CVE-2026-53049

CVE-2026-53049 affects the Linux kernel GFS2 component. The root cause is that gfs2_logd() called log-flushing routines (gfs2_ail1_start(), gfs2_ail1_wait(), gfs2_ail1_empty()) without holding sdp->sd_log_flush_lock, exposing a risk of race conditions with concurrent transactions. The patch in...

CVE-2026-53061

CVE-2026-53061 is a Linux kernel issue where the dirty-mapping check for passthrough mode in dm-cache could load dirty mappings during table preload, risking data loss. The patch moves the relevant checks to the preresume phase during table preload and removes an unused function. Connected adviso...

CVE-2026-53078

The CVE-2026-53078 issue is a Linux kernel BPF sock_ops vulnerability. When a BPF sock_ops program accesses ctx fields with the same destination and source registers (dst_reg == src_reg), SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() failed to zero the destination register in the !fullsock/!locked_t...

CVE-2026-53103

CVE-2026-53103 affects the Linux kernel Wi-Fi subsystem, specifically the mt7925_roc_abort_sync path. The issue is a potential deadlock: roc_abort_sync() may call cancel_work_sync() while roc_work() is still running and holding dev->mt76.mutex, and if the caller already owns that mutex, both s...

CVE-2026-53106

CVE-2026-53106 is described as a Linux kernel issue related to bpf storage deletion in NMIs. Connected OSV entries show that Root has patched CVE-2026-53106 in the rootio-linux package for Root:Debian:12 and Root:Debian:13, with multiple fixed versions available, and UBUNTU-2204 patches also noti...

CVE-2026-53127

The CVE-2026-53127 issue affects the Linux kernel block subsystem. It describes a memory leak in the zones_cond path when revalidating disk zones: if blk_revalidate_disk_zones() fails after disk_revalidate_zone_resources() has allocated args.zones_cond, the allocated memory is not freed on the er...

CVE-2026-53144

CVE-2026-53144 affects the Linux kernel's DRM/AMDKFD path, specifically a NULL dereference in get_queue_ids(). If usr_queue_id_array is NULL and num_queues is non-zero, get_queue_ids() can return NULL; callers only check IS_ERR(), so a NULL pointer is not treated as an error, allowing suspend_que...

CVE-2026-53172

The CVE-2026-53172 issue in the Linux kernel’s accel/ethosu component is a local-privilege/heap corruption flaw caused by an incorrect mask (0x7f) when processing NPU_SET_IFM_REGION. This allows a userspace caller to supply a region index > 7, writing up to 1016 bytes past the start of region_...

CVE-2026-53190

CVE-2026-53190 concerns a Linux kernel vulnerability in the drm/virtio path where a refcount leak could occur in error handling of virtio_gpu_dma_fence_wait(). The root cause is that dma_fence_unwrap_for_each() calls dma_fence_unwrap_first(), which assigns cursor->chain = dma_fence_get(head) (...

CVE-2026-53234

The CVE-2026-53234 entry concerns the Linux kernel IBM EMAC network driver. The root cause is a use-after-free window created by using devm_register_netdev(), which defers unregister_netdev() to the devres cleanup phase after emac_remove() returns, allowing the network stack to access freed hardw...

CVE-2026-53310

CVE-2026-53310 affects the Linux kernel’s soc/tegra: cbb component. The root cause was a misused base address during target timeout lookup: the code read target timeout registers from cbb->regs while applying offsets from a different fabric’s target map, which could trigger a kernel page fault...

CVE-2026-53312

In CVE-2026-53312, a Linux kernel iommu/riscv vulnerability is resolved: an integer overflow in the invalidation path could cause an infinite loop when handling sign-extended page tables (ULONG_MAX) during a gather/end computation. The fix moves the +1 away from the potentially overflowed compari...

CVE-2026-53390

The CVE-2026-53390 issue affects ksmbd in the Linux kernel, where an out-of-bounds heap read can be triggered by crafted ACEs in SMB DACLs. Root cause: smb_check_perm_dacl() validates ACE header and caps sid.num_subauth but did not ensure ace->size is large enough to contain num_subauth sub-au...

CVE-2026-64116

Summary: CVE-2026-64116 fixes a NULL pointer dereference in the Linux kernel IOAM path for IPv6 Hop-by-Hop processing. What was affected: The function ipv6_hop_ioam() could read __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. During interface teardow...

CVE-2026-64209

CVE-2026-64209 affects the Linux kernel Qualcomm QMP USBC PHY driver (qmp-usbc). A boundary check in the DP swing configuration incorrectly uses > 4 instead of >= 4, allowing index 4 to access swing_tbl and pre_emphasis_tbl (both 4x4). This can lead to out-of-bounds memory access and potent...

CVE-2026-64254

CVE-2026-64254: In the Linux kernel NTB EPF path, a teardown path could call pci_iounmap() on the same iomem with an offset when BARs for PEER_SPAD and CONFIG are shared. The result was a kernel warning about vunmap() on a nonexistent vm area. A fix exists to unmap only when the two BARs used are...

CVE-2026-64255

Summary: CVE-2026-64255 affects the Linux kernel WiFi stack (iwlwifi, MLD). Three BA session handlers compute station IDs with ffs(ba_data->sta_mask) - 1 without ensuring sta_mask is non-zero, causing an out-of-bounds access on fw_id_to_link_sta[] when sta_mask is zero (ffd returns 0, wrapped ...

CVE-2022-50311

CVE-2022-50311 affects the Linux kernel: a refcount leak in cxl_calc_capp_routing due to of_get_next_parent() returning a node pointer with refcount incremented and a missing of_node_put() on the error path. The issue is resolved by adding the missing of_node_put() in the error path to balance th...

CVE-2022-50329

CVE-2022-50329 affects the Linux kernel’s block/bfq subsystem. The root cause was a use-after-free: bfqq could be freed in bfq_exit_icq_bfqq() and then used in bic_set_bfqq(), leading to UAF. The fix reorders operations by moving bfq_exit_bfqq() behind bic_set_bfqq(), preventing the invalid access.

CVE-2022-50420

CVE-2022-50420 affects the Linux kernel crypto driver crypto: hisilicon/hpre. The root cause is in hpre_remove(): if the disable operation of qm sriov fails, the function previously returned early, causing resource leakage. The fix ensures the remaining resources allocated are released (preventin...

CVE-2022-50424

CVE-2022-50424 affects the Linux kernel WiFi driver for MT7921 (mt76/mt7921). The issue is a resource leak in mt7921_check_offload_capability() where a fw/allocated storage goes out of scope, leaking memory. The vulnerability is described as resolved/fixed via a Coverity-related fix (Addresses-Co...

CVE-2022-50429

CVE-2022-50429 affects the Linux kernel memory/OF subtree. The issue is a refcount leak in of_lpddr3_get_ddr_timings() caused by not balancing refcounts when breaking out of for_each_child_of_node(). The fix adds of_node_put() at the exit path to balance refcounts. Connected advisories (SUSE OSVs...

CVE-2022-50438

CVE-2022-50438 : In the Linux kernel, the hinic driver leaks memory when reading the function table if the input index matches a certain case in hinic_dbg_get_func_table(), where read_data is not released. A fix was applied to release the memory, resolving the issue. The connected sources referen...

CVE-2022-50440

The CVE-2022-50440 issue affects the Linux kernel DRM vmwgfx driver (drm/vmwgfx) where an invalid box size check for the snooped cursor allows an overflow during DMA surface copies, potentially crashing the system. The problem stems from improper validation of the copybox dimensions against the s...

CVE-2022-50446

CVE-2022-50446 : In the Linux kernel, ARC CPUs are affected by a memory leak in page table entries (PTEs) due to the pmd_pgtable macro returning a direct virtual address after the pgtable_t switch back to struct page *. The leak occurs during process termination and can degrade available memory o...

CVE-2022-50447

The CVE pertains to the Linux kernel Bluetooth subsystem. A crash in the HCI path occurs when connecting multiple ISO sockets without DEFER_SETUP, caused by a NULL pointer dereference in hci_create_cis_sync, leading to a KASAN crash. The vulnerability is described in CVE-2022-50447 as fixed by th...

CVE-2022-50451

CVE-2022-50451 involves a memory leak in the Linux kernel’s ntfs3 module, specifically in the ntfs_fill_super() error path. The provided documents consistently describe a bug where an unreferenced kmemleak object is leaked during mounting, traced to the error handling path of ntfs_fill_super(). T...

CVE-2022-50459

CVE-2022-50459 : In the Linux kernel, a NULL pointer dereference can occur in the SCSI/iscsi iscsi_tcp path when freeing a socket concurrently with access via sysfs. The root cause is a sequence where sock_hold() increments a sock refcount, sockfd_put() later releases the socket and clears sock-&...

CVE-2022-50462

The CVE-2022-50462 issue affects the Linux kernel (MIPS vpe-mt) where a device name allocated dynamically during module exit could leak memory. root cause: after commit 1fa5ae…, vpe_device release removed kfree, freeing was needed at module exit; the static vpe_device now requires proper freeing ...

CVE-2022-50470

The CVE-2022-50470 vulnerability is a Linux kernel issue in the xHCI host controller code. It occurs when freeing a virtual device if the xHCI host controller dies or is removed; endpoints may not be dropped from the bandwidth list due to early returns, triggering a list_del corruption and kernel...

CVE-2022-50481

CVE-2022-50481 pertains to the Linux kernel; the issue is a potential null pointer dereference in cxl_guest_init_afu|adapter() when device_register() fails in cxl_register_afu|adapter(). The error path could dereference a removed-but-not-added device unless the reference is properly released. The...

CVE-2022-50489

CVE-2022-50489 : In the Linux kernel, the drm/mipi-dsi subsystem detaches devices when removing the host. The mitigation: the vulnerability is resolved by fixes in the kernel’s host unregister path (mipi_dsi_host_unregister), which previously could unregister devices without detaching them from t...

CVE-2022-50499

Linux kernel (media/dvb-core) contains a double free in dvb_register_device() when dvb_create_media_entity() fails and the caller frees dvb->entity again via dvb_media_device_free(), potentially causing a Use After Free in media_device_unregister_entity(). The fix, as described in CVE-2022-504...

CVE-2022-50511

CVE-2022-50511 : In the Linux kernel, the vulnerability is fixed in the fonts code path. Specifically, the issue arises from shifting a signed 32-bit value by 31 bits in get_default_font within lib/fonts, which is undefined behavior. The patch converts the operation to an unsigned branch to avoid...

CVE-2022-50533

CVE-2022-50533 concerns a Linux kernel issue in the wifi/mac80211 mlme handling where a failed association to an AP without a link 0 could trigger a null-pointer dereference in tracing. The observed root cause was that sdata->vif.valid_links is cleared and then ap_mld_addr or link 0 BSS may be...

CVE-2022-50547

The CVE affects the Linux kernel, specifically the solo6x10 driver’s solo_sysfs_init() path. When device_register() errors during initialization, memory allocated by dev_set_name() was not freed, leading to a memory leak. The fix, implemented in the upstream kernel and reflected in related adviso...

CVE-2023-53215

CVE-2023-53215 affects the Linux kernel sched/fair component. The issue occurs when the load balancer tries to migrate a task that is migration-disabled to its current CPU, triggering a warning in set_task_cpu() during balance. The root cause is how the new_dst_cpu is selected from env->dst_gr...

CVE-2023-53216

CVE-2023-53216 affects the Linux kernel on ARM64 where EFI runtime services could sleep in an invalid context due to the new efi_rt_lock spinlock. The root cause is the addition of a spinlock (efi_rt_lock) introduced by commit ff7a167961d1 to execute EFI runtime services from a dedicated stack, w...

CVE-2023-53244

In Linux kernel, the media: pci: tw68 driver vulnerability CVE-2023-53244 fixes a null pointer dereference in buffer handling: if dma_alloc_coherent fails during tw68_risc_buffer(), buf->cpu may be null and later accesses/free could crash. The fix adds checks on the return value of tw68_risc_b...

CVE-2023-53453

The CVE-2023-53453 issue affects the Linux kernel’s Radeon driver (drm/radeon/atombios) where iio objects allocated during atom_index_iio() were not freed on driver shutdown, causing a kmemleak reference and a potential leak. The fix releases the iio in radeon_atombios_fini() to prevent the kmeml...

CVE-2023-53461

CVE-2023-53461 pertains to the Linux kernel’s io_uring exit path. The vulnerability comes from io_ring_exit_work, invoked by kworker, waiting on request completions in a way that could interact with signal handling. The patch changes the wait state from TASK_UNINTERRUPTIBLE to TASK_INTERRUPTIBLE ...

CVE-2023-53462

Summary: The CVE concerns the Linux kernel HID/HSR driver (net/hsr/hsr_forward.c). A KMSAN-uninitialized-value access is reported in fill_frame_info() when VLAN (ETH_P_8021Q) is encountered, due to VLAN not being supported in the hsr driver. The issue is resolved by returning an error from fill_f...

CVE-2023-53478

CVE-2023-53478 refers to a Linux kernel issue in tracing/synthetic: races on freeing last_cmd could cause use-after-free or double-free. Reported root cause: last_cmd could be accessed concurrently when multiple users manipulate synthetic_events, leading to race conditions. The patch adds lastcmd...

CVE-2023-53512

CVE-2023-53512 : Linux kernel scsi/mpt3sas memory leak fixed by adding a forgotten kfree() in the affected path. The vulnerability is resolved in kernel updates; the connected advisories (Unity Linux/EulerOS NASL entries) reference the same fix and confirm remediation via patch version. Cards emp...

CVE-2023-53520

The CVE-2023-53520 issue is in the Linux kernel Bluetooth subsystem (hci_suspend_notifier/hci_suspend_sync). The root cause is a race where hci_suspend_notifier may access an hci_dev object after hci_unregister_dev() frees it, causing a crash. The described fix: the patch maintains the reference ...

CVE-2023-53521

CVE-2023-53521 affects the Linux kernel as reported by EulerOS advisories: scsi: ses: Fix slab-out-of-bounds in ses_intf_remove(). The bug occurs when edev->components is zero, causing reads from edev->component[0] to access invalid memory, resulting in a slab-out-of-bounds condition (read ...

CVE-2023-53522

CVE-2023-53522 concerns the Linux kernel, specifically the cgroup/freezer path. The data show a circular locking dependency between cpu_hotplug_lock and freezer_mutex triggered by a rewrite of core freezer logic (commit f5d39b020809) that replaced atomic_inc() with static_branch_inc() in freezer_...

CVE-2023-53586

CVE-2023-53586 affects the Linux kernel SCSI target subsystem. The vulnerability arises when LUN_RESET handling across multiple sessions can cause running I/O commands to be inconsistently cleaned up, leading to aborted tasks and potential misrestart of I/O. The documented fix reverts the patch t...

CVE-2023-53595

CVE-2023-53595 affects the Linux kernel, specifically the octeontx2-pf driver’s macsec (mcs) path. The issue triggers NULL pointer dereferences during teardown when rebooting after creating a macsec interface, leading to kernel crashes as shown by call traces like cn10k_mdo_del_secy and macsec_no...

CVE-2023-53601

CVE-2023-53601 is a Linux kernel vulnerability in the bonding driver where code could assume skb_mac_header is set in ndo_start_xmit, risking invalid skb handling. The fixed description states that skb->data is sufficient and bonding must not rely on mac_header. Concrete details appear in conn...