CVE-2026-52913

CVE-2026-52913 is addressed in OSV entries as a flaw in the rootio-linux package. Root has patched CVE-2026-52913 in Root:Ubuntu-22.04, with multiple fixed versions available. Additional OSV records indicate patched status for Root:Ubuntu-24.04 and Root:Debian-11/12, also noting multiple fixed ve...

CVE-2026-52962

The CVE refers to the Linux kernel Ceph driver: in __ceph_setxattr(), old_blob can retain ci->i_xattrs.prealloc_blob during a retry, and ceph_buffer_put() is not called for the old_blob, causing a buffer leak. A patch fixes this leak. Connected SUSE advisories (OSV entries) confirm this CVE (C...

CVE-2026-52964

Summary of CVE-2026-52964 : A flaw in the Linux kernel’s ALSA USB-audio path (USB MIDI 2.0 endpoint parser) fails to validate descriptor lengths for the MIDI 2.0 endpoint, allowing a malformed device to cause out-of-bounds reads on baAssoGrpTrmBlkID[] due to walking endpoint extras before verifyi...

CVE-2026-52983

The CVE-2026-52983 issue concerns the Linux kernel airoha network driver where inflight packets were counted only for the AIROHA_NUM_TX_RING TX queues in airoha_dev_xmit(), while airoha_qdma_tx_napi_poll() aggregated completions across all netdev TX queues (num_tx_queues). This mismatch creates a...

CVE-2026-53052

CVE-2026-53052 affects the Linux kernel ASoC: qcom: qdsp6: topology. The flaw arises from not validating widget type before accessing private topology data, which could allow an invalid (virtual) widget not tied to a DSP graph to trigger out-of-bounds memory access. The issue is resolved by the u...

CVE-2026-53053

The CVE-2026-53053 issue lies in the Linux kernel’s iommu/amd driver where clone_alias() incorrectly uses the wrong device ID (devid) for alias devices, risking propagation of wrong or stale Device Table Entries (DTEs). The fix passes the original pdev as opaque data to both clone_alias() and pci...

CVE-2026-53060

CVE-2026-53060 is a Linux kernel memory-leak in dm_cache_metadata_abort when a root_lock can’t be acquired due to a read-only metadata state. The issue is fixed in updated kernels (e.g., Root’s rootio-linux patches for Ubuntu 22.04/24.04 and related distro advisories). Affected environments shoul...

CVE-2026-53107

CVE-2026-53107 is a Linux kernel issue in the libertas wifi TX path where URBs were previously killed in interrupt context; the fix alters tx logic to avoid sleeping in interrupt contexts and returns -EBUSY when a TX is pending. Public notes show OSV and Debian-root patches across multiple releas...

CVE-2026-53115

Technical details about CVE-2026-53115 are not publicly provided in the supplied documents; no affected products, impacts, or fixes are specified beyond the generic Linux kernel fix. Monitor for updates.

CVE-2026-53210

The CVE-2026-53210 issue is in the Linux kernel’s Trusted Execution Environment (TEE) subsystem. A shm leak occurs in register_shm_helper() when TEE_IOC_SHM_REGISTER registers a zero-length shared memory, because shm is allocated before iov_iter_npages() and not freed if it returns 0; the code pa...

CVE-2026-53229

The CVE-2026-53229 issue concerns the Linux kernel mlx5e driver: on XDP_TX transmit failure, DMA mappings are not properly unmapped and XDP frames are not freed, causing a potential DMA/resource leak. The description specifies that in mlx5e_xmit_xdp_buff(), when sq->xmit_xdp_frame() returns fa...

CVE-2026-53240

CVE-2026-53240 concerns a use-after-free in the Linux kernel xfrm: iptfs partial reassembly logic (__input_process_payload). The bug occurs when first_skb is saved to xtfs->ra_newskb under drop_lock and a concurrent path may complete reassembly, NULL the ra_newskb, and free the skb before the ...

CVE-2026-53278

CVE-2026-53278 affects the Linux kernel arm_mpam component. The vulnerability arises when __destroy_component_cfg() is invoked from mpam_disable() before the configuration array has been allocated, causing a NULL pointer dereference. The function frees the configuration array and mbwu_state; sinc...

CVE-2026-53311

CVE-2026-53311 affects the Linux kernel’s FUSE subsystem: fuse_dentry_revalidate() may be invoked with a dentry whose d_time has not been initialised, originating from KMSAN observations during path resolution (lookup_open/d_revalidate). Multiple vendors and feeds document the fix as resolving th...

CVE-2026-53320

Technical details of CVE-2026-53320 are not publicly provided in the supplied documents; no vendor/product/patch information is confirmed here. Monitor for updates.

CVE-2026-53379

Technical details for CVE-2026-53379 are not provided in the supplied documents. Monitor for updates.

CVE-2026-53394

CVE-2026-53394 describes a Linux kernel vulnerability in nfsd where pre-allocated openowner state is leaked during an unconfirmed retry race. The issue occurs in find_or_alloc_open_stateowner(): if an unconfirmed owner is encountered, the code frees the previous state only partially and then unco...

CVE-2026-53396

CVE-2026-53396 (Linux kernel, NFSd) : The issue arises in nfsd4_create_file() where two ACL-handling bugs allow potential ACL leakage and incorrect behavior on CREATE. Specifically, the return value of nfsd4_acl_to_attr() is discarded, so failed ACL conversions (e.g., -EINVAL for unsupported ACE ...

CVE-2026-64056

The CVE covers a Linux kernel issue in the Cortina ethernet driver. The RX socket buffer (SKB) used to assemble fragments in gmac_rx() was a static local variable, which could race on devices with two ethernet ports (Gemini) when both ports are active. The fix makes the RX SKB a per-port variable...

CVE-2026-64081

CVE-2026-64081 concerns the Linux kernel firmware path (arm_ffa) and fixes how framework notifications in the shared RX buffer are validated. The issue arose from indirect messages where an incorrect offset/size could enable misinterpretation of payloads. The fix validates the reported offset and...

CVE-2026-64121

CVE-2026-64121 affects the Linux kernel’s ifb (virtual Ethernet back-end) device. The vulnerability arises from a miswalk of per-queue ethtool statistics: the code allocates per-queue tx_private entries based on dev->num_tx_queues, but ethtool/statistics callbacks use real_num_rx_queues/real_n...

CVE-2026-64140

The CVE-2026-64140 issue affects the Linux kernel’s ksmbd: after a SMB2 session logoff, a reconnectable file pointer may still be present in global_ft.idr. When users read /proc/fs/ksmbd/files, proc_show_files() dereferences fp->tcon->id without NULL checking, causing a null-ptr dereference...

CVE-2026-64167

CVE-2026-64167 affects the Linux kernel. The issue arises because kho_fill_kimage() unconditionally populates KHO metadata for all kexec image types, including crash kernels that run in a small reserved region. This can cause the crash kernel to fault during kho_memory_init() when it accesses a K...

CVE-2026-64182

The CVE-2026-64182 vulnerability concerns the Linux kernel memory subsystem: memblk_nr_poison_inc() and memblk_nr_poison_sub() look up a memory block via find_memory_block_by_id(), which returns a reference to the memory block device. Both helpers use the returned memory block without dropping th...

CVE-2026-64208

Summary : CVE-2026-64208 affects the Linux kernel’s crypto/krb5 and AF_RXRPC path. The root cause was missing pre-decrypt/pre-verify length checks, now fixed by updating the krb5 crypto library to provide facilities for prechecking message length and by applying this in AF_RXRPC to validate DATA ...

CVE-2026-64209

CVE-2026-64209 affects the Linux kernel Qualcomm QMP USBC PHY driver (qmp-usbc). A boundary check in the DP swing configuration incorrectly uses > 4 instead of >= 4, allowing index 4 to access swing_tbl and pre_emphasis_tbl (both 4x4). This can lead to out-of-bounds memory access and potent...

CVE-2026-64234

The CVE-2026-64234 entry concerns the Linux kernel tty/serial driver pch_uart. The root cause is a missing check of the return value from dma_alloc_coherent(), which could yield a NULL pointer, triggering a crash in dma_handle_rx(). The fix adds a guard for dma_alloc_coherent() failure and ensure...

CVE-2026-64259

CVE-2026-64259 (Linux kernel, fuse-uring) : A race allowed a use-after-free in fuse-uring by letting a fuse_req on an SQE commit become findable after memcpy, if a malicious userspace sent commit SQEs before the request reached fuse-server. The fix reorders operations: moving fuse_uring_add_to_pq...

CVE-2026-64328

CVE-2026-64328 is a DMA fence memory leak in the Linux kernel's USB gadget FunctionFS (f_fs) driver. In ffs_dmabuf_transfer(), the first reference to an ffs_dma_fence object is never released after dma_resv_add_fence() acquires a second reference, causing objects to accumulate without being freed...

CVE-2026-64402

CVE-2026-64402 concerns the Linux kernel coresight ultrasoc-smb path: an OOB write in smb_sync_perf_buffer() can occur when the SMB sink is used as a perf AUX sink because the initial page index is derived before applying modulo normalization to the buffer size. The issue is fixed by normalizing ...

CVE-2026-64408

The CVE concerns the Linux kernel Bluetooth BNEP path: during netdev registration, bnep_add_connection() reads the L2CAP connection without holding the channel lock, and passes the HCI device to register_netdev() while a controller teardown could clear the connection. The published fix is to take...

CVE-2026-64441

The CVE-2026-64441 fix applies to the Linux kernel staging rtl8723bs code and addresses out-of-bounds reads in three IE/attribute parsers: rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr(). The patch adds cnt+2 bounds checks before loop bodies in rtw_get_sec_ie() and rtw_get_wapi_ie(), ...

CVE-2022-50078

CVE-2022-50078 describes a resolved Linux kernel issue in the tracing subsystem (eprobes). The root cause is a NULL pointer dereference that occurs when event probes (eprobes) try to retrieve the instruction pointer (RIP) using registers, while eprobes do not use pt_regs. The fix, implemented in ...

CVE-2022-50264

CVE-2022-50264 affects the Linux kernel clock subsystem, specifically the socfpga gate init path. The issue is a memory leak in the socfpga_clk/ops error path, corrected by freeing both the socfpga_clk and its ops on error. The vulnerability is categorized with a CVSS v3.1 base score of 5.5 (Medi...

CVE-2022-50291

CVE-2022-50291 pertains to the Linux kernel KCM subsystem. Connected advisories describe a data-race in kcm_rfree() related to kcm->rx_psock and an analogous race for kcm->rx_wait, fixed by annotating reads/writes around these fields. The patches address lockless reads in kcm_rfree and ensu...

CVE-2022-50299

CVE-2022-50299 is a Linux kernel issue in the md (multiple device) module where snprintf() could wrap around when the total length of the block device names with slashes exceeds 200, leading to incorrect buffer sizing. The vulnerability arises from using snprintf; the fix is to replace snprintf w...

CVE-2022-50330

CVE-2022-50330 (Linux kernel Cavium crypto driver) : The vulnerability occurs in the Cavium firmware loading path (drivers/crypto/cavium/cpt/cptpf_main.c) where the code_length field is read from the firmware file. The calculation ntohl(ucode->code_length) * 2 can overflow an integer, potentia...

CVE-2022-50396

CVE-2022-50396 affects the Linux kernel’s net/sched tcindex code. The root cause is in tcindex_change when old_r is taken from p->perfect: the code allocates a new filter result via tcindex_alloc_perfect_hash() and then calls tcindex_filter_result_init() to clear the old result without destroy...

CVE-2022-50402

CVE-2022-50402 concerns Linux kernel’s md-bitmap code. The vulnerability arises from not validating the return value of md_bitmap_get_counter(), which can lead to a NULL pointer dereference. The issue was resolved by updating the code to check the return value and guard against NULL dereferences;...

CVE-2022-50421

The CVE-2022-50421 entry concerns the Linux kernel rpmsg subsystem. The root cause is a double-destroy path for the default rpmsg endpoint: rpmsg_chrdev_eptdev_destroy() may destroy the default endpoint again after rpmsg_dev_remove() releases it, causing refcount underflow and use-after-free. Rep...

CVE-2022-50424

CVE-2022-50424 affects the Linux kernel WiFi driver for MT7921 (mt76/mt7921). The issue is a resource leak in mt7921_check_offload_capability() where a fw/allocated storage goes out of scope, leaking memory. The vulnerability is described as resolved/fixed via a Coverity-related fix (Addresses-Co...

CVE-2022-50440

The CVE-2022-50440 issue affects the Linux kernel DRM vmwgfx driver (drm/vmwgfx) where an invalid box size check for the snooped cursor allows an overflow during DMA surface copies, potentially crashing the system. The problem stems from improper validation of the copybox dimensions against the s...

CVE-2022-50457

CVE-2022-50457 : In the Linux kernel, the vulnerability is in mtd: core where del_mtd_device() calls of_node_put() on mtd_get_of_node(mtd) after memset(&mtd->dev, 0), clearing mtd->dev first and causing a refcount leak. The fix caches the pointer to the device_node to avoid unbalanced of_no...

CVE-2022-50461

CVE-2022-50461 affects the Linux kernel net: ethernet: ti: am65-cpsw driver. The root cause was PM runtime leakage in am65_cpsw_nuss_ndo_slave_open(), due to an omitted pm_runtime_put() on error paths. The vulnerability has been resolved in the kernel by ensuring pm_runtime_put() is issued in the...

CVE-2022-50475

CVE-2022-50475 : In the Linux kernel, the RDMA/core path fixes an issue where the ib_port structure could be invalid when accessing a sysfs node. The vulnerability arises if ib_port is not properly set before adding the sysfs kobject and not reset after its removal, which could lead to a NULL poi...

CVE-2022-50483

CVE-2022-50483 concerns a Linux kernel issue in the net: enetc path where, on XDP redirects, a page reference counting race could leak pages. The root cause: enetc_flip_rx_buff() could be executed before xdp_do_redirect() completes, causing page refcounts to reach 2 (or 0 on some paths) and enabl...

CVE-2022-50492

CVE-2022-50492 affects the Linux kernel DRM MSM driver. The issue is a use-after-free during probe deferral, where the bridge counter isn’t reset on DRM device teardown, causing stale pointers to deallocated structures to be accessed on the next tear down (e.g., after a late bind deferral). With ...

CVE-2022-50497

CVE-2022-50497 affects the Linux kernel’s binfmt_misc subsystem. The provided documents indicate a fix for a shift-out-of-bounds issue in check_special_flags, with UBSAN warning about left shift of 1 by 31 in an unsigned int context. The vulnerability arises from how Node flags/macros are typed, ...

CVE-2022-50513

CVE-2022-50513 affects Linux kernel staging/rtl8723bs: in the rtw_init_cmd_priv() error paths, pcmdpriv->cmd_allocated_buf was not freed when rsp_allocated_buf was allocated, causing a memory leak. The fix adds kfree(pcmdpriv->cmd_allocated_buf) on the error path and simplifies the return l...

CVE-2022-50518

CVE-2022-50518 relates to the Linux kernel parisc/firmware path: the fix locks in pdc_iodc_print() to protect parallel modifications of iodc_dbuf[], validates length to prevent iodc_dbuf[] overflow, drops iodc_retbuf[], and corrects indentation. This resolves a local-impact issue on parisc system...