CVE-2026-64259

CVE-2026-64259 (Linux kernel, fuse-uring) : A race allowed a use-after-free in fuse-uring by letting a fuse_req on an SQE commit become findable after memcpy, if a malicious userspace sent commit SQEs before the request reached fuse-server. The fix reorders operations: moving fuse_uring_add_to_pq...

CVE-2026-64103

Technical details for CVE-2026-64103 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-64159

CVE-2026-64159 is a bug in the Linux kernel's netfs (network file system) library. The function netfs_release_folio() incorrectly uses the local i_size instead of remote_i_size when updating the zero point (the file position from which the server is assumed to return zeros). This occurs when unco...

CVE-2026-64163

CVE-2026-64163 targets the Linux kernel kprobes test module. The issue arises from leftover data in kprobes/kretprobes between test runs, causing register_kprobe to fail with -22 and potentially crashing the kernel. The fix moves all kprobe/kretprobe cleanup into kprobes_test_init, which runs bef...

CVE-2026-64177

CVE-2026-64177 is a Linux kernel vulnerability in the Phonet protocol (pep) handling where forwarding of skb to a child socket via sk_receive_skb() incorrectly acquires the child socket lock with BH enabled in the softirq path. The root cause is a BH state mismatch between softirq and process pat...

CVE-2026-64181

In Linux kernel CVE-2026-64181, the issue on 32-bit x86 with THP enabled stems from __vm_normal_page failing to account for missing implementation of pmd_special()/pud_special(). This can cause warnings and later kernel state bugs (Bad rss-counter state, Bad page state) during memory reclaim when...

CVE-2026-64222

CVE-2026-64222 affects the Linux kernel on OcteonTX2/CN20K: a double-free in pool->stack during AQ pool init cleanup. The otx2_pool_aq_init() path frees pool->stack on mailbox sync/retry failure but doesn’t null the pointer, causing otx2_sq_aura_pool_init() cleanup (via otx2_aura_pool_free(...

CVE-2026-64234

The CVE-2026-64234 entry concerns the Linux kernel tty/serial driver pch_uart. The root cause is a missing check of the return value from dma_alloc_coherent(), which could yield a NULL pointer, triggering a crash in dma_handle_rx(). The fix adds a guard for dma_alloc_coherent() failure and ensure...

CVE-2026-64251

CVE-2026-64251 concerns a Linux kernel bug in the pwrseq core where use-after-free occurs in the pwrseq_debugfs_seq_next() path due to incorrect reference counting. The fix standardizes reference management across seq_file callbacks to prevent prematurely dropped references: start() now returns a...

CVE-2026-64308

CVE-2026-64308 affects the Linux kernel's crypto:ccp module, which handles AMD SEV (Secure Encrypted Virtualization) and SNP (Secure Nested Paging). The root cause is that the ioctl(SNP_VLEK_LOAD) handler performed a pointless init/shutdown wrapper—firmware deletes the VLEK on SNP_SHUTDOWN anyway...

CVE-2026-64315

The CVE-2026-64315 issue affects the Linux kernel crypto caam path and is resolved by using print_hex_dump_devel() for dumping sensitive key material in *_setkey() to prevent leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG is enabled. The vulnerability impact is HIGH for confidentiality, int...

CVE-2026-64328

CVE-2026-64328 is a DMA fence memory leak in the Linux kernel's USB gadget FunctionFS (f_fs) driver. In ffs_dmabuf_transfer(), the first reference to an ffs_dma_fence object is never released after dma_resv_add_fence() acquires a second reference, causing objects to accumulate without being freed...

CVE-2026-64358

CVE-2026-64358 is a Linux kernel vulnerability in the mtk-jpeg media driver . The mtk_jpeg_release function unconditionally calls cancel_work_sync to cancel a background workqueue task, but only multicore-based hardware variants actually initialize the jpeg_worker platform data field. On other va...

CVE-2026-64361

CVE-2026-64361 affects the Linux kernel’s hfs/hfsplus code. The vulnerability arises in check_and_correct_requested_length, where a comparison uses 32‑bit arithmetic (off + len) against node_size. If a large len is supplied (e.g., due to underflow in hfs_brec_remove), off + len may wrap around 2^...

CVE-2022-49953

CVE-2022-49953 concerns the Linux kernel’s iio: light cm3605 driver. The issue is an error-handling path in cm3605_probe() that, after a fix, introduced a new error-path which should jump to the existing error-handling path to avoid resource leaks. The connected sources consistently describe this...

CVE-2022-50106

The CVE-2022-50106 issue affects the Linux kernel, specifically powerpc/cell/axon_msi: a refcount leak in setup_msi_msg_address caused by of_get_next_parent() returning a node pointer with an incremented refcount. The root cause is missing of_node_put() in the error path, leading to leaking refer...

CVE-2022-50247

CVE-2022-50247 concerns a Linux kernel USB xHCI MTK driver issue: if wakeup IRQ setup fails, the shared HCD is leaked because usb_put_hcd() may not NULL the @shared_hcd before decreasing usage. The patch (referenced in the description) fixes leakage by ensuring shared_hcd is NULLed prior to decre...

CVE-2022-50249

CVE-2022-50249 : Linux kernel memory subsystem flaw in the OF (Open Firmware) tree. The bug is a refcount leak in of_get_ddr_timings() caused by missing of_node_put() when exiting for_each_child_of_node(). The description states the fix is to add of_node_put() on exit, addressing refcount mismana...

CVE-2022-50281

CVE-2022-50281 concerns a leak in the Linux kernel’s SGI-IP27 mips platform-bridge handling. The vulnerability occurs in bridge_platform_create() where, on error after calling platform_device_add()/platform_device_add_data()/platform_device_add_resources(), the failed device (pdev) must be releas...

CVE-2022-50282

CVE-2022-50282: Linux kernel vulnerability in chardev handling where error paths in cdev_device_add() could leave kobject state inconsistent during fault injection tests. Connected advisories (Unity Linux UTSA entries and related EulerOS/SUSE notices) confirm the issue and describe the fix as add...

CVE-2022-50285

CVE-2022-50285 tracks a Linux kernel vulnerability in the hugetlb subsystem where resv_huge_pages could be decremented outside the hugetlb_lock, risking a corrupted counter. The issue arises in alloc_huge_page’s corner case, creating a local (unprivileged) attack surface with a low attack complex...

CVE-2022-50288

The CVE-2022-50288 issue affects the Linux kernel qlcnic driver: under OOM, qlcnic_dcb_attach() can fail inside qlcnic_dcb_enable(), leading to adapter->dcb being freed while callers still use it via qlcnic_dcb_get_info(), causing a use-after-free. The fix propagates errors from qlcnic_dcb_ena...

CVE-2022-50295

CVE-2022-50295: In the Linux kernel io_uring/msg_ring path, a NULL pointer dereference occurs in io_msg_send_fd() when file_ptr is NULL, causing src_file to be NULL and get_file() to dereference a NULL pointer and trigger a crash. The issue was fixed by adding a NULL check in io_msg_send_fd(), pr...

CVE-2022-50305

CVE-2022-50305 is a Linux kernel ASoC issue: sof_es8336_remove() could cause use-after-free because cancel_delayed_work() may not wait for the work function to finish. The fix uses cancel_delayed_work_sync() to ensure the work is cancelled, not running, and cannot be re-scheduled. Affected compon...

CVE-2022-50318

The CVE-2022-50318 issue is in the Linux kernel perf/x86/intel/uncore: hswep_has_limit_sbox reference-count leak. The root cause is that pci_get_device() increments the reference count of the dev object, and pci_read_config_dword() uses it without decrementing; the fix adds pci_dev_put() immediat...

CVE-2022-50337

The CVE-2022-50337 issue affects the Linux kernel OCXL path: get_function_0() calls pci_get_domain_bus_and_slot(), which returns a PCI device with an incremented refcount. If pci_dev_put() is not called, a refcount leak can occur. The fixes add device reference handling and ensure calls to pci_de...

CVE-2022-50340

CVE-2022-50340 affects the vimc hardware-media driver in the Linux kernel. The issue arises in vimc_init(): if platform_driver_register(&vimc_pdrv) fails, the code incorrectly calls platform_driver_unregister(&vimc_pdrv) instead of platform_device_unregister(&vimc_pdev), causing a kernel warning ...

CVE-2022-50347

In CVE-2022-50347, the Linux kernel vulnerability is in mmc: rtsx_usb_sdmmc where mmc_add_host() return value was not checked. If mmc_add_host() fails and the code ignores the error, memory allocated by mmc_alloc_host() can be leaked, causing a kernel crash from deleting a non-added device in the...

CVE-2022-50366

CVE-2022-50366 affects the Linux kernel powercap subsystem (intel_rapl). Root cause: UBSAN shift-out-of-bounds when ilog2() is computed with a value

CVE-2022-50421

The CVE-2022-50421 entry concerns the Linux kernel rpmsg subsystem. The root cause is a double-destroy path for the default rpmsg endpoint: rpmsg_chrdev_eptdev_destroy() may destroy the default endpoint again after rpmsg_dev_remove() releases it, causing refcount underflow and use-after-free. Rep...

CVE-2022-50424

CVE-2022-50424 affects the Linux kernel WiFi driver for MT7921 (mt76/mt7921). The issue is a resource leak in mt7921_check_offload_capability() where a fw/allocated storage goes out of scope, leaking memory. The vulnerability is described as resolved/fixed via a Coverity-related fix (Addresses-Co...

CVE-2022-50497

CVE-2022-50497 affects the Linux kernel’s binfmt_misc subsystem. The provided documents indicate a fix for a shift-out-of-bounds issue in check_special_flags, with UBSAN warning about left shift of 1 by 31 in an unsigned int context. The vulnerability arises from how Node flags/macros are typed, ...

CVE-2022-50499

Linux kernel (media/dvb-core) contains a double free in dvb_register_device() when dvb_create_media_entity() fails and the caller frees dvb->entity again via dvb_media_device_free(), potentially causing a Use After Free in media_device_unregister_entity(). The fix, as described in CVE-2022-504...

CVE-2022-50523

The CVE-2022-50523 issue affects the Linux kernel, specifically the Rockchip clock driver (clk: rockchip). The vulnerability arises in rockchip_clk_register_pll() where, on clk_register() failure, pll->rate_table may have been allocated via kmemdup() and is not freed, causing a memory leak. Th...

CVE-2022-50532

CVE-2022-50532 concerns the Linux kernel SCSI MPT3sas driver. The vulnerability occurs in mpt3sas_transport_port_add(): if sas_rphy_add() returns an error, the resource allocated in sas_end_device_alloc() must be freed via sas_rphy_free(); otherwise a NULL pointer dereference can occur during dev...

CVE-2022-50549

CVE-2022-50549 describes an ABBA deadlock in the Linux kernel’s dm-thin path where concurrent drop_caches and dm thin worker activity can cause a deadlock between shrink_slab (holding shrinker_rwsem) and dm_pool_abort_metadata (holding dm_block/root locks). The result is a hung task as shown by t...

CVE-2023-53148

In CVE-2023-53148, the Linux kernel igb driver had a task-hang vulnerability when a Thunderbolt hub is unplugged. The igb_down path could be invoked twice (via igb_io_error_detected and igb_remove), causing a hang at napi_synchronize and breaking Ethernet. The patch prevents the non-fatal PCIe er...

CVE-2023-53163

CVE-2023-53163 affects the Linux kernel NTFS-3 driver: a deadlock occurs when ntfs_truncate() calls truncate_setsize() while holding ni_lock, due to interaction with PG_locked set by filemap_update_page() -> filemap_read_folio() after folio_trylock(). This can cause a hung task (do_user_addr_f...

CVE-2023-53165

CVE-2023-53165 is a Linux kernel vulnerability in the UDF filesystem code. The issue is an uninitialized array read in the UDF charset conversion when processing filenames that begin with a dot and are 2–5 characters long, which can cause the output name to be prepended with a “unification hash” ...

CVE-2023-53298

CVE-2023-53298 – Linux kernel : The issue is a memory leak in the NFC subsystem. The se_io callback context allocated inside nfc_genl_se_io is not always freed on several error paths, risking a leak. The patch adds explicit cb_context freeing on those error paths. No exploit details are provided ...

CVE-2023-53402

CVE-2023-53402 affects the Linux kernel, specifically the printk debugfs path. The root cause is a memory leak in kernel/printk/index.c when using debugfs_lookup() without a matching dput(). The documented fix replaces the sequence with debugfs_lookup_and_remove(), handling the logic and preventi...

CVE-2023-53455

CVE-2023-53455 concerns the Linux kernel DRM vc4 deadlock: vc4_hdmi_reset_link() returning -EDEADLK may deadlock in the locking context. The accepted fix is to drop held locks and back off using drm_modeset_backoff(), per the cited kernel DRM-KMS guidance. The vulnerability entry provides example...

CVE-2023-53462

Summary: The CVE concerns the Linux kernel HID/HSR driver (net/hsr/hsr_forward.c). A KMSAN-uninitialized-value access is reported in fill_frame_info() when VLAN (ETH_P_8021Q) is encountered, due to VLAN not being supported in the hsr driver. The issue is resolved by returning an error from fill_f...

CVE-2023-53493

The CVE-2023-53493 entry describes a Linux kernel issue in accel/qaic where bounds checking in decode_message() was tightened to mirror encode_message() bounds checks. The fix ensures there is space for at least one header (checking msg_hdr_len), validates that the next header can be read (msg_le...

CVE-2023-53495

The CVE-2023-53495 issue in the Linux kernel concerns the mvpp2 ethernet driver (mvpp2_main). A fix was implemented to prevent an OOB write in mvpp2_ethtool_get_rxnfc() by validating rule_cnt before iterating over rules allocated in ethtool_get_rxnfc(). The underlying problem was that the rules b...

CVE-2023-53505

CVE-2023-53505 concerns the Linux kernel: a memory leak in the clk: tegra: tegra124-emc path where the tegra resources allocated in error paths were not freed, leading to leaks. The vulnerability is in the error handling path for freeing the tegra resources; the fix is described as resolving the ...

CVE-2023-53514

CVE-2023-53514 concerns the Linux kernel gpu: host1x memory leak of device names. Root cause: device names allocated by dev_set_name() were not freed because the kobject refcount set in device_initialize() wasn’t decreased to 0; cleanup relied on put_device() and device_del() semantics, but freei...

CVE-2023-53522

CVE-2023-53522 concerns the Linux kernel, specifically the cgroup/freezer path. The data show a circular locking dependency between cpu_hotplug_lock and freezer_mutex triggered by a rewrite of core freezer logic (commit f5d39b020809) that replaced atomic_inc() with static_branch_inc() in freezer_...

CVE-2023-53524

CVE-2023-53524 involves an integer overflow in the Linux kernel’s iwl_write_to_user_buf() used by iwl_dbgfs_monitor_data_read() in iwlwifi PCIe. The bug computes buf_size_left from count and *bytes_copied, then reduces it and may pass a negative value to copy_to_user, causing a heap overflow. It ...

CVE-2023-53551

The CVE-2023-53551 issue affects the Linux kernel USB gadget, specifically the u_serial driver. The root cause was a potential null pointer dereference in gserial_resume that could occur if gserial_disconnect had already cleared gser->ioport and a wakeup interrupt fired afterward. The fix adds...