CVE-2026-31736

CVE-2026-31736 affects the Linux kernel MTK PPE Ethernet driver. When the gmac0 interface is disabled, a precheck for a valid ingress device can dereference a NULL pointer (eth->netdev[0] is NULL) and crash the system. The underlying issue is that the code was only checking the first net_devic...

CVE-2026-43165

CVE-2026-43165 corresponds to a Linux kernel hwmon issue in the nct7363 driver where of_parse_phandle_with_args() references were not released with of_node_put(), causing a resource leak in nct7363_present_pwm_fanin. The connected OSV entries indicate patches in rootio-linux for various Ubuntu/De...

CVE-2026-98059

The Linux kernel contains a vulnerability in the BPF subsystem where the sched_process_wait argument was not marked as nullable . This allowed the verifier to accept an unchecked dereference because kernel_wait4() could leave wo_pid as NULL for certain wait4(-1) or waitid(P_ALL) calls. An attacke...

CVE-2026-98153

A race condition exists in the Linux kernel 's NVMe driver within the nvme_query_fdp_info() function. The vulnerability occurs because the function is called per-path and populates the head->nr_plids and head->plids fields for Flexible Data Placement (FDP) registration without proper synchr...

CVE-2026-23355

The CVE-2026-23355 issue affects the Linux kernel libata subsystem. It describes a defect where queued work for a deferred command (deferred_qc) is not canceled when cleared, allowing a WARN_ON() condition to fire later if ap->ops->qc_defer() returns non-zero. The root cause is that, althou...

CVE-2026-43092

The CVE-2026-43092 issue affects the Linux kernel AF_XDP subsystem: bind now validates MTU against the usable frame space provided by UMEM chunks. Previously, zero-copy pool configurations could be accepted without confirming that the device MTU fits into the usable frame space, considering tailr...

CVE-2026-43470

CVE-2026-43470 affects the Linux kernel NFS implementation. When an alias found via nfs3_do_create/nfs_add_or_obtain /d_splice_alias corresponds to a directory, the code could forget the alias while keeping the original negative dentry, causing an oops in nfs_atomic_open_v23/finish_open. The issu...

CVE-2026-98121

The Linux kernel is vulnerable to a NULL pointer dereference within the msc313e watchdog driver. The root cause is that msc313e_wdt_probe() fails to set the driver data for the platform device, causing dev_get_drvdata() to return NULL during msc313e_wdt_suspend() and msc313e_wdt_resume() operatio...

CVE-2026-98135

A flaw in the Linux kernel NTFS file system driver allows a local user capable of mounting storage volumes to cause a Denial of Service (DoS) and crash the operating system. The vulnerability stems from a lack of input validation in the is_boot_sector_ntfs() function regarding the sectors_per_clu...

CVE-2026-98147

A flaw in the Linux kernel printk subsystem allows a local user to trigger a Denial of Service (DoS) by causing an unexpected system crash. This occurs because the kernel inappropriately triggers a warning check when background print thread creation fails due to an interruption signal (SIGKILL). ...

CVE-2025-71296

CVE-2025-71296 relates to the Linux kernel DRM SHMEM path. The issue arises when the reservation lock around the purge operation in drm_gem_shmem_purge_locked() is not properly held, potentially triggering kernel warnings. The fix/published guidance exports a new helper, drm_gem_shmem_purge(), sp...

CVE-2026-31544

The CVE-2026-31544 issue affects the Linux kernel firmware component arm_scmi, where the helper __scmi_event_handler_get_ops could yield a NULL instead of an ERR_PTR when an event handler is missing or not created. This caused a NULL dereference in the notify error path, potentially leading to a ...

CVE-2026-98058

The Linux kernel is vulnerable to a flaw where the bpf_sys_bpf() and bpf_sys_close() helpers were not correctly marked as sleepable via .might_sleep on their prototypes. This missing check allowed these helpers to be invoked from hrtimer softirq contexts by bpf_timer callbacks, potentially trigge...

CVE-2026-98093

The Linux kernel is affected by a vulnerability in the ASoC: fsl_micfil driver regarding the balance mclk enable/disable functionality. The root cause is that hw_params() enables mclk unconditionally while hw_free() disables it unconditionally. Because the PCM core does not guarantee 1:1 pairing,...

CVE-2026-98118

The Linux kernel 's netfs (network filesystem) subsystem contains a race condition vulnerability in its readahead operations. The flaw arises from improper synchronization between the application thread, which adds folios to a rolling buffer, and the collector thread, which processes or clears th...

CVE-2026-98133

A flaw exists in the Linux kernel 's NTFS file system implementation within the ntfs_set_ea() function. The vulnerability occurs because the exit path unconditionally updates the HasEA flag based on ea_info_qsize. If an error happens before ea_info_qsize is updated, the NInoClearHasEA() function ...

CVE-2026-98148

A flaw exists in the Linux kernel 's Generic USB Display (GUD) driver where it fails to verify that the GUD_ROTATION_0 bit is present in a device's reported rotation bitmask before registering display properties. This can trigger a WARN_ON assertion in drm_plane_create_rotation_property() if a ma...

CVE-2026-98094

The Linux kernel contains a vulnerability in the staging: fbtft component where fbtft_mkdirty() can be reached from the fbcon rendering path during a hardirq context. This causes a potential IRQ lock inversion involving dirty_lock and console_owner because dirty_lock is also held by fbtft_deferre...

CVE-2026-98110

A vulnerability exists in the Linux kernel 's Bluetooth subsystem, specifically within the btintel driver. The issue stems from the firmware ID being treated as a NUL-terminated string even though its boundary is defined by the TLV length . If the received value lacks a NUL terminator, the snprin...

CVE-2026-98113

The Linux kernel is vulnerable in the ksmbd component due to a lack of rate limiting on unmapped SID errors. An authenticated client can provide multiple structurally valid but unmapped SIDs in a DACL, triggering the kernel to generate hundreds of error messages per request. This can lead to a de...

CVE-2026-98138

A flaw exists in the Linux kernel's NTFS file system driver where the ntfs_sync_fs() function unconditionally clears the volume's dirty state flag , even if errors were previously recorded. In contrast, other paths like ntfs_put_super() only clear this bit when no volume errors are present. A loc...

CVE-2026-98143

The Linux kernel contains a vulnerability in the accel: ethosu driver where the command stream parser incorrectly interprets the rounding mode on U65 hardware as a storage mode . Specifically, bits 15:14 of NPU_SET_{IFM,OFM}_PRECISION are intended for rounding on U65 but were being read as storag...

CVE-2026-23453

CVE-2026-23453 affects the Linux kernel net:ti icssg-prueth XDP_DROP in non-zero-copy mode, causing a memory leak where pages aren’t returned to the page pool, potentially leading to OOM. The documented fix updates the caller path: when emac_run_xdp() returns ICSSG_XDP_CONSUMED for XDP_DROP, emac...

CVE-2026-98051

The Linux kernel contains a vulnerability in the net: bcmasp component within the tx_spb_ring_full() function. The root cause is that the next_index variable was being initialized from intf->tx_spb_index during every iteration of a loop, causing incr_ring() to produce the same result and only ...

CVE-2026-98117

A flaw exists in the Linux kernel's cachefiles subsystem involving the trace_cachefiles_coherency() function. The system incorrectly reads fixed-size data from a buffer that may be empty or shorter than the expected 8 bytes, leading to a potential Use-After-Free (UAF) or KASAN warning. A local us...

CVE-2026-98120

A flaw exists in the Linux kernel 's netfs (network filesystem) subsystem. A local user can trigger a Denial of Service (DoS) by initiating specific unbuffered write operations on an affected filesystem. The root cause is a reference leak in netfs_unbuffered_write() that occurs when a write subre...

CVE-2026-98129

The Linux kernel is vulnerable to a NULL pointer dereference within the mpi3mr_sas_port_add() function of the scsi: mpi3mr driver. The issue arises because sas_port_alloc_num() can return NULL during memory allocation failure, and this value is passed directly to sas_port_add() without a precedin...

CVE-2026-98139

A vulnerability exists in the Linux kernel's NTFS (New Technology File System) driver where the ntfs_cluster_free_from_rl_nolock() function incorrectly increments the nr_freed counter even when ntfs_bitmap_clear_run() fails. Specifically, the function inflates vol->free_clusters when the error...

CVE-2026-98144

A flaw in the Linux kernel 's AMD XDNA accelerator driver allows a local user to cause a denial of service (DoS) by triggering a resource leak during command error handling. Specifically, the amdxdna_cmd_set_error() function takes a reference to the first Buffer Object (BO) of a command chain but...

CVE-2026-98146

A flaw in the Linux kernel's AMD XDNA driver allows a local attacker to trigger a Denial of Service (DoS) . The vulnerability exists because the amdxdna_cmd_chain structure contains a flexible array annotated with __counted_by(command_count). Since this structure is stored in shared AMDXDNA_BO_SH...

CVE-2026-98140

A flaw in the Linux kernel's NTFS file system allows a local user to trigger a memory leak during Master File Table (MFT) write operations. Specifically, the write_mft_record_nolock() function fails to unmap the MFT record folio on pre_write_mst_fixup() and bio_add_folio() failure paths. Because ...