CVE-2026-97937

The Linux kernel contains a vulnerability in ftrace where the child function graph state is not initialized early enough during a fork operation. Specifically, dup_task_struct() copies the parent's task_struct including the ret_stack. Because ftrace_graph_init_task() currently runs after copy_exe...

CVE-2026-97936

The Linux kernel contains a memory corruption vulnerability in the tracing subsystem. The event_hist_trigger() function performs an unbounded memcpy when handling the histogram stacktrace modifier, using a count directly from the event data. This allows for an out-of-bounds write that can overwri...

CVE-2026-97934

The Linux kernel is vulnerable to memory corruption within the tracing subsystem. The issue arises because generic fields like "STACKTRACE" are mapped to placeholders instead of NULL by parse_field() . Consequently, create_hist_field() interprets data from the common_type field as an offset, lead...

CVE-2026-97935

The Linux kernel contains a slab-use-after-free vulnerability in the tracing subsystem. The issue occurs because hist_register_trigger() adds a histogram trigger to the global named_triggers list before validating the trace clock. If the clock string is unknown, tracing_set_clock() fails, causing...

CVE-2026-97933

The Linux kernel is vulnerable to a use-after-free race condition within the tracing subsystem. When a tracer option file is opened, the system uses a descriptor pointing to an element on the trace_array's topts array to increment the trace_array's reference counter. However, a race condition exi...

CVE-2026-97931

The Linux kernel contains a vulnerability in the ALSA subsystem where the hwdep mmap callback fails to clear the VM_MAYWRITE flag on read-buffer mappings created with PROT_READ . This allows a process capable of opening the hwdep node with O_RDWR to use mprotect() to escalate permissions and make...

CVE-2026-97932

A vulnerability exists in the Linux kernel tracing subsystem where the enable_event trigger defers trace_event_put_ref() to the trigger free kthread. However, the trace_event_file can be freed prematurely when the instance is removed, leading to a use-after-free condition. The fix involves keepin...

CVE-2026-97929

The Linux kernel contains a vulnerability in the ALSA: usbusx2y driver within the i_usx2y_in04_int() function. The driver fails to validate urb->actual_length , allowing a malfunctioning device to trigger a short transfer. This causes the handler to process uninitialized heap data from the kma...

CVE-2026-97930

The Linux kernel contains a vulnerability in the ALSA: usbusx2y component due to an array size mismatch between in04_last and in04_buf. Specifically, in04_last is declared as 24 bytes, while in04_buf is allocated as 21 bytes. This causes a buffer over-read in the i_usx2y_in04_int() function durin...

CVE-2026-97928

The Linux kernel contains a vulnerability in the drm/amdgpu driver where the amdgpu_ttm_map_buffer() function incorrectly forces a VMID 0 flush when performing a clear-on-release on VRAM . Because VRAM is accessed via a direct memory controller (MC) address without a programmed GART window , this...

CVE-2026-97927

The Linux kernel contains a vulnerability in the ufs filesystem where ufs_fill_super() installs the root dentry before successfully loading cylinder group structures for writable mounts. If ufs_read_cylinder_structures() fails, the error path frees the in-core superblock information and sets sb-&...

CVE-2026-97926

The Linux kernel contains a vulnerability in the ufs filesystem where ufs_read_cylinder() copies cylinder group index and rotor positions from on-disk groups into cache without validation. A crafted image can set these values to trigger out-of-bounds access during allocation or free operations. S...

CVE-2026-97925

A race condition exists in the Linux kernel during the replacement of a broadcast device . The issue occurs because tick_install_broadcast_device() is not serialized against concurrent tick broadcast operations. Specifically, a race between __tick_broadcast_oneshot_control() and tick_install_broa...

CVE-2026-97923

The Linux kernel contains a memory leak vulnerability within the tracing subsystem. Specifically, the create_var_ref() function allocates a VAR_REF hist_field and calls init_var_ref() to populate it. If init_var_ref() fails, the allocated field is leaked because it is not added to the trigger's v...

CVE-2026-97924

The Linux kernel contains a vulnerability in the tracing/user_events component. The destroy_user_event() function incorrectly destroys an event's fields before attempting to remove the trace event call. If the removal fails (e.g., returning -EBUSY because the event is still enabled), the event re...

CVE-2026-97922

The Linux kernel contains a memory leak vulnerability in the tracing subsystem. Specifically, using the same variable three or more times in a single hist trigger causes the variable reference and its associated strings to leak when the trigger is removed. The root cause is that while repeated re...

CVE-2026-97921

The Linux kernel contains a memory leak in the tracing subsystem. When creating a histogram trigger with a value or variable carrying an invalid modifier, the kernel identifies the error but fails to free the allocated field because it is skipped during the store operation. This results in unrefe...

CVE-2026-97920

The Linux kernel contains a vulnerability where the print_entries() function incorrectly handles memory allocation failures. When a histogram stats allocation fails, the variable n_entries is overwritten with -ENOMEM. Because tracing_map_destroy_sort_entries() treats this value as an unsigned int...

CVE-2026-97919

A slab-use-after-free vulnerability exists in the Linux kernel tracing subsystem. The issue occurs in event_hist_trigger_named_init() because the function publishes a trigger to the global named_triggers list before ensuring the subsequent initialization (event_hist_trigger_init()) succeeds. If a...

CVE-2026-97918

A slab-use-after-free vulnerability exists in the Linux kernel tracing subsystem. The issue occurs because a trigger registered during a failed hist_trigger_enable() operation remains on the global named_triggers list but is not on the file->triggers list. This causes hist_unregister_trigger()...