CVE-2026-64222

CVE-2026-64222 affects the Linux kernel on OcteonTX2/CN20K: a double-free in pool->stack during AQ pool init cleanup. The otx2_pool_aq_init() path frees pool->stack on mailbox sync/retry failure but doesn’t null the pointer, causing otx2_sq_aura_pool_init() cleanup (via otx2_aura_pool_free(...

CVE-2026-43008

CVE-2026-43008 affects the Linux kernel gpio: qixis-fpga driver. The issue is incorrect error handling in devm_regmap_init_mmio(): it returns ERR_PTR() on failure, but code checked for NULL, risking invalid pointer dereference. Mitigation: patch uses IS_ERR() and PTR_ERR() to handle errors correc...

CVE-2026-43022

The CVE-2026-43022 issue affects the Linux kernel Bluetooth HCI synchronization path: hci_cmd_sync_queue_once() did not indicate when a queue item already existed, risking resource leaks. The fix changes hci_cmd_sync_queue_once() to return -EEXIST when a queue item already exists and requires upd...

CVE-2026-43082

CVE-2026-43082 affects the Linux kernel net: txgbe component. The issue arises from how property_entry lists are terminated: the driver allocated exactly the number of entries used and did not reserve space for the terminating empty entry. The fix updates the struct definition of property_entry t...

CVE-2026-43104

The CVE-2026-43104 entry concerns the Linux kernel DRM vc4 driver. Root cause: a memory leak in the hang state path where vc4_save_hang_state() could return early without freeing previously allocated kernel_state. Remediation: consolidated early return paths and added missing kfree() calls. Impac...

CVE-2026-43138

In the Linux kernel vulnerability CVE-2026-43138, a dynamically created GPIO reset controller device could be unbound via the sysfs interface, triggering a use-after-free condition and potentially destabilizing the system. The issue arises from improper handling of unbinding in the sysfs path for...

CVE-2026-43149

The CVE-2026-43149 issue affects the Linux kernel: the net: wan/fsl_ucc_hdlc driver allocated priv->rx_buffer and priv->tx_buffer as a single contiguous block in uhdlc_init(), but incorrectly freed them as two buffers in uhdlc_memclean() by calling dma_free_coherent() twice. The fix changes...

CVE-2026-43160

The vulnerability CVE-2026-43160 concerns the Linux kernel’s mfd: macsmc driver, where a mutex in struct apple_smc was not initialized in apple_smc_probe(). An uninitialized mutex can lead to occasional NULL pointer dereferences in apple_smc_read() invoked by probe() paths of subdevices. A patch ...

CVE-2026-43166

CVE-2026-43166 concerns the Linux kernel’s erofs filesystem. A flaw in interlaced plain extent identification occurs when the start position and on-disk physical length are not both aligned to the block size, causing plain data to be misclassified as interlaced instead of shifted. This can lead t...

CVE-2026-43167

CVE-2026-43167 relates to the Linux kernel xfrm subsystem where a reference-count leak in xfrm_state occurs when a network device is unregistered. The issue stems from an IPsec hardware-offload API change (commit d77e38e612a0) that made xfrm_dev_unregister() a no-op, even though xfrm_dev_state_ad...

CVE-2026-43179

Summary: CVE-2026-43179 affects the Linux kernel’s EROFS filesystem. The issue stems from incorrect early exits for invalid metabox-enabled images with metadata compression, which can trigger folio reference leaks. The problem does not apparently cause system crashes or other severe issues accord...

CVE-2026-43218

CVE-2026-43218 affects the Linux kernel driver for tw9903 (media: i2c/tw9903) where, in an error path of tw9903_probe(), memory allocated for V4L2 control processing (v4l2_ctrl_handler_init() and v4l2_ctrl_new_std()) is not freed. The fix adds a call to v4l2_ctrl_handler_free() on the handler in ...

CVE-2026-43259

CVE-2026-43259 affects the Linux kernel in the phy: fsl-imx8mq-usb driver. The vulnerability arises from missing platform_set_drvdata(), with data intended for use in remove(). The fixed code adds the missing platform_set_drvdata() call in the driver. Impact, as per the CVE details, is consistent...

CVE-2026-43285

Linux kernel mm/slab: do not access current->mems_allowed_seq if !allow_spin. The issue arises when get_from_any_partial() runs in NMI context, since seqcount_spinlock_t is not NMI-safe and can trigger a deadlock in the write/read sequence. Affected code path can lead to inconsistent lock stat...

CVE-2026-43290

Summary (CVE-2026-43290) A flaw in the Linux kernel's media subsystem (uvcvideo) can occur when start_streaming() fails due to an error in uvc_pm_get(), causing queued buffers to not be returned. The issue can lead to system instability or a denial of service by triggering a USB host controller f...

CVE-2026-43355

CVE-2026-43355 affects the Linux kernel bh1780 light sensor driver (iio: light). The root cause is a PM runtime reference-count leak: pm_runtime_put_autosuspend() was not guaranteed to run after pm_runtime_get_sync() if the read operation failed. The fixed response moves the autosuspend call befo...

CVE-2026-43367

The CVE-2026-43367 issue affects the Linux kernel, specifically the drm/amd component. It stems from NULL pointer dereferences during device cleanup on unsupported hardware, caused by missing NULL checks on a version pointer. The fixes add NULL checks to these cleanup paths and were cherry-picked...

CVE-2026-43399

CVE-2026-43399 affects the Linux kernel amdgpu driver: a reference leak in amdgpu_userq_wait_ioctl occurs when an ioctl is aborted because the output array is too small. The fix drops references to syncobj and timeline fence during abort, and is cherry-picked from commit 68951e9c3e6bb22396bc42ef2...

CVE-2026-43401

The CVE-2026-43401 issue affects the Linux kernel's intel_pstate component. A NULL pointer dereference can occur in update_cpu_qos_request() when the code dereferences cpudata before validating the policy, especially on systems booted with nosmt where all_cpu_data[cpu] may be NULL for SMT sibling...

CVE-2026-43442

The CVE-2026-43442 issue affects the Linux kernel io_uring subsystem: when IORING_SETUP_SQE_MIXED is used without IORING_SETUP_NO_SQARRAY, a flawed 128-byte SQE bounds check validates the logical SQ head instead of the physical SQE index. This can let an unprivileged local user remap a logical po...

CVE-2026-43448

CVE-2026-43448 corresponds to a race in the Linux kernel nvme-pci driver (nvme_poll_irqdisable) where a device can be disabled between operations, causing nvme_poll_irqdisable() to race with nvme_reset_work() and leading to an unbalanced IRQ enable (IRQ 10 in the crash log). The root cause is a m...

CVE-2026-43470

CVE-2026-43470 affects the Linux kernel NFS implementation. When an alias found via nfs3_do_create/nfs_add_or_obtain /d_splice_alias corresponds to a directory, the code could forget the alias while keeping the original negative dentry, causing an oops in nfs_atomic_open_v23/finish_open. The issu...

CVE-2026-52921

CVE-2026-52921 : In the Linux kernel, netfilter ipset hash:* range iteration could continue past the upper bound when iterating IPv4 ranges, due to a 32-bit iterator not stopping at the end. This allowed traversal state to move past the requested boundary and potentially affect retries. The issue...

CVE-2026-52984

CVE-2026-52984 affects the Linux kernel netem queue limit check in net/sched. The bug counts queue length using q->t_len, excluding packets enqueued via reorder (__qdisc_enqueue_head); fix adds sch->q.qlen to the limit check. Impact is local, with potential high availability impact under pa...

CVE-2026-53020

The CVE-2026-53020 entry documents a Linux kernel issue: a race condition during Translation Lookaside Buffer (TLB) synchronization when the page table is traversed and modified without holding the proper page table lock. The root cause is the lack of adequate locking during TLB sync, which can l...

CVE-2026-53022

CVE-2026-53022 concerns the Linux kernel component platform/x86 dell-wmi-sysman where firmware-provided value-modifier and possible-value strings are aggregated into fixed buffers. The root cause is that while individual source strings are bounded, the code uses strcat to append strings and separ...

CVE-2026-53083

CVE-2026-53083 affects the rootio-linux package in RootOS (Debian 11/12, Ubuntu 22.04/24.04). Multiple fixed versions are available; Root has patched the vulnerability. Remediate by updating to the patched rootio-linux versions for the respective OS releases.

CVE-2026-53107

CVE-2026-53107 is a Linux kernel issue in the libertas wifi TX path where URBs were previously killed in interrupt context; the fix alters tx logic to avoid sleeping in interrupt contexts and returns -EBUSY when a TX is pending. Public notes show OSV and Debian-root patches across multiple releas...

CVE-2026-53162

Summary (CVE-2026-53162) : In the Linux kernel memcg subsystem, a non-NMI-safe path around random-number generation during NMI handling could corrupt the ChaCha batch state, enabling memcg charge draining. The fix replaces the get_random_u32_below() path with a per-CPU round-robin counter stored ...

CVE-2026-53187

The CVE-2026-53187 issue affects the Linux kernel RDMA/core: the cpu_id supplied via UVERBS_ATTR_ALLOC_DMAH_CPU_ID is passed to cpumask_test_cpu() without validating it against nr_cpu_ids, leading to an out-of-bounds read of the cpumask bitmap. On kernels built with CONFIG_DEBUG_PER_CPU_MAPS this...

CVE-2026-64096

Summary of CVE-2026-64096 (Linux kernel, batman-adv): A use-after-free in batman-adv multicast origin node release was fixed. The function batadv_mcast_purge_orig() removed entries from RCU-protected hlists without waiting for an RCU grace period, risking access to freed memory by concurrent read...

CVE-2026-64106

Linux kernel KVM arm64 vgic-its vulnerability: a userspace process can restore an ITS Device Table Entry with a Size encoding more EventID bits than the virtual ITS supports. Although MAPD rejects the state, vgic_its_restore_dte() stores the out-of-range value in dev->num_eventid_bits, allowin...

CVE-2026-64178

The CVE-2026-64178 issue is in the Linux kernel Bluetooth BNEP implementation. A use-after-free can occur when reading dev->name during bnep_add_connection() because the underlying net_device may be freed concurrently by bnep_del_connection(). The root cause is that bnep_add_connection() did n...

CVE-2026-64186

CVE-2026-64186 relates to the Linux kernel AMD IOMMU debugfs handling. The issue arises from using int-typed dbg_mmio_offset and dbg_cap_offset populated via kstrtou32_from_user(), which can wrap to a negative value for large inputs, risking out-of-bounds access in read/write paths. The patch fix...

CVE-2026-64210

Summary of CVE-2026-64210 (Linux kernel, net/mlx5e/xsk): The vulnerability arises from unlocking writes to the ICOSQ during NAPI polling when CPU affinity changes while XSK work remains. Two races are described: A) mlx5e_trigger_irq() executes on the old CPU after napi_complete_done() while mlx5e...

CVE-2026-64211

CVE-2026-64211 affects the Linux kernel SRCU: during CPU state transitions, tree SRCU could queue workqueue callbacks to CPUs that are not online or will never be online (including imaginary CPUs). The issue could cause hangs on s390 due to scheduling workqueue handlers on such CPUs. The referenc...

CVE-2026-64231

CVE-2026-64231 affects the Linux kernel component DRM MSM DSI on DSI 6G platforms. The issue arises from improper adjustment of memory-dump size after the IO address space is offset by io_offset, which could allow access to unmapped regions. The stated remediation is to lower the ctrl_size by the...

CVE-2026-64260

CVE-2026-64260 affects the Linux kernel’s fuse-uring path. The issue concerns races on the queue->stopped flag: several readers check the value under a lock, but fuse_uring_commit_fetch() (and in fuse_uring_abort_end_requests() as noted) did not, meaning the flag could be observed/modified wit...

CVE-2022-50308

The CVE-2022-50308 entry concerns a Linux kernel ASoC issue for Qualcomm components. Root cause: devm_kcalloc may return NULL, so the return value must be checked to prevent NULL pointer dereference. The connected advisories confirm a patch to add checks in ASoC: qcom, resolving the vulnerability...

CVE-2022-50453

CVE-2022-50453 affects the Linux kernel (gpiolib: cdev). The vulnerability arises from NULL-pointer dereferences when userspace can trigger GPIO syscalls on a hot-unplugged GPIO device, allowing races where a device is removed after a NULL check. The fix partially mitigates by verifying gdev->...

CVE-2022-50464

In the Linux kernel, mt76 MT7915 PCI path had a refcount leak in mt7915_pci_init_hif2(); the issue stems from pci_get_device() returning a device with increased refcount and not balancing with pci_dev_put(). The fix saves the returned pci_device and ensures a pci_dev_put() is called to decrease t...

CVE-2022-50468

CVE-2022-50468 affects the Linux kernel, specifically the Cros USB PD notifier driver (platform/chrome: cros_usbpd_notify). The issue arises because cros_usbpd_notify_init() does not check the return value of platform_driver_register(), allowing cros_usbpd_notify to install even if registration f...

CVE-2022-50508

CVE-2022-50508 affects the Linux kernel wifi driver for MT76x0/MT76x02. After commit ba45841ca5eb, MT76x02 relies on ht[0-7] rate_power for vht mcs{0,7} but uses vth[0-1] rate_power for vht mcs{8,9}, which can cause a possible out-of-bounds access in the function mt76x0_phy_get_target_power. The ...

CVE-2023-53450

The CVE-2023-53450 entry concerns the Linux kernel ext4 subsystem. A malicious fuzzer that overwrites the ext4 superblock while mounted can set s_first_data_block to a very large value, causing the block-group calculation to underflow and trigger a BUG_ON. The fix changes the BUG_ON to ext4_warni...

CVE-2023-53465

CVE-2023-53465 : Linux kernel vulnerability in the SoundWire qcom driver where qcom_swrm_ctrl->pconfig (14 entries) can be written past bounds because indexing starts at 1 instead of 0, corrupting the next struct member. Exploitation is local (per CVSS: 7.1, HIGH impact on availability/Confide...

CVE-2023-53470

CVE-2023-53470 – Linux kernel issue : The vulnerability arises from a missing NULL check after devlink_alloc(), risking kernel panic when devlink_priv() is called on a NULL result. A fix adds the NULL check; as a result, driver load may fail but the kernel will not panic. Documents show the issue...

CVE-2023-53479

In CVE-2023-53479, the Linux kernel cxl driver had a use-after-free in cxl_parse_cfmws() during cxl_decoder_add() fail path. KASAN/KFENCE observed a slab-use-after-free where a released cxld was accessed in a later dev_err() path. The root cause was dereferencing freed memory; the fix replaces th...

CVE-2023-53536

CVE-2023-53536 affects the Linux kernel in the blk-crypto subsystem. The issue stems from blk_crypto_evict_key() sometimes returning early without unlinking the key from the keyslot management structures, while the caller proceeds to free the blk_crypto_key. This mismatch can cause a use-after-fr...

CVE-2023-53572

CVE-2023-53572 affects Linux kernel clk: imx: scu. The vulnerability arises in a loop that frees clk; without using a safe list iterator it can dereference a freed item. The fix is to replace the loop with list_for_each_entry_safe(), preventing use-after-free. References indicate a resolved patch...

CVE-2023-53640

CVE-2023-53640: In Linux kernel ASoC lpass, a use-after-free / out-of-bounds read in regcache_flat_read was fixed. The issue manifested as a KASAN slab-out-of-bounds read (read size 4) during regcache/regmap operations, observed in syzkaller backtraces. The vulnerability is addressed by the upstr...