CVE-2026-46256

CVE-2026-46256 refers to a Linux kernel flaw in the NFS LOCALIO optimization. The issue allows a recursion deadlock during direct reclaim when writing pages back into NFS via nfs_writepages, potentially affecting NFS loopback paths where LOCALIO is used on the same system. The root cause is that ...

CVE-2026-31434

CVE-2026-31434 affects the Linux kernel's btrfs subsystem. The root cause is a leak of kobject names for sub-group space_info entries: during removal, kobject_init_and_add is paired with allocations, but the corresponding btrfs_sysfs_remove_space_info() is not called on freed elements, causing le...

CVE-2026-31441

CVE-2026-31441 affects the Linux kernel in the dmaengine: idxd component, where a memory leak occurs on workqueue reset. Root cause: idxd_wq_disable_cleanup() resets the wq type to NONE before resources are released. The upstream patch fixes the leak by ensuring resources are released before clea...

CVE-2026-31453

The CVE-2026-31453 issue affects the Linux kernel XFS path. The root cause is use-after-free-like behavior: after xfsaild_push_item() calls iop_push(), the log item could be freed if the AIL lock is dropped, allowing a freed log item to be dereferenced by tracepoints in the switch that follow. Th...

CVE-2026-31464

Summary (CVE-2026-31464): In the Linux kernel, the scsi: ibmvfc driver is fixed to cure an out-of-bounds access during target discovery. A malicious or compromised VIO server can return a num_written value in the discover targets MAD response that exceeds max_targets. This value is stored directl...

CVE-2026-31467

CVE-2026-31467 concerns the Linux kernel vulnerability where the bio completion path in certain process contexts (e.g., dm-verity) could call into decompression and then into vm_map_ram() with GFP_KERNEL, risking memory pressure and a potential deadlock in submit_bio_wait. The issue is tied to th...

CVE-2026-31498

Linux kernel CVE-2026-31498 affects Bluetooth L2CAP by exposing memory leaks during reconfiguration (ERTM data structures) and a zero-valued max_pdu_size path that can lead to an infinite loop in l2cap_segment_sdu. Root cause: reconfiguration previously re-initialized ERTM state and NULL’d sdu wi...

CVE-2026-31501

The CVE-2026-31501 issue affects the Linux kernel net: ti: icssg-prueth driver and is a use-after-free in the RX path. cpp i5_hdesc_get_psdata() returns a pointer into the CPPI descriptor, and the descriptor is freed via k3_cppi_desc_pool_free() before psdata[0]/psdata[1] are used by emac_rx_time...

CVE-2026-31580

CVE-2026-31580 affects the Linux kernel (bcache component). The issue is a use-after-free in cached_dev.sb_bio when a device is stopped while a superblock write is in progress, which can cause a crash/DoS through libceph I/O paths. Public reports align on this being resolved by patching bcache to...

CVE-2026-31598

Summary of CVE-2026-31598 (ocfs2 deadlock) : In the Linux kernel OCFS2, a potential deadlock arises from ABBA lock ordering between unlink and dio_end_io_write. The path in unlink acquires inode_lock (orphan_dir_inode) before ip_alloc_sem, while dio_end_io_write acquires ip_alloc_sem first, then ...

CVE-2026-31609

CVE-2026-31609 affects the Linux kernel SMB client; the double-free occurs in smbd_free_send_io() after smbd_send_batch_flush() because smbd_send_batch_flush() already frees via smbd_free_send_io() and has been moved to the batch list. The issue has been addressed in multiple advisories and patch...

CVE-2026-31632

CVE-2026-31632 affects the Linux kernel rxrpc component. The issue is a memory leak in rxgk_verify_response() caused by not cleaning up the rxgk context it creates; a fix has been applied to ensure the rxgk context is properly cleaned up. The available documents do not provide exploit details or ...

CVE-2026-31662

CVE-2026-31662 concerns the Linux kernel’s TIPc grouping protocol. The bug in tipc_group_proto_rcv() decrements bc_ackers for every inbound GRP_ACK_MSG, even if the sender already acknowledged the current broadcast round. Since bc_ackers is a 16-bit unsigned, a duplicate ACK after the last legiti...

CVE-2026-31721

CVE-2026-31721 affects the Linux kernel USB gadget subsystem, specifically the f_hid driver. The issue arises from initializing wait queues (poll_wait) with init_waitqueue_head inside hidg_bind, which re-initializes queues that may still contain items when the HID gadget is bound/unbound and epol...

CVE-2026-31726

Technical details for CVE-2026-31726 are not publicly available in the provided Connected documents. The Initial Description outlines a Linux kernel UVC unbind race fix, but no vendor/product/version specifics are given here. Monitor for updates from OSV/Mageia/Debian advisories.

CVE-2026-31739

CVE-2026-31739 affects the Linux kernel tegra crypto driver. The driver failed to set CRYPTO_ALG_ASYNC on asynchronous algorithms, causing the crypto API to select async paths for users requesting synchronous operations, potentially causing crashes. Mitigation implemented in the patch: explicitly...

CVE-2026-43015

The CVE-2026-43015 issue is in the Linux kernel macb PCI glue driver where clk handling during platform_device_unregister() can be used after the device is unregistered. The root cause is that platform_device_unregister may still use registered clks during a runtime resume callback, leading to a ...

CVE-2026-43040

CVE-2026-43040 corresponds to a Linux kernel issue in IPv6 Router Advertisements handling via nduseropt, where three padding fields in nduseroptmsg were not initialized to zero, leaking kernel data. Affected component: net/ipv6/ndisc (ndc ra user options). Root cause: padding fields were not zero...

CVE-2026-43063

CVE-2026-43063 pertains to the Linux kernel XFS attribute recovery path. The vulnerability arises when xlog_recovery_iget* fails to yield a valid pointer and an ensuing irele operates on a dangling pointer, potentially enabling a local attacker to crash the system and cause a DoS. The Red Hat adv...

CVE-2026-43075

The CVE-2026-43075 issue affects the Linux kernel’s ocfs2 filesystem code. A corrupted ocfs2 filesystem mounted on a loop device could trigger an out-of-bounds write in ocfs2_write_end_inline during a copy_file_range splice fallback, caused by trusting on-disk id_count to fit inline data. The roo...

CVE-2026-43097

CVE-2026-43097 affects the Linux kernel PCI Hyper-V driver. During error handling in hv_pci_probe, the domain_nr is freed twice: first via pci_bus_release_emul_domain_nr(), and again when the bridge release callback pci_release_host_bridge_dev() runs during cleanup, leading to ida_free on an unal...

CVE-2026-43100

CVE-2026-43100 covers a Linux kernel bridge issue where, if CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and nbp_vlan_group() may return NULL and the code path in br_fdb_delete_locals_per_vlan_port() / br_fdb_insert_locals_per_vlan_port() dereferences a NULL vlan group pointer. Connec...

CVE-2026-43139

The CVE-2026-43139 entry concerns the Linux kernel xfrm6 subsystem. The issue arises in xfrm6_get_saddr() which does not check the return value of ipv6_dev_get_saddr(); when ipv6_dev_get_saddr() fails with -EADDRNOTAVAIL, saddr->in6 remains uninitialized and xfrm6_get_saddr() incorrectly retur...

CVE-2026-43191

CVE-2026-43191 concerns the Linux kernel DRM/AMD display path, specifically the PHY FSM transition from TX_EN to PLL_ON for TMDS on DCN35. The issue stems from a backport from DCN401 intended to fix turning off the PHY PLL during TMDS disable, which could cause OTG to hang and affect DCHVM invali...

CVE-2026-43246

The CVE-2026-43246 issue affects the Linux kernel driver media: i2c/tw9906 (tw9906_probe). The root cause is a memory leak where memory allocated for the V4L2 control handler (v4l2_ctrl_handler_init and v4l2_ctrl_new_std) is not freed in an error path, potentially causing resource exhaustion or i...

CVE-2026-43253

CVE-2026-43253 relates to the Linux kernel IOMMU AMD component. When iommu.strict=1, the wait_on_sem() busy-wait runs inside a spinlock with interrupts disabled, risking soft lockups under load. The fix moves the completion wait out of the spinlock in iommu_completion_wait(), since wait_on_sem() ...

CVE-2026-43258

CVE-2026-43258 concerns the Linux kernel: on Alpha systems, memory compaction can trigger user-space crashes and heap corruption due to insufficient TLB shootdown during page migration. Root cause involves ASN rollover and stale instruction translations surviving migration. The fix introduces a m...

CVE-2026-43264

The CVE-2026-43264 issue affects the Linux kernel fbdev subsystem, specifically in of_get_display_timings() where of_parse_phandle() returns a device_node with an incremented refcount. On certain error paths, native_mode’s refcount isn’t decremented, causing a refcount leak and potential resource...

CVE-2026-43275

In the Linux kernel, a race condition in the UFS core driver can occur during system suspend when Runtime Power Management (RPM) level is zero. The driver previously bypassed flushing the exception-event handling work in this state, risking illegal host-controller access after entering deep power...

CVE-2026-43346

The CVE-2026-43346 entry documents a Linux kernel issue in ice: ptp used in VFIO passthrough where the PTP controlling PF (adapter->ctrl_pf) may not be initialized, causing NULL dereference risk and a WARN_ON() in ice_ptp_setup_pf(). The fix replaces the warning with an informational message a...

CVE-2026-43384

The CVE-2026-43384 issue concerns the Linux kernel TCP Authentication Option (TCP-AO) where MACs were compared without constant-time handling. The connected documents confirm a fix was applied to make MAC comparisons constant-time, mitigating timing-attack leakage of sensitive information. The vu...

CVE-2026-43397

Technical details about CVE-2026-43397 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories.

CVE-2026-43398

The CVE-2026-43398 entry concerns the Linux kernel amdgpu driver. A vulnerability arises from improper input validation in the userq_wait ioctl (amdgpu_userq_wait_ioctl), where excessively large input values can cause an Out-Of-Memory (OOM) situation, leading to Denial of Service. The root cause ...

CVE-2026-43424

The CVE concerns the Linux kernel USB gadget f_tcm nexus handling. The tpg->tpg_nexus pointer used by the BOT command/data paths can be NULL during race windows (before nexus is established or after it’s dropped). Dereferencing tv_nexus->tvn_se_sess without a NULL check leads to a kernel pa...

CVE-2026-43428

CVE-2026-43428 affects the Linux kernel USB core. The vulnerability arises from usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() allowing unbounded, uninterruptible timeouts, which could hang a task indefinitely. The fix enforces a maximum timeout of 60 seconds and treats negative timeo...

CVE-2026-43440

CVE-2026-43440 affects the Linux kernel net/mana driver, where during mana_gd_setup() cleanup a workqueue pointer (service_wq) could remain non-NULL after destroy_workqueue(), leading to a potential use-after-free if the pointer is checked after a failed setup. Connected advisories confirm the ro...

CVE-2026-45909

CVE-2026-45909 pertains to the Linux kernel Mediatek clock-gate driver. The fix removes __initconst from mtk_gate structures because, since commit 8ceff24a... the gate structs are used at runtime, not just for initialization. Documents indicate this resolves a runtime-access issue with potentiall...

CVE-2026-45953

CVE-2026-45953 affects the Linux kernel’s MD RAID5 subsystem. The root cause is a missing check in need_this_block() when an llbitmap bit is unwritten in a degraded array, which can cause stripe handling to deadlock and trigger an I/O hang (DoS-like impact). Public sources describe the issue and ...

CVE-2026-45979

CVE-2026-45979 affects the Linux kernel amdgpu driver. The issue arises in drm/amdgpu: clean up the amdgpu_cs_parser_bos where, under low memory conditions, kmalloc can fail and the mutex may not be unlocked, leading to resource contention. The patch/fix exits cleanly by unlocking the mutex, and ...

CVE-2026-45980

In the Linux kernel, the accel/amdxdna driver vulnerability CVE-2026-45980 arises from scheduling jobs on a hardware context while aie2_release_resource() is releasing resources. This can cause a use-after-free and crashes. The fix is to stop job scheduling before calling aie2_release_resource() ...

CVE-2026-46104

Linux kernel CVE-2026-46104 affects SELinux socket permission helpers. The vulnerability arises because sock_has_perm() and nlmsg_sock_has_extended_perms() dereference sk->sk_security directly, assuming the SELinux socket blob is at offset zero. In stacked LSM configurations this assumption fa...

CVE-2026-52978

The CVE-2026-52978 issue affects the Linux kernel PSP networking code. The netlink operations dev-set and key-rotate modify sensitive PSP state (version configuration and cryptographic keys) but did not require CAP_NET_ADMIN; access was only checked by psp_dev_check_access() for netns membership....

CVE-2026-52992

CVE-2026-52992 is a Linux kernel vulnerability affecting ADFS boot-time validation. The issue arises when nzones equals 0 during adfs boot-block validation, leading to an out-of-bounds write (adfs_map_layout writes dm[-1]) via kmalloc_array(0, …). A fix adds the equivalent rejection in adfs_valid...

CVE-2026-53012

CVE-2026-53012 affects the Linux kernel: when an IPv6 nexthop is replaced with an IPv4 nexthop, the has_v4 flag in groups containing that nexthop is not updated. The reverse direction (AF_INET6 to AF_INET) is missed, enabling a stale has_v4=false to bypass fib6_check_nexthop and may cause a NULL ...

CVE-2026-53034

CVE-2026-53034 is a Linux kernel issue in af_unix sockmap handling where a race between unix_stream_connect() state update and unix_peer assignment can lead to a NULL pointer dereference in unix_stream_bpf_update_proto(). The root cause is a timing window when sk_state is set to TCP_ESTABLISHED b...

CVE-2026-53115

Technical details about CVE-2026-53115 are not publicly provided in the supplied documents; no affected products, impacts, or fixes are specified beyond the generic Linux kernel fix. Monitor for updates.

CVE-2026-53138

The CVE-2026-53138 issue affects the Linux kernel’s drm/amd/display driver. A malformed VBIOS image can cause unbounded record-chain walk loops in bios_parser.c and bios_parser2.c due to for(;;) loops that terminate only on a 0xFF sentinel or zero record_size. This can lead to a large number of i...

CVE-2026-53155

In Linux kernels, CVE-2026-53155 relates to mm/huge_memory and device-private PMD entries. A commit (65edfda6f3f2) updated set_pmd_migration_entry() to use pmdp_huge_get_and_clear() in the softleaf case but did not adjust the function fully, causing incorrect use of pmd_write(), pmd_soft_dirty(),...

CVE-2026-53157

The CVE-2026-53157 issue affects the Linux kernel’s phonet code: phonet_device is removed from the per-net device list with list_del_rcu(), but freed immediately, creating a use-after-free for readers that still hold pointers. The root cause is mismatched lifetime management; the fix switches to ...

CVE-2026-53162

Summary (CVE-2026-53162) : In the Linux kernel memcg subsystem, a non-NMI-safe path around random-number generation during NMI handling could corrupt the ChaCha batch state, enabling memcg charge draining. The fix replaces the get_random_u32_below() path with a per-CPU round-robin counter stored ...