CVE-2026-97952

A vulnerability exists in the Linux kernel 's sunvdc driver where a failure during __vdc_tx_trigger() causes the driver to fail to unmap LDC cookies . Because the descriptor remains in a READY state and the prod pointer is not advanced, the mapping is never released, leading to a permanent leak o...

CVE-2026-97953

A vulnerability exists in the Linux kernel 's stmmac driver related to the TX descriptor availability check for TSO traffic . The stmmac_tso_xmit() function incorrectly estimates the required free TX descriptors by assuming the payload is split into TSO_MAX_BUFF_SIZE chunks. This logic underestim...

CVE-2026-97951

The Linux kernel contains a vulnerability in the iSCSI target component where certain aborted WRITE_PENDING commands cause a hang. When a LUN_RESET aborts a WRITE command in the TRANSPORT_WRITE_PENDING state, the target core sets the CMD_T_ABORTED flag and waits for the frontend. If the initiator...

CVE-2026-97950

The Linux kernel contains a vulnerability in configfs where create_link() incorrectly relies on an item reference that pins the item but not its dentry. A race condition between a symlink creation and an rmdir of its target can cause configfs_remove_dir() to release the dentry via simple_rmdir() ...

CVE-2026-97949

The Linux kernel contains a vulnerability in configfs where configfs_rmdir() fails to unhash a dentry before dropping the item. This creates a race condition because configfs_get_config_item() relies on the hashed state as proof of a live item, but simple_rmdir() only unhashes the dentry via d_de...

CVE-2026-97947

The Linux kernel contains a vulnerability in the x86/amd_node component where amd_smn_read() and amd_smn_write() functions could trigger a NULL pointer dereference . This occurs because these functions are exported around __amd_smn_rw(), making them accessible even if amd_smn_init() fails. In suc...

CVE-2026-97948

The Linux kernel contains a vulnerability in the powerpc/eeh driver where a recursive locking issue can cause the eehd to hang. The root cause is that the pci_rescan_remove_lock is held during eeh_handle_normal_event() and eeh_reset_device(), but the code path in eeh_rmv_device() failed to remove...

CVE-2026-97946

The Linux kernel contains a flaw in the x86/amd_node architecture involving incorrect PCI device reference counting within the amd_smn_init() function. The issue stems from a local "root" pointer used as a temporary variable during device searching, where refcounts related to search iterators wer...

CVE-2026-97944

The Linux kernel contains a flaw in the x86/cfi implementation where the cfi_get_func_hash() function uses an incorrect hard-coded offset for the FineIBT hash. This mismatch occurred because the hash immediate moved from offset 7 to offset 5 during a preamble optimization. Consequently, the BPF J...

CVE-2026-97945

The Linux kernel contains a vulnerability in x86 memory management where PMD-mapped Huge Transparent Pages (THP) can experience data loss. The root cause is that pmd_modify() incorrectly masks out the hardware dirty bit (_PAGE_DIRTY). This causes the kernel to lose the dirty state of a page when ...

CVE-2026-97943

The Linux kernel contains a vulnerability in the x86 architecture's Change Page Attributes (CPA) mechanism. Specifically, the cpa_collapse_large_pages() function can collapse kernel page table entries into huge page table entries and free the old page tables without holding necessary locks. This ...

CVE-2026-97942

The Linux kernel contains a vulnerability in the x86 alternatives patching code where a race condition between text poking and change_page_attr (CPA) can occur. If vmalloc_to_page() fails due to this race, it can result in the collapsing of page tables or the breaking of PMD hugepages . This issu...

CVE-2026-97941

A race condition exists in the Linux kernel memory management system within mm/slab. The __slab_try_return_freelist() function incorrectly assumed that no objects were freed to a slab if slab->freelist was NULL and cmpxchg succeeded. This oversight leads to a classic ABA problem where a slab c...

CVE-2026-97939

The Linux kernel is affected by a vulnerability where a netadmin in a user+net namespace could create numerous IPv4 and IPv6 multicast routing tables using MRT_TABLE and MRT6_TABLE. Because these mr_table objects were not charged to memcg , the host's unreclaimable slab would grow proportionally ...

CVE-2026-97940

The Linux kernel is affected by a Use-After-Free (UAF) vulnerability in the ipv6 component. The issue arises because ipv6_route_iter_active() incorrectly treats a walker in FWS_U at the table root as already unlinked. This allows fib6_del_route() to move a still-linked walker into that state when...

CVE-2026-97938

The Linux kernel contains a use-after-free race condition involving the cad_pid struct pid pointer. The issue occurs because proc_do_cad_pid() reads the pointer and passes it to pid_vnr() without protecting its lifetime; a concurrent writer can replace the pointer and drop the reference before th...

CVE-2026-97937

The Linux kernel contains a vulnerability in ftrace where the child function graph state is not initialized early enough during a fork operation. Specifically, dup_task_struct() copies the parent's task_struct including the ret_stack. Because ftrace_graph_init_task() currently runs after copy_exe...

CVE-2026-97936

The Linux kernel contains a memory corruption vulnerability in the tracing subsystem. The event_hist_trigger() function performs an unbounded memcpy when handling the histogram stacktrace modifier, using a count directly from the event data. This allows for an out-of-bounds write that can overwri...

CVE-2026-97935

The Linux kernel contains a slab-use-after-free vulnerability in the tracing subsystem. The issue occurs because hist_register_trigger() adds a histogram trigger to the global named_triggers list before validating the trace clock. If the clock string is unknown, tracing_set_clock() fails, causing...

CVE-2026-97934

The Linux kernel is vulnerable to memory corruption within the tracing subsystem. The issue arises because generic fields like "STACKTRACE" are mapped to placeholders instead of NULL by parse_field() . Consequently, create_hist_field() interprets data from the common_type field as an offset, lead...