CVE-2026-23352

CVE-2026-23352 affects Linux kernel's x86 EFI code: efi_free_boot_services() defers freeing of EFI_BOOT_SERVICES memory, but memblock_free_late() is not suitable for reserved memory and may miss uninitialized memory maps when CONFIG_DEFERRED_STRUCT_PAGE_INIT=y. This can cause a RAM leak (~140 MB ...

CVE-2026-23364

CVE-2026-23364 concerns the Linux kernel’s ksmbd path, where MAC comparisons were not performed in constant time. The underlying issue is a timing-attack-prone memcmp() usage; the recommended fix is to replace memcmp() with crypto_memneq() to ensure constant-time comparisons. The vulnerability is...

CVE-2026-23370

CVE-2026-23370 concerns a Linux kernel vulnerability in platform/x86: dell-wmi-sysman where set_new_password() hex dumps the buffer containing plaintext passwords (including current/new passwords). The issue could leak credentials locally and is mitigated by removing the hex dump; upstream kernel...

CVE-2026-23378

CVE-2026-23378 concerns a Linux kernel net/sched issue in act_ife where metalist entries were appended on replace instead of replacing existing data, risking unbounded metadata growth and potential out-of-bounds encode errors. The root cause is fixed by adding metalist to the ife RCU data structu...

CVE-2026-23386

CVE-2026-23386 concerns the Linux kernel gve driver in QPL mode, where gve_tx_clean_pending_packets() could misinterpret the dma_addr_t array as buffer IDs, causing out-of-bounds/unmap errors. The root cause was an improper buffer cleanup path in gve_tx_clean_pending_packets() that could referenc...

CVE-2026-23404

CVE-2026-23404 affects the Linux kernel AppArmor profile management. The issue arises from recursive profile removal in the AppArmor code path; nested profiles could trigger deep recursion, risking kernel stack exhaustion and system crashes. The connected documents confirm the root cause is the r...

CVE-2026-31417

The CVE-2026-31417 issue affects the Linux kernel’s net/x25 implementation. Affected component: x25_sock.fraglen can overflow during packet accumulation, with the root cause involving missing overflow checks and an incorrect fraglen reset when fragment_queue is purged in x25_clear_queues(). The p...

CVE-2026-31440

CVE-2026-31440 affects the Linux kernel’s dmaengine idxd driver. The issue arises during device removal when a reset clears configuration registers, causing the prior check for event log support to fail if evl is no longer valid. The propagated fixes remove the check for “evl” enabled state and i...

CVE-2026-31459

CVE-2026-31459 affects the Linux kernel DAMON_SYSFS path. The vulnerability is a memory leak: when damon_sysfs_new_test_ctx() fails inside damon_sysfs_commit_input(), param_ctx is leaked because the cleanup at the out label is skipped. The patch series “mm/damon/sysfs: fix memory leak and NULL de...

CVE-2026-31511

CVE-2026-31511 affects the Linux kernel Bluetooth MGMT subsystem, specifically a dangling pointer in mgmt_add_adv_patterns_monitor_complete where mgmt_pending_free(cmd) could kfree cmd before unlinking from the list. Connected advisories indicate Debian/Root and other OSV entries report a patch w...

CVE-2026-31513

Summary: CVE-2026-31513 affects the Linux kernel Bluetooth L2CAP code. A stack-out-of-bounds read occurs in l2cap_ecred_conn_req when handling a malformed Enhanced Credit Based Connection Request with more SCIDs than allowed. The bug arises from computing rsp_len before validating the number of S...

CVE-2026-31521

The CVE-2026-31521 issue is in the Linux kernel module loader’s simplify_symbols() where an out-of-bounds st_shndx (eg SHN_XINDEX) could cause a kernel panic. The patch adds validation of st_shndx against the valid range before using it, preventing the potential crash. Several OSV entries (Debian...

CVE-2026-31583

The CVE-2026-31583 issue affects the Linux kernel em28xx media driver. A race in em28xx_v4l2_open() occurs because dev->v4l2 is read without holding dev->lock, racing with em28xx_v4l2_init()/em28xx_v4l2_fini() that free the structure and set dev->v4l2 to NULL under lock. This leads to us...

CVE-2026-31633

In the Linux kernel rxrpc subsystem, CVE-2026-31633 is addressed by fixing an integer overflow in rxgk_verify_response(). The bug arises when token_len is rounded up before the length check, allowing the check to be bypassed. The patch ensures the unrounded token_len is also compared against len,...

CVE-2026-31689

The CVE-2026-31689 issue affects the Linux kernel EDAC/mc path: edac_mc_alloc() may call put_device() during an error path before device_init completes, causing a kobject initialization/cleanup hazard and in-kernel MCE decoding symptoms. The fix reorders the initialization so the device (and its ...

CVE-2026-31706

In ksmbd (Linux kernel), CVE-2026-31706 is due to a validation flaw in smb_inherit_dacl(): the on-disk num_aces from a parent directory’s security.NTACL is trusted to size a heap allocation (kmalloc(sizeof(struct smb_ace) * num_aces * 2)) without verifying consistency with pdacl_size. An authenti...

CVE-2026-31710

CVE-2026-31710 — Linux kernel CIFS SMB1 UNIX mounts: A fix addresses incorrect dir separators caused by not updating @cifs_sb->mnt_cifs_flags after reset_cifs_unix_caps() when mounting SMB1 UNIX shares. The root cause is that the POSIX ACLs/paths flags (CIFS_MOUNT_POSIXACL, CIFS_MOUNT_POSIX_PA...

CVE-2026-43039

CVE-2026-43039 concerns the Linux kernel icssg-prueth driver. In ZC RX dispatch, emac_dispatch_skb_zc() allocates a new skb via napi_alloc_skb() but fails to copy the received packet data from the XDP buffer, causing uninitialized heap memory to be passed up the stack and potentially leaking kern...

CVE-2026-43123

Summary: CVE-2026-43123 affects the Linux kernel’s fbcon component. The root cause is a missing return-value check in con2fb_acquire_newinfo(); if fbcon_open() fails during this call, info->fbcon_par may be NULL and dereferenced, potentially crashing the system. The provided documents indicate...

CVE-2026-43174

The CVE-2026-43174 issue is in the Linux kernel’s io_uring/zcrx subsystem. Descriptions across multiple sources state that post-open error handling was fixed to avoid releasing the zcrx context before all associated page pools are terminated, addressing improper resource cleanup. The practical im...

CVE-2026-43182

Concrete details are available: CVE-2026-43182 affects the Linux kernel’s media: ccs component. The root cause is a missing check for a non-zero MIN_X_OUTPUT_SIZE limit register value when computing the maximum M for scaler configuration, risking a division-by-zero. Exploitation status is not pro...

CVE-2026-43207

The vulnerability CVE-2026-43207 affects the Linux kernel mtk-mdp media driver. Root cause: improper error handling in the probe function can cause resource leaks; a missing check for vpu_get_plat_device() may dereference a NULL and the function increases the platform device reference count, risk...

CVE-2026-43217

CVE-2026-43217 affects the Linux kernel, specifically the media: iris: gen2 component. The issue occurs in iris_kill_session where inst->state is set to IRIS_INST_ERROR and session_close frees inst_hfi_gen2->packet; if stop_streaming is called afterward, a crash may occur. The published fix...

CVE-2026-43238

CVE-2026-43238 is a Linux kernel issue in the net/sched act_skbedit module. The bug arises in tcf_skbedit_hash() when calculating mapping_mod = queue_mapping_max - queue_mapping + 1, which could reach 65536 for full u16 queue ranges. This value cannot fit in a u16 and previously wrapped to 0, cau...

CVE-2026-43255

The CVE-2026-43255 entry concerns the Linux kernel component for wireless Libertus (wifi: libertas). The vulnerability arises when usb_tx_block() submits cardp->tx_urb without guaranteeing the previous URB has completed; a second call during active URB state can trigger a warning (“URB submitt...

CVE-2026-43271

CVE-2026-43271 involves the Linux kernel md-cluster module where a race during MD array startup can cause a NULL pointer dereference in process_metadata_update when a METADATA_UPDATED message arrives before mddev->thread is initialized. The root cause is the code path that dereferences the thr...

CVE-2026-43274

Summary (validated by connected docs): In the Linux kernel, the mailbox subsystem (mchp-ipc-sbi) had an out-of-bounds access in mchp_ipc_get_cluster_aggr_irq() caused by indexing the dynamically allocated cluster_cfg array with hartid (potentially non-contiguous/ out of range). The fix switches t...

CVE-2026-43356

The CVE-2026-43356 issue affects the Linux kernel IIO ADIS IMU drivers (e.g., adis16480, adis16490, adis16545). In adis_init(), the code dereferences adis->ops to inspect function pointers without first verifying that adis->ops itself is non-NULL, leading to a NULL pointer dereference durin...

CVE-2026-43380

CVE-2026-43380 relates to the Linux kernel hwmon driver pmbus/q54sj108a2. The q54sj108a2_debugfs_read function suffers a stack buffer overflow due to incorrect bin2hex argument usage and insufficient output buffer size, causing writes beyond the stack. A fix expands the data_char buffer to 66 byt...

CVE-2026-43388

CVE-2026-43388 (Linux kernel, DAMON) : The vulnerability arises in mm/damon/core/damos_walk(), which sets ctx->walk_control to a caller-provided control structure before checking if the context is running. If the context is inactive, it returns -EINVAL without clearing the pointer, leaving a d...

CVE-2026-43412

CVE-2026-43412 pertains to the Linux kernel ASoC Qualcomm qdsp6 driver. The root cause is an incorrect removal order during ADSP stop/start, where q6apm-audio teardown can delete RTDs containing q6apm DAI components before their removal pass, leaving components linked to the card and causing a cr...

CVE-2026-43419

CVE-2026-43419 affects the Linux kernel Ceph filesystem component, where ceph_mdsc_build_path() could leak memory via a path pointer obtained with __getname() if not freed or transferred. The fixes add __putname() calls in error paths and ensure the pointer is freed when ownership isn’t passed to...

CVE-2026-43441

CVE-2026-43441 relates to the Linux kernel bonding code. When IPv6 is disabled, receiving an IPv6 NS/NA on a bonded slave could reach bond_validate_na() and trigger a NULL pointer dereference in ipv6_chk_addr(). The fixes provided in the sources implement a guard: check ipv6_mod_enabled() (or ipv...

CVE-2026-43449

CVE-2026-43449 concerns the Linux kernel NVMe PCI driver. The issue is a slab-out-of-bounds write in nvme_dbbuf_set caused by an incorrect loop bound when indexing dev->online_queues; index 0 (admin queue) is excluded, but the loop could overrun. The vulnerability is evidenced by KASAN reports...

CVE-2026-43455

In CVE-2026-43455, multiple sources confirm a race in the Linux kernel MCTP module: mctp_flow_prepare_output() checks key->dev and may call mctp_dev_set_key() without holding key->lock, while both mctp_dev_set_key() and mctp_dev_release_key() require the lock. This can allow concurrent path...

CVE-2026-43463

Summary: Multiple sources confirm a Linux kernel vulnerability in rxrpc and afs where rxrpc_kernel_lookup_peer() could return error pointers in addition to NULL, risking instability. The fix changes rxrpc_kernel_lookup_peer() to return -ENOMEM on allocation failure (instead of NULL) and updates c...

CVE-2026-46034

CVE-2026-46034 affects the Linux kernel VFIO/PCI MSI handling: a NULL pointer dereference can occur in vfio_cdx_set_msi_trigger() if interrupts are triggered before MSIs are configured. The openSUSE Tumbleweed OpenSUSE-SU-2026:10954-1 advisory documents the fix in kernel-devel-7.0.11-1.1, noting ...

CVE-2026-46263

CVE-2026-46263 is a Linux kernel issue in drm/amd/display where eng_id may index stream_enc_regs beyond its 5-element size, causing out-of-bounds access. The fix adds an explicit bounds check (using ARRAY_SIZE) before indexing stream_enc_regs[eng_id], preventing access when eng_id is ENGINE_ID_DI...

CVE-2026-52962

The CVE refers to the Linux kernel Ceph driver: in __ceph_setxattr(), old_blob can retain ci->i_xattrs.prealloc_blob during a retry, and ceph_buffer_put() is not called for the old_blob, causing a buffer leak. A patch fixes this leak. Connected SUSE advisories (OSV entries) confirm this CVE (C...

CVE-2026-52974

Summary of CVE-2026-52974 (Linux kernel net: tls): The leak is a memory leak in the TLS offload RX path where, if tls_set_device_offload_rx() fails in tls_dev_add(), the cleanup path does not free the anchor skb allocated in tls_strp_init(). This occurs in the “failed to start offload” code path ...

CVE-2026-52978

The CVE-2026-52978 issue affects the Linux kernel PSP networking code. The netlink operations dev-set and key-rotate modify sensitive PSP state (version configuration and cryptographic keys) but did not require CAP_NET_ADMIN; access was only checked by psp_dev_check_access() for netns membership....

CVE-2026-52983

The CVE-2026-52983 issue concerns the Linux kernel airoha network driver where inflight packets were counted only for the AIROHA_NUM_TX_RING TX queues in airoha_dev_xmit(), while airoha_qdma_tx_napi_poll() aggregated completions across all netdev TX queues (num_tx_queues). This mismatch creates a...

CVE-2026-53021

CVE-2026-53021 affects the Linux kernel SCSI target core (UNMAP bounds check). The root cause is an overflow where LBA + range can wrap on 64-bit overflow, with a fix that adds an overflow check mirroring the pattern used for WRITE_SAME. Publicly noted patches exist across multiple OS families: R...

CVE-2026-53057

The CVE-2026-53057 entry describes a Linux kernel IOMMU issue for RISCV: after updating DDT/PDT entries, the system must invalidate TLB and context cache entries. The fix adds riscv_iommu_iodir_iotinval() to perform the required IOTINVAL-based invalidations in accordance with the RISC-V IOMMU spe...

CVE-2026-53127

The CVE-2026-53127 issue affects the Linux kernel block subsystem. It describes a memory leak in the zones_cond path when revalidating disk zones: if blk_revalidate_disk_zones() fails after disk_revalidate_zone_resources() has allocated args.zones_cond, the allocated memory is not freed on the er...

CVE-2026-53138

The CVE-2026-53138 issue affects the Linux kernel’s drm/amd/display driver. A malformed VBIOS image can cause unbounded record-chain walk loops in bios_parser.c and bios_parser2.c due to for(;;) loops that terminate only on a 0xFF sentinel or zero record_size. This can lead to a large number of i...

CVE-2026-53240

CVE-2026-53240 concerns a use-after-free in the Linux kernel xfrm: iptfs partial reassembly logic (__input_process_payload). The bug occurs when first_skb is saved to xtfs->ra_newskb under drop_lock and a concurrent path may complete reassembly, NULL the ra_newskb, and free the skb before the ...

CVE-2026-53283

CVE-2026-53283 concerns the Linux kernel AMD IOMMU driver. The issue arises when the inlined check path in __rlookup_amd_iommu() performs an out-of-bounds read on rlookup_table[devid] for a PCI device whose BDF isn’t described by IVRS. Prior to the commit that changed kvalloc() usage, the over-re...

CVE-2026-53294

Technical details for CVE-2026-53294 are not publicly available in the provided documents. Monitor for updates from Debian/Ubuntu OSV entries and kernel advisories for affected components, versions, and fixes.

CVE-2026-53386

CVE-2026-53386 affects the Linux kernel iio: adc: ti-ads1298 driver. The issue is a bounds check for pga_settings indexing: ads1298_pga_settings has 7 elements but ADS1298_MASK_CH_PGA can yield 0–7; values >= 7 cause an out-of-bounds access. A fix adds a bounds check and returns -EINVAL when t...