CVE-2026-31769

The CVE-2026-31769 issue in the Linux kernel gpib module is resolved by adding a kernel-only descriptor_busy reference count in struct gpib_descriptor to prevent use-after-free of gpib_descriptor objects during concurrent IO ioctl handling (IBRD, IBWRT, IBCMD, IBWAIT). Each IO path increments des...

CVE-2026-31774

The CVE-2026-31774 issue affects the Linux kernel io_uring/net path. A 32-bit length value (sqe->len) is stored into sr->len (int), allowing values above INT_MAX (e.g., 0xFFFFFFFF) to overflow and propagate through the bundle recv/send path. This can cause a slab-out-of-bounds read in io_bu...

CVE-2026-31776

CVE-2026-31776 affects the Linux kernel via ALSA ctxfi SPDIF1 handling. The issue occurs in daio_device_index() for SPDIF1 (hw20k2) where the index is not properly handled, leading to an out-of-bounds access. Affected code path is fixed upstream by returning the correct index, mirroring the hw20k...

CVE-2026-52954

The CVE-2026-52954 issue affects the Linux kernel libceph component. A crafted CEPH_MSG_OSD_MAP can carry a CRUSH map with two crush_choose_arg_maps sharing the same index, causing an assertion in insert_choose_arg_map() to trigger a kernel BUG when inserting the second entry. The vulnerability c...

CVE-2026-52961

The CVE-2026-52961 entry describes a race in the Linux kernel Ceph xattr handling. Root cause: during __build_xattrs_blob(), the required_blob_size computation happens before __build_xattrs(), while __build_xattrs() may release and reacquire i_ceph_lock, allowing a newer MDS-provided blob to repl...

CVE-2026-52966

The CVE-2026-52966 entry concerns the Linux kernel DRM subsystem. A logical error in the change handle path failed to replace the newly generated IDR pointer with the old id’s pointer at the correct location, potentially triggering a kernel warning or a system crash (DoS) under local conditions. ...

CVE-2026-52968

CVE-2026-52968 affects the Linux kernel KVM on s390. The root cause is double-scaling the GAIT table index: code in kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward() multiplies the GAIT index by sizeof(struct zpci_gaite) even though gait is already a pointer to struct ...

CVE-2026-52980

CVE-2026-52980 concerns the Linux kernel sched/fair subsystem. Connected sources describe a bug where, when a new sched_entity is forked, its se->rel_deadline may still be set and cause the scheduler to treat the deadline as relative, converting it to an absolute value by adding the current vr...

CVE-2026-53007

CVE-2026-53007 affects the Linux kernel ice driver. The vulnerability arises when ice_set_ringparam() clears tstamp_ring of temporary tx_rings without clearing ICE_TX_RING_FLAGS_TXTIME. If ICE_TX_RING_FLAGS_TXTIME is set and ice_setup_tx_ring() then fails, unwinding can dereference a NULL tstamp_...

CVE-2026-53019

CVE-2026-53019 : The Linux kernel clk driver for Spacemit’s ccu_mix contains an inverted condition in ccu_mix_trigger_fc() that can skip frequency change triggers, causing kernel panics during CPU frequency scaling. The vulnerability was resolved by fixing this condition. Affected component: clk:...

CVE-2026-53035

CVE-2026-53035 concerns the Linux kernel where bpf_iter_unix_seq_show can deadlock between lock paths in af_unix sockets when a sockmap update is attempted from a running iter_prog. The root cause is a locking interplay that leads to a recursive/single-thread deadlock in sock_map_update_elem via ...

CVE-2026-53038

CVE-2026-53038 affects the Linux kernel IMA subsystem. When handling unsupported TPM hash algorithms, ima_fs can access hash_algo_name[] with an invalid crypto_id (set to HASH_ALGO__LAST), causing a read-out-of-bounds in create_securityfs_measurement_lists. The issue is associated with TPM_ALG_SH...

CVE-2026-53044

In the Linux kernel, the issue affects the soc/tegra: cbb fabric lookup tables due to incorrect ARRAY_SIZE usage. The root cause is an ARRAY_SIZE miscalculation that could lead to out-of-bounds access during target timeout lookup. This has been fixed in the referenced commits; the vulnerability i...

CVE-2026-53048

CVE-2026-53048 affects the Linux kernel by introducing a NULL pointer dereference in gfs2 during unmount. Specifically, gfs2_log_release() dereferences sdp->sd_jdesc after it has been deallocated, which can occur while flushing outstanding glock work in gfs2_log_flush(). The vulnerability is l...

CVE-2026-53053

The CVE-2026-53053 issue lies in the Linux kernel’s iommu/amd driver where clone_alias() incorrectly uses the wrong device ID (devid) for alias devices, risking propagation of wrong or stale Device Table Entries (DTEs). The fix passes the original pdev as opaque data to both clone_alias() and pci...

CVE-2026-53061

CVE-2026-53061 is a Linux kernel issue where the dirty-mapping check for passthrough mode in dm-cache could load dirty mappings during table preload, risking data loss. The patch moves the relevant checks to the preresume phase during table preload and removes an unused function. Connected adviso...

CVE-2025-71124

CVE-2025-71124 —Linux kernel DRM MSM A6XX path fix: moved preempt_prepare_postamble() to after validating preempt_postamble_ptr to prevent NULL pointer dereference when postamble allocation fails. Impact described as crash risk; patch available in Patchwork 687659; no exploitation details provide...

CVE-2026-23299

CVE-2026-23299 relates to a Linux kernel Bluetooth issue where, when TX timestamping is enabled (SO_TIMESTAMPING), SKBs may be queued in the sk_error_queue during socket destruction and could leak if unread or if the controller is removed. The fixed mitigation is the addition of skb_queue_purge()...

CVE-2026-23449

Summary (CVE-2026-23449) : The Linux kernel vulnerability is in the TEQL scheduler path (net/sched/teql) where a lockless Qdisc root can cause a double-free in skb_release_data via an unsafe qdisc_reset path. The underlying issue occurs when teql_master_xmit fails to use seq_lock to guard qdisc_r...

CVE-2026-31513

Summary: CVE-2026-31513 affects the Linux kernel Bluetooth L2CAP code. A stack-out-of-bounds read occurs in l2cap_ecred_conn_req when handling a malformed Enhanced Credit Based Connection Request with more SCIDs than allowed. The bug arises from computing rsp_len before validating the number of S...

CVE-2026-31584

CVE-2026-31584 - Linux kernel (MediaTek vcodec) use-after-free in encoder release path : The fops_vcodec_release() frees the context (ctx) without cancelling or synchronizing pending/running encode work, allowing the mtk_venc_worker to dereference freed ctx. Root cause: v4l2_m2m_ctx_release() wai...

CVE-2026-31733

CVE-2026-31733 concerns the Linux kernel’s sched_ext component, where the direct dispatch state (ddsp_dsq_id) could remain set across paths, causing a spurious warning in mark_direct_dispatch(). The root cause is that ddsp_dsq_id was only cleared in dispatch_enqueue(), and not consistently cleare...

CVE-2026-31742

The CVE-2026-31742 issue affects the Linux kernel’s virtual terminal (vt) handling of alternate screen mode. When entering alt screen, vc_uni_lines is saved to vc_saved_uni_lines and vc_uni_lines is set to NULL. A subsequent console resize can skip reallocating the unicode buffer because vc_uni_l...

CVE-2026-31757

CVE-2026-31757 affects the Linux kernel USB subsystem (usbio). The issue is a memory leak where, if usb_submit_urb() fails during device probing (usbio_probe()), the previously allocated URB is not freed. The fix directs control flow to an error path (err_free_urb) to properly release the URB and...

CVE-2026-43192

The provided sources describe CVE-2026-43192 as a Linux kernel issue in the device-mapper multipath (dm mpath) subsystem. A missing cleanup (dm_put_device) when failing to retrieve the SCSI handler name during path parsing (scsi_dh_attached_handler_name) could leak references to the path device. ...

CVE-2026-52953

The CVE-2026-52953 issue affects the Linux kernel IOMMU VT-d subsystem, where an out-of-scope memory access could trigger a general protection fault (kernel oops) when a QEMU process is terminated. The triggering path involves domain_remove_dev_pasid and related IOMMU PASID handling, with a dummy...

CVE-2026-52965

The CVE-2026-52965 issue affects the Linux kernel DRM TTM path. When ttm_tt_swapout() fails, the old flow could place the resource on the LRU in a way that makes the next walk re-visit the same resource, causing an infinite loop and potential DoS. The fixes defer the bulk-move deletion to the suc...

CVE-2026-52971

CVE-2026-52971 affects the Linux kernel ENA (Elastic Network Adapter) driver, specifically the PHC (Precision Time Protocol Hardware Clock) timestamp path get_timestamp. A race exists where phc->active is checked without holding the spinlock and resp is cached from ena_dev->phc.virt_addr be...

CVE-2026-52984

CVE-2026-52984 affects the Linux kernel netem queue limit check in net/sched. The bug counts queue length using q->t_len, excluding packets enqueued via reorder (__qdisc_enqueue_head); fix adds sch->q.qlen to the limit check. Impact is local, with potential high availability impact under pa...

CVE-2026-52985

CVE-2026-52985 concerns the Linux kernel in the netdevsim feature, where the IP header in a dummy skb was not zero-initialized in nsim_dev_trap_skb_build. The issue arises from using skb_put instead of skb_put_zero, leading to uninitialized values in the IP header and potential memory/safety impl...

CVE-2026-53015

The CVE-2026-53015 issue concerns the Linux kernel‑erofs filesystem where the lcn variable was 32‑bit on 32‑bit platforms, risking truncation when calculating large offsets (lcn <

CVE-2026-53032

The CVE-2026-53032 issue affects the Linux kernel's BPF subsystem, specifically the map_kptr_match_type function. A scalar register stored into a kptr can trigger a NULL dereference when the code branches on btf_is_kernel(reg->btf) before verifying base_type(), since such registers have no BTF...

CVE-2026-53047

CVE-2026-53047 concerns the Linux kernel EFI capsule-loader heap allocation due to incorrect sizeof in phys array reallocation, potentially enabling a heap overflow on 32-bit PAEs. Public records in OSV show multiple vendor-specific patches and mitigations (e.g., Root Linux packages for Ubuntu 22...

CVE-2026-53057

The CVE-2026-53057 entry describes a Linux kernel IOMMU issue for RISCV: after updating DDT/PDT entries, the system must invalidate TLB and context cache entries. The fix adds riscv_iommu_iodir_iotinval() to perform the required IOTINVAL-based invalidations in accordance with the RISC-V IOMMU spe...

CVE-2026-53067

The CVE-2026-53067 issue affects the Linux kernel PCI endpoint MSI doorbell allocation (pci-ep-msi). Root cause: pci_epf_alloc_doorbell() caches the doorbell array in epf->db_msg and epf->num_db before MSI vectors are allocated; if MSI allocation fails, the array could be freed while epf st...

CVE-2026-53188

The CVE-2026-53188 entry concerns a Linux kernel RDMA/core flaw where fops passed to ib_get_ucaps() could be spoofed via a block device sharing a dev_t with a character device (char/block alias). The root cause is insufficient validation of f_ops, allowing a local attacker with access to device n...

CVE-2026-31535

Summary: CVE-2026-31535 affects the Linux kernel SMB client receive credit management. A race in handling smbdirect_socket.recv_io.credits.available can cause over- or under-counted credits, potentially destabilizing the SMB receive path. The root cause is a window where a peer might have consume...

CVE-2026-53008

The CVE-2026-53008 entry pertains to the Linux kernel ice network driver and a race condition in the TX timestamp ring cleanup. The issue arises from a race between ice_free_tx_tstamp_ring() and ice_tx_map(), where clearing ICE_TX_FLAGS_TXTIME occurs after tx_ring->tstamp_ring is NULL, enablin...

CVE-2026-53017

The CVE-2026-53017 issue affects the Linux kernel f2fs filesystem: data loss could occur when fsync on a newly created file races with a checkpoint. Root cause: IS_CHECKPOINTED and HAS_LAST_FSYNC flags on nat_entry may be observed as set before the checkpoint fully completes, causing incorrect as...

CVE-2026-53028

CVE-2026-53028 describes a Linux kernel vulnerability in the USB Type-C subsystem where an error pointer for tps->partner is checked but not handled, and the code later dereferences it. Specifically, after assigning tps->partner = typec_register_partner(...) and checking IS_ERR(tps->part...

CVE-2026-53049

CVE-2026-53049 affects the Linux kernel GFS2 component. The root cause is that gfs2_logd() called log-flushing routines (gfs2_ail1_start(), gfs2_ail1_wait(), gfs2_ail1_empty()) without holding sdp->sd_log_flush_lock, exposing a risk of race conditions with concurrent transactions. The patch in...

CVE-2026-53051

The CVE-2026-53051 issue is a Linux kernel PCIe race in the NVIDIA Tegra194 CBB path. When PERST# toggles (assert → deassert → assert → deassert), the code sequence calls pci_epc_deinit_notify() and dw_pcie_ep_cleanup() before the controller core is powered on, causing a CBB timeout at DBI regist...

CVE-2026-53055

CVE-2026-53055 concerns the Linux kernel crypto: hisilicon/sec2 module. Under heavy load, during packet transmission, the hardware may free the request memory (req) before the software finishes processing, causing a use-after-free when the software accesses the freed memory. The issue affects the...

CVE-2026-53064

In Linux kernel dm-cache passthrough mode, a race between invalidate_complete() and concurrent writes can leave mg->cell NULL, causing a NULL pointer dereference during unlock/free. The reported fix is to validate mg->cell before unlocking it. Affected context described includes local, low-...

CVE-2026-53078

The CVE-2026-53078 issue is a Linux kernel BPF sock_ops vulnerability. When a BPF sock_ops program accesses ctx fields with the same destination and source registers (dst_reg == src_reg), SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() failed to zero the destination register in the !fullsock/!locked_t...

CVE-2026-53080

CVE-2026-53080 affects the Linux kernel net/sched cls_fw. Description in connected advisories shows that a NULL dereference could occur for old-style filters during shared-block publication, leading to a crash/warn during packet classification. The fix skips “old-style” classification on shared b...

CVE-2026-53099

CVE-2026-53099 concerns the Linux kernel BPF/CFI config handling. The issue stems from a rename: CONFIG_CFI_CLANG was renamed to CONFIG_CFI, but some builds may still use the old name, causing CFI to be compiled out. As a result, CFI failures for btF_dtor_kfunc_t could be missed, potentially allo...

CVE-2026-53014

CVE-2026-53014 (Linux kernel net/sched: act_mirred) has concrete details across multiple sources. The bug in tcf_blockcast_redir loops over block ports to redirect packets to multiple devices and erroneously queries the mac_header_xmit flag from the NEXT device instead of the device being sent to...

CVE-2026-53031

The CVE-2026-53031 issue affects the Linux kernel BPF unit: arena_alloc_pages() accepts a plain int node_id and forwards it through the allocation chain without bounds checks. A fix validates node_id before passing it down, mitigating potential memory corruption that could lead to DoS or instabil...

CVE-2026-53054

CVE-2026-53054 affects the Linux kernel DRM subsystem for Qualcomm Adreno (MSM) where an incorrect argument in VM_BIND UNMAP locking caused certain objects involved in UNMAP operations to not be consistently locked. The issue could impact system stability, particularly for non-NO_SHARE buffer obj...