CVE-2026-53324

CVE-2026-53324 is addressed in the Linux kernel’s net: mana path. The fix replaces per-device debugfs directory naming that previously used a hardcoded "0" for PFs and pci_slot_name(pdev->slot) for VFs with pci_name(pdev), which yields the unique BDF address. This eliminates two issues: (1) po...

CVE-2026-64305

CVE-2026-64305 is a race condition in the Linux kernel's Intel QAT crypto driver (crypto/qat). The service_table list is protected by service_lock when entries are added or removed, but several functions (adf_dev_init, adf_dev_start, adf_dev_stop, adf_dev_shutdown, and notifier callbacks) iterate...

CVE-2026-53379

Technical details for CVE-2026-53379 are not provided in the supplied documents. Monitor for updates.

CVE-2026-63806

CVE-2026-63806 relates to the Linux kernel KVM ioeventfd datamatch bug. The issue occurs when a guest store spans multiple pages and hits MMIO on the second page, potentially triggering a datamatch IO event due to an alignment check in a 32-byte destination pointer; the code used a BUG_ON() with ...

CVE-2026-64044

Concrete details confirm CVE-2026-64044 fix in the Linux kernel’s OpenVPN peer handling. The error path in ovpn_nl_peer_new_doit() previously called ovpn_peer_release() directly instead of ovpn_peer_put(), bypassing the kref, risking use-after-free when a caller holds a ref during an in-flight op...

CVE-2026-64103

Technical details for CVE-2026-64103 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-64147

The pds_core kernel driver leaks a dentry reference (missing dput()) on every firmware reset recovery, and when CONFIG_DEBUG_FS is disabled, debugfs_lookup() returns ERR_PTR(-ENODEV) rather than NULL, which the existing check passes, causing a crash. Red Hat confirms this can lead to denial of se...

CVE-2026-64328

CVE-2026-64328 is a DMA fence memory leak in the Linux kernel's USB gadget FunctionFS (f_fs) driver. In ffs_dmabuf_transfer(), the first reference to an ffs_dma_fence object is never released after dma_resv_add_fence() acquires a second reference, causing objects to accumulate without being freed...

CVE-2026-64337

CVE-2026-64337 affects the Linux kernel's USB MTU3 gadget driver . The function mtu3_gadget_queue() maps the request DMA before checking whether the QMU GPD ring can accept another transfer. When mtu3_prepare_transfer() fails, the request is returned with -EAGAIN but the DMA mapping is never unma...

CVE-2026-64346

CVE-2026-64346 is a Use-After-Free (UAF) in the Linux kernel's USB gadget UDC subsystem. A race condition allows usb_del_gadget() to free the udc management structure (e.g., via a mode-switch workqueue) while gadget_match_driver() concurrently accesses it through configfs, triggering a NULL point...

CVE-2026-64402

CVE-2026-64402 concerns the Linux kernel coresight ultrasoc-smb path: an OOB write in smb_sync_perf_buffer() can occur when the SMB sink is used as a perf AUX sink because the initial page index is derived before applying modulo normalization to the buffer size. The issue is fixed by normalizing ...

CVE-2022-49992

This CVE (CVE-2022-49992) concerns the Linux kernel, where a swap-entry PFN fetch path could be misapplied during mprotect changes. Root cause: in swp_offset_pfn(), a check for swap type allowed pfn_swap_entry_to_page() to be invoked for non-write-migration entries, triggering kernel BUG at inclu...

CVE-2022-50119

The CVE-2022-50119 issue concerns the Linux kernel and a refcount leak in rpmsg_register_device_override. The root cause is that put_device was not invoked to free the vchan on a driver_set_override error path, risking a leak. The fix adds a put_device() in the error path to ensure proper resourc...

CVE-2022-50235

CVE-2022-50235 affects the Linux kernel’s NFS server (NFSD) by allowing a buffer overflow via the NFSv2 READDIR path. The underlying issue is a sender buffer overrun when processing the @count argument, and the fix restores the previous limit on that parameter to prevent the overflow. The vulnera...

CVE-2022-50282

CVE-2022-50282: Linux kernel vulnerability in chardev handling where error paths in cdev_device_add() could leave kobject state inconsistent during fault injection tests. Connected advisories (Unity Linux UTSA entries and related EulerOS/SUSE notices) confirm the issue and describe the fix as add...

CVE-2022-50292

The CVE-2022-50292 entry concerns the Linux kernel DRM MSM DP bridge lifetime issue. Device-managed resources allocated after component bind must be tied to the lifetime of the aggregate DRM device; if not, resources may leak or binding may fail on retry. For DP bridges, bridges allocated earlier...

CVE-2022-50311

CVE-2022-50311 affects the Linux kernel: a refcount leak in cxl_calc_capp_routing due to of_get_next_parent() returning a node pointer with refcount incremented and a missing of_node_put() on the error path. The issue is resolved by adding the missing of_node_put() in the error path to balance th...

CVE-2022-50351

CVE-2022-50351 affects the Linux kernel CIFS subsystem. The issue stems from leaking an xid in cifs_create() when the CIFS session is shutdown, as the xid is not freed before returning. The vulnerability results in an xid leak (resource exhaustion potential) and has a fixed in the Linux kernel vi...

CVE-2022-50420

CVE-2022-50420 affects the Linux kernel crypto driver crypto: hisilicon/hpre. The root cause is in hpre_remove(): if the disable operation of qm sriov fails, the function previously returned early, causing resource leakage. The fix ensures the remaining resources allocated are released (preventin...

CVE-2022-50431

CVE-2022-50431 : Linux kernel patch fixes a memory-leak in ALSA aoa i2sbus handling. The issue stems from dev_set_name() allocating memory for the name in soundbus_add_one() and not freeing it if of_device_register() fails; the fix adds soundbus_dev_put() and frees resources in i2sbus_release_dev...

CVE-2022-50454

CVE-2022-50454 affects the Linux kernel’s DRM Nouveau driver. The vulnerability arises in nouveau_gem_prime_import_sg_table() due to a use-after-free: on failure of nouveau_bo_init(), the associated gem object is released by ttm_bo_init(), but the code later calls nouveau_bo_ref() which dereferen...

CVE-2022-50460

The CVE-2022-50460 issue is in the Linux kernel CIFS logic: an xid leak in cifs_flock() when flock is used can leak xid on early return (-ENOLCK). Multiple connected advisories (Astra Linux, Unity Linux, EulerOS, SUSE) cite the same description and confirm a fix in the kernel. The vulnerability i...

CVE-2022-50480

CVE-2022-50480 pertains to the Linux kernel memory handling for pl353-smc, where a refcount leak in pl353_smc_probe() was fixed. The issue stems from the break path of for_each_available_child_of_node() not balancing a reference when the child is no longer used; the fix adds a corresponding of_no...

CVE-2022-50499

Linux kernel (media/dvb-core) contains a double free in dvb_register_device() when dvb_create_media_entity() fails and the caller frees dvb->entity again via dvb_media_device_free(), potentially causing a Use After Free in media_device_unregister_entity(). The fix, as described in CVE-2022-504...

CVE-2022-50513

CVE-2022-50513 affects Linux kernel staging/rtl8723bs: in the rtw_init_cmd_priv() error paths, pcmdpriv->cmd_allocated_buf was not freed when rsp_allocated_buf was allocated, causing a memory leak. The fix adds kfree(pcmdpriv->cmd_allocated_buf) on the error path and simplifies the return l...

CVE-2022-50532

CVE-2022-50532 concerns the Linux kernel SCSI MPT3sas driver. The vulnerability occurs in mpt3sas_transport_port_add(): if sas_rphy_add() returns an error, the resource allocated in sas_end_device_alloc() must be freed via sas_rphy_free(); otherwise a NULL pointer dereference can occur during dev...

CVE-2022-50542

CVE-2022-50542 affects the Linux kernel media/si470x driver. A use-after-free occurs in si470x_int_in_callback() when urb->context (holding a si470x_device) is freed if si470x_start_usb() has submitted a URB but the subsequent si470x_start() path fails. The fix ensures URBs are destroyed when ...

CVE-2022-50549

CVE-2022-50549 describes an ABBA deadlock in the Linux kernel’s dm-thin path where concurrent drop_caches and dm thin worker activity can cause a deadlock between shrink_slab (holding shrinker_rwsem) and dm_pool_abort_metadata (holding dm_block/root locks). The result is a hung task as shown by t...

CVE-2023-53171

CVE-2023-53171 affects the Linux kernel’s vfio/type1 path. The issue occurs when a vfio container is preserved across execs: the task’s mm can change to a new mm with locked_vm=0, causing undercounted DMA mappings and a later unmap to underflow locked_vm, leading to ENOMEM on a subsequent dma map...

CVE-2023-53207

CVE-2023-53207 applies to the Linux kernel ublk subsystem. The issue arises in ublk_ctrl_end_recovery: if wait_for_completion_interruptible() is interrupted by a signal, queues aren’t yet fully set up, so the kernel must fail UBLK_CMD_END_USER_RECOVERY to avoid a kernel oops. The CVSS 3.1 data in...

CVE-2023-53217

Summary (CVE-2023-53217): Linux kernel vulnerability affecting the nubus subsystem where reading files under /proc/bus/nubus could segfault. The issue stems from a regression introduced during the conversion of proc_create_single_data() usage, making single_open() calls with nubus_proc_rsrc_show(...

CVE-2023-53291

CVE-2023-53291 concerns a Linux kernel regression where kfree_scale_thread(s) could continue running after unloading the rcuscale module, risking a page fault. The root cause is the threads not being stopped during module removal, and the fix adds a cleanup call by invoking kfree_scale_cleanup() ...

CVE-2023-53341

CVE-2023-53341 refers to a Linux kernel memory initialization fix: the function early_init_dt_scan_memory now returns 1 when memory is found and 0 if none, allowing other memory setup paths to run. This changes the control flow after the ramips plat_mem_setup call, addressing scenarios where memo...

CVE-2023-53462

Summary: The CVE concerns the Linux kernel HID/HSR driver (net/hsr/hsr_forward.c). A KMSAN-uninitialized-value access is reported in fill_frame_info() when VLAN (ETH_P_8021Q) is encountered, due to VLAN not being supported in the hsr driver. The issue is resolved by returning an error from fill_f...

CVE-2023-53463

The CVE-2023-53463 entry concerns Linux kernel ibmvnic (IBM Power NIC) handling of NON_FATAL resets. The advisory describes a bug where resetting dql stats on NON_FATAL resets could lead to a mismatch between num_queued and num_completed due to batched skb handling, causing a BUG_ON crash during ...

CVE-2023-53495

The CVE-2023-53495 issue in the Linux kernel concerns the mvpp2 ethernet driver (mvpp2_main). A fix was implemented to prevent an OOB write in mvpp2_ethtool_get_rxnfc() by validating rule_cnt before iterating over rules allocated in ethtool_get_rxnfc(). The underlying problem was that the rules b...

CVE-2023-53520

The CVE-2023-53520 issue is in the Linux kernel Bluetooth subsystem (hci_suspend_notifier/hci_suspend_sync). The root cause is a race where hci_suspend_notifier may access an hci_dev object after hci_unregister_dev() frees it, causing a crash. The described fix: the patch maintains the reference ...

CVE-2023-53556

CVE-2023-53556 is a Linux kernel use-after-free in the iavf driver (free_netdev) when removing virtual functions during SR-IOV handling. The connected Nessus/SUSE advisories enumerate this CVE among a large set of kernel issues and indicate the vulnerability is addressed by kernel updates in Eule...

CVE-2023-53559

CVE-2023-53559 affects the Linux kernel ip_vti path when an ip_vti device is using the sfb qdisc. The cb field of the skb may be modified during enqueuing, causing slab-use-after-free on IPv6 packet transmission. The root cause is that IP6CB(skb)->nhoff is not set during transmit, as described...

CVE-2023-53575

In CVE-2023-53575, the Linux kernel wifi driver (iwlwifi, mvm) fixes a potential array out-of-bounds access by accounting for IWL_SEC_WEP_KEY_OFFSET when verifying key_len in iwl_mvm_sec_key_add(). The fix is implemented in the kernel code referenced in the stable commits: https://git.kernel.org/...

CVE-2023-53585

CVE-2023-53585 : In the Linux kernel, a bug in bpf_sk_assign could leak a refcount when a newly created unhashed UDP socket is bound after being added to a sockmap. The issue arises because bpf_sk_assign may be invoked in an RCU-critical section before the sk’s final state (SOCK_RCU_FREE) is appl...

CVE-2023-53586

CVE-2023-53586 affects the Linux kernel SCSI target subsystem. The vulnerability arises when LUN_RESET handling across multiple sessions can cause running I/O commands to be inconsistently cleaned up, leading to aborted tasks and potential misrestart of I/O. The documented fix reverts the patch t...

CVE-2023-53590

CVE-2023-53590 affects the Linux kernel SCTP scheduler code. The root cause was a missing reference counter in sctp_stream_priorities, which could cause a nested loop when freeing a stream priority (potential heavy CPU usage). The advisory notes that a refcnt is now added in sctp_stream_prioritie...

CVE-2023-53591

CVE-2023-53591 affects the Linux kernel’s mlx5e offload path. The issue is a deadlock in the tc route query code when peer flows are created while holding the devcom rw semaphore. The patch refactors the code for lockless execution by making the devcom data pointer RCU-friendly, wrapping the pair...

CVE-2023-53594

CVE-2023-53594 is a Linux kernel driver-core resource leak in device_add(): if kobject_add() fails, dev->kobj.parent is set to NULL, causing a leak in resource cleanup and potentially insmod failure for mac80211_hwsim. The initial description and EulerOS/SUSE advisories confirm the vulnerabili...

CVE-2023-53598

CVE-2023-53598 affects the Linux kernel MHI bus host: if CHDBOFF or ERDBOFF register values read from the device fall outside the MHI register space, an invalid address could be computed and crash the kernel. The fix added range checks on the read values to prevent crashes caused by bad data from...

CVE-2023-53610

The CVE-2023-53610 issue affects the Linux kernel and is tied to irqchip/refcount handling in platform_irqchip_probe. Specifically, of_irq_find_parent() returns a node pointer with an incremented refcount, and the advisory notes that of_node_put() must be invoked when the node is no longer needed...

CVE-2023-53622

Summary of CVE-2023-53622 (Linux kernel, gfs2): A data race can occur in gfs2_show_options() when accessing fields of gfs2_tune (eg, gt_logd_secs) without holding the gt_spin lock, allowing concurrent execution with gfs2_reconfigure() to race. The fix acquires the lock (sdp->sd_tune.gt_spin) b...

CVE-2023-53636

CVE-2023-53636 : Linux kernel vulnerability in clk: microchip auxdev handling causes a use-after-free. If auxiliary_device_add() fails, the release callback can be invoked twice, leading to a UAF. The fix moves auxiliary_device_uninit() to the unregister callback to ensure proper teardown. Exploi...

CVE-2023-53656

The CVE-2023-53656 issue affects the Linux kernel perf path (drivers/perf: hisi) where a migration of the perf context to the CPU going to teardown can occur because cpu_online_mask() has not yet updated during cpuhp teardown. The result is a call trace (example: __switch_to, __schedule, mutex_lo...