CVE-2026-23330

Summary: CVE-2026-23330 affects the Linux kernel NFC/NCI subsystem. The issue arises in nci_close_device() where pending data exchanges may not be completed before closing, allowing a leaking unreferenced socket object (example: 0xff1100000f435000, size 2048) and associated references. This could...

CVE-2025-68333

The CVE-2025-68333 issue affects the Linux kernel, specifically a potential deadlock in sched_ext deferred_irq_workfn() on PREEMPT_RT=y configurations. The root cause is that deferred_irq_workfn() could run in a non-disable-irq context, leading to a lock sequence like lock(&rq->__lock); interr...

CVE-2025-71133

The CVE-2025-71133 entry concerns the Linux kernel RDMA/irdma path, where irdma_net_event could dereference neigh (ptr) data before confirming NETEVENT_NEIGH_UPDATE. The code fix moves neigh->dev access under the NETEVENT_NEIGH_UPDATE case, preventing a potential out-of-bounds read reported by...

CVE-2025-71180

CVE-2025-71180 affects the Linux kernel’s interrupt handling: the IRQF_NO_THREAD flag should not be used with code that may take a spinlock, as warned by CONFIG_PROVE_RAW_LOCK_NESTING. The issue occurs when an IRQ handler may either use IRQF_NO_THREAD or acquire a spinlock_t, leading to a potenti...

CVE-2025-71297

The provided CVE-2025-71297 stems from the Linux kernel wifi driver stack (rtw88/rtw8822b). The issue occurs when rtw8822b_set_antenna() is invoked from userspace while the wireless chip is powered off, causing rtw8822b_config_trx_mode() to read RF registers and trigger a WARNING. The patch ensur...

CVE-2026-23293

CVE-2026-23293 affects the Linux kernel net/vxlan code. Root cause: when IPv6 is disabled (ipv6.disable=1), nd_tbl is not initialized, leading to a NULL pointer dereference in neigh_lookup() invoked by route_shortcircuit() when an IPv6 packet is injected. Impact is local: a crafted, locally deliv...

CVE-2026-23310

Summary: CVE-2026-23310 affects the Linux kernel bonding/kern XDP path. If a bond is in 802.3ad or balance-xor mode and an XDP program is loaded, changing xmit_hash_policy to vlan+srcmac can escape the existing guard, leaving bond->xdp_prog set and causing an incompatible state during tear-dow...

CVE-2026-23364

CVE-2026-23364 concerns the Linux kernel’s ksmbd path, where MAC comparisons were not performed in constant time. The underlying issue is a timing-attack-prone memcmp() usage; the recommended fix is to replace memcmp() with crypto_memneq() to ensure constant-time comparisons. The vulnerability is...

CVE-2026-23377

CVE-2026-23377 affects the Linux kernel in the ice network driver under XDP. The root cause is an incorrect use of frag_size in XDP RxQ info, which should reflect the whole buffer size but was treated as a DMA write length, causing negative tailroom and potential kernel panic when crafting packet...

CVE-2026-23378

CVE-2026-23378 concerns a Linux kernel net/sched issue in act_ife where metalist entries were appended on replace instead of replacing existing data, risking unbounded metadata growth and potential out-of-bounds encode errors. The root cause is fixed by adding metalist to the ife RCU data structu...

CVE-2026-23391

CVE-2026-23391 affects the Linux kernel netfilter xt_CT feature. The issue arises when templates reference nfqueue objects (e.g., helper, nfnetlink_cttimeout) that can be removed while packets are queued, potentially leaving pending packets. The vulnerability has been resolved by flushing enqueue...

CVE-2026-23443

CVE-2026-23443 refers to a Linux kernel ACPI processor errata handling flaw (piix4). A use-after-free could occur from dereferencing device pointers after their objects were freed, stemming from a NULL-pointer dereference in acpi_processor_errata_piix4(). The fix moves diagnostic message printing...

CVE-2026-23464

CVE-2026-23464 concerns the Linux kernel vulnerability in the Microchip PolarFire SoC mpfs driver. The issue is a memory leak in mpfs_sys_controller_probe(): if of_get_mtd_device_by_node() fails, the function returns early without freeing allocated memory for sys_controller. The fix routes error ...

CVE-2026-23474

CVE-2026-23474 concerns a Linux kernel issue related to RedBoot partition table parsing that could trigger a buffer overflow when Fortify-derived checks mis-handle dynamic allocation sizing. The connected OSV/Nessus data indicate this vulnerability has been addressed in multiple distros via patch...

CVE-2026-31394

CVE-2026-31394 concerns the Linux kernel mac80211 path where AP_VLAN (4addr) stations can trigger a NULL pointer dereference in __ieee80211_sta_cap_rx_bw() due to sta->sdata pointing to VLAN sdata, which may not participate in chanctx reservations. The root cause is that link->reserved.oper...

CVE-2026-31423

The CVE-2026-31423 issue affects the Linux kernel’s net/sched sch_hfsc; rtsc_min() can divide by a value derived from the difference of large u64 slopes, risking a divide-by-zero when the difference equals 2^32. The fix widens the internal counter to u64 and replaces do_div() with div64_u64() to ...

CVE-2026-31462

CVE-2026-31462 concerns the Linux kernel DRM/AMDGPU PASID reuse issue where a process reusing a PASID could leave pending page faults in the IH ring buffer after exit. The fix uses an idr cyclic allocator to prevent immediate PASID reuse. Connected OSV entries show Root has patched this CVE in ro...

CVE-2026-31470

CVE-2026-31470 concerns the Linux kernel TDX guest path, specifically the virt: tdx-guest component. Multiple connected sources confirm a fix for handling of the host-controlled quote buffer length, where the host can set quote_buf->out_len to influence how many bytes of the quote are copied t...

CVE-2026-31475

In CVE-2026-31475, the Linux kernel ASoC sma1307 component had a double-free issue: mode_set entries allocated with devm_kzalloc() were (incorrectly) freed with kfree() in an error path. The remedy documented across multiple sources is to drop the manual kfree() loop and rely on device resource m...

CVE-2026-31476

In the Linux kernel component ksmbd, CVE-2026-31476 describes a logic flaw where a multichannel session binding request that fails (for example, due to a wrong password) could cause the targeted session to be marked SMB2_SESSION_EXPIRED. Because the failed binding may reference a session from ano...

CVE-2026-31482

The CVE-2026-31482 issue affects the Linux kernel on s390, where r12 was not scrubbed on kernel entry due to an incomplete update in the s390 entry path. The root cause is that, after removing TIF_ISOLATE_BP, the register-clearing sequence failed to include the xgr %r12,%r12 scrub, leaving the cu...

CVE-2026-31485

The CVE-2026-31485 issue affects the Linux kernel SPI driver for the FSL LPSPI controller. Root cause: teardown order when unregistering the SPI controller can race with in-flight DMA transfers, causing a NULL pointer dereference (UAF) and an I/O error in DMA RX during a transfer. The documented ...

CVE-2026-31511

CVE-2026-31511 affects the Linux kernel Bluetooth MGMT subsystem, specifically a dangling pointer in mgmt_add_adv_patterns_monitor_complete where mgmt_pending_free(cmd) could kfree cmd before unlinking from the list. Connected advisories indicate Debian/Root and other OSV entries report a patch w...

CVE-2026-31543

The CVE-2026-31543 entry concerns the Linux kernel. A vulnerability in crash_dump/logging: read_key_from_user_keying() incorrectly logged the first 8 bytes of the key payload when debug logging was enabled, partially exposing the dm-crypt key. The issue is resolved by stopping logging any key byt...

CVE-2026-31575

The CVE-2026-31575 issue affects the Linux kernel mm/userfaultfd code, where hugetlb fault mutex hashing used linear_page_index() (PAGE_SIZE units) instead of huge-page units, causing different mutexes to be used for addresses within the same huge page. The mismatch can allow races between faulti...

CVE-2026-31590

The CVE-2026-31590 issue affects the Linux kernel KVM SEV path: sev_pin_memory() would WARN when npages overflowed an int due to KVM_MEMORY_ENCRYPT_REG_REGION with a large size, enabling a local user to trigger a harmless warning via userspace input (e.g., addr=0, size=-1ul). The root cause is th...

CVE-2026-31647

CVE-2026-31647 concerns the Linux kernel idpf driver. The vulnerability stems from improper nesting of PREEMPT_RT raw/BH spinlocks during asynchronous VC handling, which could yield an invalid wait context. A fix switches from the completion’s raw spinlock to a local lock in the idpf_vc_xn struct...

CVE-2026-31721

CVE-2026-31721 affects the Linux kernel USB gadget subsystem, specifically the f_hid driver. The issue arises from initializing wait queues (poll_wait) with init_waitqueue_head inside hidg_bind, which re-initializes queues that may still contain items when the HID gadget is bound/unbound and epol...

CVE-2026-31779

The CVE-2026-31779 issue is in the Linux kernel’s wifi iw lwifi mvm path, specifically iwl_mvm_nd_match_info_handler(). A memcpy may copy more bytes than the dynamic notif->matches array can safely hold, enabling an out-of-bounds read and potential information disclosure. Debian and Red Hat ad...

CVE-2026-43075

The CVE-2026-43075 issue affects the Linux kernel’s ocfs2 filesystem code. A corrupted ocfs2 filesystem mounted on a loop device could trigger an out-of-bounds write in ocfs2_write_end_inline during a copy_file_range splice fallback, caused by trusting on-disk id_count to fit inline data. The roo...

CVE-2026-43089

CVE-2026-43089 : In the Linux kernel, the xfrm_user component exposes an information-disclosure vulnerability caused by a one-byte padding hole in struct xfrm_usersa_id that was not zeroed before copying to userspace. The fix zeros the entire structure before setting fields (build_mapping path). ...

CVE-2026-43100

CVE-2026-43100 covers a Linux kernel bridge issue where, if CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and nbp_vlan_group() may return NULL and the code path in br_fdb_delete_locals_per_vlan_port() / br_fdb_insert_locals_per_vlan_port() dereferences a NULL vlan group pointer. Connec...

CVE-2026-43139

The CVE-2026-43139 entry concerns the Linux kernel xfrm6 subsystem. The issue arises in xfrm6_get_saddr() which does not check the return value of ipv6_dev_get_saddr(); when ipv6_dev_get_saddr() fails with -EADDRNOTAVAIL, saddr->in6 remains uninitialized and xfrm6_get_saddr() incorrectly retur...

CVE-2026-43251

CVE-2026-43251 affects the Linux kernel HID prodikeys driver. A local attacker can connect a crafted USB device whose report descriptor bypasses the pm->input_ep82 check, leaving input_ep82 NULL and causing a crash (potential DoS). Multiple OSV entries show patches in rootio-linux packages for...

CVE-2026-43253

CVE-2026-43253 relates to the Linux kernel IOMMU AMD component. When iommu.strict=1, the wait_on_sem() busy-wait runs inside a spinlock with interrupts disabled, risking soft lockups under load. The fix moves the completion wait out of the spinlock in iommu_completion_wait(), since wait_on_sem() ...

CVE-2026-43256

CVE-2026-43256 is a Linux kernel vulnerability in the media subsystem (Qualcomm CAMSS VM) where the vfe_isr_reg_update() function may perform an out-of-bounds access. The code loops with MSM_VFE_IMAGE_MASTERS_NUM(7) but accesses vfe->line[] defined as struct vfe_line lineVFE_LINE_NUM_MAX . Whe...

CVE-2026-43264

The CVE-2026-43264 issue affects the Linux kernel fbdev subsystem, specifically in of_get_display_timings() where of_parse_phandle() returns a device_node with an incremented refcount. On certain error paths, native_mode’s refcount isn’t decremented, causing a refcount leak and potential resource...

CVE-2026-43321

The CVE-2026-43321 issue is in the Linux kernel BPF subsystem, where indirect jumps did not correctly mark the live registers for a gotox rX, leaving the affected register state unchecked. When the kernel fails to mark registers as used, it can enable manipulation of kernel state and potentially ...

CVE-2026-43354

CVE-2026-43354 affects the Linux kernel hx9023s proximity sensor driver (iio). The root cause is a division-by-zero in set_samp_freq when the sampling frequency is unspecified. The vulnerability was addressed by a fix in the kernel to protect against this division by zero. Multiple vendor advisor...

CVE-2026-43415

CVE-2026-43415 describes a race in the Linux kernel’s UFS host controller driver (scsi: ufs: core) during UFS suspend. The issue arises because cancel_delayed_work_sync() is invoked after ufshcd_vops_suspend(..., POST_CHANGE), allowing ufshcd_rtc_work() to race with suspend operations and potenti...

CVE-2026-43463

Summary: Multiple sources confirm a Linux kernel vulnerability in rxrpc and afs where rxrpc_kernel_lookup_peer() could return error pointers in addition to NULL, risking instability. The fix changes rxrpc_kernel_lookup_peer() to return -ENOMEM on allocation failure (instead of NULL) and updates c...

CVE-2026-43474

CVE-2026-43474 concerns the Linux kernel’s fuse filesystem. A local uninitialized-value bug was reported in fuse_fileattr_get, triggered when calling vfs_fileattr_get, due to not initializing flags_valid before the call. The issue is resolved by initializing the kernel’s internal file_kattr struc...

CVE-2026-43475

CVE-2026-43475 affects the Linux kernel hv_storvsc driver when PREEMPT_RT is enabled on Hyper-V. The issue stems from scheduling while atomic in storvsc_queuecommand, which could lead to a lock-up under certain I/O loads (as reported in the vulnerability description and kernel traces). A fix has ...

CVE-2026-43477

Summary: CVE-2026-43477 affects the Linux kernel DRM i915 VRR path. The vulnerability arises from configuring VRR timings (TRANS_VRR_VMAX/FLIPLINE) before enabling TRANS_DDI_FUNC_CTL, which can cause an MCE hang on some Intel/Icelake platforms (e.g., Dell XPS 7390 2‑in‑1 with a dock and faulty US...

CVE-2026-43479

CVE-2026-43479 concerns the Linux kernel’s lan78xx USB Ethernet driver. The issue is a WARN triggered during USB device disconnect in __netif_napi_del_locked when NAPI is still enabled, caused by an unnecessary netif_napi_del() call in the disconnect path. The provided documents consistently stat...

CVE-2026-45922

In CVE-2026-45922, the Linux kernel RDMA/mlx5 GET_DATA_DIRECT_SYSFS_PATH handler leaks memory: it allocates device-path memory with kobject_get_path() and, if the path length exceeds the output buffer, returns -ENOSPC without freeing, causing a memory leak. The fix adds a kfree() in the error pat...

CVE-2026-46104

Linux kernel CVE-2026-46104 affects SELinux socket permission helpers. The vulnerability arises because sock_has_perm() and nlmsg_sock_has_extended_perms() dereference sk->sk_security directly, assuming the SELinux socket blob is at offset zero. In stacked LSM configurations this assumption fa...

CVE-2026-52968

CVE-2026-52968 affects the Linux kernel KVM on s390. The root cause is double-scaling the GAIT table index: code in kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward() multiplies the GAIT index by sizeof(struct zpci_gaite) even though gait is already a pointer to struct ...

CVE-2026-53007

CVE-2026-53007 affects the Linux kernel ice driver. The vulnerability arises when ice_set_ringparam() clears tstamp_ring of temporary tx_rings without clearing ICE_TX_RING_FLAGS_TXTIME. If ICE_TX_RING_FLAGS_TXTIME is set and ice_setup_tx_ring() then fails, unwinding can dereference a NULL tstamp_...

CVE-2026-53065

The CVE-2026-53065 issue in the Linux kernel affects ASoC: sti by leaking regmap_field allocations created during driver init. The underlying cause is that regmap_field objects were not freed, potentially exhausting resources if the driver is removed. The fixed approach switches to devm_regmap_fi...