CVE-2026-31461

CVE-2026-31461 affects the Linux kernel’s drm/amd/display component (amdgpu_dm). When a sink is connected, the driver overwrote connector->drm_edid without freeing the previously allocated memory, causing a memory leak on resume. Root cause: failure to free the prior drm_edid before updating. ...

CVE-2026-31538

CVE-2026-31538 (Linux kernel SMB server) : A race condition in the SMB server’s recv credits logic (smbdirect_socket.recv_io.credits.available) can cause credits to be granted that may already have been consumed by the peer due to mismatched counting of posted recv_io versus granted credits. The ...

CVE-2026-31571

The CVE-2026-31571 entry concerns the Linux kernel DRM/I915: unlink_nv12_plane() could clobber plane state after plane_atomic_check() when a Y-plane is repurposed as a normal plane. The fix is to unlink the NV12 planes before computing the new plane state, preventing the race condition that could...

CVE-2026-31741

CVE-2026-31741 affects the Linux kernel rz-mtu3-cnt counter module. Repeated writes to the sysfs enable file can underflow/overflow the Runtime PM usage count, causing clocked-off hardware register accesses and potential instability/DoS. The issue is resolved in upstream kernel (v6.6.137) and dis...

CVE-2026-31742

The CVE-2026-31742 issue affects the Linux kernel’s virtual terminal (vt) handling of alternate screen mode. When entering alt screen, vc_uni_lines is saved to vc_saved_uni_lines and vc_uni_lines is set to NULL. A subsequent console resize can skip reallocating the unicode buffer because vc_uni_l...

CVE-2026-31761

CVE-2026-31761 concerns the Linux kernel IIO gyro driver for mpu3050. The issue is a race condition caused by calling iio_device_register() in an incorrect location during probe. The fix places iio_device_register() at the end of the probe function and aligns iio_device_unregister() accordingly. ...

CVE-2026-31765

Summary: CVE-2026-31765 affects the Linux kernel AMDGPU driver. A mismatch between the reserved trap area (AMDGPU_VA_RESERVED_TRAP_SIZE) and the allocated KFD GPU memory on systems with 64KB pages can cause a kernel crash, including a NULL pointer dereference, when running certain GPU tests (e.g....

CVE-2026-31766

The CVE-2026-31766 issue affects the Linux kernel AMDGPU driver: amdgpu_userq_get_doorbell_index() passes user-supplied doorbell_offset to amdgpu_doorbell_index_on_bar() without proper bounds checking. An arbitrarily large doorbell_offset can drive the computed doorbell index outside the allocate...

CVE-2026-31775

The CVE-2026-31775 issue affects the Linux kernel ALSA ctxfi driver. A refactor caused atc_get_resources() to loop over all DAIOTYP entries, causing SPDIF1 (a special type used only on hw20k1 CTSB073X) to be considered for hw20k2 where it has no definition. This could crash the kernel during DAIO...

CVE-2026-43082

CVE-2026-43082 affects the Linux kernel net: txgbe component. The issue arises from how property_entry lists are terminated: the driver allocated exactly the number of entries used and did not reserve space for the terminating empty entry. The fix updates the struct definition of property_entry t...

CVE-2026-43394

CVE-2026-43394 (Linux kernel) : A local credential reference leak in nfsd_nl_listener_set_doit() occurs because get_current_cred() is used without a corresponding put_cred(). The function runs in process context during sendmsg(), and current->cred remains valid, so the extra refcount is unnece...

CVE-2026-53031

The CVE-2026-53031 issue affects the Linux kernel BPF unit: arena_alloc_pages() accepts a plain int node_id and forwards it through the allocation chain without bounds checks. A fix validates node_id before passing it down, mitigating potential memory corruption that could lead to DoS or instabil...

CVE-2026-53054

CVE-2026-53054 affects the Linux kernel DRM subsystem for Qualcomm Adreno (MSM) where an incorrect argument in VM_BIND UNMAP locking caused certain objects involved in UNMAP operations to not be consistently locked. The issue could impact system stability, particularly for non-NO_SHARE buffer obj...

CVE-2026-53099

CVE-2026-53099 concerns the Linux kernel BPF/CFI config handling. The issue stems from a rename: CONFIG_CFI_CLANG was renamed to CONFIG_CFI, but some builds may still use the old name, causing CFI to be compiled out. As a result, CFI failures for btF_dtor_kfunc_t could be missed, potentially allo...

CVE-2025-71287

The CVE-2025-71287 issue affects the Linux kernel driver mtk-smi for memory handling during larb probes. The root cause is failure to drop the reference to the SMI device on late probe failure or driver unbind, causing a memory leak that could lead to resource exhaustion and potential DoS. The vu...

CVE-2025-71288

The CVE-2025-71288 entry concerns the Linux kernel mtk-smi memory driver. The root cause is failure to release device references during common probe failures and on driver unbind, leading to potential resource exhaustion. This could enable a local attacker to cause a Denial of Service on affected...

CVE-2026-23252

The CVE-2026-23252 issue affects the Linux kernel XFS code. The root cause is the xchk_xfile_*_descr macros calling kasprintf, which could fail to allocate memory when formatting strings larger than the non‑no-fail limit. The patch removes this path by passing static strings instead, eliminating ...

CVE-2026-23280

CVE-2026-23280 affects the Linux kernel’s accel/amdxdna component. The issue is a size calculation overflow for the ubuf, which can lead to an undersized allocation and potential memory corruption. The root cause is improper handling of arithmetic when computing the ubuf size. The publicly docume...

CVE-2026-23294

The CVE describes a race in the Linux kernel’s PREEMPT_RT path for the per-CPU xdp_dev_bulk_queue (bq). The vulnerability arises because bq_enqueue() and __dev_flush() were believed to run atomically on the same CPU, but PREEMPT_RT can preempt, leading to concurrent access to bq->count and bq-...

CVE-2026-23311

CVE-2026-23311 is a Linux kernel issue in perf/core: Fix of an invalid wait context in ctx_sched_in(). Lockdep reports a bug where a pinned event wakeup could grab a wait-queue lock under perf-context lock; the fix switches to using irq_work and avoids grabbing the lock in the problematic context...

CVE-2026-23337

The CVE-2026-23337 entry concerns the Linux kernel, specifically the pinconf-generic driver in the pinctrl subsystem. The root cause is a memory leak in pinconf_generic_parse_dt_config() when parse_dt_cfg() fails and exits early, bypassing cleanup. The resulting leak is of the cfg buffer. The fix...

CVE-2026-23350

CVE-2026-23350 is a Linux kernel vulnerability in the drm/xe/queue path. The issue arises when an exec queue creation fails and is not properly finalized, leaving a damaged queue in exec_queue_lookup which can cause an invalid memory reference. The fix adds a finalization call (fini) for each que...

CVE-2026-23353

Summary (CVE-2026-23353) A bug in the Linux kernel ice network driver causes a kernel NULL pointer dereference during the ethtool offline loopback test after ICE conversion to page pool. The root cause is not initializing libeth for the receive (RX) ring, leading to a crash when the loopback test...

CVE-2026-31391

CVE-2026-31391 is reported in the OSV records as patched by the Root project in the rootio-linux package across multiple RootOS releases (Debian 11/12/13 and Ubuntu 22.04/24.04 variants). The affected component is the Linux kernel package in rootio-linux, with fixes available in multiple versions...

CVE-2026-31490

CVE-2026-31490 affects the Linux kernel drm/xe/pf component. A use-after-free vulnerability occurs when xe_sriov_pf_migration_restore_produce() returns an error and the data pointer is not cleared, potentially enabling memory corruption or a crash. The fix sets the data pointer to NULL on error t...

CVE-2026-31535

Summary: CVE-2026-31535 affects the Linux kernel SMB client receive credit management. A race in handling smbdirect_socket.recv_io.credits.available can cause over- or under-counted credits, potentially destabilizing the SMB receive path. The root cause is a window where a peer might have consume...

CVE-2026-31549

CVE-2026-31549 relates to the Linux kernel cp2615 I2C driver. The vulnerability arises when the driver uses the USB device serial string as the i2c adapter name but does not ensure the string exists, potentially causing a NULL pointer dereference if a device lacks a serial number. Documented impa...

CVE-2026-31654

CVE-2026-31654 affects the Linux kernel mm/vma path for mmap-backed shared mappings (notably /dev/zero). The root cause was a memory leak: when __mmap_new_vma() fails after shmem_zero_setup_desc() allocates a replacement shmem file, that new file isn’t released in the error path, leaving an unref...

CVE-2026-31776

CVE-2026-31776 affects the Linux kernel via ALSA ctxfi SPDIF1 handling. The issue occurs in daio_device_index() for SPDIF1 (hw20k2) where the index is not properly handled, leading to an out-of-bounds access. Affected code path is fixed upstream by returning the correct index, mirroring the hw20k...

CVE-2026-43142

CVE-2026-43142 affects the Linux kernel media: iris: gen1 driver. The issue arises because the driver does not destroy internal buffers after firmware releases, leaving stale allocations (notably when display resolutions change). This can waste memory until session close and may contribute to res...

CVE-2026-43164

CVE-2026-43164 affects the Linux kernel UDP-Lite implementation. The issue is a null-pointer dereference in __udp_enqueue_schedule_skb() triggered during UDP-Lite socket initialization, as reported by syzbot. Post-commit changes allow udp_lib_init_sock(), udp_init_sock(), and udpv6_init_sock() to...

CVE-2026-43404

CVE-2026-43404: In the Linux kernel mm subsystem, hmm_range_fault() can livelock if folio_trylock() fails during device-private folio migration; the spinning waiter may be starved if a dependent work item on the same CPU never runs, causing a DoS-like livelock. Conditions include: migration path ...

CVE-2026-52966

The CVE-2026-52966 entry concerns the Linux kernel DRM subsystem. A logical error in the change handle path failed to replace the newly generated IDR pointer with the old id’s pointer at the correct location, potentially triggering a kernel warning or a system crash (DoS) under local conditions. ...

CVE-2026-64120

The CVE-2026-64120 issue affects the Linux kernel’s ethtool/phy_prepare_data path. It arises from unverified allocations via kstrdup() for strings like name, drvname, upstream_sfp_name, and downstream_sfp_name, which can yield NULL and cause a NULL pointer dereference in phy_reply_size() and a ke...

CVE-2026-23295

CVE-2026-23295 concerns the Linux kernel accel/amdxdna driver. A deadlock can occur when a user-space process issues a query IOCTL during auto suspend: the query path holds dev_lock and calls pm_runtime_resume_and_get(), waiting for suspend to finish while the suspend callback may block on dev_lo...

CVE-2026-23314

The CVE-2026-23314 entry describes a Linux kernel issue in the regulator/bq257xx subsystem: in bq257xx_reg_dt_parse_gpio(), if it fails to obtain a subchild, it may return without calling of_node_put(child), leaking a device node reference. The vulnerability is reported as resolved in the Linux k...

CVE-2026-23324

CVE-2026-23324 : In the Linux kernel, the issue affects the can: usb: etas_es58x driver where an urb anchored with the anchor pattern must be anchored before submitting it in the read bulk callback. If not anchored, the urb could be leaked when usb_kill_anchored_urbs() runs. The fixes apply to th...

CVE-2026-31736

CVE-2026-31736 affects the Linux kernel MTK PPE Ethernet driver. When the gmac0 interface is disabled, a precheck for a valid ingress device can dereference a NULL pointer (eth->netdev[0] is NULL) and crash the system. The underlying issue is that the code was only checking the first net_devic...

CVE-2026-43044

The CVE-2026-43044 issue affects the Linux kernel's crypto: caam module. When processing HMAC keys longer than the block size, the copied key’s memory was not properly aligned for DMA, risking corruption of adjacent memory. The vulnerability’s root cause was the allocation of a copy that relied o...

CVE-2026-43092

The CVE-2026-43092 issue affects the Linux kernel AF_XDP subsystem: bind now validates MTU against the usable frame space provided by UMEM chunks. Previously, zero-copy pool configurations could be accepted without confirming that the device MTU fits into the usable frame space, considering tailr...

CVE-2026-31544

The CVE-2026-31544 issue affects the Linux kernel firmware component arm_scmi, where the helper __scmi_event_handler_get_ops could yield a NULL instead of an ERR_PTR when an event handler is missing or not created. This caused a NULL dereference in the notify error path, potentially leading to a ...

CVE-2026-31550

CVE-2026-31550 is a Linux kernel issue in the bcm2835-power component. The bcm2835_asb_control() polling loop could fail to properly disable the V3D master ASB on BCM2711 under heavy workloads, leaving the V3D in a broken state and potentially causing bus faults or system hangs. The mitigation in...

CVE-2026-31740

CVE-2026-31740 : In the Linux kernel, a race condition can occur in the rz-mtu3-cnt counter driver where the shared rz_mtu3_channel.dev pointer is overwritten by the counter and PWM sub-drivers when assigning device pointers for channels 1 and 2. This can lead the counter sub-driver to perform ru...

CVE-2025-71296

CVE-2025-71296 relates to the Linux kernel DRM SHMEM path. The issue arises when the reservation lock around the purge operation in drm_gem_shmem_purge_locked() is not properly held, potentially triggering kernel warnings. The fix/published guidance exports a new helper, drm_gem_shmem_purge(), sp...

CVE-2026-43165

CVE-2026-43165 corresponds to a Linux kernel hwmon issue in the nct7363 driver where of_parse_phandle_with_args() references were not released with of_node_put(), causing a resource leak in nct7363_present_pwm_fanin. The connected OSV entries indicate patches in rootio-linux for various Ubuntu/De...

CVE-2026-23355

The CVE-2026-23355 issue affects the Linux kernel libata subsystem. It describes a defect where queued work for a deferred command (deferred_qc) is not canceled when cleared, allowing a WARN_ON() condition to fire later if ap->ops->qc_defer() returns non-zero. The root cause is that, althou...

CVE-2026-23299

CVE-2026-23299 relates to a Linux kernel Bluetooth issue where, when TX timestamping is enabled (SO_TIMESTAMPING), SKBs may be queued in the sk_error_queue during socket destruction and could leak if unread or if the controller is removed. The fixed mitigation is the addition of skb_queue_purge()...

CVE-2026-23305

The CVE-2026-23305 entry concerns a Linux kernel issue in accel/rocket where unwinding in rocket_probe’s error path was incorrect. If rocket_core_init() fails (e.g., due to EPROBE_DEFER), the kernel must unwind by decrementing the incremented counter and, if it’s the first core failed to probe, c...

CVE-2026-23453

CVE-2026-23453 affects the Linux kernel net:ti icssg-prueth XDP_DROP in non-zero-copy mode, causing a memory leak where pages aren’t returned to the page pool, potentially leading to OOM. The documented fix updates the caller path: when emac_run_xdp() returns ICSSG_XDP_CONSUMED for XDP_DROP, emac...