CVE-2023-53542

The CVE-2023-53542 issue affects the Linux kernel (ARM/Exynos) where the MIPI video PHY support for Exynos5420 was not using the correct Exynos5420 compatible, leading to a kernel panic. The description states that the fix is to use the proper compatible for Exynos5420, effectively patching the d...

CVE-2023-53617

CVE-2023-53617 affects the Linux kernel in the Aspeed SoC information path. The issue arises in the error handling path of soc:aspeed:socinfo, where memory allocated for kstrdup could leak. The fix adds a kfree() in the error handling to prevent memory leaks. Connected advisories reference kernel...

CVE-2023-53655

CVE-2023-53655 (Linux kernel) is a stack overflow vulnerability caused by registering a kprobe on __rcu_irq_enter_check_tick(). The issue can trigger kernel panics/stack overflow when NO_HZ_FULL is enabled and the system boots with nohz_full=, leading to a tree of stack traces and a kernel panic,...

CVE-2025-39900

CVE-2025-39900: Linux kernel net_sched: gen_estimator est_timer vulnerability fixed. When CONFIG_PREEMPT_RT=y, timer callbacks could be preempted, risking seqcount/seqlock integrity. A fix in net/core/gen_estimator.c updates est_timer() by adopting preempt_disable_nested()/preempt_enable_nested()...

CVE-2025-39936

The CVE-2025-39936 issue affects the Linux kernel crypto: ccp code path used during SEV/SNP shutdown. Root cause: __sev_firmware_shutdown() could call __sev_platform_shutdown_locked() with a NULL argument after the error-messages refactor, causing a NULL pointer dereference on the shutdown path d...

CVE-2025-39962

The CVE-2025-39962 entry concerns the Linux kernel RXRPC path. A bug in rxgk_app.c involved an untrusted unsigned subtract (ticket_len - 10 * 4) that could affect token parsing. The fix prechecks token lengths in two places and uses sizeof() for the extracted struct. This CVE is marked as resolve...

CVE-2025-71103

CVE-2025-71103 pertains to the Linux kernel DRM MSM Adreno driver. The issue occurs on A7xx GPUs without IFPC support, where ifpc_reglist could be dereferenced in a7xx_patch_pwrup_reglist(), leading to a kernel crash with a NULL pointer dereference (pc : a6xx_hw_init...). The vulnerability has be...

CVE-2025-71110

Technical details about CVE-2025-71110 are not publicly available in the provided connected documents. No specific affected products, versions, or remediation information are disclosed here; monitor for updates.

CVE-2025-71132

CVE-2025-71132 affects the Linux kernel, specifically the smc91x driver when built with PREEMPT_RT. The issue manifests as a broken IRQ-context in PREEMPT_RT, leading to a leaked workqueue state (example given: kworker/2:1[106]) and stack traces showing WARN/BUG in the mld/workqueue path. Root ca...

CVE-2025-71289

CVE-2025-71289 affects the Linux kernel’s ntfs3 handling of attr_set_size() when truncating files. If attr_set_size() fails during down-truncation, the error may be silently ignored, potentially leaving the inode in an inconsistent state. The connected sources corroborate this description and lis...

CVE-2025-71291

The CVE-2025-71291 issue affects the Linux kernel bcm_vk_read() function, where a NULL entry dereference could occur if entry is NULL and rc is -EMSGSIZE, potentially causing system instability or DoS. The fix copies fields (to_h_msg, usr_msg_id, to_h_blks) from the iterator into temporary variab...

CVE-2026-22995

The CVE concerns a Linux kernel race in ublk_partition_scan_work that can cause a use-after-free of ub->ub_disk due to a race between async partition scanning and device teardown. The vulnerability occurs when ublk_ctrl_start_dev() schedules partition_scan_work after add_disk(), and ublk_stop_...

CVE-2026-23009

CVE-2026-23009 is a Linux kernel vulnerability in the xHCI sideband code where xhci_sideband_remove_endpoint() could dereference a non-existent transfer ring (ep->ring) during suspend/resume or re-enumeration, risking a crash. The fix adds a guard to only dereference ep->ring if it exists a...

CVE-2026-23283

The vulnerability CVE-2026-23283 affects the Linux kernel regulator fp9931 component. In fp9931_hwmon_read(), when regmap_read() fails, the function returns the error without calling pm_runtime_put_autosuspend(), causing a PM runtime reference leak. This can lead to resource exhaustion and system...

CVE-2026-23297

CVE-2026-23297 affects the Linux kernel’s NFS daemon (nfsd). The issue is a memory leak of struct cred caused by how nfsd_nl_threads_set_doit() passes current credentials to nfsd_svc() and later to _svc_xprt_create() without transferring ownership, leaving a refcount leak. SYZBOT identified a lea...

CVE-2026-23342

CVE-2026-23342 describes a race in the Linux kernel’s PREEMPT_RT path for BPF cpumap/xdp_bulk_queue. The issue arises when bq_enqueue() and __cpu_map_flush() run concurrently on the same CPU, breaking assumptions about atomicity and enabling races such as double __list_del_clearprev() and concurr...

CVE-2026-23344

The CVE-2026-23344 issue affects the Linux kernel crypto: ccp module. In sev_tsm_init_locked(), the error path dereferences t after it has been freed (kfree), with pr_err() attempting to access t->tio_en and t->tio_init_done after free. The documented fix moves the pr_err() call before kfre...

CVE-2026-23365

The CVE-2026-23365 entry concerns the Linux kernel kalmia USB driver, where probing code must validate the device’s endpoints before binding. If a malicious device omits or mismatches expected endpoints, the driver may access invalid endpoints and crash. The issue is resolved in upstream kernel b...

CVE-2026-23382

The CVE-2026-23382 entry concerns the Linux kernel HID subsystem. The issue arises when raw HID event callbacks can fire for a device that has not been claimed, potentially leading to a crash due to a missing HID_CLAIMED_INPUT guard. The fix, described in the upstream commit 2ff5baa9b527, adds th...

CVE-2026-23396

The CVE-2026-23396 issue affects the Linux kernel mac80211 mesh code. The function mesh_matches_local() dereferenced ie->mesh_config without verifying presence, allowing a crafted CSA action frame that includes a Mesh ID IE but omits the Mesh Configuration IE to crash the kernel. The race is t...

CVE-2026-23418

The CVE-2026-23418 issue affects the Linux kernel component drm/xe/reg_sr. It describes a memory leak that occurs when xa_store() fails to store a newly allocated entry, leaving the entry not freed on the error path. The patched fix frees the allocated entry on error (notably via a goto fail_free...

CVE-2026-23435

The CVE-2026-23435 entries describe a Linux kernel PMU/X86 perf vulnerability that was resolved. The root cause was a commit that moved cpuc->events[idx] assignment out of x86_pmu_start() into step 2 of x86_pmu_enable(), after PERF_HES_ARCH checks. This could allow a path that calls pmu->st...

CVE-2026-31390

CVE-2026-31390 affects the Linux kernel's drm/xe path, causing a memory leak in the function path used by xe_vm_madvise_ioctl when check_bo_args_are_sane() validation fails. The underlying issue was incorrect resource cleanup, now addressed by jumping to a new free_vmas cleanup label to properly ...

CVE-2026-31437

The CVE-2026-31437 issue is in the Linux kernel netfs path: when a write subrequest is marked NETFS_SREQ_NEED_RETRY, netfs_unbuffered_write() could dereference stream->prepare_write if it is NULL (not all filesystems, e.g., 9P, set prepare_write). The fixed behavior mirrors write_retry.c: if s...

CVE-2026-31443

CVE-2026-31443 : Linux kernel, dmaengine: idxd driver fix. When hardware does not support event logging and a Function Level Reset (FLR) occurs, the driver previously attempted to restore the event log even if it was never allocated, and may crash. The fix ensures the event log is only freed if i...

CVE-2026-31559

This CVE (CVE-2026-31559) affects the LoongArch implementation in the Linux kernel. The issue is a missing NULL check in kstrdup() during device-tree processing, fixed by replacing of_find_node_by_path("/") with of_root to avoid multiple of_node_put() calls, and by preventing a kernel oops during...

CVE-2026-31572

CVE-2026-31572 involves the Linux kernel driver for the i2c: designware: amdisp. A race exists between probe and runtime PM resume: when the ISP is powered on via runtime PM before probe completes, the amdisp I2C resume can occur early, causing a NULL dereference in kernel v7.0. The fix uses genp...

CVE-2026-31728

The CVE-2026-31728 issue in the Linux kernel affects usb: gadget: u_ether, where a race between gether_disconnect() and eth_stop() could dereference a cleared endpoint descriptor, causing a NULL pointer dereference and a potential hardlockup. The root cause is the delayed clearing of dev->port...

CVE-2026-31735

The CVE-2026-31735 issue affects the Linux kernel IOMMU page table handling. Specifically, when an unmap operation partially overlaps a large or contiguous IOPTE, the invalidation/gather logic could flush only the requested range, causing a short invalidation where part of the unmapped area remai...

CVE-2026-43028

The CVE-2026-43028 vulnerability affects the Linux kernel netfilter x_tables component. The root cause is that certain names were not guaranteed to be nul-terminated before being passed to functions that expect C strings, which could lead to misprocessing, system instability, or hazardous behavio...

CVE-2026-43031

The CVE concerns the Linux kernel xilinx axienet driver. When a TX packet spans multiple buffer descriptors, the current accounting in axienet_free_tx_chain summing per-BD lengths into an accumulator can lose earlier bytes if the packet completes across different polls, causing BQL to overestimat...

CVE-2026-43086

CVE-2026-43086 concerns the Linux kernel IPVS component. The vulnerability occurs in the error path of ip_vs_add_service when ip_vs_bind_scheduler() has succeeded and the local variable sched is set to NULL; if ip_vs_start_estimator() then fails, ip_vs_unbind_scheduler(svc, sched) is invoked with...

CVE-2026-43202

CVE-2026-43202 affects the Linux kernel fbdev vt8500lcdfb driver. The root cause is a memory leak: fbi->fb.screen_buffer is allocated with dma_alloc_coherent() but is not freed on error paths due to missing dma_free_coherent() cleanup. This can exhaust system memory and cause DoS. Multiple OSV...

CVE-2026-43230

The CVE-2026-43230 issue affects the Linux kernel’s Reliable Datagram Sockets (RDS) by not clearing the reconnect-pending bit when canceling the reconnect worker before it has been scheduled. This can cause the system to believe a reconnect is pending indefinitely, potentially impairing network o...

CVE-2026-43286

The CVE-2026-43286 entry is resolved in the Linux kernel’s hugetlb subsystem (mm/hugetlb). A fix for an underflow in hstate->resv_huge_pages was introduced by commit a833a693a490 to correct fallback behavior for subpools, but it created a new issue where the subpool’s used_hpages could remain ...

CVE-2026-43322

CVE-2026-43322 is a Linux kernel vulnerability in Bluetooth HCI sync handling (le_read_features_complete). The issue is a use-after-free (UAF) caused by freeing hci_conn after le_read_features_complete has been initiated but before it completes, allowing hci_cmd_sync_dequeue to fail to prevent th...

CVE-2026-43356

The CVE-2026-43356 issue affects the Linux kernel IIO ADIS IMU drivers (e.g., adis16480, adis16490, adis16545). In adis_init(), the code dereferences adis->ops to inspect function pointers without first verifying that adis->ops itself is non-NULL, leading to a NULL pointer dereference durin...

CVE-2026-43368

The CVE-2026-43368 entry concerns the Linux kernel DRM/i915 component (GEM shmem objects). A overflow can occur in the unsigned int .length field of a scatterlist when a scatterlists table for a GEM shmem object of 4 GB or more is built from folio-allocated pages, causing the total byte length of...

CVE-2026-43389

CVE-2026-43389 affects the Linux kernel memfd_luo subsystem. The root cause is a flaw where preserving LUO state could leave folios marked clean, risking data loss if they are dirtied later and reclaimed under memory pressure. The fix changes all folios of the file to be dirty and sets MEMFD_LUO_...

CVE-2026-43461

CVE-2026-43461 affects the Linux kernel’s spi: amlogic: spifc-a4 driver, specifically aml_sfc_dma_buffer_setup(). The patch fixes three DMA mapping error paths: (1) removing an unnecessary goto when sfc->daddr mapping fails, (2) preventing a double-unmap when info DMA mapping fails by avoiding...

CVE-2026-45907

CVE-2026-45907 details a Linux kernel mlx5e netdev deadlock caused by incorrect lock ordering between devlink, rtnl, and netdev locks during recovery paths. The fix modifies several recovery flows to move netdev_trylock usage from lower-level work handlers to earlier points in the call chain (as ...

CVE-2026-45939

CVE-2026-45939 affects the Linux kernel gpib implementation. The bug is a memory leak in ni_usb_init() when ni_usb_setup_init() fails: the writes buffer is not freed in the error path, and ni_usb_setup_init() may return 0 on failure, causing ni_usb_init() to return -EFAULT. The published fix free...

CVE-2026-45955

Summary (CVE-2026-45955): In the Linux kernel, the md/md-llbitmap path suffers a logic error where llbitmap_suspend_timeout() times out waiting for percpu_ref to reach zero and returns -ETIMEDOUT without resurrecting percpu_ref. This leaves the page control structure in a killed state, potentiall...

CVE-2026-53013

The CVE-2026-53013 issue affects the Linux kernel macvlan module. The root cause is that macvlan_get_size() did not reserve space for the IFLA_MACVLAN_BC_CUTOFF attribute, while macvlan_fill_info() may include that attribute when port->bc_cutoff != 1. As a result, nla_put_s32() can fail with -...

CVE-2026-53022

CVE-2026-53022 concerns the Linux kernel component platform/x86 dell-wmi-sysman where firmware-provided value-modifier and possible-value strings are aggregated into fixed buffers. The root cause is that while individual source strings are bounded, the code uses strcat to append strings and separ...

CVE-2026-53038

CVE-2026-53038 affects the Linux kernel IMA subsystem. When handling unsupported TPM hash algorithms, ima_fs can access hash_algo_name[] with an invalid crypto_id (set to HASH_ALGO__LAST), causing a read-out-of-bounds in create_securityfs_measurement_lists. The issue is associated with TPM_ALG_SH...

CVE-2026-53055

CVE-2026-53055 concerns the Linux kernel crypto: hisilicon/sec2 module. Under heavy load, during packet transmission, the hardware may free the request memory (req) before the software finishes processing, causing a use-after-free when the software accesses the freed memory. The issue affects the...

CVE-2026-53067

The CVE-2026-53067 issue affects the Linux kernel PCI endpoint MSI doorbell allocation (pci-ep-msi). Root cause: pci_epf_alloc_doorbell() caches the doorbell array in epf->db_msg and epf->num_db before MSI vectors are allocated; if MSI allocation fails, the array could be freed while epf st...

CVE-2026-53069

The CVE-2026-53069 issue is a Linux kernel null-pointer dereference in the XDP redirect path for bonding devices that have not been fully initialized. Specifically, bond_rr_gen_slave_id() can dereference a NULL rr_tx_counter when XDP redirects reach a bond that was never opened. The fix in xdp_ma...

CVE-2026-53083

CVE-2026-53083 affects the rootio-linux package in RootOS (Debian 11/12, Ubuntu 22.04/24.04). Multiple fixed versions are available; Root has patched the vulnerability. Remediate by updating to the patched rootio-linux versions for the respective OS releases.