SB2026060546 - openEuler 24.03 LTS SP3 update for kernel

Description

This security bulletin contains information about 151 vulnerabilities.

1) Improper locking (CVE-ID: CVE-2025-39833)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the hfcpci_softirq() and HFC_init() functions in drivers/isdn/hardware/mISDN/hfcpci.c. A local user can perform a denial of service (DoS) attack.

2) Resource management error (CVE-ID: CVE-2025-68334)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the drivers/platform/x86/amd/pmc/pmc.h. A local user can perform a denial of service (DoS) attack.

3) Resource management error (CVE-ID: CVE-2025-68340)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the team_port_add() function in drivers/net/team/team_core.c. A local user can perform a denial of service (DoS) attack.

4) Use-after-free (CVE-ID: CVE-2025-68801)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mlxsw_sp_neigh_entry_alloc(), mlxsw_sp_nexthop_dead_neigh_replace(), mlxsw_sp_nexthop_neigh_init() and mlxsw_sp_nexthop_neigh_fini() functions in drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c. A local user can escalate privileges on the system.

5) Buffer overflow (CVE-ID: CVE-2025-71068)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the svc_rdma_copy_inline_range() function in net/sunrpc/xprtrdma/svc_rdma_rw.c. A local user can perform a denial of service (DoS) attack.

6) Off-by-one (CVE-ID: CVE-2025-71087)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an off-by-one error within the iavf_config_rss_reg() function in drivers/net/ethernet/intel/iavf/iavf_main.c. A local user can perform a denial of service (DoS) attack.

7) NULL pointer dereference (CVE-ID: CVE-2025-71130)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the eb_lookup_vmas(), i915_gem_do_execbuffer() and i915_gem_execbuffer2_ioctl() functions in drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c. A local user can perform a denial of service (DoS) attack.

8) Improper locking (CVE-ID: CVE-2025-71152)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the dsa_port_parse_of(), dev_find_class(), dsa_switch_release_ports() and dsa_switch_shutdown() functions in net/dsa/dsa.c. A local user can perform a denial of service (DoS) attack.

9) Improper locking (CVE-ID: CVE-2025-71194)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the is_transaction_blocked(), start_transaction() and btrfs_wait_for_commit() functions in fs/btrfs/transaction.c. A local user can perform a denial of service (DoS) attack.

10) Use-after-free (CVE-ID: CVE-2026-23001)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the macvlan_hash_lookup_source(), macvlan_hash_add_source(), macvlan_hash_add(), macvlan_flush_sources(), macvlan_forward_source() and macvlan_fill_info_macaddr() functions in drivers/net/macvlan.c. A local user can escalate privileges on the system.

11) Improper error handling (CVE-ID: CVE-2026-23011)

CWE-ID: CWE-388 - Error Handling

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the ipgre_header() function in net/ipv4/ip_gre.c. A local user can perform a denial of service (DoS) attack.

12) Improper locking (CVE-ID: CVE-2026-23025)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __pcp_trylock_noop(), rmqueue_bulk(), decay_pcp_high(), drain_zone_pages(), drain_pages_zone() and zone_pcp_update_cacheinfo() functions in mm/page_alloc.c. A local user can perform a denial of service (DoS) attack.

13) Buffer overflow (CVE-ID: CVE-2026-23054)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the netvsc_set_rxfh() function in drivers/net/hyperv/netvsc_drv.c. A local user can perform a denial of service (DoS) attack.

14) Use-after-free (CVE-ID: CVE-2026-23074)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the teql_qdisc_init() function in net/sched/sch_teql.c. A local user can escalate privileges on the system.

15) Incorrect calculation (CVE-ID: CVE-2026-23100)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the include/linux/hugetlb.h. A local user can perform a denial of service (DoS) attack.

16) Infinite loop (CVE-ID: CVE-2026-23138)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the __ftrace_trace_stack() function in kernel/trace/trace.c. A local user can perform a denial of service (DoS) attack.

17) Exposure of sensitive information to an unauthorized actor (CVE-ID: CVE-2026-23247)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper output neutralization in the TCP sequence number generation mechanism when handling SYN cookies. A remote attacker can send specially crafted TCP connection requests to disclose sensitive information.

The attacker can exploit the side-channel to infer TCP source ports, enabling off-path attacks that leak information about connection parameters.

18) Out-of-bounds read (CVE-ID: CVE-2026-23269)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the AppArmor subsystem's DFA state table validation when processing untrusted policy data. A local user can provide a specially crafted AppArmor policy with an out-of-bounds start state to trigger an out-of-bounds read during policy unpacking.

Exploitation requires the ability to load or modify AppArmor policies, which typically requires privileged access. The out-of-bounds read may expose contents of kernel memory.

19) Use After Free (CVE-ID: CVE-2026-23272)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code, escalate privileges, and cause a denial of service.

The vulnerability exists due to a use-after-free in the netfilter nf_tables component when handling set element insertion in a full set. A local user can send a specially crafted request to trigger improper RCU handling, leading to a use-after-free condition.

Exploitation requires non-administrative local privileges and does not require user interaction. The vulnerability occurs during normal operation of netfilter rules with full sets.

20) Uncontrolled Recursion (CVE-ID: CVE-2026-23312)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the kaweth USB driver when handling USB endpoints during device probing. A remote attacker can connect a malicious USB device with invalid or unexpected endpoint configurations to cause a denial of service.

Exploitation does not require authentication or user interaction beyond physically connecting the device; however, the attack vector is considered remote as it targets kernel-level USB subsystem handling.

21) Use After Free (CVE-ID: CVE-2026-23340)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a use-after-free in the network scheduler (qdisc) component when resetting transmit queues for lockless qdiscs during changes in the number of real transmit queues. A local user can trigger a race condition between qdisc_reset() and the packet dequeue path, leading to use-after-free and potential execution of arbitrary code or system crash.

Exploitation requires the ability to modify network interface queue configurations, which typically requires local user privileges. The issue affects systems using lockless qdiscs such as pfifo_fast, especially under high network load and frequent queue resizing operations.

22) Out-of-bounds write (CVE-ID: CVE-2026-23378)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to improper memory access in the net/sched: act_ife component when updating metadata lists during packet processing. A local user can send a specially crafted request to trigger out-of-bounds memory write via the ife_tlv_meta_encode function.

Exploitation requires the ability to configure or trigger traffic control (tc) actions within the kernel, which is typically available to local users with sufficient privileges to manipulate network scheduling policies.

23) Missing release of memory after effective lifetime (CVE-ID: CVE-2026-23389)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in the ice_set_ringparam() function when processing ring parameter configuration. A local user can trigger improper memory deallocation to cause a denial of service.

Exploitation requires access to the network interface control functionality, which is typically available to local users with network configuration privileges.

24) Out-of-bounds write (CVE-ID: CVE-2026-23406)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service or potentially execute arbitrary code.

The vulnerability exists due to improper pointer arithmetic in the AppArmor match_char() macro within the Linux kernel's DFA matching logic when processing path permissions during file open operations. A local user can provide a specially crafted file access request that triggers differential encoding chain traversal with a post-incremented string pointer, causing the pointer to advance multiple times per iteration and resulting in out-of-bounds memory reads. This can lead to kernel memory corruption and system instability.

The vulnerability is exploitable during AppArmor policy enforcement when opening files, and may allow privilege escalation or system crash.

25) Out-of-bounds write (CVE-ID: CVE-2026-23407)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to improper bounds checking in the AppArmor verify_dfa() function when parsing a malformed DFA policy. A local user can provide a specially crafted AppArmor policy with differential encoding that triggers out-of-bounds memory access to execute arbitrary code or crash the kernel.

Successful exploitation requires the ability to load a malicious AppArmor profile, which requires user privileges but no special administrative rights beyond those needed to manage AppArmor policies.

26) Use-after-free (CVE-ID: CVE-2026-23410)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in AppArmor rawdata inode handling when opening rawdata files while simultaneously removing the corresponding profile. A local attacker can trigger a race condition to access freed memory and cause a denial of service.

27) Race condition (CVE-ID: CVE-2026-23411)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in the AppArmor i_private data management when accessing filesystem callback functions after reference removal. A local attacker can trigger a use-after-free condition by exploiting the race between freeing data and filesystem access to trigger a denial of service.

The issue arises when the inode persists beyond AppArmor data cleanup and filesystem callbacks are invoked after the reference has been released. This race condition primarily affects data stored in i_private, including rawdata/loaddata interfaces.

28) NULL pointer dereference (CVE-ID: CVE-2026-23439)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in udp_sock_create6() and its caller fou_create() when handling netlink requests with CONFIG_IPV6 disabled. A local privileged user can send a specially crafted netlink request to cause a denial of service.

Only privileged users can trigger the issue, and exploitation requires a kernel built with CONFIG_IPV6 disabled.

29) Race condition (CVE-ID: CVE-2026-23440)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the net/mlx5e IPSec ESN update handling path when processing ESN wrap events in IPSec full offload mode. A local user can trigger duplicate ESN update handling to cause a denial of service.

Processing the same event twice can incorrectly increment the ESN high-order bits and program invalid ESN state into hardware, resulting in anti-replay failures and a complete halt of IPSec traffic.

30) Race condition (CVE-ID: CVE-2026-23441)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause unexpected behavior and incorrect results.

The vulnerability exists due to a race condition in the IPSec ASO context handling in the mlx5e driver when processing concurrent IPSec offload ASO operations. A local user can trigger concurrent query or update operations to cause unexpected behavior and incorrect results.

The issue arises because a shared DMA-mapped context is used for ASO operations and can be overwritten before earlier hardware processing completes.

31) Memory leak (CVE-ID: CVE-2026-23444)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper memory management in ieee80211_tx_prepare_skb() when processing transmit skbs. A local attacker can trigger an error path that does not free an skb to cause a denial of service.

The issue affects the first error path where ieee80211_tx_prepare() returns TX_DROP, resulting in inconsistent skb handling compared to the other error paths.

32) Out-of-bounds read (CVE-ID: CVE-2026-23448)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in cdc_ncm_rx_verify_ndp16() and cdc_ncm_rx_fixup() when parsing a crafted NDP16 structure in a received NTB. A remote attacker can send a specially crafted network packet to disclose sensitive information.

The issue occurs because the DPE array size check does not account for ndpoffset, allowing DPE entries near the end of the buffer to extend past the skb data buffer and be read out of bounds.

33) NULL pointer dereference (CVE-ID: CVE-2026-23450)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in smc_tcp_syn_recv_sock() when processing TCP connection requests concurrently with closing an SMC listen socket. A remote attacker can send network traffic that triggers access to a NULL sk_user_data pointer to cause a denial of service.

The issue arises when sk_user_data is set to NULL during the close path while the TCP receive path reads it and dereferences the associated state, leading to a kernel panic.

34) Use-after-free (CVE-ID: CVE-2026-23450)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition leading to a NULL pointer dereference and use-after-free in smc_tcp_syn_recv_sock() when processing TCP connection requests concurrently with closing an SMC listen socket. A remote attacker can send network traffic that triggers the TCP handshake path to cause a denial of service.

The issue occurs because sk_user_data may become NULL or reference a freed smc_sock while the TCP receive path accesses it, resulting in a kernel panic.

35) Use-after-free (CVE-ID: CVE-2026-23452)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in pm_runtime_work() when handling device removal during runtime power management. A local user can trigger a race condition involving device removal to cause a denial of service.

The issue is caused by dereferencing the dev->parent pointer after the parent device has been freed. It is reproducible sporadically with blktest block/001 and results in a KASAN-reported slab-use-after-free.

36) Use-after-free (CVE-ID: CVE-2026-23461)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in l2cap_unregister_user when accessing conn->users and conn->hchan concurrently with l2cap_conn_del(). A local attacker can trigger a race condition to cause a denial of service.

The issue is caused by inconsistent locking on the l2cap_conn structure and may also result in list corruption.

37) Race condition (CVE-ID: CVE-2026-23473)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a wakeup race in io_uring multishot recv polling when processing socket wakeups and shutdown state changes. A local user can trigger back-to-back socket send and shutdown events to cause a denial of service.

The issue can cause the multishot recv operation to hang indefinitely because the shutdown event may be lost and no further wakeups occur.

38) NULL pointer dereference (CVE-ID: CVE-2026-23475)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL-pointer dereference in the spi controller sysfs attributes when handling sysfs attribute access before controller statistics allocation. A remote attacker can access the affected sysfs attributes during this window to cause a denial of service.

The issue occurs because controller per-cpu statistics are not allocated until after the controller has been registered, creating a race window that can crash the kernel.

39) Improper access control (CVE-ID: CVE-2026-31392)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to gain access to a share using incorrect credentials.

The vulnerability exists due to improper access control in the smb client session matching logic when processing cifs mounts with sec=krb5 and a username mount option. A local user can mount another share with a different username option to gain access to a share using incorrect credentials.

The issue occurs when Kerberos mounts reuse an SMB session from a previous mount even though a different username was specified, which can cause a mount that should fail with -ENOKEY to proceed with the first user's session.

40) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-31398)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect pte restoration in folio_unmap_pte_batch() when restoring page table entries for lazyfree folios during reclaim. A local user can trigger a crafted memory-management sequence to cause a denial of service.

The issue can lead to a kernel BUG and crash when a batch contains a mix of writable and non-writable bits, causing writable mappings to be restored incorrectly and breaking anonymous memory copy-on-write semantics.

41) Use-after-free (CVE-ID: CVE-2026-31399)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in nd_async_device_register() when handling asynchronous device initialization after device_add() failure. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the parent pointer may be accessed after the device reference count drops to zero. No user interaction is required.

42) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-31400)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in cache_release when closing a reader file descriptor during a partial read of a cache_request. A local user can close a file descriptor in that state to cause a denial of service.

The issue occurs because the request readers count is decremented without freeing the cache_request when the count reaches zero and CACHE_PENDING is clear, which can result in a memory leak.

43) Use-after-free (CVE-ID: CVE-2026-31403)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the /proc/fs/nfs/exports proc entry handling when reading from a still-open file descriptor after the associated network namespace is torn down. A local user can keep the file descriptor open across namespace teardown and perform subsequent reads to cause a denial of service.

The issue occurs because the open file captures the current network namespace and stores its export cache without holding a reference to the namespace for the lifetime of the file descriptor.

44) Use-after-free (CVE-ID: CVE-2026-31408)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in sco_recv_frame() when processing Bluetooth SCO frames during concurrent socket closure. A local user can trigger a race condition to cause a denial of service.

The issue occurs because the socket reference is not held after releasing sco_conn_lock() before accessing sk->sk_state.

45) NULL pointer dereference (CVE-ID: CVE-2026-31421)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in fw_classify() in the cls_fw packet classifier when classifying a packet after attaching an empty cls_fw filter to a shared block using the old method without TCA_OPTIONS. A local user can attach such a filter and trigger packet classification with a nonzero major skb mark to cause a denial of service.

The issue occurs because shared blocks leave block->q NULL in the old-method path.

46) NULL pointer dereference (CVE-ID: CVE-2026-31422)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in flow_change() in the cls_flow classifier when creating a flow filter without a fully qualified baseclass on a shared block. A local user can create such a flow filter to cause a denial of service.

47) Use-after-free (CVE-ID: CVE-2026-31426)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in acpi_ec_space_handler() when handling AML evaluation that accesses an EC OpRegion field after probe deferral leaves a stale handler context. A local user can trigger a sysfs read that causes AML to touch an EC OpRegion to cause a denial of service.

The issue occurs on reduced-hardware EC platforms when the GPIO IRQ provider defers probing.

48) Double free (CVE-ID: CVE-2026-31429)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a cross-cache free in skb_kfree_head() when freeing KFENCE-allocated skb head data. A local user can trigger allocation and freeing of a specially sized skb head object to cause a denial of service.

Exploitation requires KFENCE to be enabled.

49) Out-of-bounds read (CVE-ID: CVE-2026-31430)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the X.509 extension parser when parsing a certificate with an empty Basic Constraints or Key Usage extension. A local user can submit a specially crafted certificate through the keyrings(7) API to cause a denial of service.

50) Improper resource shutdown or release (CVE-ID: CVE-2026-31441)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in idxd workqueue reset handling when resetting a workqueue. A local user can trigger a workqueue reset to cause a denial of service.

51) Use-after-free (CVE-ID: CVE-2026-31442)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the idxd dmaengine driver when handling a second function level reset after a prior reset completed and scratch area allocation fails. A local user can trigger this condition to cause a denial of service.

52) Use-after-free (CVE-ID: CVE-2026-31446)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in ext4 update_super_work when racing with filesystem unmount. A local user can trigger error notification activity during unmount to cause a denial of service.

The issue occurs because sysfs notification may access a freed kernfs_node after sysfs teardown during the race.

53) Out-of-bounds read (CVE-ID: CVE-2026-31449)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ext4_ext_correct_indexes when processing a corrupted or crafted on-disk extent header. A local user can supply a crafted filesystem image to disclose sensitive information.

54) Race condition (CVE-ID: CVE-2026-31450)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ext4_inode_attach_jinode() when handling concurrent fast commit flush operations. A local user can trigger concurrent filesystem activity to cause a denial of service.

The issue occurs because a jinode pointer may be observed as non-NULL before its associated i_vfs_inode field is initialized, leading to a kernel crash when the fast commit flush path dereferences it.

55) Reachable assertion (CVE-ID: CVE-2026-31451)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of oversized inline data in ext4_read_inline_folio when reading inline data from a crafted ext4 filesystem. A local user can trigger processing of inline data whose size exceeds PAGE_SIZE to cause a denial of service.

56) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-31452)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in ext4_setattr() when processing truncate operations that grow a file beyond inline storage capacity. A local user can truncate a file with inline data to a large size and trigger a write operation to cause a denial of service.

The issue occurs when an inode retains the inline data flag even though the file size exceeds the actual inline capacity, leading to a kernel BUG_ON() during sendfile()-triggered writes.

57) Resource exhaustion (CVE-ID: CVE-2026-31467)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the erofs bio completion path when processing decompression in process context. A local user can trigger memory pressure during this operation to cause a denial of service.

The issue can lead to a deadlock when memory reclaim causes swap I/O through submit_bio_wait.

58) Use-after-free (CVE-ID: CVE-2026-31469)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the virtio_net driver transmit path when transmitting packets after the network namespace is destroyed while previously queued skbs are still pending. A local user can trigger packet transmission and network namespace teardown to cause a denial of service.

The issue occurs when the virtio_net driver is configured with napi_tx disabled and the device's IFF_XMIT_DST_RELEASE flag is cleared.

59) Use-after-free (CVE-ID: CVE-2026-31487)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the SPI driver_override handling when matching drivers during device probing. A local user can trigger driver probing to cause a denial of service.

60) Improper input validation (CVE-ID: CVE-2026-31495)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ctnetlink when handling netlink attribute values. A local user can send a specially crafted netlink message to cause a denial of service.

The issue involves invalid TCP state, window scale, and flag values accepted through ctnetlink attributes.

61) Improper access control (CVE-ID: CVE-2026-31496)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in nf_conntrack_expect proc handling when reading proc entries. A local user can read expectation entries from other network namespaces to disclose sensitive information.

62) Resource exhaustion (CVE-ID: CVE-2026-31498)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the Bluetooth L2CAP ERTM implementation when processing configuration requests and segmenting user-supplied protocol data. A remote attacker can send specially crafted L2CAP configuration data to cause a denial of service.

The issue can be triggered during channel reconfiguration in the connected state, and a zero remote_mps value can lead to an infinite loop that exhausts available memory.

63) Deadlock (CVE-ID: CVE-2026-31499)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in l2cap_conn_del() when canceling delayed work items. A local user can trigger Bluetooth L2CAP connection deletion while the associated timer work is executing to cause a denial of service.

64) Out-of-bounds write (CVE-ID: CVE-2026-31505)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in iavf_get_ethtool_stats() when handling concurrent ethtool channel and statistics operations. A local user can issue crafted ethtool requests to cause a denial of service.

The issue can be triggered when "ethtool -L" and "ethtool -S" are executed simultaneously during queue reconfiguration.

65) NULL pointer dereference (CVE-ID: CVE-2026-31510)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in l2cap_sock_ready_cb when handling L2CAP connection state changes. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can lead to a kernel panic.

66) Use-after-free (CVE-ID: CVE-2026-31511)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mgmt_add_adv_patterns_monitor_complete when handling Bluetooth management operations. A local user can trigger a crafted sequence of management operations to cause a denial of service.

The issue can be triggered by subsequent list traversal that dereferences freed memory.

67) Out-of-bounds read (CVE-ID: CVE-2026-31512)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in l2cap_ecred_data_rcv() when processing a crafted L2CAP Enhanced Credit Based Flow Control data packet with less than 2 bytes of data. A remote attacker can send a specially crafted Bluetooth packet to disclose sensitive information.

68) Use-after-free (CVE-ID: CVE-2026-31516)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in xfrm_hash_rebuild() when processing an XFRM_MSG_NEWSPDINFO request that queues policy_hthresh.work during net namespace teardown. A local user can send a specially crafted XFRM_MSG_NEWSPDINFO request to cause a denial of service.

69) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-31518)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in esp_output_tail_tcp when handling a full espintcp TX queue with asynchronous crypto. A local user can trigger packet processing errors to cause a denial of service.

The issue occurs when asynchronous crypto is used instead of synchronous crypto.

70) Integer overflow (CVE-ID: CVE-2026-31525)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to access out-of-bounds map values.

The vulnerability exists due to improper handling of signed integer minimum values in the BPF interpreter's signed 32-bit division and modulo handlers when processing crafted BPF operations that use INT_MIN. A local user can load a crafted BPF program to access out-of-bounds map values.

The issue is caused by a verifier and interpreter mismatch in range tracking for signed 32-bit division and modulo operations.

71) Out-of-bounds read (CVE-ID: CVE-2026-31528)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds memory access in x86_pmu_del() when rolling back a failed group_sched_in() operation for a group whose leader is a software event. A local user can trigger a failed group scheduling operation to cause a denial of service.

The issue occurs because inherited events may use the wrong PMU context for grouped events.

72) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-31531)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory allocation in rtm_get_nexthop() when handling RTM_GETNEXTHOP requests for large nexthop groups. A local user can send a specially crafted netlink request to cause a denial of service.

This issue can be triggered when querying large Equal-Cost Multi-Path nexthop groups such as groups containing hundreds of nexthops.

73) Use-after-free (CVE-ID: CVE-2026-31532)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in raw_rcv() when processing CAN frames after a raw CAN socket is released. A local user can trigger concurrent socket release and packet reception to cause a denial of service.

The issue involves the percpu uniq storage referenced through RCU-delayed receiver deletion.

74) Use-after-free (CVE-ID: CVE-2026-31533)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in tls_do_encryption() when handling an -EBUSY error path during asynchronous encryption processing. A local user can trigger asynchronous encryption and a subsequent sendmsg to cause a use-after-free.

The issue occurs because a pending cryptd callback may access a freed tls_rec after cleanup state is corrupted by double handling of encrypt_pending and scatterlist restoration.

75) NULL pointer dereference (CVE-ID: CVE-2026-31540)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the i915 driver suspend handling path when suspending a system without i915 driver firmware binaries present. A local user can trigger a suspend operation to cause a denial of service.

The issue occurs because the set_default_submission function pointer may be unset and still dereferenced during suspend.

76) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-31542)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of deconfigured sockets in UV hub info structure allocation when allocating UV hub info structures for a socket mapped to SOCK_EMPTY. A local user can trigger allocation in this state to cause a denial of service.

77) NULL pointer dereference (CVE-ID: CVE-2026-31546)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in bond_debug_rlb_hash_show when reading debugfs entries for RLB hash-table entries with no assigned slave. A local user can read the affected debugfs entry to cause a denial of service.

The issue occurs when an entry remains on the rx_hashtbl_used_head list with its slave pointer set to NULL.

78) Use-after-free (CVE-ID: CVE-2026-31555)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a stale pointer in futex_lock_pi() retry path in kernel/futex/core.c when retrying priority-inheritance futex locking after owner exit handling. A local user can trigger repeated futex_lock_pi() operations to cause a kernel warning and crash.

79) Use-after-free (CVE-ID: CVE-2026-31566)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in amdgpu_amdkfd_submit_ib() when waiting for GPU job completion after submitting a GPU job. A local user can trigger the vulnerable code path to cause a denial of service.

80) Out-of-bounds write (CVE-ID: CVE-2026-31570)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service or corrupt memory.

The vulnerability exists due to an out-of-bounds write in cgw_csum_crc8_rel() when processing CAN gateway crc8 checksum configuration with crafted negative indices. A local user can supply crafted checksum index values to cause a denial of service or corrupt memory.

Exploitation requires CAP_NET_ADMIN to configure the can-gw crc8 checksums.

81) Integer overflow (CVE-ID: CVE-2026-31590)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an integer overflow condition in sev_pin_memory() when processing a KVM_MEMORY_ENCRYPT_REG_REGION ioctl request with a crafted size value. A local user can submit a specially crafted ioctl request to cause a kernel warning.

The issue is reachable from userspace through the KVM SEV memory encryption region registration interface.

82) Race condition (CVE-ID: CVE-2026-31595)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the epf_ntb_cmd_handler work handler in pci-epf-vntb when cleaning up endpoint controller resources. A local user can trigger the vulnerable cleanup path to cause a denial of service.

83) Information disclosure (CVE-ID: CVE-2026-31628)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to improper isolation of partial divider results in x86 CPU handling when executing division operations on Zen1 processors. A local attacker can run a thread that observes residual partial results from previous operations to disclose sensitive information.

Exploitation requires another thread to access leaked partial results left by a previous operation under certain circumstances.

84) Stack-based buffer overflow (CVE-ID: CVE-2026-31630)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in the AF_RXRPC procfs helpers when formatting socket addresses for procfs output with "%pISpc". A local user can trigger address formatting with a specially crafted IPv6 address representation to cause a denial of service.

The issue occurs because the fixed 50-byte stack buffers are too small for the longest current IPv6-with-port textual form, including certain ISATAP address formats.

85) NULL pointer dereference (CVE-ID: CVE-2026-31651)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the vub300 mmc driver disconnect handler when disconnecting the device. A local user can trigger a device disconnect to cause a denial of service.

The issue may also lead to a use-after-free condition.

86) Use-after-free (CVE-ID: CVE-2026-31665)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in nft_ct_timeout_obj_destroy() when destroying timeout objects during concurrent packet processing. A local user can trigger concurrent packet processing and object destruction to cause a denial of service.

The issue arises because other CPUs may still hold RCU-protected references to the timeout object.

87) Improper locking (CVE-ID: CVE-2026-31667)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock management in the uinput force-feedback handling path when processing force-feedback operations and device lifecycle events. A local user can trigger a circular locking dependency to cause a denial of service.

The issue can be triggered when using a force-feedback gamepad with uinput.

88) Out-of-bounds read (CVE-ID: CVE-2026-31675)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in netem_enqueue() when processing fully non-linear packets sent over an IPIP tunnel through an AF_PACKET TX_RING. A local user can send a specially crafted packet to cause a denial of service.

89) Resource exhaustion (CVE-ID: CVE-2026-31677)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in af_alg_get_rsgl() when processing recvmsg calls with data extraction into the RX scatterlist. A local user can send a specially crafted recvmsg request to cause a denial of service.

90) Race condition (CVE-ID: CVE-2026-31678)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the openvswitch tunnel device destruction path when destroying a tunnel vport after device unregistration. A local user can trigger concurrent access to a detached device reference to cause a denial of service.

91) Out-of-bounds read (CVE-ID: CVE-2026-31684)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in tcf_csum_act() when processing packets with nested in-payload VLAN headers. A remote attacker can send a specially crafted packet to cause a denial of service.

92) Improper input validation (CVE-ID: CVE-2026-31685)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ip6t_eui64 when processing packets with an invalid MAC header. A remote attacker can send a specially crafted packet to cause a denial of service.

93) Improper Initialization (CVE-ID: CVE-2026-31689)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in edac_mc_alloc() when handling a failed mci->pvt_info allocation. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs because put_device() may invoke the device release function before device initialization has completed.

94) Out-of-bounds read (CVE-ID: CVE-2026-31697)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in sev_ioctl_do_get_id2 in the ccp/sev ioctl handler when handling a request to retrieve the CPU ID with a userspace buffer and length that are too small after a firmware command failure. A local user can issue a specially crafted ioctl request to disclose sensitive information.

The issue occurs when the firmware command fails due to an invalid length and the kernel still copies the firmware-required byte count to userspace.

95) Out-of-bounds read (CVE-ID: CVE-2026-31698)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in sev_ioctl_do_pdh_export when handling a PDH certificate export ioctl after a firmware command failure caused by an invalid length. A local user can provide a userspace buffer and length that are too small to trigger copying beyond the kernel-allocated buffer to disclose sensitive information.

The issue occurs when retrieving the PDH certificate and the firmware reports the required size after the supplied userspace buffer is too small.

96) Out-of-bounds read (CVE-ID: CVE-2026-31699)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the sev_ioctl_do_pek_csr ioctl handler when processing a PEK CSR retrieval request after a failed firmware command. A local user can supply a too-small userspace buffer and length to trigger a copy to userspace that discloses sensitive information.

The issue occurs when the firmware reports an invalid length for the requested blob.

97) Out-of-bounds read (CVE-ID: CVE-2026-31708)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in smb2_ioctl_query_info() when processing a crafted QUERY_INFO response from an SMB server. A remote attacker can return a malformed response with an OutputBufferLength larger than the actual response buffer to disclose sensitive information.

98) Out-of-bounds read (CVE-ID: CVE-2026-31738)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in vxlan_na_create when parsing neighbor discovery options. A remote attacker can send a specially crafted packet to cause a denial of service.

99) Out-of-bounds read (CVE-ID: CVE-2026-31752)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in br_nd_send when parsing malformed neighbor discovery options. A remote attacker can send a specially crafted neighbor solicitation packet to cause a denial of service.

100) NULL pointer dereference (CVE-ID: CVE-2026-31755)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in __cdns3_gadget_ep_queue() when queueing requests on a disabled or unconfigured gadget endpoint. A local user can trigger the vulnerable code path to cause a denial of service.

101) Out-of-bounds read (CVE-ID: CVE-2026-31771)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Bluetooth HCI event handling logic when processing a short HCI event frame. A local attacker can send a specially crafted HCI event frame to cause a denial of service.

The issue occurs because wake reason storage is reached before per-event minimum payload length validation is enforced.

102) Improper Authentication (CVE-ID: CVE-2026-31773)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass authentication requirements.

The vulnerability exists due to improper authentication state handling in the Bluetooth SMP legacy responder STK handling in smp_random() when processing Just Works or Confirm legacy pairing. A remote attacker can initiate a legacy pairing sequence that results in an unauthenticated STK being stored as authenticated to bypass authentication requirements.

The issue affects the legacy responder path and occurs when high security is requested but the pairing flow does not achieve MITM authentication.

103) Out-of-bounds read (CVE-ID: CVE-2026-31779)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in iwl_mvm_nd_match_info_handler() when processing a crafted notification packet. A local user can supply a notification with an insufficient packet length to disclose sensitive information.

104) Observable discrepancy (CVE-ID: CVE-2026-31781)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper restriction of speculative execution in drm_compat_ioctl when processing a user-controlled pointer used as an index into a function pointer table. A local user can supply a crafted index value to disclose sensitive information.

The issue affects the drm compat ioctl path.

105) Stack-based buffer overflow (CVE-ID: CVE-2026-43020)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in the Bluetooth MGMT Long Term Key load and reply handling logic when processing a crafted management LTK record with an oversized enc_size value. A remote user can supply a specially crafted LTK record to overflow a reply stack buffer to cause a denial of service or execute arbitrary code.

106) Use of uninitialized resource (CVE-ID: CVE-2026-43036)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper handling of packet header data in gso_features_check() when processing packets injected through PF_PACKET paths. A local attacker can inject a specially crafted packet to cause a denial of service.

The issue occurs because the IPv4 header access may rely on skb header offsets that are not always safe for direct dereference in this context.

107) Improper Initialization (CVE-ID: CVE-2026-43040)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper initialization in ndisc_ra_useropt when processing router advertisements with user options. A remote attacker can send a specially crafted router advertisement to disclose sensitive information.

The issue affects the RTM_NEWNDUSEROPT netlink message because padding fields in the nduseroptmsg structure are not zeroed before being exposed.

108) NULL pointer dereference (CVE-ID: CVE-2026-43043)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the crypto scatterwalk code when processing sendmsg() operations that chain a new scatter/gather list after an existing list is filled exactly to MAX_SGL_ENTS. A local user can send crafted messages through the AF_ALG interface to cause a denial of service.

The issue is triggered when a subsequent sendmsg() allocates a new scatter/gather list after the previous list's last data entry remains incorrectly marked as the end, leading to a kernel panic.

109) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43061)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the 8250 serial DMA transmit handling when terminating a DMA transaction asynchronously. A local user can trigger cancellation of a transmit DMA transaction to cause a denial of service.

The issue can leave transmit DMA permanently stalled because the tx_running state is not cleared if the completion callback does not run.

110) Improper resource shutdown or release (CVE-ID: CVE-2026-43064)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the idxd DSA/IAA device workqueue handling when releasing a device object. A local user can trigger release of a crafted or repeatedly created device object to cause a denial of service.

111) Out-of-bounds write (CVE-ID: CVE-2026-43079)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in uncore_pci_pmu_register() when parsing the discovery table for offline dies. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can be triggered when NUMA is disabled and the system boots with fewer CPUs than the number of CPUs in die 0.

112) NULL pointer dereference (CVE-ID: CVE-2026-43099)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in icmp_build_probe() when processing probe requests that use an IPv6 interface identifier while the IPv6 stack is inactive. A remote attacker can send a specially crafted probe request to cause a denial of service.

The issue occurs when IPv6 support is configured as a module and is not loaded.

113) NULL pointer dereference (CVE-ID: CVE-2026-43148)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in parse_thread_groups() when parsing device tree thread group properties. A local user can trigger allocation failure conditions to cause a denial of service.

114) Improper input validation (CVE-ID: CVE-2026-43156)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in pegasus_probe() when probing a malformed USB device with mismatched endpoint descriptors. An attacker with physical access can connect a specially crafted USB device to cause a denial of service.

The issue is triggered because the driver assumes fixed endpoint numbers and transfer types for RX, TX, and status interrupt URBs.

115) Use-after-free (CVE-ID: CVE-2026-43163)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race in write_page() when resizing an array while bitmap daemon work is iterating over bitmap->storage.filemap. A local user can trigger concurrent bitmap update and resize operations to cause a denial of service.

The issue occurs because the md thread can continue running during quiesce(), allowing concurrent access to freed pages.

116) Heap-based buffer overflow (CVE-ID: CVE-2026-43186)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in __ioam6_fill_trace_data() when processing a crafted incoming IPv6 IOAM packet on the receive path. A remote attacker can send a specially crafted packet to cause a denial of service.

A packet with an inconsistent nodelen field and type bits can trigger an out-of-bounds write of about 100 bytes into adjacent heap memory.

117) Improper input validation (CVE-ID: CVE-2026-43212)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in cpumask_of_node() when handling a NUMA_NO_NODE index. A local user can trigger the vulnerable code path to cause a denial of service.

The issue affects the LoongArch architecture-specific implementation.

118) Improper input validation (CVE-ID: CVE-2026-43240)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ima_restore_measurement_list function when booting a second-stage kernel via kexec with a limiting command line such as "mem=". A local user can boot the second-stage kernel with a crafted limiting command line to cause a denial of service.

The issue occurs when the physical range containing the carried-over IMA measurement list falls outside truncated RAM, leading to a kernel panic.

119) Improper locking (CVE-ID: CVE-2026-43262)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in gfs2_fiemap() when processing fiemap requests on a memory-mapped fiemap buffer associated with the same inode. A local user can trigger a page fault that leads to recursive glock taking to cause a denial of service.

120) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-43273)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause data inconsistencies in snapshots.

The vulnerability exists due to improper context handling in ceph_zero_partial_object() when performing OSD write operations for partial object zeroing. A local user can modify a file and access its snapshot to cause data inconsistencies in snapshots.

Exploitation requires access to a CephFS mount and interaction with snapshot functionality.

121) Improper Initialization (CVE-ID: CVE-2026-43288)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in ext4 per-CPU counter handling when mounting a crafted ext4 filesystem with quota and project features enabled. A local user can mount a specially crafted filesystem image to cause a denial of service.

The issue is triggered when block bitmap validation fails during filesystem mount.

122) Resource exhaustion (CVE-ID: CVE-2026-43292)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in kasan_release_vmalloc_node when freeing KASAN shadow pages during vmalloc cleanup. A local user can trigger processing of a large purge list to cause a denial of service.

The issue occurs when CONFIG_PAGE_OWNER is enabled, and processing many vmap_area entries without yielding can lead to prolonged RCU stalls and potential OOM conditions.

123) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43345)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper register field definition in the IPA GSI event ring configuration logic when initializing event rings on IPA v5.0+ hardware. A local user can trigger channel operations that wait for transfer completion to cause a denial of service.

The issue can cause runtime suspend, system suspend, and remoteproc stop operations to hang indefinitely, and the IPA data path may become non-functional.

124) Improper input validation (CVE-ID: CVE-2026-43366)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state validation in the io_uring kernel buffer recycling logic when recycling a previously grabbed buffer. A local user can trigger recycling of a buffer after the target buffer list has changed type to cause a denial of service.

This can occur when the request is forced via io-wq.

125) Out-of-bounds read (CVE-ID: CVE-2026-43406)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in process_message_header() when processing a maliciously corrupted message frame. A remote attacker can send a specially crafted message frame to disclose sensitive information.

The issue can be triggered if the control segment length is smaller than the message header size or if a different frame is made to appear as a message frame.

126) Memory leak (CVE-ID: CVE-2026-43419)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in ceph_mdsc_build_path() when handling error paths. A local user can trigger the vulnerable code path to cause a denial of service.

127) Race condition (CVE-ID: CVE-2026-43427)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a race condition in the cdc-wdm read code path when processing read operations. A local user can trigger the race and read uninitialized memory to disclose sensitive information.

128) Improper resource shutdown or release (CVE-ID: CVE-2026-43428)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in usbcore when handling USB message timeouts. A local user can trigger an excessively long synchronous timeout to cause a denial of service.

Exploitation can leave a task stuck in an uninterruptible wait until the target device is unplugged.

129) Deadlock (CVE-ID: CVE-2026-43468)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in net/mlx5 eswitch event handling when processing eswitch mode changes and queued work items. A local user can trigger eswitch mode changes to cause a denial of service.

130) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43493)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error conditions in the pcrypt crypto subsystem when processing MAY_BACKLOG requests. A local user can trigger requests that return EBUSY to cause a denial of service.

131) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43503)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to modify the page cache of a root-owned read-only file.

The vulnerability exists due to improper state management in frag-transfer helpers in the Linux kernel networking stack when moving fragment descriptors between socket buffers. A local user can trigger packet processing through a duplicated skb path to modify the page cache of a root-owned read-only file.

One demonstrated path involves ESP input after a packet is duplicated through an nft 'dup to' rule or another nf_dup_ipv4() / xt_TEE caller.

132) NULL pointer dereference (CVE-ID: CVE-2026-45834)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in l2cap_sock_state_change_cb() when handling Bluetooth L2CAP socket state changes. A local user can trigger the vulnerable callback to cause a denial of service.

133) Use-after-free (CVE-ID: CVE-2026-45861)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in qd_put and the gfs2 quota data LRU handling when shutting down the filesystem and the shrinker scans quota data objects. A local user can trigger filesystem shutdown to cause a denial of service.

134) NULL pointer dereference (CVE-ID: CVE-2026-45911)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the cdns3 driver resume path when switching roles during resume. A local user can trigger a role change while the system is resuming to cause a denial of service.

The issue occurs when the driver switches to host mode during resume and the xhci-hcd device probe is deferred.

135) NULL pointer dereference (CVE-ID: CVE-2026-45943)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in z_erofs_decompress_pcluster() when processing inline data for ztailpacking pclusters during file reads. A local user can read a crafted erofs image to cause a denial of service.

The issue may occur if a fatal signal arrives while read_mapping_folio() is running.

136) Memory leak (CVE-ID: CVE-2026-45947)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in amdgpu_acpi_enumerate_xcc() when handling an error from amdgpu_acpi_dev_init(). A local user can trigger the affected code path to cause a denial of service.

The issue occurs when amdgpu_acpi_dev_init() returns -ENOMEM.

137) Improper resource shutdown or release (CVE-ID: CVE-2026-45961)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in gfs2_fill_super() and gfs2_make_fs_rw() when transitioning a filesystem to read-write mode and handling error paths. A local user can trigger failures during this process to cause a denial of service.

The issue involves memory leaks of created kernel threads and an allocated quota bitmap buffer during specific failure conditions.

138) NULL pointer dereference (CVE-ID: CVE-2026-45982)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in acpi_ev_address_space_dispatch() when handling address space dispatch operations. A local attacker can trigger the vulnerable code path to cause a denial of service.

139) Out-of-bounds read (CVE-ID: CVE-2026-45999)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in z_erofs_lz4_handle_overlap() when processing a crafted EROFS image during LZ4 inplace decompression. A local user can mount a crafted image and trigger decompression to disclose sensitive information.

The issue occurs for illegal extents where partial decoding is disabled and m_llen is smaller than m_plen, causing an unsigned underflow in the outpages minus inpages calculation.

140) Improper resource shutdown or release (CVE-ID: CVE-2026-46044)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the ssif kthread cleanup logic when handling error conditions after creating the ssif kthread but before starting the ssif interface. A local user can trigger an error condition during ssif interface initialization to cause a denial of service.

141) Improper locking (CVE-ID: CVE-2026-46051)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in retry_aligned_read() when processing overlapped stripes. A local user can trigger overlapped stripe handling to cause a denial of service.

142) Improper access control (CVE-ID: CVE-2026-46076)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to bypass hypercall interception controls.

The vulnerability exists due to improper access control in KVM nested SVM handling when processing VMMCALL from an L2 guest. A remote user can invoke an unhandled VMMCALL to bypass hypercall interception controls.

Exploitation requires an active nested virtualization scenario where L2 is running, L1 does not intercept VMMCALL, nested_svm_l2_tlb_flush_enabled() is true, and the hypercall is not one of the supported Hyper-V hypercalls.

143) Out-of-bounds read (CVE-ID: CVE-2026-46078)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the EROFS directory entry handling code when parsing a crafted EROFS image with a trailing directory entry containing an invalid name offset. A local user can provide a specially crafted EROFS image to disclose sensitive information.

The issue occurs because an unchecked name offset can cause an underflow in the length calculation used by strnlen(), leading to a read past the directory block.

144) Improper handling of exceptional conditions (CVE-ID: CVE-2026-46082)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in KVM SVM instruction emulation when processing the INVLPGA instruction with EFER.SVME cleared. A local user can execute the INVLPGA instruction in a guest context to cause a denial of service.

145) Race condition (CVE-ID: CVE-2026-46093)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in decay_va_pool_node() when the shrinker path runs concurrently with vmap area purging. A local user can trigger concurrent shrinker and purge activity to cause a denial of service.

The issue can also result in possible memory leaks.

146) Use-after-free (CVE-ID: CVE-2026-46121)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in DAMON sysfs memcg_path file handling when performing concurrent reads and writes through separate open files. A local user can trigger concurrent access to a freed buffer to cause a denial of service.

The issue affects user-driven direct reads and writes, while reads performed during parameter committing are separately synchronized.

147) Out-of-bounds read (CVE-ID: CVE-2026-46138)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hci_le_create_big_complete_evt when processing a crafted LE_Create_BIG_Complete event. A remote attacker can send a specially crafted Bluetooth controller event to cause a denial of service.

The issue can also result in an infinite loop while hci_dev_lock is held when the event contains fewer bis_handle entries than expected or num_bis is zero.

148) Improper locking (CVE-ID: CVE-2026-46165)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in the openvswitch vport release logic when removing tunnel ports. A local user can trigger device removal to cause a denial of service.

The issue results in a self-deadlock during device removal because the RCU callback that releases the reference is not reached.

149) Memory leak (CVE-ID: CVE-2026-46171)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in kvm_riscv_vcpu_alloc_vector_context when allocating vector context buffers. A local user can trigger the allocation failure path to cause a denial of service.

150) Improper resource shutdown or release (CVE-ID: CVE-2026-46178)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in mlx4_ib_create_srq() when handling error conditions during SRQ creation. A local user can trigger an error during SRQ creation to cause a denial of service.

151) Out-of-bounds read (CVE-ID: CVE-2026-46190)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in spi_nor_params_show() when displaying SPI NOR parameters through debugfs. A local attacker can trigger access to debugfs output to disclose sensitive information.

The issue is caused by passing the byte size of an array of pointers instead of the actual element count, which can permit reads past the end of the names array on 64-bit systems when certain flag bits are set.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2582