CVE-2026-97448

The Linux kernel contains a vulnerability within the ACPICA component related to the acpi_ns_build_normalized_path() function. The root cause is a lack of validation for nodes, which can lead to use-after-free vulnerabilities. Remediation involves the addition of validation for nodes in the affec...

CVE-2026-97447

The Linux kernel contains a vulnerability in the ACPICA component within the acpi_ex_load_table_op() function. The root cause is insufficient OEM ID and Table ID validation , which could lead to buffer overflows . Remediation is provided through kernel updates as indicated by the referenced commi...

CVE-2026-97446

The Linux kernel contains a NULL pointer dereference vulnerability within the ACPICA component in the acpi_ns_custom_package() function. The flaw occurs because the function unconditionally dereferences the first element of a package to read the _BIX version number without verifying if the refere...

CVE-2026-97445

The Linux kernel is affected by a vulnerability in the ACPICA component. Specifically, the function acpi_ut_walk_aml_resources() requires enhanced buffer validation to prevent potential buffer overflows . This issue has been resolved in the kernel; however, the provided documents do not specify t...

CVE-2026-97444

The Linux kernel contains a vulnerability within the ACPICA component due to missing boundary checks in the acpi_ps_get_next_namestring() and acpi_ps_peek_opcode() functions. This flaw can lead to out-of-bounds access . The vulnerability has been resolved by adding necessary boundary checks in bo...

CVE-2026-97443

The Linux kernel contains a vulnerability in the perf/ftrace component where perf_ftrace_function_unregister() unconditionally calls unregister_ftrace_function() without verifying if the ftrace_ops was successfully registered. This missing check triggers a WARN_ON in __unregister_ftrace_function(...

CVE-2026-97442

The Linux kernel contains a vulnerability in the ath11k wireless driver. Specifically, the ath11k_dp_rx_h_undecap_nwifi() function fails to properly handle packets provided by hardware that exceed the maximum native Wi-Fi header length. This flaw occurs during the DP_RX_DECAP_TYPE_NATIVE_WIFI dec...

CVE-2026-97441

The Linux kernel contains a vulnerability in the ahci driver where a disabled AHCI controller might report a bogus value in its HOST_CAP register. If the CAP.NP (Number of Ports) field claims more ports than the mapped BAR region can physically accommodate, accessing port registers beyond the bou...

CVE-2026-97440

The Linux kernel contains a vulnerability in the qrtr component where the qrtr_send_resume_tx() function fails to properly release a node reference. Specifically, if qrtr_node_lookup() succeeds but the subsequent qrtr_alloc_ctrl_packet() call fails due to a memory allocation error, the function r...

CVE-2026-97439

The Linux kernel 's ntfs3 file system driver is vulnerable to a NULL function pointer dereference when handling a corrupted ntfs3 image. The issue occurs in generic_perform_write() after toggling system.ntfs_attrib and subsequently overwriting system.dos_attrib on the same file. The root cause is...

CVE-2026-97438

The Linux kernel 's ntfs3 filesystem driver is vulnerable to a slab-out-of-bounds read. The root cause is that index-header validators only checked high-level geometry and failed to verify that individual NTFS_DE entries were properly aligned or that their key_size fit within the payload. A malfo...

CVE-2026-97437

The Linux kernel 's ntfs3 driver is vulnerable to an out-of-bounds read in the ntfs_dir_emit() and hdr_find_e() functions. The root cause is an insufficient bounds check in ntfs_dir_emit() that fails to account for the UTF-16LE encoding (2 bytes per character) and the ATTR_FILE_NAME header size. ...

CVE-2026-97436

In the Linux kernel , the dpaa2-switch component contains a logic flaw in how FDB management is handled on the bridge leave path. When a port leaves a bridge, the dpaa2_switch_port_set_fdb() function incorrectly allocates new FDBs without properly marking old ones as unused. This is particularly ...

CVE-2026-97435

The Linux kernel contains a vulnerability in the net: dsa: sja1105: flower driver where the dsa_port_from_netdev() function may return a valid port index from a different switch chip. This allows an attacker or process to program another chip's port index into the local hardware, leading to redir...

CVE-2026-97434

The Linux kernel contains a vulnerability in the dpaa2-switch driver. The issue stems from how NAPI instances are handled during the .remove() path for a DPSW device. Because NAPI instances are shared across all ports but only disabled once the last port goes down, unregistering and freeing ports...

CVE-2026-97433

The Linux kernel contains a vulnerability in the nvme driver related to the handling of FDP configuration descriptors. A lack of size validation while walking the FDP configurations log could allow a descriptor with dsze == 0 or a descriptor located past the log end to cause unbounded iteration o...

CVE-2026-97432

The Linux kernel contains a vulnerability in the wifi: iwlwifi: mvm driver related to P2P-Device binding handling . A station interface and a P2P-Device can encounter a scenario where a P2P-Device is removed from a binding but its phy_ctxt pointer remains as a cache. Subsequent binding updates by...

CVE-2026-97431

The Linux kernel contains a vulnerability in the drm/amd/display component. The issue arises because calling dc_update_planes_and_stream separately for a stream and its phantom stream leads to a NULL pointer dereference , as the phantom is destroyed during the first call. The fix involves skippin...

CVE-2026-97430

The Linux kernel contains a vulnerability where commands could be queued on the command ring even if the xhci controller was marked as inaccessible. The fix ensures the kernel refuses to queue new commands if the HCD_FLAG_HW_ACCESSIBLE flag is not set. Additionally, the kernel now prints a warnin...

CVE-2026-97429

A Use-After-Free (UAF) race condition exists in the Linux kernel within the drm/amdkfd component, specifically in the destroy_queue_cpsch function. The vulnerability is caused by wait_on_destroy_queue() dropping locks while waiting for a queue resume, which allows a concurrent destroy operation t...