CVE-2026-31748

CVE-2026-31748 (Linux kernel, comedi me_daq) : A firmware-overrun was fixed in the me2600_xilinx_download() path used by request_firmware(). The code trusts the firmware header and reads file_length from the first 4 bytes, then copies file_length bytes from offset 16 without verifying the data st...

CVE-2026-31777

The CVE-2026-31777 entry concerns the Linux kernel ALSA ctxfi driver. The root cause is the driver’s missing validation of the return value from daio_device_index(), leading to incorrect assumptions and potential system instability. Documents indicate this has been resolved via patches. Remediati...

CVE-2026-43026

CVE-2026-43026 concerns the Linux kernel netfilter ctnetlink path: when CTA_EXPECT_NAT is absent, ctnetlink_alloc_expect() can leave saved_addr and saved_proto uninitialized, risking leakage of stale data. The safe nf_ct_expect_init() in the packet path zeros these fields, and the patch adds expl...

CVE-2026-43079

CVE-2026-43079 affects the Linux kernel’s perf/x86/intel/uncore component. When NUMA is disabled and the system boots with fewer CPUs than those in die 0, the kernel continues to parse the discovery table for offline dies, which can trigger an array overflow at pmu->boxes[die] and may lead to ...

CVE-2026-43160

The vulnerability CVE-2026-43160 concerns the Linux kernel’s mfd: macsmc driver, where a mutex in struct apple_smc was not initialized in apple_smc_probe(). An uninitialized mutex can lead to occasional NULL pointer dereferences in apple_smc_read() invoked by probe() paths of subdevices. A patch ...

CVE-2026-43173

CVE-2026-43173 is a Linux kernel vulnerability in the net: ethernet: xscale driver where ixp46x_ptp_find() is invoked unconditionally from ixp4xx_get_ts_info(), even on systems without ixp46x support. This NULL pointer dereference can lead to a kernel crash/DoS when reading PTP-related info via e...

CVE-2026-43204

Summary: CVE-2026-43204 affects the Linux kernel ASoC: qcom q6asm component, where DSP responses for closed data streams could still be processed, causing system lockups. Root cause: DSP responses arriving after stream closure were not unconditionally dropped. Fix: unconditionally drop all DSP re...

CVE-2026-43210

The CVE-2026-43210 entry concerns the Linux kernel tracing ring-buffer subsystem. The root cause is inadequate validation of event length in rb_read_data_buffer(), which can cause an invalid memory access if an event’s length is corrupted, potentially at boot time. The published fix is to check t...

CVE-2026-43243

CVE-2026-43243 affects the Linux kernel drm/amd/display subsystem, specifically the dcn401 get_phyd32clk_src path, where missing signal type checks can cause a crash when accessing a DP link on DPIA. Connected OSV entries show Root and Debian/Ubuntu patches applied to rootio-linux (Ubuntu 22.04/2...

CVE-2026-43263

The CVE-2026-43263 entry concerns the Linux kernel chips-media wave5 driver. The vulnerability arises when multiple driver instances are created and destroyed, causing many interrupts and removal of decoder structures. The shared vpu_instance structure is not protected by a lock, allowing a poten...

CVE-2026-43290

Summary (CVE-2026-43290) A flaw in the Linux kernel's media subsystem (uvcvideo) can occur when start_streaming() fails due to an error in uvc_pm_get(), causing queued buffers to not be returned. The issue can lead to system instability or a denial of service by triggering a USB host controller f...

CVE-2026-43298

CVE-2026-43298 affects the Linux kernel drm/amdgpu driver. The issue arises during deinitialization where VF (Virtual Function) instances may attempt to release a VCN poison IRQ that was not enabled in VCNv2.5, causing a kernel warning in amdgpu_irq_put() and a potential instability. The disclose...

CVE-2026-43316

CVE-2026-43316 affects the Linux kernel, specifically the media/solo6x10 component. A signed shift could exceed 32 bits when compiled with UBSAN_SHIFT enabled, triggering undefined behavior; remediation added by checking the existing max chip_id and using an unsigned shift. This removes runtime i...

CVE-2026-43355

CVE-2026-43355 affects the Linux kernel bh1780 light sensor driver (iio: light). The root cause is a PM runtime reference-count leak: pm_runtime_put_autosuspend() was not guaranteed to run after pm_runtime_get_sync() if the read operation failed. The fixed response moves the autosuspend call befo...

CVE-2026-43454

CVE-2026-43454 concerns the Linux kernel nf_tables netfilter component. The issue arises when handling NETDEV_REGISTER notifications: a device may be registered twice because nft_netdev_hook_alloc() could have already added the device when the hook was created. The result is duplicate device regi...

CVE-2026-53020

The CVE-2026-53020 entry documents a Linux kernel issue: a race condition during Translation Lookaside Buffer (TLB) synchronization when the page table is traversed and modified without holding the proper page table lock. The root cause is the lack of adequate locking during TLB sync, which can l...

CVE-2026-53035

CVE-2026-53035 concerns the Linux kernel where bpf_iter_unix_seq_show can deadlock between lock paths in af_unix sockets when a sockmap update is attempted from a running iter_prog. The root cause is a locking interplay that leads to a recursive/single-thread deadlock in sock_map_update_elem via ...

CVE-2026-64075

CVE-2026-64075 is a use-after-free vulnerability in the Linux kernel's fprobe subsystem (part of KProbes tracing). The root cause is that commit 4346ba1604093 rewrote fprobe on the function-graph tracer to use an RCU hash list but forgot to wait for an RCU grace period in unregister_fprobe(), all...

CVE-2026-64087

CVE-2026-64087 is an out-of-bounds read in the Linux kernel's adm1266 PMBus hardware-monitoring driver. The function adm1266_nvmem_read_blackbox() uses a record_count value taken directly from byte 3 of a device's BLACKBOX_INFO response as a loop bound without validating it against the maximum of...

CVE-2026-64157

CVE-2026-64157 is a Linux kernel vulnerability in the netfs subsystem's netfs_invalidate_folio() function. When a partial invalidation region overlaps the front (but not all) of a dirty write cached in a streaming-write folio, the function incorrectly sets the dirty region offset to the start rat...

CVE-2026-64170

Based on the connected SUSE CVE entry, CVE-2026-64170 affects the Linux kernel SPI driver for the qup: SPI subsystem. The issue arises when DMA setup fails during probe, causing a dereference of an error pointer or a second release attempt unless DMA channel pointers are cleared on setup failure....

CVE-2026-64214

CVE-2026-64214 affects the Linux kernel on PowerPC where arch_irq_work_raise() redundantly called preempt_disable()/preempt_enable() while handling machine check exceptions in real mode. The MCE/NMI context is not preemptible, so the extra preemption protection could fault when accessing preempt_...

CVE-2026-64240

Summary of CVE-2026-64240 (Linux kernel, igorplugusb): The issue arises from the igorplugusb driver when the control request setup packet was moved to an allocated usb_ctrlrequest pointer for DMA coherency, but the code still passed ir->request to usb_fill_control_urb(), causing the URB to poi...

CVE-2023-53549

CVE-2023-53549 is a Linux kernel vulnerability affecting netfilter ipset long task execution when adding/deleting large numbers of elements in one step. The issue arose because a prior patch to limit batch size was insufficient, risking hung tasks. The fix reworks the batching by saving state and...

CVE-2023-53565

CVE-2023-53565 : Linux kernel vulnerability in brcmfmac wifi driver where probe() id argument can be NULL in two scenarios (brcmf_pcie_pm_leave_D3 reprobe path and manual driver binding via sysfs). This NULL IDs can cause a NULL pointer dereference on resume, potentially impacting Wi‑Fi functiona...

CVE-2023-53572

CVE-2023-53572 affects Linux kernel clk: imx: scu. The vulnerability arises in a loop that frees clk; without using a safe list iterator it can dereference a freed item. The fix is to replace the loop with list_for_each_entry_safe(), preventing use-after-free. References indicate a resolved patch...

CVE-2023-53579

CVE-2023-53579: In the Linux kernel, the gpio: mvebu driver had a resource leak in the irq domain triggered on driver detach. A fix was applied (using a custom devm action) to address the leak. Connected advisories (SUSE OSV entries, Root Debian patch notes, Astra Linux bulletin) corroborate the ...

CVE-2025-71290

CVE-2025-71290 concerns a memory leak in the Linux kernel’s misc: ti_fpc202 probe function. The root cause is not releasing a device node reference during iteration, leading to a leak. The remedy implemented is a code change that uses for_each_child_of_node_scoped() to ensure the node reference i...

CVE-2026-22983

The CVE-2026-22983 entry refers to a Linux kernel issue where msg_get_inq was written in the callee, risking a NULL pointer dereference. The vulnerability is described as a kernel-internal variant of msghdr where callers reinitialize the field; fixing the write is intended to improve robustness a...

CVE-2026-23367

CVE-2026-23367 – Linux kernel (wifi: radiotap: reject radiotap with unknown bits) The issue arises in the radiotap parser used for the radiotap namespace. If an undefined field (field 18) is present, the alignment/size is unknown and iterator->_next_ns_data is not initialized for non-visible v...

CVE-2026-23384

CVE-2026-23384 : In the Linux kernel's RDMA/ionic component, a kernel stack leak was fixed in the function ionic_create_cq(). The resp structure leaks 7 bytes from rsvd[7], and up to 4 additional bytes in cqid[2] (potentially 11 bytes total) if udma_mask only has bit 0 set and cqid[1] is not writ...

CVE-2026-23421

The CVE-2026-23421 issue is a Linux kernel memory-leak in drm/xe/configfs where ctx_restore_mid_bb is allocated in wa_bb_store() but freed only partially by xe_config_device_release(), leaving ctx_restore_mid_bb[0].cs undisposed when a configfs device is removed. The vulnerability is described as...

CVE-2026-23431

CVE-2026-23431 affects the Linux kernel component amlogic-spisg (spi driver). The issue is a memory leak in aml_spisg_probe() where ctlr allocated via spi_alloc_target()/spi_alloc_host() is not released on several error paths, causing leaks if probe fails after initial allocation. The fix uses me...

CVE-2026-23462

CVE-2026-23462 affects the Linux kernel Bluetooth stack (HIDP/L2CAP). The issue is a use-after-free related to not dropping the l2cap_conn reference during user remove callbacks, leading to a trace like l2cap_conn_free and cascading calls in the Bluetooth/hci_core paths. Connected sources confirm...

CVE-2026-31395

The CVE-2026-31395 issue affects the bnxt_en driver in the Linux kernel. The ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER handler uses a firmware‑supplied 16‑bit type field as an index into bp->bs_trace[] without proper bounds validation, allowing values 0–65535 to trigger out‑of‑bounds access i...

CVE-2026-31526

Summary: CVE-2026-31526 concerns the Linux kernel BPF verifier. A defect in exception exits for BPF subprograms allowed ORC unwinding to proceed without releasing user-held locks, risking resource leaks and instability. The root cause: process_bpf_exit_full() could set check_lock=false for except...

CVE-2026-31558

The CVE-2026-31558 issue affects the Linux kernel LoongArch KVM component. The vulnerable code is kvm_get_vcpu_by_cpuid(), which accepts a cpuid as int; if cpuid is negative, the function could access kvm_arch::phyid_map::phys_map[] out of bounds. The documented fix makes kvm_get_vcpu_by_cpuid() ...

CVE-2026-31639

In the Linux kernel, CVE-2026-31639 affects the rxrpc subsystem. A client call acquires a reference to a key during rxrpc_alloc_client_call(), but this reference is not released when the call is destroyed, causing a key reference-count leak. The documented fix frees call->key in rxrpc_destroy_...

CVE-2026-31645

CVE-2026-31645 pertains to the Linux kernel lan966x network driver. The issue is a memory/resource leak: in error paths of lan966x_fdma_rx_alloc() a created page pool is not destroyed if a subsequent fdma_alloc_coherent() fails, and in lan966x_fdma_init() the page pool created by lan966x_fdma_rx_...

CVE-2026-31653

Summary : CVE-2026-31653 impacts the Linux kernel DAMON subsystem (DAMON_SYSFS). When a monitored process terminates before damon_call() runs, a dynamically allocated repeat_call_control is not deallocated, causing a memory leak. The connected sources document the root cause and confirm the fix: ...

CVE-2026-31744

Summary: CVE-2026-31744 concerns the Linux kernel energy model code path that processes perf domain IDs. The function dev_energymodel_nl_get_perf_domains_doit() calls em_perf_domain_get_by_id() and uses its return value without verifying it; if a caller supplies a non-existent perf domain ID, em_...

CVE-2026-31764

Summary (CVE-2026-31764) : A vulnerability in the Linux kernel IIO IMU driver for the st_lsm6dsx allows an out-of-bounds access when a non-accelerometer/gyroscope sensor tries to set the buffer sampling frequency via the sysfs attribute. The function st_lsm6dsx_hwfifo_odr_store() calls st_lsm6dsx...

CVE-2026-31769

The CVE-2026-31769 issue in the Linux kernel gpib module is resolved by adding a kernel-only descriptor_busy reference count in struct gpib_descriptor to prevent use-after-free of gpib_descriptor objects during concurrent IO ioctl handling (IBRD, IBWRT, IBCMD, IBWAIT). Each IO path increments des...

CVE-2026-31780

In CVE-2026-31780, the Linux kernel wi l c1000 Wi‑Fi driver is affected by a heap buffer overflow in the SSID scan path. The code accumulates total SSID lengths into a variable declared as u8, allowing up to 330 bytes for 10 SSIDs, but the u8 wrap causes a 75-byte kmalloc allocation followed by a...

CVE-2026-31784

CVE-2026-31784 affects the Linux kernel, specifically the drm/xe/pxp component. The issue arises in pxp_start where a restart flag is not cleared, causing the function to potentially loop back to the start after reaching the end. This has been resolved by cherry-picking a fix from commit 0850ec7b...

CVE-2026-43098

Summary (concrete details from provided documents): CVE-2026-43098 affects the Linux kernel NFC subsystem, specifically the s3fwrn5 driver, where s3fwrn82_uart_read() may consume bytes into recv_skb and deliver a complete frame before a new receive buffer is allocated. If alloc_skb() fails, the c...

CVE-2026-43131

CVE-2026-43131 affects the Linux kernel DRM AMD PM path. When SMU is disabled during Reliability, Availability, and Serviceability (RAS) initialization, a null pointer dereference can occur in drm/amd/pm, potentially causing a system crash (DoS). Public-availability details come from multiple sou...

CVE-2026-43176

The CVE-2026-43176 entry refers to a vulnerability in the Linux kernel’s rtw89 WiFi driver (PCI path) affecting RTL8922DE where release report content was not properly validated. This could cause a crash (DoS) when handling a malformed TX release report. The root cause is insufficient validation ...

CVE-2026-43179

Summary: CVE-2026-43179 affects the Linux kernel’s EROFS filesystem. The issue stems from incorrect early exits for invalid metabox-enabled images with metadata compression, which can trigger folio reference leaks. The problem does not apparently cause system crashes or other severe issues accord...

CVE-2026-43282

CVE-2026-43282 affects the Linux kernel, specifically the RDMA ionic driver. The issue is in ionic_query_port(), which calls ib_device_get_netdev() without validating the return value, risking a NULL pointer dereference. The documented fix is to check the returned netdev and return -ENODEV if it ...