CVE-2026-31781

CVE-2026-31781 concerns the Linux kernel drm/ioc32 compat ioctl path, where a user-controlled pointer was used to index a table of function pointers (spectre-like pattern). The issue is mitigated by applying array_index_nospec on the index to the function-pointer list, as described in the fix. Co...

CVE-2026-43015

The CVE-2026-43015 issue is in the Linux kernel macb PCI glue driver where clk handling during platform_device_unregister() can be used after the device is unregistered. The root cause is that platform_device_unregister may still use registered clks during a runtime resume callback, leading to a ...

CVE-2026-43018

The CVE-2026-43018 entry is confirmed: a Use-After-Free in Linux kernel Bluetooth HCI event handling (hci_le_remote_conn_param_req_evt) due to insufficient locking during hci_conn lookup/access. The vulnerability arises from hci_conn lookup and field access not always being protected by the hdev ...

CVE-2026-43022

The CVE-2026-43022 issue affects the Linux kernel Bluetooth HCI synchronization path: hci_cmd_sync_queue_once() did not indicate when a queue item already existed, risking resource leaks. The fix changes hci_cmd_sync_queue_once() to return -EEXIST when a queue item already exists and requires upd...

CVE-2026-43034

Root cause CVE-2026-43034: in the bnxt_en driver of the Linux kernel, ctxm->type is populated from the firmware response (resp->type) and later used to index fixed backing-store metadata arrays, risking memory corruption. The fix changes ctxm->type to come from the current loop variable ...

CVE-2026-43050

CVE-2026-43050 describes a race in the Linux kernel’s ATM lec code. A race between lec_atm_close() clearing priv->lecd and concurrent access in send_to_lecd(), lec_handle_bridge(), and lec_atm_send() can cause a use-after-free on the lecd pointer when a socket is freed via RCU. The fix convert...

CVE-2026-43195

CVE-2026-43195 affects the Linux kernel component drm/amdgpu related to user queue size handling. The issue is resolved by adding validation to ensure user queue sizes meet hardware requirements: the size must be a power of two for correct ring-buffer wrapping and at least AMDGPU_GPU_PAGE_SIZE to...

CVE-2026-43199

CVE-2026-43199 affects the Linux kernel net/mlx5e component. A scheduling-while-atomic bug occurred when mlx5e_ipsec_init_macs() queried hardware MAC via mlx5_query_mac_address() from an atomic context (mlx5e_ipsec_handle_event/workqueue), which can sleep. The fix uses the MAC address already pre...

CVE-2026-43219

CVE-2026-43219 concerns the Linux kernel networking code in cpsw_new. The issue arises when register_netdev() fails for the first MAC in cpsw_register_ports() but cpsw->slaves[1].ndev remains set, allowing cpsw_unregister_ports() to later try to unregister the second MAC. The root cause is not...

CVE-2026-43252

CVE-2026-43252 concerns the Linux kernel MPTCP subsystem (Multiswitch TCP). The issue arises in the in-kernel MPTCP path for removing endpoints, where code path __mark_subflow_endp_available/mptcp_pm_nl_fullmesh/mptcp_pm_nl_set_flags_all/mptcp_pm_nl_set_flags can trigger a kernel warning when a s...

CVE-2026-43255

The CVE-2026-43255 entry concerns the Linux kernel component for wireless Libertus (wifi: libertas). The vulnerability arises when usb_tx_block() submits cardp->tx_urb without guaranteeing the previous URB has completed; a second call during active URB state can trigger a warning (“URB submitt...

CVE-2026-43294

The CVE-2026-43294 entry concerns Linux kernel’s MIPI-DSI driver for Renesas rz-du/rzg2l panels. Root cause: in reboot/unprepare paths, the MIPI-DSI interface could be stopped too late, causing a kernel panic via rzg2l_mipi_dsi_host_transfer(). Fix: move rzg2l_mipi_dsi_stop() to the new callback ...

CVE-2026-43325

Summary: The Linux kernel iwlwifi mvm driver must not send MCC_ALLOWED_AP_TYPE_CMD to devices that don’t support 6E. The firmware erroneously advertised 6E support for AX201, causing a firmware crash and potential DoS. The entry is resolved in the provided references; no exploit details or active...

CVE-2026-43330

CVE-2026-43330 relates to the Linux kernel crypto/caam path, where an overflow occurs when a long HMAC key (longer than the block size) is copied for hashing. The vulnerability arises because the copy’s allocated memory is aligned for DMA, and the original kmemdup path could read beyond the key b...

CVE-2026-43347

The CVE-2026-43347 details a Linux kernel arm64 Monaco issue where firmware mistakenly reports a Gunyah hypervisor memory region as available. The kernel may allocate from hypervisor-owned memory, causing spurious ESR=0x96000010 aborts and kernel crashes. The fix adds a reserved-memory carveout f...

CVE-2026-43373

The CVE-2026-43373 entry describes a Linux kernel vulnerability in the net: ncsi subsystem. Early return paths in NCSI RX and AEN handlers fail to release received skbuffers (skb) when processing invalid AEN packets or failing to resolve NCSI devices/handlers, leading to a memory leak. The impact...

CVE-2026-43390

The CVE-2026-43390 issue affects the Linux kernel nstree component, where listing permissions were tightened so that even privileged services may not be allowed to view other privileged namespaces. The root cause is insufficient information isolation between namespaces; the kernel now uses may_se...

CVE-2026-43400

CVE-2026-43400 affects the Linux kernel’s DRM/AMDGPU component. The vulnerability arises from missing upper-bound input validation in the amdgpu_userq_signal_ioctl handler, allowing huge input values to trigger an Out-Of-Memory (OOM) condition and thus a Denial of Service. The issue is mitigated ...

CVE-2026-43403

CVE-2026-43403 concerns the Linux kernel nsfs component. The issue arises from insufficient permission checks in ns iteration ioctls, potentially allowing a privileged service to view information from other privileged services and perform information disclosure. Multiple sources (Red Hat, Debian,...

CVE-2026-43410

Summary: CVE-2026-43410 affects the Linux kernel firmware driver for Stratix 10 RSU. When RSU is not enabled in the FSBL, the driver can NULL-dereference via svc_normal_to_secure_thread(), causing a kernel panic. The root cause is rsu_send_async_msg() freeing the channel on failure, while the pro...

CVE-2026-43411

CVE-2026-43411: Linux kernel TIPc divide-by-zero in tipc_sk_filter_connect() when conn_timeout is 0–3, triggering a kernel oops/panic on certain overload retry paths. The public docs state that an attacker can set conn_timeout via setsockopt(TIPC_CONN_TIMEOUT) to values below 4, causing delay %= ...

CVE-2026-43440

CVE-2026-43440 affects the Linux kernel net/mana driver, where during mana_gd_setup() cleanup a workqueue pointer (service_wq) could remain non-NULL after destroy_workqueue(), leading to a potential use-after-free if the pointer is checked after a failed setup. Connected advisories confirm the ro...

CVE-2026-43444

CVE-2026-43444 is a Linux kernel vulnerability in the drm/amdkfd component. The issue arises from improper error handling in which a buffer object (bo) is not released if a queue update fails, leaving the BO unreserved. The description across multiple sources notes that the error path should unre...

CVE-2026-43457

CVE-2026-43457 affects the Linux kernel MCTP over I2C receive path. When midev->allow_rx is false, a newly allocated skb is not consumed by netif_rx() and must be freed directly, otherwise a memory leak can occur leading to potential DoS through memory exhaustion. The available connected sourc...

CVE-2026-43464

Summary: CVE-2026-43464 affects the Linux kernel mlx5e driver in XDP multi-buffer scenarios. When XDP programs modify buffer layout via bpf_xdp_pull_data() or bpf_xdp_adjust_tail(), the driver previously failed to count dropped fragments, causing negative page reference counts during cleanup and ...

CVE-2026-43468

CVE-2026-43468 affects the Linux kernel net/mlx5 subsystem, where a deadlock can occur between the devlink lock and the esw->work_queue. The deadlock trace involves esw_functions_changed_event_handler executing esw_vfs_changed_event_handler, while eswitch_mode_set acquires the devlink lock and...

CVE-2026-43486

CVE-2026-43486 – Linux kernel (arm64 contpte) details: The issue arises from contpte_ptep_set_access_flags() using a gathered ptep_get() to detect no-ops, which, in CONT ranges, can misreport a target as updated when a sibling sub-PTE still has PTE_RDONLY or lacks PTE_AF. This can trigger false n...

CVE-2026-45863

Summary: CVE-2026-45863 relates to the Linux kernel i3c dw driver, where dw_i3c_master_i2c_xfers() leaks memory when pm_runtime_resume_and_get() fails. The root cause is allocating the xfer structure via dw_i3c_master_alloc_xfer() without freeing on the error path. Consequence: memory leak potent...

CVE-2026-45888

In the Linux kernel md/raid1 subsystem, CVE-2026-45888 describes a memory leak in raid1_run(): when setup_conf() registers a thread via md_register_thread(), a subsequent failure in raid1_set_limits() may leave the thread registered, leaking the md_thread structure and the thread resource. The fi...

CVE-2026-45921

CVE-2026-45921 affects the Linux kernel’s mtd: parsers component, specifically the function mtd_parser_tplink_safeloader_parse(). The issue arises when buf allocated by mtd_parser_tplink_safeloader_read_table() is not freed if parts[idx].name allocation fails inside the loop, causing a memory lea...

CVE-2026-52984

CVE-2026-52984 affects the Linux kernel netem queue limit check in net/sched. The bug counts queue length using q->t_len, excluding packets enqueued via reorder (__qdisc_enqueue_head); fix adds sch->q.qlen to the limit check. Impact is local, with potential high availability impact under pa...

CVE-2026-53001

CVE-2026-53001 in the Linux kernel concerns the netfilter xtables extensions. The fix partially reverts a previous change to restrict several matches (xt_mac, xt_owner, xt_physdev) to the inet family (IPv4/IPv6), with xt_realm limited to IPv4. The intent is to apply these restrictions and avoid u...

CVE-2026-53023

CVE-2026-53023 in the Linux kernel affects the ntfs3 filesystem driver: when converting on-disk volume labels from UTF-16 to UTF-8, the cached label in sbi->volume.label is not guaranteed to be NUL-terminated, which could lead to reading past the buffer in ntfs3_label_show(). The fix explicitl...

CVE-2026-53053

The CVE-2026-53053 issue lies in the Linux kernel’s iommu/amd driver where clone_alias() incorrectly uses the wrong device ID (devid) for alias devices, risking propagation of wrong or stale Device Table Entries (DTEs). The fix passes the original pdev as opaque data to both clone_alias() and pci...

CVE-2026-53093

Technical details about CVE-2026-53093 (Linux kernel wifi brcmfmac error pointer handling) are not present in the provided connected documents. The available sources reference the CVE but do not disclose affected versions, root cause, impact, or fixes here. Monitor for updates.

CVE-2026-53140

The CVE-2026-53140 issue pertains to the Linux kernel drm/v3d driver. A fault in v3d_rewrite_csd_job_wg_counts_from_indirect() maps both the indirect buffer and the workgroup buffer and, if any workgroup count read from the buffer is zero, the cleanup is skipped on an early exit, leaking the virt...

CVE-2026-53164

The CVE-2026-53164 entry concerns the Linux kernel IOMMU DMA SWIOTLB path. The vulnerability arises when iommu_dma_iova_link_swiotlb() maps an unaligned memory region and, if the middle portion is empty, calls iommu_map() with a 0 size, which the iommu_pt implementation treats as illegal, corrupt...

CVE-2026-53173

Summary (concrete details from provided docs): The Linux kernel component accel/ethosu contains an OOB write in ethosu_gem_cmdstream_copy_and_validate(). A local user can trigger by supplying a crafted command stream, causing memory corruption and potential instability. The issue arises in a pars...

CVE-2026-53234

The CVE-2026-53234 entry concerns the Linux kernel IBM EMAC network driver. The root cause is a use-after-free window created by using devm_register_netdev(), which defers unregister_netdev() to the devres cleanup phase after emac_remove() returns, allowing the network stack to access freed hardw...

CVE-2026-53237

In CVE-2026-53237, the Linux kernel’s mvebu GPIO implementation can dereference a NULL mvchip->mvpwm during suspend/resume because mvebu_pwm_suspend() / mvebu_pwm_resume() are invoked for all GPIO banks, including those without PWM functionality. The root cause is that some banks have mvchip-&...

CVE-2026-53298

In CVE-2026-53298, the Linux kernel airoha network driver is affected by a race in initialization: ndesc is initialized too early in airoha_qdma_init_rx_queue(), causing a NULL pointer dereference during cleanup if allocation fails. The documented fix moves ndesc initialization to the end of airo...

CVE-2026-53305

CVE-2026-53305 affects the Linux kernel USB Type-C ps883x driver. A NULL pointer dereference Oops occurs when unbinding a device for vfio-platform binding (example using unbind on bc0000.geniqup), caused by ps883x_retimer_remove() reading driver data via i2c_get_clientdata() that was never set du...

CVE-2026-53306

CVE-2026-53306 affects the Linux kernel tty/hvc_iucv path. The issue is an off-by-one in the number of supported devices: MAX_HVC_IUCV_LINES is 8, and hvc_iucv_devices can be 0–8. When devices == 8, a path that validates against the table size can access hvc_iucv_table[8], potentially triggering ...

CVE-2026-53308

The CVE-2026-53308 issue concerns the Linux kernel max77705 power supply driver. The root cause is improper management of a workqueue and interrupt handlers during device removal, which could lead to use-after-free of memory after the workqueue is destroyed but before the interrupt is freed via t...

CVE-2026-53317

CVE-2026-53317 concerns the Linux kernel wifi driver stack (mt76/mt7921). A station AID value greater than 20 could trigger a firmware crash on AP interfaces (IFTYPE_AP) when a modified hostapd allocates AIDs starting at a high value (65 in testing). The issue is mitigated by a fix that imposes a...

CVE-2026-53320

Technical details of CVE-2026-53320 are not publicly provided in the supplied documents; no vendor/product/patch information is confirmed here. Monitor for updates.

CVE-2026-53324

CVE-2026-53324 is addressed in the Linux kernel’s net: mana path. The fix replaces per-device debugfs directory naming that previously used a hardcoded "0" for PFs and pci_slot_name(pdev->slot) for VFs with pci_name(pdev), which yields the unique BDF address. This eliminates two issues: (1) po...

CVE-2026-53379

Technical details for CVE-2026-53379 are not provided in the supplied documents. Monitor for updates.

CVE-2026-63806

CVE-2026-63806 relates to the Linux kernel KVM ioeventfd datamatch bug. The issue occurs when a guest store spans multiple pages and hits MMIO on the second page, potentially triggering a datamatch IO event due to an alignment check in a 32-byte destination pointer; the code used a BUG_ON() with ...

CVE-2026-64044

Concrete details confirm CVE-2026-64044 fix in the Linux kernel’s OpenVPN peer handling. The error path in ovpn_nl_peer_new_doit() previously called ovpn_peer_release() directly instead of ovpn_peer_put(), bypassing the kref, risking use-after-free when a caller holds a ref during an in-flight op...