CVE-2026-97610

A vulnerability exists in the Linux kernel netfs component within the netfs_unbuffered_write() function. The issue stems from an uninitialized return value where the function may exit its loop before the ret variable is initialized if the first subrequest fails or during an empty-iterator check. ...

CVE-2026-97611

The Linux kernel contains a use-after-free vulnerability in the Open vSwitch component involving the flow table mask array. The issue exists in tbl_mask_array_realloc(), where call_rcu() is invoked to retire the old mask_array before it is no longer reachable. Because the pointer swap with rcu_as...

CVE-2026-97609

The Linux kernel contains a use-after-free (UAF) vulnerability within the netfilter: cttimeout component during module unload. The issue occurs because cttimeout_exit() unregisters per-net operations before clearing the hook, allowing a race condition where one CPU can free the pernet storage whi...

CVE-2026-97608

The Linux kernel contains a race condition in the netfilter subsystem, specifically within nf_log_syslog and nfnetlink_log . The vulnerability occurs because these backends unregister per-network namespace operations before unregistering their global logger backends. This creates a window where a...

CVE-2026-97607

The Linux kernel contains a vulnerability in the vdpa: ifcvf component where unsupported provisioned features were not handled consistently. The issue caused a failure to release the allocated device and adapter pointers consistently following the vdpa_alloc_device() call. The vulnerability has b...

CVE-2026-97605

The Linux kernel contains a vulnerability in the erofs filesystem involving the pool-resize path for LZMA decoders . The root cause is that the system frees old decoders before successfully allocating replacements; if an allocation fails mid-process, the failed stream is returned to the list with...

CVE-2026-97606

The Linux kernel contains a memory leak vulnerability in the autofs filesystem component within the autofs_fill_super() function. The issue occurs because the system creates a new inode using autofs_new_ino(), but fails to free this inode if the root_inode creation fails, resulting in an -ENOMEM ...

CVE-2026-97604

The Linux kernel contains a use-after-free vulnerability within the fbdev: vfb driver. The issue occurs because FBIOGETCMAP takes a shallow snapshot of info->cmap and performs a usercopy after dropping the info->lock . Simultaneously, vfb_remove() may free the colormap immediately after unr...

CVE-2026-97603

The Linux kernel contains a use-after-free vulnerability in the idpf driver. The issue occurs because the driver fails to drain Tx/Rx DIM works before freeing the q_vectors memory in idpf_vport_intr_rel(). Specifically, tx_dim and rx_dim are queued via net_dim() during NAPI polling, but nothing c...

CVE-2026-97602

The Linux kernel is vulnerable to a flaw where fqdir_pre_exit() flushes skbs from incomplete queues without updating their completion state. This allows a fragment to reuse stale reassembly metadata after a queue is cleared. In IPv6 , this can cause ip6_frag_reasm() to use an old nhoffset with a ...

CVE-2026-97600

The Linux kernel contains a use-after-free vulnerability in the ieee802154 driver within the cc2520 component. The issue arises because the FIFOP interrupt handler queues cc2520_fifop_irqwork , but the cc2520_remove() function only flushes the work instead of disabling it. Consequently, the devm-...

CVE-2026-97601

The Linux kernel contains a vulnerability in the ieee802154: 6lowpan component where a NULL pointer dereference can occur in the lowpan_newlink() function. This issue is triggered when an RTM_NEWLINK request allows a TUN device to change its link-layer type to ARPHRD_IEEE802154 via TUNSETLINK wit...

CVE-2026-97599

The Linux kernel contains a vulnerability in the ieee802154: hwsim component where a double-free condition can occur. The root cause is an unserialized read-swap-free of phy->pib within the hwsim_update_pib() function. Because the mac802154 scan worker can update channels without holding the R...

CVE-2026-97597

The Linux kernel contains a vulnerability in the ipv6 flowlabel mechanism where the ipv6_flowlabel_get() function fails to apply lease admission checks during the recheck path for compatible existing flowlabels. This allows repeated GET requests for a shareable label to grow a socket's lease list...

CVE-2026-97598

The Linux kernel contains a vulnerability in the ipv4: fib component where the fib_empty_table() function probes every table ID starting from 1 until a free one is found. In a dense set of IDs, this causes each probe to walk a growing hash chain while the RTNL is held. To mitigate this, the autom...

CVE-2026-97595

The Linux kernel contains a use-after-free vulnerability in the mac802154 component. The issue stems from the ieee802154_subif_frame() softirq producer queuing beacon and MAC-command frames onto lists without proper locking or reference counting. This allows sibling interfaces on the same PHY to ...

CVE-2026-97596

The Linux kernel contains a vulnerability in IPVS where sync receivers fail to reject invalid states in connection template sync records . While ordinary connections are validated, connection templates only log states outside the allowed range while still storing them. This allows TCP and SCTP to...

CVE-2026-97594

The Linux kernel contains a use-after-free vulnerability in the landlock LSM. The current_check_refer_path() function reads old_dentry->d_parent without holding a reference or lock, leading to a race condition during filename_linkat(). Because hook_path_link() does not lock the parent, a concu...

CVE-2026-97593

The Linux kernel contains a NULL pointer dereference vulnerability in the iommu/s390 component. When using a 5-level translation table via ZPCI_TABLE_TYPE_RFX , the function get_rto_from_iova() fails to verify if the region-second origin rso is non-NULL before accessing rso[rsx] . This occurs bec...

CVE-2026-97592

The Linux kernel contains a vulnerability in the s390/crypto component related to the AES CTR and GCM algorithms. Specifically, the ctr_aes_crypt() function failed to scrub a buffer used for processing remaining bytes smaller than AES_BLOCK_SIZE, potentially leading to the exposure of sensitive d...