue arises from contpte_ptep_set_access_flags() using a gathered ptep_get() to detect no-ops, which, in CONT ranges, can misreport a target as updated when a sibling sub-PTE still has PTE_RDONLY or lacks PTE_AF. This can trigger false n...

CVE-2026-45887

CVE-2026-45887 affects the Linux kernel af_unix subsystem's unix_stream_connect() path. Root cause: if prepare_peercred() fails, unix_release_sock() is not called for the new socket (newsk), causing a memory leak. Impact: potential DoS or instability due to unreleased memory. Remediation: move pr...

CVE-2026-45921

CVE-2026-45921 affects the Linux kernel’s mtd: parsers component, specifically the function mtd_parser_tplink_safeloader_parse(). The issue arises when buf allocated by mtd_parser_tplink_safeloader_read_table() is not freed if parts[idx].name allocation fails inside the loop, causing a memory lea...

CVE-2026-46034

CVE-2026-46034 affects the Linux kernel VFIO/PCI MSI handling: a NULL pointer dereference can occur in vfio_cdx_set_msi_trigger() if interrupts are triggered before MSIs are configured. The openSUSE Tumbleweed OpenSUSE-SU-2026:10954-1 advisory documents the fix in kernel-devel-7.0.11-1.1, noting ...

CVE-2026-52920

The CVE-2026-52920 involves the Linux kernel netfilter xt_policy module, where strict inbound policy matching previously consumed info->pol[] in an incorrect order when multiple transforms were applied. Root cause: match_policy_in() iterates sec_path entries from last to first, violating the f...