CVE-2026-64049

In the Linux kernel, the drm/msm/adreno driver fixes a userspace-triggered crash on a2xx–a4xx by adding a guard in adreno_get_param() to check for UBWC configuration and return sane defaults when UBWC params are queried but not supported. Before this, older generations wouldn’t fetch UBWC params,...

CVE-2026-64050

In CVE-2026-64050, the Linux kernel's drm/msm/dpu subsystem had a use-after-free during driver teardown due to mixing devm and drmm memory management functions. Specifically, wb connector data could be destroyed because devm_kzalloc() was used while the WB connector still interacted with via drmm...

CVE-2026-64048

The CVE-2026-64048 entry describes a Linux kernel issue in the SMC subsystem (net/smc) where a CHID-0 match against an empty ism_dev slot can trigger a NULL dereference during smc_conn_create, potentially causing a fault if an SMC-Dv2 peer replies with CHID 0. The root cause is that slot 0 (reser...

CVE-2026-64046

The CVE-2026-64046 issue affects the Linux kernel’s TLS implementation in the crypto/scatterlist handling. A chain-after-chain could occur when end = 0 (start != 0), creating a wrap link that pointed to another chain link, which the sg_next iterator cannot recursively resolve. The vulnerability i...

CVE-2026-64047

CVE-2026-64047 involves the Linux kernel’s TLS path: an off-by-one in sg_chain entry counting for wrapped sk_msg rings can misindex the scatterlist, causing incorrect chaining when sg.end

CVE-2026-64045

CVE-2026-64045 describes a Linux kernel race in ovpn_tcp_close() where the code loads sock->peer under an RCU read lock, caches the pointer, then uses the dereferenced sock->peer after the RCU section. This can race with ovpn_socket_release()’s detach/synchronize_rcu path, potentially leadi...

CVE-2026-64044

In Linux kernel networking code related to the OpenVPN (ovpn) subsystem, CVE-2026-64044 fixes a race where ovpn_nl_peer_new_doit() released a peer directly via ovpn_peer_release() instead of using ovpn_peer_put(), bypassing the kref refcount mechanism. This allowed a concurrent caller holding a p...

CVE-2026-64043

The CVE-2026-64043 entry describes a race condition in the Linux kernel related to ovpn interfaces. During deletion of an ovpn netdevice, a CMD_PEER_NEW netlink message could race with the unregistration process, taking a fresh reference to the netdev and leaving the device in a state where it ca...

CVE-2026-64042

Concrete details: CVE-2026-64042 affects the Linux kernel, specifically vfio/pci, where DMABUF exports have access to BAR resources. The root cause is exporting BAR resources before they are reserved; a check was added in the DMABUF-creation path to ensure resources are reserved before export. Im...

CVE-2026-64041

The CVE-2026-64041 entry concerns the Linux kernel ASoC codecs pathway for fs210x. The vulnerability arises in fs210x_effect_scene_info(), where a string is copied with strscpy(DST, SRC, strlen(SRC) + 1), which can overflow DST if strlen(SRC) >= sizeof(DST). The documented fix enforces correct...

CVE-2026-64040

CVE-2026-64040 affects the Linux kernel’s cachefiles path. The root cause is that when vfs_mkdir() fails, the error code was not extracted from the error pointer, causing mkdir_error to be reached with ret=0 and returning ERR_PTR(0) (NULL) instead of a proper error pointer. The public description...

CVE-2026-64039

The CVE affects the Linux kernel DRM MSM subsystem, specifically the drm/msm/snapshot code used for state dumping. The vulnerability is not a traditional remote fault but a correctness issue in the snapshotting of data regions: the code aligns data segments to 16 bytes, which breaks for DSI data ...

CVE-2026-64038

CVE-2026-64038 concerns the Linux kernel hwmon lm90 driver. In lm90_probe(), devm actions to cancel alert_work and report_work were registered before hwmon device registration. With devm cleanup in reverse order, the hwmon device could be freed first, allowing lm90_update_alarms() to dereference ...

CVE-2026-64037

The CVE concerns the Linux kernel wireless stack (iwlwifi MLD) where TSO segmentation can explode when AMSDU is disabled. When max_tid_amsdu_len is set to the sentinel value 1, the TSO path neglects this sentinel, causing zero subframes and gso_size=0, which can flood TX with thousands of micro-f...

CVE-2026-64035

The CVE-2026-64035 issue affects the Linux kernel igc driver: igc_fpe_init_smd_frame() initializes igc_tx_buffer for SMD skbs but omits setting the buffer type, allowing reused entries to retain a stale XDP/XSK type and cause TX completion to take the wrong cleanup path. The fix sets the buffer t...

CVE-2026-64036

The CVE-2026-64036 issue affects the Linux kernel cgroup/rstat path. A BPF iter/cgroup program could pass an invalid CPU value to the BPF kfunc css_rstat_updated(), which uses the CPU as an index for per-CPU rstat lookups without validating that the CPU is within a valid range. An unfixed UBSCAN_...

CVE-2026-64034

CVE-2026-64034 affects the Linux kernel’s net: mana path. The issue is a TOCTOU double-fetch of the field hwc_msg_id from a DMA buffer in mana_hwc_rx_event_handler(): the value is first read and bounds-checked, then re-read for test_bit() and pointer arithmetic. Because DMA-coherent memory is map...

CVE-2026-64033

The CVE-2026-64033 entry describes a use-after-free in the Linux kernel RDMA/rtrs path file cleanup. In rtrs_srv_create_path_files(), if an error occurs after sysfs root folders are created and srv_path->kobj is initialized, cleanup calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy...

CVE-2026-64032

Summary (CVE-2026-64032): In the Linux kernel bridge multicast code, a use-after-free can occur when removing a bridge port if both per-port and per-{port, VLAN} multicast contexts are enabled. The root cause is a race where, after enabling/disabling per-port and per-{port, VLAN} contexts during ...

CVE-2026-64031

CVE-2026-64031 : In the Linux kernel’s erofs filesystem, a race condition was fixed in the managed cache for unaligned extents (-E48bit with zstd). The issue occurred when a common folio could be discovered in z_erofs_bind_cache by two threads before folio->private was cleared, potentially lea...