CVE-2026-97621

The Linux kernel contains a buffer overflow vulnerability in the drm/rockchip: analogix_dp component. Specifically, the function rockchip_dp_drm_encoder_enable() utilizes sprintf() to format a device tree path into a fixed 32-byte stack buffer . Because device tree paths can exceed this size, a s...

CVE-2026-97618

The Linux kernel contains a vulnerability in the io_uring/net subsystem where a recv/recvmsg operation using MSG_TRUNC causes the system to overconsume buffers. Specifically, if an incoming packet exceeds the provided buffer size, the net layer returns the full packet length instead of the number...

CVE-2026-97619

The Linux kernel contains a vulnerability in the io_uring subsystem regarding write accounting. Specifically, moving write accounting out of the kiocb completion handler and into io_req_rw_complete() task work creates a risk where dropping SB_FREEZE_WRITE protection depends on a task that may be ...

CVE-2026-97617

A vulnerability exists in the Linux kernel 's ring-buffer mechanism. The ring_buffer_subbuf_order_set() function incorrectly stores a new order before checking if any CPUs have resizing disabled. Because __rb_map_vma() reads buffer->subbuf_order without holding the buffer->mutex, a race con...

CVE-2026-97616

The Linux kernel contains a memory leak vulnerability within the net/sched: act_api component. During a batched RTM_NEWACTION request, tcf_idr_check_alloc() takes a temporary reference on an action. If a subsequent action fails to initialize, tcf_action_destroy() uses strict release semantics tha...

CVE-2026-97615

The Linux kernel contains a vulnerability in the net: bridge component related to how CFM and MRP frame handlers are registered. Because these protocols registered a global br_frame_type whose hlist_node is linked into the per-bridge frame_type_list , enabling the protocol on multiple bridges ins...

CVE-2026-97614

The Linux kernel contains a vulnerability in the net: dsa: tag_brcm component where the legacy FCS tagger fails to declare required tailroom. When a nonlinear skb reaches the tagger, it calculates the CRC over bytes starting at skb->data, causing it to read past the linear head into unrelated ...

CVE-2026-97613

A vulnerability in the Linux kernel network subsystem involves improper sizing of the RX completion queue for MANA hardware. The current sizing fails to reserve an extra slot for the CQE_RX_OBJECT_FENCE posted by MANA_FENCE_RQ , which can cause the driver to drop the fence completion while holdin...

CVE-2026-97612

The Linux kernel is vulnerable to a memory corruption issue in the MPLS stack. The skb_mpls_push() function records a pre-encapsulation network header but skb_mpls_pop() fails to clear it when the last label is popped. This allows Open vSwitch to re-push MPLS onto a packet where the inner_network...

CVE-2026-97611

The Linux kernel contains a use-after-free vulnerability in the Open vSwitch component involving the flow table mask array. The issue exists in tbl_mask_array_realloc(), where call_rcu() is invoked to retire the old mask_array before it is no longer reachable. Because the pointer swap with rcu_as...

CVE-2026-97610

A vulnerability exists in the Linux kernel netfs component within the netfs_unbuffered_write() function. The issue stems from an uninitialized return value where the function may exit its loop before the ret variable is initialized if the first subrequest fails or during an empty-iterator check. ...

CVE-2026-97608

The Linux kernel contains a race condition in the netfilter subsystem, specifically within nf_log_syslog and nfnetlink_log . The vulnerability occurs because these backends unregister per-network namespace operations before unregistering their global logger backends. This creates a window where a...

CVE-2026-97609

The Linux kernel contains a use-after-free (UAF) vulnerability within the netfilter: cttimeout component during module unload. The issue occurs because cttimeout_exit() unregisters per-net operations before clearing the hook, allowing a race condition where one CPU can free the pernet storage whi...

CVE-2026-97607

The Linux kernel contains a vulnerability in the vdpa: ifcvf component where unsupported provisioned features were not handled consistently. The issue caused a failure to release the allocated device and adapter pointers consistently following the vdpa_alloc_device() call. The vulnerability has b...

CVE-2026-97605

The Linux kernel contains a vulnerability in the erofs filesystem involving the pool-resize path for LZMA decoders . The root cause is that the system frees old decoders before successfully allocating replacements; if an allocation fails mid-process, the failed stream is returned to the list with...

CVE-2026-97606

The Linux kernel contains a memory leak vulnerability in the autofs filesystem component within the autofs_fill_super() function. The issue occurs because the system creates a new inode using autofs_new_ino(), but fails to free this inode if the root_inode creation fails, resulting in an -ENOMEM ...

CVE-2026-97604

The Linux kernel contains a use-after-free vulnerability within the fbdev: vfb driver. The issue occurs because FBIOGETCMAP takes a shallow snapshot of info->cmap and performs a usercopy after dropping the info->lock . Simultaneously, vfb_remove() may free the colormap immediately after unr...

CVE-2026-97603

The Linux kernel contains a use-after-free vulnerability in the idpf driver. The issue occurs because the driver fails to drain Tx/Rx DIM works before freeing the q_vectors memory in idpf_vport_intr_rel(). Specifically, tx_dim and rx_dim are queued via net_dim() during NAPI polling, but nothing c...

CVE-2026-97602

The Linux kernel is vulnerable to a flaw where fqdir_pre_exit() flushes skbs from incomplete queues without updating their completion state. This allows a fragment to reuse stale reassembly metadata after a queue is cleared. In IPv6 , this can cause ip6_frag_reasm() to use an old nhoffset with a ...

CVE-2026-97601

The Linux kernel contains a vulnerability in the ieee802154: 6lowpan component where a NULL pointer dereference can occur in the lowpan_newlink() function. This issue is triggered when an RTM_NEWLINK request allows a TUN device to change its link-layer type to ARPHRD_IEEE802154 via TUNSETLINK wit...