CVE-2026-97438

The Linux kernel 's ntfs3 filesystem driver is vulnerable to a slab-out-of-bounds read. The root cause is that index-header validators only checked high-level geometry and failed to verify that individual NTFS_DE entries were properly aligned or that their key_size fit within the payload. A malfo...

CVE-2026-97437

The Linux kernel 's ntfs3 driver is vulnerable to an out-of-bounds read in the ntfs_dir_emit() and hdr_find_e() functions. The root cause is an insufficient bounds check in ntfs_dir_emit() that fails to account for the UTF-16LE encoding (2 bytes per character) and the ATTR_FILE_NAME header size. ...

CVE-2026-97436

In the Linux kernel , the dpaa2-switch component contains a logic flaw in how FDB management is handled on the bridge leave path. When a port leaves a bridge, the dpaa2_switch_port_set_fdb() function incorrectly allocates new FDBs without properly marking old ones as unused. This is particularly ...

CVE-2026-97435

The Linux kernel contains a vulnerability in the net: dsa: sja1105: flower driver where the dsa_port_from_netdev() function may return a valid port index from a different switch chip. This allows an attacker or process to program another chip's port index into the local hardware, leading to redir...

CVE-2026-97434

The Linux kernel contains a vulnerability in the dpaa2-switch driver. The issue stems from how NAPI instances are handled during the .remove() path for a DPSW device. Because NAPI instances are shared across all ports but only disabled once the last port goes down, unregistering and freeing ports...

CVE-2026-97433

The Linux kernel contains a vulnerability in the nvme driver related to the handling of FDP configuration descriptors. A lack of size validation while walking the FDP configurations log could allow a descriptor with dsze == 0 or a descriptor located past the log end to cause unbounded iteration o...

CVE-2026-97432

The Linux kernel contains a vulnerability in the wifi: iwlwifi: mvm driver related to P2P-Device binding handling . A station interface and a P2P-Device can encounter a scenario where a P2P-Device is removed from a binding but its phy_ctxt pointer remains as a cache. Subsequent binding updates by...

CVE-2026-97431

The Linux kernel contains a vulnerability in the drm/amd/display component. The issue arises because calling dc_update_planes_and_stream separately for a stream and its phantom stream leads to a NULL pointer dereference , as the phantom is destroyed during the first call. The fix involves skippin...

CVE-2026-97430

The Linux kernel contains a vulnerability where commands could be queued on the command ring even if the xhci controller was marked as inaccessible. The fix ensures the kernel refuses to queue new commands if the HCD_FLAG_HW_ACCESSIBLE flag is not set. Additionally, the kernel now prints a warnin...

CVE-2026-97429

A Use-After-Free (UAF) race condition exists in the Linux kernel within the drm/amdkfd component, specifically in the destroy_queue_cpsch function. The vulnerability is caused by wait_on_destroy_queue() dropping locks while waiting for a queue resume, which allows a concurrent destroy operation t...

CVE-2026-97428

The Linux kernel contains a vulnerability within the drm/amdgpu component related to FRU PIA parsing . The root cause is an open-coded TLV walk that fails to properly bound reads against the actual EEPROM data length , potentially leading to out-of-bounds reads when processing truncated or malfor...

CVE-2026-97427

The Linux kernel contains a heap overflow vulnerability within the drm/amd/pm component. The issue originates from the pp_dpm_set_pp_table() function, where memcpy uses a sysfs store count (up to PAGE_SIZE) without an upper bound check against the pre-allocated soft_pp_table_size. This allows for...

CVE-2026-97426

The Linux kernel contains a vulnerability in the drm/amdgpu/pm component related to the SmartShift bias sysfs store . The root cause is that the system returns a parse error before acquiring the PM refcount , which can lead to issues during error handling. A fix has been implemented to ensure the...

CVE-2026-97425

A buffer overflow vulnerability exists in the Linux kernel within the drm/amdgpu component during a vBIOS update . The root cause is an improper handling of buffer positions, which could allow out-of-bounds access. The issue is resolved by clamping the buffer position to the maximum buffer size u...

CVE-2026-97424

The Linux kernel contains a vulnerability in the drm/amdgpu/ras component related to the cp_ecc_error_irq interrupt. Specifically, the interrupt was acquired in amdgpu_gfx_ras_late_init() but released in gfx_v9_0_hw_fini(), creating a mismatch because the acquisition was skipped on SR-IOV VF . To...

CVE-2026-97423

The Linux kernel contains a vulnerability in the cxl/region component where the construct_region() function fails to validate the cxled->part value before using it as an index for the cxlds->part[] array. If a partition is never resolved, the value remains at -1 , leading to an out-of-bound...

CVE-2026-97422

A vulnerability in the Linux kernel 's drm/amdkfd component allows a cross-process information leak regarding SMI events. The issue arises because the kfd_smi_ev_enabled() function skips user privilege checks when pid=0. Consequently, PROCESS_START , PROCESS_END , and VMFAULT events are emitted w...

CVE-2026-97421

The Linux kernel contains a vulnerability in the RDMA/umem subsystem related to boundary conditions in the ib_umem_find_best_pgsz() function. The issue specifically affects 32-bit systems due to several corner cases: the umem->iova is a u64 and requires a u64 argument to prevent truncation, a ...

CVE-2026-97420

The Linux kernel contains a vulnerability in the BPF subsystem where the function bpf_sysctl_set_new_value() fails to append a NUL terminator when replacing a pending sysctl value. This oversight occurs because the helper only copies buf_len bytes, potentially leading to out-of-bounds access in d...

CVE-2026-97419

The Linux kernel contains a vulnerability in the HSR (High-availability Seamless Redundancy) generic netlink family. Because the .netnsok flag is set to true, devices can reside in various network namespaces; however, two async notifiers—hsr_nl_ringerror() and hsr_nl_nodedown()—incorrectly use ge...