CVE-2026-31575

The CVE-2026-31575 issue affects the Linux kernel mm/userfaultfd code, where hugetlb fault mutex hashing used linear_page_index() (PAGE_SIZE units) instead of huge-page units, causing different mutexes to be used for addresses within the same huge page. The mismatch can allow races between faulti...

CVE-2023-53633

CVE-2023-53633 pertains to the Linux kernel where the leak occurs in accel/qaic’s map_user_pages() path. If get_user_pages_fast() allocates some pages but not as many as requested, the current code fails to release the pages, causing a leak. The root cause is improper page accounting in the get_u...

CVE-2023-53645

CVE-2023-53645 : Linux kernel patch fixes a use-after-free risk in BPF non-owning references by making bpf_refcount_acquire fallible. The fix changes the implementation (bpf_refcount_acquire_impl) to use refcount_inc_not_zero and return KF_RET_NULL, preventing increment on a possibly freed object...

CVE-2023-53649

CVE-2023-53649 concerns a memory-leak in the Linux kernel related to perf trace. The described fix corrects how the evsel->priv area is freed: previously, freeing occurred only when evsel->tp_format->system compared to 'syscalls' yielded zero, but evsel->priv could be non-zero in othe...

CVE-2023-53677

CVE-2023-53677 is associated with a Linux kernel issue in the drm/i915 area. The affected component is the i915 selftests code path, where the patch fixes memory leaks on error escapes in function fake_get_pages (cherry-picked from a kernel commit). The vulnerability was resolved in the kernel, a...

CVE-2023-53684

Summary (CVE-2023-53684) in the Linux kernel's xfrm subsystem, the patch fixes a padding issue when copying data to user space. Specifically, zero padding is now used when dumping xfrm algorithms and the encap template in xfrm_user, preventing potentially sensitive padding data from being exposed...

CVE-2023-53686

CVE-2023-53686: Linux kernel vulnerability in net/handshake/netlink.c fix null-ptr-deref in handshake_nl_done_doit(); ensures trace_handshake_cmd_done_err() is not called if socket lookup fails and is invoked before releasing the file to avoid dereferencing sock->sk. Affects kernel networking ...

CVE-2023-53687

CVE-2023-53687 affects the Linux kernel’s serial Samsung TTY path (s3c24xx_serial_getclk) where a memory leak occurs while iterating best clock candidates; if a better match is found, the previous clock and the new candidate must be freed, or a leak may occur. Public docs confirm the issue and th...

CVE-2025-39777

The CVE-2025-39777 entry concerns the Linux kernel crypto: acomp component, where a control flow integrity (CFI) failure was caused by type punning. The issue could lead to a crash when CFG is enabled. The documented fix uses a consistent type for the workspace free function and ensures it is inv...

CVE-2025-39814

In CVE-2025-39814, the Linux kernel ice driver contains a NULL pointer dereference when resetting a device without RDMA support. Specifically, ice_unplug_aux_dev() dereferences pf->cdev_info->adev, and pf->cdev_info may be NULL, leading to a crash during reset described in the trace. A f...

CVE-2025-39900

CVE-2025-39900: Linux kernel net_sched: gen_estimator est_timer vulnerability fixed. When CONFIG_PREEMPT_RT=y, timer callbacks could be preempted, risking seqcount/seqlock integrity. A fix in net/core/gen_estimator.c updates est_timer() by adopting preempt_disable_nested()/preempt_enable_nested()...

CVE-2025-39954

The CVE-2025-39954 issue concerns the Linux kernel (clk: sunxi-ng: mp) where the P divider offset was omitted in the .recalc_rate readback for dual-divider clocks, causing the reported clock rate to be bogus or zero. The COMMITs in the connected sources indicate that the problem arises specifical...

CVE-2025-71274

Summary (CVE-2025-71274): A race in the Linux kernel rpmsg driver_override_show() can cause use-after-free of the driver_override string because reading occurs without the device_lock while the store path frees/modifies it under the lock. The fix replaces rpmsg_string_attr with explicit show/stor...

CVE-2025-71301

CVE-2025-71301 affects the Linux kernel DRM shmem test code. The root cause is that the GEM object reservation lock was not consistently held during vmap and vunmap, which led to warnings and potential instability. The published fixes acquire and release the reservation lock around vmap and vunma...

CVE-2026-23342

CVE-2026-23342 describes a race in the Linux kernel’s PREEMPT_RT path for BPF cpumap/xdp_bulk_queue. The issue arises when bq_enqueue() and __cpu_map_flush() run concurrently on the same CPU, breaking assumptions about atomicity and enabling races such as double __list_del_clearprev() and concurr...

CVE-2026-23357

CVE-2026-23357 affects the Linux kernel can/mcp251x driver. The deadlock occurred when free_irq() was called in the error path of mcp251x_open while mpc_lock was still held, potentially waiting for an IRQ handler. The fix moves free_irq() to after releasing the lock, and sets priv->force_quit ...

CVE-2026-23365

The CVE-2026-23365 entry concerns the Linux kernel kalmia USB driver, where probing code must validate the device’s endpoints before binding. If a malicious device omits or mismatches expected endpoints, the driver may access invalid endpoints and crash. The issue is resolved in upstream kernel b...

CVE-2026-23367

CVE-2026-23367 – Linux kernel (wifi: radiotap: reject radiotap with unknown bits) The issue arises in the radiotap parser used for the radiotap namespace. If an undefined field (field 18) is present, the alignment/size is unknown and iterator->_next_ns_data is not initialized for non-visible v...

CVE-2026-23380

CVE-2026-23380 (Linux kernel) describes a local vulnerability in tracing buffers memory management. When a process forks, the child’s VMAs copy the parent’s without incrementing user_mapped, so exiting both processes may cause tracing_buffers_mmap_close() to run twice; on the second call user_map...

CVE-2026-23421

The CVE-2026-23421 issue is a Linux kernel memory-leak in drm/xe/configfs where ctx_restore_mid_bb is allocated in wa_bb_store() but freed only partially by xe_config_device_release(), leaving ctx_restore_mid_bb[0].cs undisposed when a configfs device is removed. The vulnerability is described as...

CVE-2026-23437

CVE-2026-23437 (Linux kernel) concerns the net: shaper module. A missing liveness check occurs when a netdev is looked up during prep of Netlink operations, a reference is taken, and later the code uses the netdev’s lock or RCU protections. The conversion from a ref to a locked netdev may proceed...

CVE-2026-31443

CVE-2026-31443 : Linux kernel, dmaengine: idxd driver fix. When hardware does not support event logging and a Function Level Reset (FLR) occurs, the driver previously attempted to restore the event log even if it was never allocated, and may crash. The fix ensures the event log is only freed if i...

CVE-2026-31522

CVE-2026-31522 affects the Linux kernel HID magicmouse driver. The root cause is in magicmouse_report_fixup(), which allocated a new buffer via kmemdup and failed to free it, while the caller does not own the returned pointer. This memory leak can enable local resource exhaustion, with the CVSS i...

CVE-2026-31572

CVE-2026-31572 involves the Linux kernel driver for the i2c: designware: amdisp. A race exists between probe and runtime PM resume: when the ISP is powered on via runtime PM before probe completes, the amdisp I2C resume can occur early, causing a NULL dereference in kernel v7.0. The fix uses genp...

CVE-2026-31606

The CVE-2026-31606 issue affects the Linux kernel USB HID gadget driver. When a /dev/hidg* device is still open, unbind/bind operations can reinitialize a live cdev, which is unsafe and can crash the system. The core problem is calling cdev_init while the cdev is still in use; the fix is to alloc...

CVE-2026-31693

CVE-2026-31693 affects the Linux kernel CIFS implementation. The issue arises when replaying a request: certain local variables were not reinitialized after a replay label, which can cause unpredictable behavior and potentially denial of service or instability. The vulnerability is limited to the...

CVE-2026-31727

The CVE affects the Linux kernel USB gadget subsystem, specifically u_ether, where a NULL pointer dereference could occur when a userspace tool queries a surviving interface during a detached window after unbind. The root cause is a missing NULL check for dev->gadget in eth_get_drvinfo(), lead...

CVE-2026-31732

Summary (fact-grounded): CVE-2026-31732 affects the Linux kernel GPIO subsystem, where an unset gdev->dev.release led to resource leaks on error paths in gpiochip_add_data_with_key(). The fix drops the reference on errors and reorders error handling to prevent double-free, with the change desc...

CVE-2026-31735

The CVE-2026-31735 issue affects the Linux kernel IOMMU page table handling. Specifically, when an unmap operation partially overlaps a large or contiguous IOPTE, the invalidation/gather logic could flush only the requested range, causing a short invalidation where part of the unmapped area remai...

CVE-2026-31780

In CVE-2026-31780, the Linux kernel wi l c1000 Wi‑Fi driver is affected by a heap buffer overflow in the SSID scan path. The code accumulates total SSID lengths into a variable declared as u8, allowing up to 330 bytes for 10 SSIDs, but the u8 wrap causes a 75-byte kmalloc allocation followed by a...

CVE-2026-31782

The CVE-2026-31782 entry describes a Linux kernel perf/x86 issue where an auto counter reload could group software events with the x86_hybrid_pmu inside intel_pmu_hw_config. A container_of operation in intel_pmu_set_acr_caused_constr (via the hybrid helper) could read memory out of bounds. The fi...

CVE-2026-43046

CVE-2026-43046 affects the Linux kernel, specifically btrfs relocation logic where a non-zero drop_progress with drop_level == 0 can be observed in a read-back root_item. The root_item invariant is now validated in the tree-checker when reading from disk: if drop_progress.objectid is non-zero, dr...

CVE-2026-43132

CVE-2026-43132 affects the Linux kernel dm-verity component. The issue arises when dm_bufio_client_create() fails inside verity_fec_ctr() and the subsequent call to dm_bufio_client_destroy() uses an ERR_PTR(), causing a crash. Red Hat specifies potential local DoS from this crash; Debian/Root-OS ...

CVE-2026-43263

The CVE-2026-43263 entry concerns the Linux kernel chips-media wave5 driver. The vulnerability arises when multiple driver instances are created and destroyed, causing many interrupts and removal of decoder structures. The shared vpu_instance structure is not protected by a lock, allowing a poten...

CVE-2026-43282

CVE-2026-43282 affects the Linux kernel, specifically the RDMA ionic driver. The issue is in ionic_query_port(), which calls ib_device_get_netdev() without validating the return value, risking a NULL pointer dereference. The documented fix is to check the returned netdev and return -ENODEV if it ...

CVE-2026-43355

CVE-2026-43355 affects the Linux kernel bh1780 light sensor driver (iio: light). The root cause is a PM runtime reference-count leak: pm_runtime_put_autosuspend() was not guaranteed to run after pm_runtime_get_sync() if the read operation failed. The fixed response moves the autosuspend call befo...

CVE-2026-43369

Summary (CVE-2026-43369): In the Linux kernel’s drm/amd driver, if GPU initialization fails due to an unsupported hardware block, some IP blocks may have a NULL version pointer. During device cleanup, amdgpu_device_set_pg_state and amdgpu_device_set_cg_state access adev->ip_blocks[i].version w...

CVE-2026-43399

CVE-2026-43399 affects the Linux kernel amdgpu driver: a reference leak in amdgpu_userq_wait_ioctl occurs when an ioctl is aborted because the output array is too small. The fix drops references to syncobj and timeline fence during abort, and is cherry-picked from commit 68951e9c3e6bb22396bc42ef2...

CVE-2026-52965

The CVE-2026-52965 issue affects the Linux kernel DRM TTM path. When ttm_tt_swapout() fails, the old flow could place the resource on the LRU in a way that makes the next walk re-visit the same resource, causing an infinite loop and potential DoS. The fixes defer the bulk-move deletion to the suc...

CVE-2026-53020

The CVE-2026-53020 entry documents a Linux kernel issue: a race condition during Translation Lookaside Buffer (TLB) synchronization when the page table is traversed and modified without holding the proper page table lock. The root cause is the lack of adequate locking during TLB sync, which can l...

CVE-2026-53022

CVE-2026-53022 concerns the Linux kernel component platform/x86 dell-wmi-sysman where firmware-provided value-modifier and possible-value strings are aggregated into fixed buffers. The root cause is that while individual source strings are bounded, the code uses strcat to append strings and separ...

CVE-2026-53032

The CVE-2026-53032 issue affects the Linux kernel's BPF subsystem, specifically the map_kptr_match_type function. A scalar register stored into a kptr can trigger a NULL dereference when the code branches on btf_is_kernel(reg->btf) before verifying base_type(), since such registers have no BTF...

CVE-2026-53064

In Linux kernel dm-cache passthrough mode, a race between invalidate_complete() and concurrent writes can leave mg->cell NULL, causing a NULL pointer dereference during unlock/free. The reported fix is to validate mg->cell before unlocking it. Affected context described includes local, low-...

CVE-2026-53069

The CVE-2026-53069 issue is a Linux kernel null-pointer dereference in the XDP redirect path for bonding devices that have not been fully initialized. Specifically, bond_rr_gen_slave_id() can dereference a NULL rr_tx_counter when XDP redirects reach a bond that was never opened. The fix in xdp_ma...

CVE-2026-53312

In CVE-2026-53312, a Linux kernel iommu/riscv vulnerability is resolved: an integer overflow in the invalidation path could cause an infinite loop when handling sign-extended page tables (ULONG_MAX) during a gather/end computation. The fix moves the +1 away from the potentially overflowed compari...

CVE-2026-64054

CVE-2026-64054 is a Linux kernel vulnerability in the net_shaper (Network Shaper API) subsystem. The function net_shaper_nl_group_doit() fails to deduplicate NET_SHAPER_A_LEAVES entries, so when userspace supplies the same leaf handle twice, the same parent pointer is stored twice in old_nodes[],...

CVE-2026-64058

The CVE-2026-64058 issue affects the Linux kernel netfs component, specifically netfs_read_folio(), which did not wait for ongoing writeback to finish. The root cause was that folio->private could be cleaned up by the collector before the writeback flag was cleared, leading to unreliable trust...

CVE-2026-64078

The CVE-2026-64078 entry concerns a Linux kernel netfilter/x_tables issue that was resolved by introducing and using xtables_unregister_table_exit (replacing xt_unregister_table()) and adding a second-stage helper to unlink the dying table from the list, free hook ops, and emit an audit notificat...

CVE-2026-64089

CVE-2026-64089 affects the Linux kernel Batman-Adv (batman-adv) TT code. The root cause is that last_changeset_len was declared as s16, which can wrap when values exceed 32767, producing a negative value that then propagates into a widened s32. This leads batadv_tt_prepare_tvlv_local_data() to al...

CVE-2026-64101

The CVE-2026-64101 issue affects the Linux kernel fwctl component, where the RPC input buffer for pds is validated too late. Root cause: pdsfc_fw_rpc() casts the raw RPC buffer to fwctl_rpc_pds and then reads fields before ensuring the input buffer is large enough, risking an out-of-bounds read w...