CVE-2026-43470

CVE-2026-43470 affects the Linux kernel NFS implementation. When an alias found via nfs3_do_create/nfs_add_or_obtain /d_splice_alias corresponds to a directory, the code could forget the alias while keeping the original negative dentry, causing an oops in nfs_atomic_open_v23/finish_open. The issu...

CVE-2026-53035

CVE-2026-53035 concerns the Linux kernel where bpf_iter_unix_seq_show can deadlock between lock paths in af_unix sockets when a sockmap update is attempted from a running iter_prog. The root cause is a locking interplay that leads to a recursive/single-thread deadlock in sock_map_update_elem via ...

CVE-2026-53083

CVE-2026-53083 affects the rootio-linux package in RootOS (Debian 11/12, Ubuntu 22.04/24.04). Multiple fixed versions are available; Root has patched the vulnerability. Remediate by updating to the patched rootio-linux versions for the respective OS releases.

CVE-2026-64105

The CVE-2026-64105 entry concerns Linux kernel KVM for ARM64 vgic: when a vCPU fails to initialize, private IRQs allocated prior to a redistributor iodev registration are not released, causing a resource leak. The root cause is a missing cleanup path in kvm_arch_vcpu_create() and the preceding kv...

CVE-2026-64129

CVE-2026-64129 affects the Linux kernel where, in migrate_vma_insert_huge_pmd_page within the memory management code, a spinlock leak could occur if check_stable_address_space() fails after pmd_lock() acquires the PMD spinlock. The path could jump to abort, bypassing the unlock, causing the PMD s...

CVE-2026-64135

CVE-2026-64135 affects the Linux kernel hwmon driver for the ADM1266 (pmbus) by leaking a 5-byte stack buffer in adm1266_nvmem_read_blackbox(). The code passes a 5-byte local buffer to i2c_smbus_read_block_data(), which can copy data.block[0] bytes from the SMBus response without honoring the cal...

CVE-2026-64148

Concrete CVE details exist: Linux kernel vulnerability CVE-2026-64148 related to the pds_core/pdsc_devcmd_wait error handling. The issue involved two cases where pdsc_devcmd_wait() could return a stale success instead of an error: (1) a firmware crash where the wait loop exits with running=false ...

CVE-2026-64152

CVE-2026-64152 affects the Linux kernel iommu path. The issue arises when an unmap error in the iommu_debug flow occurs in an error path that did not establish the original iommu_debug_map, causing mis-tracing and unbalanced tracking. Fix: move the unmap error handling into iommu_map_nosync() and...

CVE-2026-64177

CVE-2026-64177 is a Linux kernel vulnerability in the Phonet protocol (pep) handling where forwarding of skb to a child socket via sk_receive_skb() incorrectly acquires the child socket lock with BH enabled in the softirq path. The root cause is a BH state mismatch between softirq and process pat...

CVE-2022-50530

Mode C: CVE-2022-50530 affects the Linux kernel blk-mq path. The vulnerability is a NULL pointer dereference in blk_mq_clear_rq_mapping(), triggered when set->tags[hctx_idx] is NULL during an allocation path that merged two steps into one. Root cause, per the report, is that tags may not be in...

CVE-2023-53476

CVE-2023-53476 affects the Linux kernel’s RDMA/cxgb4 code path (c4iw_fill_res_cm_id_entry). The issue arises when epcp is re-assigned; re-testing epcp->state == LISTEN after reassignment can dereference NULL listen_ep or ep, leading to a NULL pointer dereference. The vulnerability is triggered...

CVE-2023-53477

Summary of CVE-2023-53477 (Linux kernel) Affects: Linux kernel; vulnerability lies in IPv6 nexthop length calculation during route changes when lwtunnel is present on siblings but not in fib6_info, causing a mismatch and warning in inet6_rt_notify. Root cause: In rt6_nlmsg_size(), nexthop length ...

CVE-2023-53490

Mode C: CVE-2023-53490 affects the Linux kernel’s MPTCP implementation, describing a race between disconnect/shutdown and accept that could lead to a kernel NULL pointer dereference. The root cause is that mptcp_stream_accept() did not take the msock lock consistently with the msk-level flag chec...

CVE-2023-53663

CVE-2023-53663 concerns the Linux kernel KVM nSVM nested-VM path. The issue occurs when nested TSC scaling support is checked on nested SVM VMRUN and an MSR write together with a guest CPUID update hides the feature, causing the guest to trigger a WARN repeatedly (sequence shown) instead of a cor...

CVE-2023-53664

CVE-2023-53664 concerns a Linux kernel issue in the OPP subsystem. The vulnerability stems from dereferencing the opp pointer before validating it with IS_ERR_OR_NULL() in dev_pm_opp_get_required_pstate(), risking a null pointer dereference. The fix removes the dereference of opp_table and derefe...

CVE-2026-23287

The CVE-2026-23287 issue affects the Linux kernel’s PLIC interrupt handling for SiFive irqchip, where a race between affinity changes and interrupt enable bits could freeze an interrupt. Root cause: completion handling could ignore or mis-handle an interrupt if the hart affinity change left the e...

CVE-2026-23344

The CVE-2026-23344 issue affects the Linux kernel crypto: ccp module. In sev_tsm_init_locked(), the error path dereferences t after it has been freed (kfree), with pr_err() attempting to access t->tio_en and t->tio_init_done after free. The documented fix moves the pr_err() call before kfre...

CVE-2026-23366

The CVE-2026-23366 entry concerns the Linux kernel DRM client component. A vulnerability in drm_client_modeset_probe can lead to a NULL pointer dereference when ‘modes’ fails to be allocated with kcalloc; if an error path calls modes_destroy on this NULL pointer, a crash can occur. The issue is r...

CVE-2026-31442

CVE-2026-31442 affects the Linux kernel in the dmaengine: idxd component. The issue occurs during a Function Level Reset (FLR): if the first FLR succeeds but the second FLR cannot allocate the scratch area for the saved configuration, an invalid memory access can occur. Reports from multiple vend...

CVE-2026-31463

Summary : CVE-2026-31463 concerns the Linux kernel iomap subsystem. A mismatch between inode block size (i_blkbits) and the IO granularity can cause invalid folio access during reads. The root cause was that, when IO is submitted for less than a full folio in the !ifs path, the code would fail to...

CVE-2026-31465

CVE-2026-31465 in the Linux kernel concerns the writeback path for filesystems without data integrity guarantees (e.g., fuse). The fix adds a SB_I_NO_DATA_INTEGRITY superblock flag; when set, sync kicks off writeback of dirty inodes but does not wait for flusher threads to finish. The change move...

CVE-2026-31514

The CVE-2026-31514 issue affects the Linux kernel erofs filesystem: I/O requests for file-backed mounts can be interrupted (SIGKILL) and cause unused folios to be incorrectly marked uptodate, potentially leading to data integrity problems or stale data exposure. Mitigation/patches address this by...

CVE-2026-31529

The CVE-2026-31529 issue affects the Linux kernel in the cxl/region code path. The vulnerability is a leakage (resource/memory) in __construct_region(): if sysfs_update_group() fails, the resource isn’t explicitly freed, which can lead to leakage. Several sources confirm the fix and describe the ...

CVE-2026-31541

CVE-2026-31541: In the Linux kernel tracing subsystem, when copy_trace_marker is enabled, deleting a tracing instance could bypass synchronization and leave a Use-After-Free (UAF) due to incorrect ordering of flag clearing and marker list updates. The fix moves clearing of all flags below the upd...

CVE-2026-31645

CVE-2026-31645 pertains to the Linux kernel lan966x network driver. The issue is a memory/resource leak: in error paths of lan966x_fdma_rx_alloc() a created page pool is not destroyed if a subsequent fdma_alloc_coherent() fails, and in lan966x_fdma_init() the page pool created by lan966x_fdma_rx_...

CVE-2026-31730

CVE-2026-31730 affects the Linux kernel fastrpc component, where a double-free of cctx->remote_heap could occur if INIT_CREATE_STATIC ioctl hits an error path and the rpmsg device is removed. The root cause is that fastrpc_init_create_static_process() frees cctx->remote_heap on the err_map ...

CVE-2026-31767

Summary: CVE-2026-31767 relates to the Linux kernel DRM/i915/dsi path and fixes an issue where DSC horizontal timing adjustments were applied in command mode, potentially causing a div-by-zero when calculating vtotal. The underlying fix prevents adjusting htotal based on compression ratio in comm...

CVE-2026-31783

The CVE-2026-31783 entry refers to a Linux kernel issue in spi: amlogic: spifc-a4 where the on-host NAND ECC engine teardown was missing in probe unwind and remove-time cleanup. The fix adds a devm cleanup action so nand_ecc_unregister_on_host_hw_engine() runs automatically on probe failures and ...

CVE-2026-43032

CVE-2026-43032 affects the Linux kernel NFC pn533/pn532 UART receive path. The root cause is that pn532_receive_buf() appends incoming bytes to dev->recv_skb and only clears the partial frame when a complete PN532 frame header is recognized, allowing a continuous invalid stream to grow the skb...

CVE-2026-43041

CVE-2026-43041 concerns the Linux kernel: the irq/qrtr path (qrtr_tx_flow) used a radix_tree that could leak memory when intermediate nodes were linked but a subsequent allocation failed. The root cause was orphaned internal radix_tree nodes left behind because radix_tree_for_each_slot() only vis...

CVE-2026-43082

CVE-2026-43082 affects the Linux kernel net: txgbe component. The issue arises from how property_entry lists are terminated: the driver allocated exactly the number of entries used and did not reserve space for the terminating empty entry. The fix updates the struct definition of property_entry t...

CVE-2026-43098

Summary (concrete details from provided documents): CVE-2026-43098 affects the Linux kernel NFC subsystem, specifically the s3fwrn5 driver, where s3fwrn82_uart_read() may consume bytes into recv_skb and deliver a complete frame before a new receive buffer is allocated. If alloc_skb() fails, the c...

CVE-2026-43138

In the Linux kernel vulnerability CVE-2026-43138, a dynamically created GPIO reset controller device could be unbound via the sysfs interface, triggering a use-after-free condition and potentially destabilizing the system. The issue arises from improper handling of unbinding in the sysfs path for...

CVE-2026-43172

CVE-2026-43172 affects the Linux kernel iwlwifi driver. If the firmware reports three LMACs (which hardware does not have), the code can overrun the array fwrt->smem_cfg.lmac[2]. The fix rejects such configurations and uses IWL_FW_CHECK instead of WARN_ON, mitigating a potential instability/Do...

CVE-2026-43176

The CVE-2026-43176 entry refers to a vulnerability in the Linux kernel’s rtw89 WiFi driver (PCI path) affecting RTL8922DE where release report content was not properly validated. This could cause a crash (DoS) when handling a malformed TX release report. The root cause is insufficient validation ...

CVE-2026-43179

Summary: CVE-2026-43179 affects the Linux kernel’s EROFS filesystem. The issue stems from incorrect early exits for invalid metabox-enabled images with metadata compression, which can trigger folio reference leaks. The problem does not apparently cause system crashes or other severe issues accord...

CVE-2026-43224

The CVE-2026-43224 entry concerns the Linux kernel io_uring/zcrx subsystem. A memory leak could occur when mapping fails in io_populate_area_dma() on PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA, as io_zcrx_map_area() would allocate a sgtable that isn’t freed due to the error path not freeing it when !is_...

CVE-2026-43394

CVE-2026-43394 (Linux kernel) : A local credential reference leak in nfsd_nl_listener_set_doit() occurs because get_current_cred() is used without a corresponding put_cred(). The function runs in process context during sendmsg(), and current->cred remains valid, so the extra refcount is unnece...

CVE-2026-53017

The CVE-2026-53017 issue affects the Linux kernel f2fs filesystem: data loss could occur when fsync on a newly created file races with a checkpoint. Root cause: IS_CHECKPOINTED and HAS_LAST_FSYNC flags on nat_entry may be observed as set before the checkpoint fully completes, causing incorrect as...

CVE-2026-53055

CVE-2026-53055 concerns the Linux kernel crypto: hisilicon/sec2 module. Under heavy load, during packet transmission, the hardware may free the request memory (req) before the software finishes processing, causing a use-after-free when the software accesses the freed memory. The issue affects the...

CVE-2026-53080

CVE-2026-53080 affects the Linux kernel net/sched cls_fw. Description in connected advisories shows that a NULL dereference could occur for old-style filters during shared-block publication, leading to a crash/warn during packet classification. The fix skips “old-style” classification on shared b...

CVE-2026-64070

CVE-2026-64070 affects the powerpc/hv-gpci driver in the Linux kernel. Four sysfs show callbacks (processor_bus_topology_show, processor_config_show, affinity_domain_via_virtual_processor_show, affinity_domain_via_domain_show) call get_cpu_var() (which invokes preempt_disable()) but only call the...

CVE-2026-64072

CVE-2026-64072 is a bio leak in the Linux kernel NVMe driver . When integrity mapping fails, the code attempted to free a local bio pointer that was always NULL, leaking the actual bio that should have been obtained directly from the request. This results in a high availability impact (resource e...

CVE-2026-64075

CVE-2026-64075 is a use-after-free vulnerability in the Linux kernel's fprobe subsystem (part of KProbes tracing). The root cause is that commit 4346ba1604093 rewrote fprobe on the function-graph tracer to use an RCU hash list but forgot to wait for an RCU grace period in unregister_fprobe(), all...

CVE-2026-64092

The CVE-2026-64092 issue affects the Linux kernel’s batman-adv module (tp_meter). The root cause is flawed coordination between receiver shutdown and batadv_tp_stop_all(), allowing a tp_vars reference leak when batadv_tp_receiver_shutdown() fails to release its reference if a timer had already ex...

CVE-2026-64139

In the Linux kernel ksmbd subsystem, commit 299f962c0b02 added check_add_overflow() guards that issue break statements in set_posix_acl_entries_dacl(), bypassing kfree(sid) calls and leaking struct smb_sid allocations per loop iteration. A crafted file with many POSIX ACL entries triggers repeate...

CVE-2026-64156

The CVE-2026-64156 vulnerability affects the Linux kernel’s netfs and AFS components. It arises when a write is skipped due to lock contention and WB_SYNC_NONE, potentially failing to re-mark the inode. The documented fix modifies netfs_write_single() to return 1 when a skip occurs and updates af...

CVE-2026-64170

Based on the connected SUSE CVE entry, CVE-2026-64170 affects the Linux kernel SPI driver for the qup: SPI subsystem. The issue arises when DMA setup fails during probe, causing a dereference of an error pointer or a second release attempt unless DMA channel pointers are cleared on setup failure....

CVE-2026-64240

Summary of CVE-2026-64240 (Linux kernel, igorplugusb): The issue arises from the igorplugusb driver when the control request setup packet was moved to an allocated usb_ctrlrequest pointer for DMA coherency, but the code still passed ir->request to usb_fill_control_urb(), causing the URB to poi...

CVE-2026-64292

CVE-2026-64292 : In the Linux kernel, the iommufd component is vulnerable due to veventq memory allocation happening inside a spinlock, enabling a local user to exhaust atomic memory reserves by creating large queues and trigger a DoS. The fix moves the veventq memory allocation outside the spinl...