CVE-2026-97585

The Linux kernel contained a vulnerability in the afs component where a double-kunmap could occur. The root cause is located in afs_edit_dir_remove() , where manually kunmapping blocks without clearing iter.blocks leads to issues if afs_dir_find_block() is called twice consecutively (specifically...

CVE-2026-97582

The Linux kernel contains a use-after-free vulnerability within the hwmon: (gpio-fan) component. The issue stems from fan_alarm_irq_handler() queuing fan_data->alarm_work without a corresponding cancellation mechanism, while fan_alarm_notify() dereferences fan_data and the hwmon device. During...

CVE-2026-97583

The Linux kernel contains a slab-use-after-free vulnerability in the AFS (Andrew File System) component. The issue arises because afs_fs_probe_fileserver() fetches the current endpoint state but leaves old_alist as NULL . Consequently, afs_set_peer_appdata() fails to unbind peers removed from the...

CVE-2026-97581

The Linux kernel contains a vulnerability in the verisilicon hantro media driver. The prepare_tile_info_buffer() function fails to properly bound loops when writing entries into the tile_sizes DMA buffer , which is sized based on the PPS uAPI array capacity . This lack of bounds checking can lead...

CVE-2026-97579

The Linux kernel contains a vulnerability in the mediatek vcodec component. Specifically, the function vdec_av1_slice_setup_tile() fails to validate that the number of entries copied from the bitstream tile_info (calculated as tile_cols + 1 and tile_rows + 1) does not exceed the capacity of the m...

CVE-2026-97580

The Linux kernel contains a vulnerability in the rkvdec media driver where HEVC tile loops and PPS IDs were not properly bound to the array capacity. Specifically, the functions compute_tiles_uniform() and compute_tiles_non_uniform() looped over entries based on untrusted PPS data, and assemble_h...

CVE-2026-97578

The Linux kernel contains a vulnerability in the Verisilicon Rockchip VPU981 AV1 decoder. The function rockchip_vpu981_av1_dec_set_tile_info() improperly handles cases where tile_cols (derived from the bitstream) is zero, leading to a division by zero error. Additionally, the function fails to pr...

CVE-2026-97576

The Linux kernel contains a vulnerability in the v4l2-ctrls component where stateless HEVC decoders fail to bound u8 counts for num_tile_columns_minus1 and num_tile_rows_minus1 . Specifically, the std_validate_compound() function does not validate these counts, allowing them to be used as tile-lo...

CVE-2026-97577

The Linux kernel contains a vulnerability in the rockchip AV1 decoder driver. Specifically, the function rockchip_vpu981_av1_dec_set_tile_info() fails to properly validate the number of tiles in an AV1 frame against the submitted entry count and the maximum capacity of the AV1_MAX_TILES buffer. T...

CVE-2026-97574

The Linux kernel contains a vulnerability in the bnxt_en driver where the bnxt_queue_mem_alloc() function performs a shallow copy of the live RX ring into a clone. Because the rx_tpa and rx_tpa_idx_map pointers are not cleared during this copy, they continue to point to the memory of the live rin...

CVE-2026-97575

The Linux kernel contains a vulnerability in the v4l2-ctrls component where stateless AV1 decoders fail to properly bound the tile_info.tile_cols and tile_info.tile_rows fields within std_validate_compound(). These fields are used as loop bounds, array indices for mi_*_starts[] and *_in_sbs_minus...

CVE-2026-97573

The Linux kernel contains a vulnerability in the bnxt_en driver. The function bnxt_rx_ring_reset() fails to properly handle memory allocation errors when reallocating ring buffers. Specifically, bnxt_alloc_one_rx_ring() can return -ENOMEM during bnxt_alloc_one_tpa_info_data(), leaving the rxr-&gt...

CVE-2026-97572

The Linux kernel contains a vulnerability in the bnxt_en driver where bnxt_init_nic() fails to propagate errors from bnxt_init_rx_rings(). Specifically, if bnxt_alloc_one_rx_ring() fails, the return value is ignored, allowing bnxt_init_chip() to enable TPA (TCP Segmentation Offload) on a partiall...

CVE-2026-97571

The Linux kernel contains a vulnerability in the bnxt_en driver within the bnxt_queue_mem_alloc() function. The issue stems from bnxt_alloc_one_tpa_info_data() returning -ENOMEM upon a single allocation failure while leaving remaining rxr->rx_tpa[] entries zeroed. Because bnxt_queue_mem_alloc(...

CVE-2026-97570

The Linux kernel contains a vulnerability in the bnxt_en driver where 57608 NICs with firmware version 233 can experience a crash at boot . The issue arises because the bnxt_alloc_agg_idx function can produce a software ID exceeding the 32 entries allocated for rx_tpa, leading to an out-of-bounds...

CVE-2026-97568

The Linux kernel contains a vulnerability within the mptcp component related to syncookies. The root cause is the use of an uninitialised bit when copying information in the subflow_ulp_clone() function. To resolve this, the backup flag from struct mptcp_subflow_request_sock is now correctly hand...

CVE-2026-97569

The Linux kernel contains a vulnerability in the bnxt_en driver where a burst of packets can cause the queue to stop permanently. This occurs because the driver may defer completions for all packets in a small ring (

CVE-2026-97566

The Linux kernel contains a vulnerability in the in-kernel MPTCP path manager where removing the id 0 endpoint fails to tear down pending announcements. This asymmetry between the id 0 path and non-zero id paths leaves a stale ADD_ADDR announcement entry alive. When the path manager later reselec...

CVE-2026-97567

The Linux kernel contains a vulnerability where a race condition can occur between the disconnect() and rtx events within the mptcp component. This race condition can lead to an inconsistent status . The issue is resolved by implementing a synchronous timer stop operation to prevent the concurren...

CVE-2026-97565

The Linux kernel contains a vulnerability in the CIFSSMBRead() function where it fails to verify that a complete READ_RSP has been received from a server. Specifically, the code dereferences DataLengthHigh , DataLength , and DataOffset without ensuring the response length is at least read_rsp_siz...