CVE-2026-53396

CVE-2026-53396 (Linux kernel, NFSd) : The issue arises in nfsd4_create_file() where two ACL-handling bugs allow potential ACL leakage and incorrect behavior on CREATE. Specifically, the return value of nfsd4_acl_to_attr() is discarded, so failed ACL conversions (e.g., -EINVAL for unsupported ACE ...

CVE-2026-53402

The CVE-2026-53402 issue affects the Linux kernel’s fbdev/fbcon path. When fbcon_do_set_font() fails (e.g., vc_resize() under memory pressure), the error path (err_out) only rolls back vc_font.charcount and neglects to restore hi_font state and the screen buffer. This leaves vc_hi_font_mask set, ...

CVE-2026-63806

CVE-2026-63806 relates to the Linux kernel KVM ioeventfd datamatch bug. The issue occurs when a guest store spans multiple pages and hits MMIO on the second page, potentially triggering a datamatch IO event due to an alignment check in a 32-byte destination pointer; the code used a BUG_ON() with ...

CVE-2026-64110

Summary (CVE-2026-64110) : Several sources describe a memory-leak vulnerability in the Linux kernel igc driver (Intel Gigabit Ethernet). The root cause is that when igc_fpe_init_tx_descriptor() fails, an allocated skb is not freed, causing a potential memory exhaustion condition. The fix is to ca...

CVE-2026-64184

CVE-2026-64184 affects the Linux kernel DAMON subsystem. The root cause is damon_sysfs_memcg_path_to_id() leaking a memcg reference by not calling mem_cgroup_iter_break() when breaking the mem_cgroup_iter() loop, causing a resource leak. The vulnerability is local and can lead to resource exhaust...

CVE-2026-64256

CVE-2026-64256 affects the Linux kernel XFS quota handling in the dqiterate path. An unsigned 32-bit quota id (q_id) can wrap to zero when it accidentally hits XFS_DQ_ID_MAX, causing the iteration over quotas to restart. The fix casts the value to a 64-bit integer (u64) to prevent wraparound. Pub...

CVE-2026-64263

CVE-2026-64263 affects the Linux kernel fuse-uring component. The issue arises when cancelled entries moved to ent_in_userspace are dereferenced by ent_list_request_expired(), causing a crash. The fix updates fuse_uring_cancel() to free the cancelled entry and drop queue_refs directly, ensuring s...

CVE-2026-64267

CVE-2026-64267 affects the Linux kernel’s FUSE (Filesystem in Userspace) path. The issue is an integer overflow in handling FUSE_NOTIFY_PRUNE messages on 32-bit architectures, where the product of outarg.count and sizeof(u64) can wrap during payload length validation, potentially causing the kern...

CVE-2022-50515

The connected SUSE/OSV entries confirm a concrete fix for CVE-2022-50515 in the Linux kernel’s DRM amdgpu path: memory leak in hpd_rx_irq_create_workqueue() when unwinding after failed workqueue construction. The SUSE-SU-2025:4320-1 advisory notes the SLES15 SP5 kernel update addresses this and o...

CVE-2023-53456

During CVE-2023-53456, the Linux kernel scsi/qla4xxx nlattrs parsing lacked length validation in three code paths: qla4xxx_set_chap_entry(), qla4xxx_iface_set_param(), and qla4xxx_sysfs_ddb_set_param(). This could allow out-of-bounds reads and leak heap data. The fix adds a nla_len check and retu...

CVE-2023-53466

CVE-2023-53466 pertains to the Linux kernel wifi driver mt76 mt7915. The issue is a memory leak in the mt7915_mcu_exit path. The security update fixes by always purging mcu skb queues in mt7915_mcu_exit, even if mt7915_firmware_state fails. This mirrors the vulnerability being addressed in OSV-20...

CVE-2023-53471

The CVE-2023-53471 issue affects the Linux kernel’s DRM AMDGPU driver (gfx9). The root cause is that gfx9 cp_ecc_error_irq was enabled only when legacy gfx ras is asserted, but gfx_v9_0_hw_fini may disable cp_ecc_error_irq outside that condition, leading to an amdgpu_irq_put calltrace. Affected p...

CVE-2023-53476

CVE-2023-53476 affects the Linux kernel’s RDMA/cxgb4 code path (c4iw_fill_res_cm_id_entry). The issue arises when epcp is re-assigned; re-testing epcp->state == LISTEN after reassignment can dereference NULL listen_ep or ep, leading to a NULL pointer dereference. The vulnerability is triggered...

CVE-2023-53477

Summary of CVE-2023-53477 (Linux kernel) Affects: Linux kernel; vulnerability lies in IPv6 nexthop length calculation during route changes when lwtunnel is present on siblings but not in fib6_info, causing a mismatch and warning in inet6_rt_notify. Root cause: In rt6_nlmsg_size(), nexthop length ...

CVE-2023-53534

Based on the UNPATCHED_CVE_2023_53534.NASL entry, CVE-2023-53534 affects the Linux kernel DRM/Mediatek path (mtk_drm_crtc). The root cause is a missing validation for devm_kcalloc return values, which may be NULL, risking NULL pointer dereference. The advisory notes that this vulnerability has be...

CVE-2023-53544

CVE-2023-53544 affects the Linux kernel cpufreq implementation for the davinci platform. The issue arises from a use-after-free: the remove function frees the clks before calling cpufreq_unregister_driver(), so a cpufreq callback that runs just before driver teardown may access freed clks. Public...

CVE-2023-53550

Technical details about CVE-2023-53550 are not provided in the connected documents. The SUSE advisories listed reference this CVE but do not include affected versions, root cause, nor remediation specifics. Monitor for updates.

CVE-2023-53579

CVE-2023-53579: In the Linux kernel, the gpio: mvebu driver had a resource leak in the irq domain triggered on driver detach. A fix was applied (using a custom devm action) to address the leak. Connected advisories (SUSE OSV entries, Root Debian patch notes, Astra Linux bulletin) corroborate the ...

CVE-2023-53645

CVE-2023-53645 : Linux kernel patch fixes a use-after-free risk in BPF non-owning references by making bpf_refcount_acquire fallible. The fix changes the implementation (bpf_refcount_acquire_impl) to use refcount_inc_not_zero and return KF_RET_NULL, preventing increment on a possibly freed object...

CVE-2023-53670

The CVE-2023-53670 issue in Linux kernel nvme-core was resolved by a patch that fixes a dev_pm_qos memleak. The root cause was an unguarded latency-tolerance accounting leading to kmemleak reporting of an unreferenced object in nvme_init_ctrl during error unwind. The vulnerability has a CVSS v3.1...

CVE-2023-53687

CVE-2023-53687 affects the Linux kernel’s serial Samsung TTY path (s3c24xx_serial_getclk) where a memory leak occurs while iterating best clock candidates; if a better match is found, the previous clock and the new candidate must be freed, or a leak may occur. Public docs confirm the issue and th...

CVE-2025-39803

CVE-2025-39803 affects the Linux kernel in the SCSI/UFShCD UFS path. The vulnerability arises from a warning path in the UIC command completion: when the UIC completion interrupt is re-enabled mid-processing, an interrupt could trigger and hit WARN_ON_ONCE(!cmd). The fix is a patch that removes t...

CVE-2025-39906

CVE-2025-39906 relates to the Linux kernel drm/amd/display path where the OEM I2C adapter could remain registered after GPU unbind, risking a null pointer dereference when apps access the invalid device. The issue has been fixed by removing the OEM I2C adapter on process finish (cherry-pick of co...

CVE-2025-39935

CVE-2025-39935 affects the Linux kernel ASoC codec sma1307. The vulnerability arises in sma1307_setting_loaded(): sma1307->set.header_size indicates 8 header integers, but the code allocates only 8 bytes instead of 8 integers, causing memory corruption during memcpy(sma1307->set.header, dat...

CVE-2025-71106

CVE-2025-71106 - Linux kernel fix . The vulnerability concerns the filesystems_freeze_callback() check (freeze_all_ptr) introduced by the commit “power: always freeze efivarfs.” The check was inverted, causing all file systems to be frozen when filesystem_freeze_enabled is false. This could trigg...

CVE-2025-71110

Technical details about CVE-2025-71110 are not publicly available in the provided connected documents. No specific affected products, versions, or remediation information are disclosed here; monitor for updates.

CVE-2025-71187

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-23307

CVE-2026-23307 concerns the Linux kernel CAN/EMS USB code, where ems_usb_read_bulk_callback() failed to validate message lengths, reading beyond buffers because actual_length can exceed the expected transfer_buffer_length, risking overflow when parsing messages. The root cause is insufficient len...

CVE-2026-23316

CVE-2026-23316 – Linux kernel ARM64 multipath hash seed alignment fix . The issue arises in the ARM64 Linux kernel when reading the 8-byte struct sysctl_fib_multipath_hash_seed (user_seed and mp_seed) atomically with READ_ONCE(). Under Clang+LTO, this full-structure read emits a 64-bit load-acqui...

CVE-2026-23341

CVE-2026-23341 affects the Linux kernel accel/amdxdna path. The issue occurs when userspace issues an ioctl to destroy a hardware context that has already been automatically suspended, which may crash due to a NULL mailbox channel pointer accessed in aie2_destroy_context(). The fix adds a mailbox...

CVE-2026-23345

The CVE-2026-23345 issue affects the Linux kernel on ARM64 with Graphics Control System (GCS) mappings when FEAT_LPA2 is enabled. The root cause is incorrect handling of PTE_SHARED bits in GCS memory mappings, which can trigger a kernel panic (DoS) due to a bad page table translation. The recomme...

CVE-2026-23369

CVE-2026-23369 (i2c i801) Summary: The vulnerability affects the Linux kernel i2c/i801 driver. Under rare boot-time race conditions, multiple udev threads may access i801_acpi_io_handler concurrently, leading to a scenario where an area is deregistered and a subsequent access uses an unregistered...

CVE-2026-23397

CVE-2026-23397 affects the Linux kernel nfnetlink_osf fingerprint matching. The issue arises when parsing TCP option fingerprints: add-time checks for option lengths are insufficient, allowing a zero-length option to bypass bounds checks and potentially trigger a fault in nf_osf_match_one() (kern...

CVE-2026-23403

CVE-2026-23403 concerns the AppArmor memory leak in Linux kernel’s verify_header. The issue arises because a function sets *ns = NULL on every call, leaking the previously allocated namespace string across successive profile unpackings and causing namespace consistency checks to see NULL for *ns....

CVE-2026-23435

The CVE-2026-23435 entries describe a Linux kernel PMU/X86 perf vulnerability that was resolved. The root cause was a commit that moved cpuc->events[idx] assignment out of x86_pmu_start() into step 2 of x86_pmu_enable(), after PERF_HES_ARCH checks. This could allow a path that calls pmu->st...

CVE-2026-23436

The CVE-2026-23436 issue affects the Linux kernel's net: shaper component. A race could occur when a netdev is unregistered between taking a reference during Netlink prep and locking/RCU in the callback, potentially leaking the hierarchy after a flush. The fix applies the instance lock in pre- st...

CVE-2026-23459

The CVE-2026-23459 issue affects the Linux kernel IP tunnel code, specifically iptunnel_xmit_stats(). The bug arose because the function assumed tunnels used NETDEV_PCPU_STAT_TSTATS, while vxlan/geneve tunnels call udp_tunnel[6]_xmit_skb() and read NETDEV_PCPU_STAT_DSTATS, creating potential data...

CVE-2026-23470

CVE-2026-23470 concerns the Linux kernel’s DRM/imagination path where the soft reset sequence can deadlock because it runs in a threaded IRQ handler and cannot call disable_irq() (which would wait on IRQ handlers). The fix is to use disable_irq_nosync() during the soft reset to avoid waiting on t...

CVE-2026-31424

CVE-2026-31424 concerns a Linux kernel netfilter xtables extension handling bug for NFPROTO_ARP. The issue arises because xt_match/xt_target structs registered with NFPROTO_UNSPEC could be loaded by any protocol family via nft_compat, and ARP’s hook layout differs from IPv4/IPv6. When a match/tar...

CVE-2026-31442

CVE-2026-31442 affects the Linux kernel in the dmaengine: idxd component. The issue occurs during a Function Level Reset (FLR): if the first FLR succeeds but the second FLR cannot allocate the scratch area for the saved configuration, an invalid memory access can occur. Reports from multiple vend...

CVE-2026-31459

CVE-2026-31459 affects the Linux kernel DAMON_SYSFS path. The vulnerability is a memory leak: when damon_sysfs_new_test_ctx() fails inside damon_sysfs_commit_input(), param_ctx is leaked because the cleanup at the out label is skipped. The patch series “mm/damon/sysfs: fix memory leak and NULL de...

CVE-2026-31460

In the Linux kernel, the drm/amd/display path was fixed to validate the ext_caps pointer before using it in BL setup, specifically for LVDS connectors that do not have extended backlight caps. The root cause was dereferencing an invalid ext_caps pointer, which could crash the system. The fix (che...

CVE-2026-31507

CVE-2026-31507 affects the Linux kernel SMC module (net/smc). The vulnerability is a double-free of the per-buffer state (smc_spd_priv) when tee(2) duplicates a splice pipe buffer, leading to a use-after-free and a kernel NULL pointer dereference, ultimately causing a kernel panic. The root cause...

CVE-2026-31565

Summary: CVE-2026-31565 affects the Linux kernel RDMA/irdma component, where a netdev reset with active RDMA applications can deadlock during device/client removal (cma/uverbs paths). The root cause is a circular dependency between iWARP-related clients and references held during device reset, le...

CVE-2026-31575

The CVE-2026-31575 issue affects the Linux kernel mm/userfaultfd code, where hugetlb fault mutex hashing used linear_page_index() (PAGE_SIZE units) instead of huge-page units, causing different mutexes to be used for addresses within the same huge page. The mismatch can allow races between faulti...

CVE-2026-31645

CVE-2026-31645 pertains to the Linux kernel lan966x network driver. The issue is a memory/resource leak: in error paths of lan966x_fdma_rx_alloc() a created page pool is not destroyed if a subsequent fdma_alloc_coherent() fails, and in lan966x_fdma_init() the page pool created by lan966x_fdma_rx_...

CVE-2026-31665

CVE-2026-31665 affects the Linux kernel netfilter nf_conntrack timeout destruction. The issue is a use-after-free where nft_ct_timeout_obj_destroy() frees the timeout object with kfree() immediately after nf_ct_untimeout(), potentially leaving RCU-protected references active. The documented fix d...

CVE-2026-31730

CVE-2026-31730 affects the Linux kernel fastrpc component, where a double-free of cctx->remote_heap could occur if INIT_CREATE_STATIC ioctl hits an error path and the rpmsg device is removed. The root cause is that fastrpc_init_create_static_process() frees cctx->remote_heap on the err_map ...

CVE-2026-31753

CVE-2026-31753 affects the Linux kernel’s auxdisplay/line-display path. A NULL dereference in linedisp_release can occur if the enclosing linedisp object has already been detached when the release callback runs, causing a crash while freeing display resources. The fix retrieves the enclosing obje...

CVE-2026-31775

The CVE-2026-31775 issue affects the Linux kernel ALSA ctxfi driver. A refactor caused atc_get_resources() to loop over all DAIOTYP entries, causing SPDIF1 (a special type used only on hw20k1 CTSB073X) to be considered for hw20k2 where it has no definition. This could crash the kernel during DAIO...