CVE-2026-97978

The Linux kernel contains a vulnerability in the eth: ice driver where the ice_tx_dim_work event triggers a double dereference in TP_printk(). This occurs because the tracing subsystem attempted to access pointers (specifically the ring or dim instance) long after the event was recorded, resultin...

CVE-2026-97976

The Linux kernel contains a vulnerability in the btintel_pcie driver. The function btintel_pcie_submit_rx_work() fails to verify if packet_len read from rfh_hdr exceeds the RX buffer size, potentially leading to an out-of-bounds read in skb_put_data(). Remediation involves validating that packet_...

CVE-2026-97975

The Linux kernel contains a NULL pointer dereference vulnerability in the Bluetooth hci_sysfs component. A race condition exists between hci_conn_del_sysfs() and concurrent child device unregistration (such as a BNEP network device calling unregister_netdev()). During unregistration, device_del()...

CVE-2026-97974

The Linux kernel contains a null-pointer dereference vulnerability within the ipv6 networking stack, specifically in the __ip6_del_rt_siblings() function. The issue occurs because rt->fib6_node can be set to NULL by a concurrent thread (e.g., when replacing an ECMP route via RTM_NEWROUTE with ...

CVE-2026-97973

The Linux kernel contains a memory leak vulnerability in the macb driver. The macb_mii_init() function creates a phylink instance on success paths, but the probe unwind sequence frees the netdev without destroying the instance. This leads to a leak if macb_alloc_tieoff() or register_netdev() fail...

CVE-2026-97972

The Linux kernel contains a memory leak vulnerability in the net: macb driver. Specifically, the macb_mii_init() function fails to release the reference returned by of_get_child_by_name() upon a successful registration of the mdio child node, only dropping it on error paths. This causes a node re...

CVE-2026-97971

The Linux kernel is vulnerable to a race condition where legitimize_ns() takes a reference on a candidate namespace before may_list_ns() determines if the caller has permission to see it. This can lead to the __free(ns_put) cleanup dropping the last reference to a mount namespace while holding an...

CVE-2026-97970

The Linux kernel contains a vulnerability within the watchdog: msc313e component where the clk_get_rate() function could return 0, potentially leading to a division by zero panic . This issue has been resolved in the kernel to prevent system instability. No specific exploit information or exploit...

CVE-2026-97969

The Linux kernel contains a vulnerability in the msc313e watchdog driver. The function msc313e_wdt_settimeout() unconditionally calls msc313e_wdt_start(), leading to two issues: a clock reference count imbalance when the watchdog is already active (causing a clock leak) and the accidental startin...

CVE-2026-97967

The Linux kernel contains a vulnerability in the hwmon (corsair-cpro) driver. When hwmon_device_register_with_info() fails immediately after ccp_debugfs_init() registers files, the ccp_probe() function returns without removing those debugfs entries. Because the HID core then frees the ccp structu...

CVE-2026-97968

A vulnerability exists in the Linux kernel within the hwmon (corsair-cpro) driver. The ccp_debugfs_init() function incorrectly registers debugfs files before the hwmon_device_register_with_info() call. If registration fails, the HID core frees the allocated ccp data, but the debugfs entries remai...

CVE-2026-97966

The Linux kernel contains a vulnerability in the octeontx2-pf driver where HTB offload programs (NIX_AF_TLxX_TOPOLOGY) are set on QoS-allocated scheduler queues, but these queues are freed during teardown without clearing the TOPOLOGY settings. Consequently, PRIO_ANCHOR and RR_PRIO settings can p...

CVE-2026-97965

The Linux kernel contains a vulnerability in the vxlan component where a packet transmitted through a device configured with VXLAN_F_COLLECT_METADATA and VXLAN_F_GBP can cause information leakage. If the external ip_tunnel_info lacks the IP_TUNNEL_VXLAN_OPT_BIT flag, the md pointer remains pointi...

CVE-2026-97964

The Linux kernel contains a vulnerability in the ppp_synctty component where the ppp_sync_txmunge() function fails to ensure the skb header is writable before prepending address and control bytes. This issue occurs because received skbs can reach this function through PPP channel bridging without...

CVE-2026-97962

The Linux kernel contains a vulnerability in the net/mlx5e driver where the representor vnic devlink health reporter is created and destroyed along a path not serialized by the devlink instance lock. This lack of serialization triggers a devl_assert_locked() splat during driver unbind. The issue ...

CVE-2026-97963

The Linux kernel contains a vulnerability in the stmmac driver where the ptp_lock (an rwlock) is only initialized during __stmmac_open(). Because the lock is accessed by stmmac_get_time() during tc_taprio_configure() even when the interface is down and never opened, using the uninitialized lock r...

CVE-2026-97961

The Linux kernel contains a vulnerability in the perf/core subsystem where a list corruption can occur. The issue arises because the function perf_sched_cb_dec() may attempt to remove an entry from the sched_cb_list while that list node is still in use by perf_pmu_sched_task(). This specific path...

CVE-2026-97959

The Linux kernel contains a memory leak vulnerability in the net/sched: cls_route component. When an existing filter is moved to a different top-level bucket via route4_change, the filter is unlinked from the old bucket, but the bucket is never freed. This results in stale empty buckets remaining...

CVE-2026-97960

The Linux kernel is vulnerable to a reentry issue in the perf/x86/intel component. The PEBS buffer is shared by all events on a CPU, meaning drain_pebs() must not be reentered; otherwise, an instance might observe a stale buffer state and potentially access out-of-bound memory . While most calls ...

CVE-2026-97957

The Linux kernel contains a heap buffer overflow vulnerability within the hinic driver. The issue originates in the check_mbox_seq_id_and_seg_len() function, which fails to account for the remaining buffer space when processing the last segment. Specifically, it allows a segment with seq_id=42 to...