SB20260721108 - Ubuntu update for linux

Description

This security bulletin contains information about 893 vulnerabilities.

1) Observable discrepancy (CVE-ID: CVE-2025-54505)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to transient execution in floating-point divisor unit when executing floating-point operations in privileged code. A local user can sample data from the floating-point divisor unit to disclose sensitive information.

The issue affects systems with SMT enabled as well as systems without SMT.

2) Improper privilege management (CVE-ID: CVE-2025-54518)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper privilege management in x86 CPU opcode cache handling when executing code on affected AMD Fam17h CPUs. A local user can execute code to escalate privileges.

The issue can permit escalation across privilege boundaries including userspace to kernel and guest to host, and only AMD Fam17h CPUs based on the Zen2 microarchitecture are believed to be affected.

3) Insufficient Entropy (CVE-ID: CVE-2025-62626)

CWE-ID: CWE-331 - Insufficient Entropy

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient entropy in Zen 5 processors, which causes the RDSEED instruction to return 0 at a rate inconsistent with randomness while incorrectly signaling success (CF=1), indicating a potential misclassification of failure as success. A local user can escalate privileges on the system.

4) Improper input validation (CVE-ID: CVE-2026-53320)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in nilfs_ioctl_mark_blocks_dirty() when processing a crafted ioctl request. A local user can send a crafted ioctl request with bd_oblocknr set to 0 to cause a denial of service.

The issue can reach a WARN_ON path after a lookup returns -ENOENT and sets the compared block number to 0.

5) Race condition (CVE-ID: CVE-2026-53314)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the padata CPU hotplug callback handling when offlining a CPU. A local user can trigger CPU hotplug operations to cause a denial of service.

The issue occurs because the CPU offline callback was placed in a hotplug teardown state where failure is not allowed.

6) Out-of-bounds read (CVE-ID: CVE-2026-53309)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dlm_match_regions() when comparing local and remote regions. A remote attacker can trigger the vulnerable region comparison to disclose sensitive information, modify data, or cause a denial of service.

7) Off-by-one (CVE-ID: CVE-2026-53306)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hvc_iucv_get_private() in the hvc_iucv driver when handling a device index equal to the number of configured devices. A local user can trigger an off-by-one access to cause a denial of service.

The issue occurs because the bounds check permits access to hvc_iucv_table[8] when hvc_iucv_devices is 8.

8) Improper input validation (CVE-ID: CVE-2026-53304)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper input validation in the sg driver def_reserved_size module parameter handling when opening /dev/sgX after assigning an invalid value to the parameter. A local privileged user can write a negative or oversized value to the def_reserved_size sysfs parameter and then open a sg device node to cause a denial of service.

9) Out-of-bounds read (CVE-ID: CVE-2026-53303)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in f2fs_sbi_show() when reading the extension_list during sysfs access concurrent with extension list updates. A local user can trigger concurrent sysfs operations to cause a denial of service.

The issue may also result in stale data being displayed.

10) Use-after-free (CVE-ID: CVE-2026-53296)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the mailbox-test driver when handling probe errors. A local user can trigger a probe error to cause a denial of service.

The issue occurs because previously obtained channels are not freed before the client structure is removed.

11) NULL pointer dereference (CVE-ID: CVE-2026-53295)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the mailbox controller channel array handling when initializing a mailbox controller without an attached channel array. A local user can trigger initialization of a mailbox controller in this state to cause a denial of service.

12) Double free (CVE-ID: CVE-2026-53294)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in mailbox-test channel handling when freeing reused channels. A local user can trigger the mailbox-test logic with an aliased RX and TX channel configuration to cause a denial of service.

The issue occurs in the special case where the RX channel is aliased to the TX channel with different MMIO.

13) Improper locking (CVE-ID: CVE-2026-53293)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in AMDGPU_INFO_READ_MMR_REG in amdgpu_kms.c when handling ioctl requests to read MMR registers. A local user can issue a crafted ioctl request to cause a denial of service.

The issue involves incorrect ordering between the reset semaphore and mm_lock, allocation while holding the reset semaphore, and failure to wait for reset completion.

14) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-53291)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in cx_probe() in the ALSA hda/conexant driver when enabling the jack detection callback. A local user can trigger the vulnerable driver path to cause a denial of service.

The issue can lead to a kernel crash when jack events are later handled after callback registration fails.

15) NULL pointer dereference (CVE-ID: CVE-2026-53289)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ice_reset_all_vfs() when handling a failed VSI rebuild during VF reset processing. A local user can trigger a failed VSI rebuild state and cause a denial of service.

The issue can occur during NVM firmware update while the firmware is in a transitional state and Admin Queue commands fail.

16) Insufficient Logging (CVE-ID: CVE-2026-53287)

CWE-ID: CWE-778 - Insufficient Logging

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to conceal capability changes in audit records.

The vulnerability exists due to incorrect data recording in __audit_log_capset() in the audit subsystem when logging CAPSET operations. A local user can modify inheritable capabilities to conceal capability changes in audit records.

This can mask preparation for a privilege-escalating exec in audit data used for compliance and forensic analysis.

17) Improper resource shutdown or release (CVE-ID: CVE-2026-53279)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the oaktrail LVDS initialization code when handling an initialization failure after obtaining an I2C adapter reference. A local user can trigger device initialization failure to cause a denial of service.

The issue can cause the kernel to hang indefinitely while waiting for an I2C adapter reference to be released.

18) Out-of-bounds write (CVE-ID: CVE-2026-53130)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to overwrite kernel memory.

The vulnerability exists due to an out-of-bounds write in omfs_make_empty() when processing a crafted OMFS filesystem image with s_sys_blocksize smaller than OMFS_DIR_START. A local user can mount a specially crafted filesystem image to overwrite kernel memory.

The issue is caused by an unsigned underflow in the length argument passed to memset().

19) Race condition (CVE-ID: CVE-2026-53128)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in drbd_adm_dump_devices() and drbd_adm_dump_peer_devices() when handling netlink dump requests with a resource filter. A local user can send a specially crafted netlink request to cause a denial of service.

20) Improper resource shutdown or release (CVE-ID: CVE-2026-53126)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in blkcg_maybe_throttle_current() when handling block cgroup throttling lookups and error paths. A local user can trigger lookup or reference acquisition failures to cause a denial of service.

The issue results from a disk reference leak that can prevent the disk object from being freed.

21) Improper locking (CVE-ID: CVE-2026-53123)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the raid456 reshape handling in the md subsystem when suspending an md device during direct I/O across the reshape position. A local user can freeze reshape and write md/suspend_lo or md/suspend_hi to trigger a deadlock and cause a denial of service.

The issue occurs because I/O can wait for reshape progress while still holding an active_io reference, preventing suspend from completing if reshape is already frozen or interrupted.

22) Deadlock (CVE-ID: CVE-2026-53122)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in the btrfs reflink operation when processing reflink operations with the flushoncommit mount option enabled. A local user can trigger a reflink of an inline extent to an offset beyond the destination inode size to cause a denial of service.

Exploitation requires the flushoncommit mount option and a reflink operation that copies an inline extent beyond the current i_size of the destination inode.

23) Use-after-free (CVE-ID: CVE-2026-53117)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the s390 cio driver_override handling when probing a driver through __driver_attach__(). A local user can trigger driver matching on a device with a stale driver_override reference to cause a denial of service.

The issue occurs because the bus match callback may access driver_override without the device lock held.

24) Use-after-free (CVE-ID: CVE-2026-53115)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the fsl-mc bus driver_override handling when matching drivers during device probing. A local user can trigger driver matching on a device with a stale driver_override reference to cause a denial of service.

The issue occurs because the match callback may access driver_override without the device lock held during __driver_attach().

25) Use-after-free (CVE-ID: CVE-2026-53112)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in irq_prepare_bcn_tasklet in the rtlwifi PCI driver when handling beacon interrupts during device probe failure or device detachment. A local user can trigger the affected code path to cause a denial of service.

The issue occurs because a pending or running tasklet may access a freed ieee80211_hw object.

26) NULL pointer dereference (CVE-ID: CVE-2026-53111)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in bpf_lwt_xmit_push_encap when executing BPF LWT_XMIT programs through bpf_prog_test_run_skb with an uninitialized skb destination reference. A local user can execute a crafted BPF program test run to cause a denial of service.

27) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-53110)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause incorrect behavior in kernel BPF processing.

The vulnerability exists due to improper handling of integer extension in the s390 BPF JIT compiler when processing BPF program return values and kfunc arguments. A local user can trigger the JIT compilation of crafted BPF code to cause incorrect behavior in kernel BPF processing.

The issue affects s390 systems because the ABI requires zero extension for unsigned arguments and return values, but only sign extension was implemented.

28) Use-after-free (CVE-ID: CVE-2026-53098)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mt7915_mac_dump_work() when processing queued dump work during device detachment. A local user can trigger device recovery while the device removal path is freeing crash_data to cause a denial of service.

The issue is caused by a race condition between the removal path and a workqueue handler.

29) Use-after-free (CVE-ID: CVE-2026-53097)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mt7996_mac_dump_work() when processing queued dump work during device detachment. A local user can trigger the race condition to cause a denial of service.

The issue occurs when the work item is still running or pending while crash_data has already been released.

30) Race condition (CVE-ID: CVE-2026-53096)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper use of RCU-safe iteration in dev_map_redirect_multi() and dev_map_enqueue_multi() when processing BPF devmap hash buckets under RCU protection. A local user can trigger concurrent updates and lookups to cause a denial of service.

On weakly ordered architectures, readers may observe a partially constructed node.

31) Use-after-free (CVE-ID: CVE-2026-53094)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the BPF offload program pointer handling in kernel/bpf/core.c when destroying a network namespace after JIT compilation with constant blinding enabled for a dev-bound-only BPF program. A local user can trigger cleanup of a crafted dev-bound-only XDP program to cause a denial of service.

Exploitation requires net.core.bpf_jit_harden to be set to 2 or higher and affects dev-bound-only programs created with BPF_F_XDP_DEV_BOUND_ONLY.

32) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-53093)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper check for exceptional conditions in brcmf_chip_recognition() in the brcmfmac driver when processing error returns from brcmf_chip_add_core(). A local user can trigger the vulnerable code path to cause a denial of service.

33) Off-by-one (CVE-ID: CVE-2026-53088)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in bcmgenet_put_txcb in the bcmgenet network driver when handling transmit control block pointer rewinding. A local user can trigger the flawed pointer handling to cause a denial of service.

34) Race condition (CVE-ID: CVE-2026-53086)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the bcmgenet_timeout handler when handling a transmit queue timeout. A local user can trigger a transmit queue timeout to cause a denial of service.

35) Use-after-free (CVE-ID: CVE-2026-53085)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the open-coded task_vma iterator in kernel/bpf/task_iter.c when iterating a task's virtual memory areas while the target task exits concurrently. A local user can trigger the iterator on a task whose mm_struct is freed concurrently to cause a denial of service.

The issue occurs because task->mm is read locklessly and no mm reference is acquired before mmap_read_trylock().

36) Improper locking (CVE-ID: CVE-2026-53084)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the bpf task_vma iterator when executing a BPF program that iterates task VMAs. A local user can trigger lock ordering conditions to cause a denial of service.

The issue arises because the iterator held a per-VMA lock across the BPF program body, creating a lock ordering problem involving vm_lock, i_rwsem, and mmap_lock.

37) Resource exhaustion (CVE-ID: CVE-2026-53083)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper control of resource consumption in bpf_fd_array_map_clear() in the BPF array map implementation when clearing PROG_ARRAY maps with many entries. A local user can trigger map clearing operations to cause a denial of service.

The issue can lead to RCU stalls under load.

38) Use of Uninitialized Variable (CVE-ID: CVE-2026-53082)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an uninitialized value read in sixpack_receive_buf() and sixpack_decode() in the 6pack hamradio driver when processing TTY input with error-flagged bytes. A local user can supply crafted input containing TTY error conditions to cause a denial of service.

The issue occurs because bytes marked with TTY error flags are not skipped correctly before decoding.

39) Improper access control (CVE-ID: CVE-2026-53077)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper restriction of operations in RDS/IB transport selection and address checking when using RDS/IB from a non-initial network namespace. A local user can select the RDS/IB transport from a non-initial network namespace to cause a denial of service.

The issue is specific to use of RDS/IB outside the initial network namespace.

40) Out-of-bounds read (CVE-ID: CVE-2026-53076)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in pcpu_init_value in the BPF hashtab implementation when copying an element from a BPF_MAP_TYPE_CGROUP_STORAGE map to another per-cpu map with the same non-8-byte-aligned value_size. A local user can update the destination map with data from the crafted source map to disclose sensitive information.

The issue occurs when the source map value size is not rounded up to 8 bytes, causing a copy operation to read past the claimed source size.

41) Improper access control (CVE-ID: CVE-2026-53075)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform unauthorized PPP administrative operations in an inherited network namespace.

The vulnerability exists due to improper access control in unattached PPP administrative ioctl handling in drivers/net/ppp/ppp_generic.c when processing PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN requests. A local user can create a new user namespace and issue crafted ioctl requests to perform unauthorized PPP administrative operations in an inherited network namespace.

Exploitation requires the ability to create a new user namespace with CLONE_NEWUSER.

42) Out-of-bounds read (CVE-ID: CVE-2026-53074)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in bpf_prog_test_run_skb() when processing crafted IPv4 or IPv6 test inputs with an insufficient L3 header. A local user can supply a specially crafted Ethernet frame to cause a denial of service.

43) Race condition (CVE-ID: CVE-2026-53073)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to a null pointer dereference in the Bluetooth hci_ldisc subsystem when processing incoming UART data after device registration fails. A local user can trigger device registration failure and subsequent UART data handling to cause a denial of service.

The issue occurs because protocol-specific receive handlers may be reached after resources have been freed.

44) Use-after-free (CVE-ID: CVE-2026-53072)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in hci_conn_request_evt() when handling deferred Bluetooth connection requests. A local user can trigger concurrent connection handling to cause a denial of service.

Only SCO deferred setup listen code paths are affected.

45) Race condition (CVE-ID: CVE-2026-53071)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to corrupt kernel memory.

The vulnerability exists due to a race condition in l2cap_ecred_reconf_rsp in the L2CAP subsystem when processing a crafted L2CAP ECRED reconfiguration response from a remote BLE device. A remote attacker can send a specially crafted L2CAP ECRED reconfiguration response to corrupt kernel memory.

Exploitation requires concurrent channel list iteration by another thread.

46) NULL pointer dereference (CVE-ID: CVE-2026-53069)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in xdp_master_redirect() when processing XDP redirect operations for a master device that is not up. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can be reached through the bonding round-robin transmit slave selection path when XDP redirection is enabled system-wide and the bond device was never opened.

47) Integer overflow (CVE-ID: CVE-2026-53068)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to integer overflow in the AFBC framebuffer size check in komeda_framebuffer.c when validating a userspace-supplied AFBC framebuffer object. A local user can provide an undersized drm_gem_object with crafted size-related values to cause an out-of-bounds memory access.

48) NULL pointer dereference (CVE-ID: CVE-2026-53066)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error pointers in sun4i_backend_atomic_check() in drivers/gpu/drm/sun4i/sun4i_backend.c when processing atomic plane state checks. A local user can trigger an error pointer dereference to cause a denial of service.

49) Improper resource shutdown or release (CVE-ID: CVE-2026-53065)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the sti uniperif player driver when removing the driver after player initialization. A local user can trigger driver initialization and removal to cause a denial of service.

50) NULL pointer dereference (CVE-ID: CVE-2026-53064)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the dm-cache target when handling concurrent writes in passthrough mode during cache entry invalidation. A local user can trigger concurrent writes to the same cached block to cause a denial of service.

Only the passthrough mode code path is affected.

51) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-53063)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper control flow management in invalidate_remove() in the dm-cache target when handling write hit bios after cache invalidation in passthrough mode. A local user can trigger write operations in this state to cause a denial of service.

The issue causes write operations to hang because a remapped overwrite bio is dropped without being submitted.

52) Use-after-free (CVE-ID: CVE-2026-53062)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the dm-cache smq policy invalidate_mapping operation when handling concurrent writes in passthrough mode. A local user can trigger concurrent cache block invalidations to cause a denial of service.

The issue occurs when the cache is operating in passthrough mode and multiple workers invalidate cache blocks simultaneously.

53) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-53061)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause data loss.

The vulnerability exists due to improper state validation in the dm-cache target when resuming a preloaded table in passthrough mode while dirty mappings are present. A local user can preload and resume a crafted dm-cache table configuration to cause data loss.

Exploitation requires local access to device-mapper management and occurs when metadata updates are still ongoing during table preloading.

54) Memory leak (CVE-ID: CVE-2026-53060)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in dm_cache_metadata_abort in the device-mapper cache metadata component when reloading a new table while metadata is read-only. A local user can trigger repeated metadata abort operations to cause a denial of service.

The issue can also occur through concurrent metadata_operation_failed calls due to races in cache mode updates.

55) Out-of-bounds write (CVE-ID: CVE-2026-53059)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in create_log_context() and dm-log bitset handling when processing a crafted device-mapper mirror target configuration with an oversized region count. A local user can create a crafted mirror target to cause a denial of service.

The issue is triggered when region_count overflows 32 bits, causing bitsets to be allocated smaller than required and later accessed with indices derived from the full region space.

56) NULL pointer dereference (CVE-ID: CVE-2026-53058)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the Cadence MHDP8546 DRM bridge driver when handling atomic enable error recovery paths. A local user can trigger link-up or register-read errors that reach modeset retry handling to cause a denial of service.

The issue occurs with the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag set.

57) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53056)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper power state management in the drm/msm/dpu runtime suspend logic when handling runtime suspend and resume operations. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when the MMCX rail is dropped to MIN_SVS while the core clock remains at its highest rate, which can lead to instability or a system crash when the clock is re-enabled.

58) Memory corruption (CVE-ID: CVE-2026-53052)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect memory access in the qdsp6 topology widget unload handler when processing a virtual widget without checking its type before accessing private data. A local user can trigger the vulnerable code path to cause a denial of service.

59) Race condition (CVE-ID: CVE-2026-53050)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dquot_scan_active() and quota deactivation handling in the quota subsystem when scanning active dquots during quota deactivation. A local user can trigger the race to cause a denial of service.

Under memory pressure, the caller of dquot_scan_active() can end up working on a freed dquot.

60) Improper locking (CVE-ID: CVE-2026-53049)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in gfs2_logd() and log flushing functions in the gfs2 log subsystem when handling concurrent transactions. A local user can trigger concurrent log flush activity to cause a denial of service.

61) NULL pointer dereference (CVE-ID: CVE-2026-53048)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in gfs2_log_release() when flushing outstanding glock work during an unmount. A local user can trigger an unmount condition to cause a denial of service.

62) Heap-based buffer overflow (CVE-ID: CVE-2026-53047)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the efi capsule loader when reallocating the phys array. A local user can trigger the vulnerable code path to cause a denial of service.

The issue affects 32-bit systems with PAE where phys_addr_t is 64-bit but pointers are 32-bit.

63) Use-after-free (CVE-ID: CVE-2026-53046)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in ksmbd_crypt_message() when handling SMB encryption requests with an asynchronous hardware crypto engine. A remote user can send a crafted SMB request to cause a denial of service.

Exploitation requires the ksmbd server to use an asynchronous crypto engine such as the Qualcomm Crypto Engine.

64) Improper input validation (CVE-ID: CVE-2026-53045)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the tegra124 emc timing change logic when processing memory timing settings. A local user can provide a timing configuration with an incorrect DLL state check to cause a denial of service.

65) Out-of-bounds read (CVE-ID: CVE-2026-53043)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in dlm_match_regions() when processing a crafted DLM_QUERY_REGION network message. A remote attacker can send a specially crafted network message to disclose sensitive information.

66) Improper input validation (CVE-ID: CVE-2026-53041)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ocfs2 xattr list handling logic when processing listxattr requests for inodes with both inline and block-based extended attributes. A local user can invoke listxattr on a crafted OCFS2 inode state to cause a denial of service.

The issue occurs when inline extended attribute names exactly consume the caller buffer and additional block-based extended attribute names are present.

67) Out-of-bounds read (CVE-ID: CVE-2026-53040)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the ocfs2 freefrag scan logic in fs/ocfs2/ioctl.c when processing a crafted filesystem through OCFS2_IOC_INFO with OCFS2_INFO_FL_NON_COHERENT. A local user can supply a crafted filesystem and issue the ioctl request to cause a denial of service.

The issue occurs in the non-coherent scan path, which reads raw group descriptor blocks without the validation performed by the coherent path.

68) Improper input validation (CVE-ID: CVE-2026-53039)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ocfs2_group_add when handling the OCFS2_IOC_GROUP_ADD ioctl with a user-controlled group block before validation. A local user can supply crafted group add input to cause a denial of service.

The issue can trigger a kernel BUG in ocfs2_set_new_buffer_uptodate().

69) Improper locking (CVE-ID: CVE-2026-53037)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper resource management in hid_post_reset() when processing a reset of a crafted USB device that includes both HID and storage or UAS components. An attacker with physical access can connect a crafted USB device to trigger a deadlock and cause a denial of service.

The issue occurs because the components can be reset only together, placing the affected code in block I/O error handling.

70) Off-by-one (CVE-ID: CVE-2026-53036)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in the arm64 BPF JIT immediate range check in check_imm() when validating branch displacement values for encoded BPF branch instructions. A local user can supply a crafted branch displacement value to cause a denial of service.

The issue can flip a forward branch into a backward one because the raw value is masked into the signed immediate field.

71) Improper locking (CVE-ID: CVE-2026-53035)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in bpf_iter_unix_seq_show() when processing BPF iterator output for AF_UNIX sockets. A local user can trigger a sockmap update from an iterator program to cause a denial of service.

Exploitation requires the ability to run a BPF iterator program that updates a sockmap.

72) NULL pointer dereference (CVE-ID: CVE-2026-53034)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in unix_stream_bpf_update_proto() when updating a sockmap for an af_unix stream socket during a concurrent connect operation. A local user can trigger a race condition via a bpf sockmap update to cause a denial of service.

The issue occurs in a race window where the socket state is set to established before the peer pointer is assigned.

73) Use-after-free (CVE-ID: CVE-2026-53033)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in unix_stream_bpf_update_proto() when processing BPF iterator updates to a sockmap during a unix socket state transition. A local user can trigger a race condition to cause a denial of service.

The issue occurs when the peer pointer becomes stale during the transition from TCP_ESTABLISHED to TCP_CLOSE.

74) NULL pointer dereference (CVE-ID: CVE-2026-53032)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in map_kptr_match_type() in the BPF verifier when processing a scalar register stored into a kptr slot. A local user can trigger the verifier to access a NULL btf pointer to cause a denial of service.

75) Out-of-bounds read (CVE-ID: CVE-2026-53023)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ntfs3_label_show() when exposing a cached NTFS volume label after UTF-8 conversion. A local user can mount a crafted NTFS filesystem image to disclose sensitive information.

76) Stack-based buffer overflow (CVE-ID: CVE-2026-53022)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in populate_enum_data() in the dell-wmi-sysman enumeration attribute handler when aggregating firmware-provided enumeration strings. A local user can provide crafted enumeration data to overflow fixed-size destination buffers and cause a denial of service.

The issue affects aggregation of value-modifier and possible-value strings into fixed 512-byte structure members.

77) Integer overflow (CVE-ID: CVE-2026-53021)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in sbc_execute_unmap() when processing UNMAP requests. A local user can send a crafted UNMAP request to cause a denial of service.

78) Out-of-bounds write (CVE-ID: CVE-2026-53016)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in ccp_aes_complete() when processing AF_ALG rfc3686-ctr-aes-ccp requests. A local user can supply a request with an 8-byte IV to cause a denial of service.

79) Integer overflow (CVE-ID: CVE-2026-53015)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer truncation in the EROFS zmap logic when processing crafted EROFS filesystem metadata on 32-bit platforms. A local user can provide a specially crafted filesystem image to cause a denial of service.

Only 32-bit platforms are affected.

80) Out-of-bounds write (CVE-ID: CVE-2026-53014)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to memory corruption in tcf_blockcast_redir in net/sched/act_mirred.c when redirecting packets to multiple devices in a block with mixed device types. A local user can trigger packet redirection through such a block to cause a denial of service.

In the worst case, an incorrect mac_len can exhaust skb headroom and panic the kernel.

81) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-53013)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper calculation of buffer size in macvlan_get_size() when dumping macvlan interface information over netlink. A local user can configure the bc_cutoff attribute and request detailed link information to cause a denial of service.

The issue is triggered when the broadcast cutoff value is not equal to 1, causing the netlink message buffer to run out of space and the interface dump to fail with -EMSGSIZE.

82) NULL pointer dereference (CVE-ID: CVE-2026-53012)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in IPv6 route handling in the nexthop subsystem when replacing an IPv6 nexthop with an IPv4 nexthop and then performing route lookups. A local user can replace a nexthop with one of a different address family and add an IPv6 route referencing the affected group to cause a denial of service.

83) Use-after-free (CVE-ID: CVE-2026-53011)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in advance_sched() in the taprio scheduler when switching schedules. A local user can trigger a schedule switch to cause a denial of service.

84) Use-after-free (CVE-ID: CVE-2026-53006)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in icmpv6_rcv() in the IPv6 ICMP handling code when processing ICMPv6 packets. A remote attacker can send a specially crafted ICMPv6 packet to cause a denial of service.

85) Out-of-bounds write (CVE-ID: CVE-2026-53004)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to corrupt adjacent userspace data.

The vulnerability exists due to an out-of-bounds write in sctp_getsockopt_peer_auth_chunks when processing a getsockopt request for peer AUTH chunks with an undersized optval buffer. A local user can supply a crafted buffer length to corrupt adjacent userspace data.

Exploitation requires an SCTP association with AUTH enabled, and the overwritten bytes land in the caller's own userspace buffer rather than in kernel memory.

86) Improper input validation (CVE-ID: CVE-2026-53003)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the PPPoE frame handling in the Linux kernel when processing PPPoE frames with a compressed protocol field. A remote attacker can send a specially crafted PPPoE frame to cause a denial of service.

The issue can trigger unaligned access exceptions on some architectures because the PPP payload becomes shifted by one byte and the network header becomes 4-byte misaligned.

87) Stack-based buffer overflow (CVE-ID: CVE-2026-53002)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in the nf_nat_sip netfilter helper when processing crafted SIP/SDP messages. A remote attacker can send specially crafted network traffic to cause a denial of service.

The issue is triggered in mangle_content_len() during SIP message handling.

88) Improper access control (CVE-ID: CVE-2026-53001)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass intended netfilter match restrictions.

The vulnerability exists due to improper access control in the netfilter xtables match extensions xt_mac, xt_owner, xt_physdev, and xt_realm when registering protocol families. A local user can invoke these matches with unsupported protocol families to bypass intended netfilter match restrictions.

The issue stems from these matches being registered for unspecified protocol families even though they are intended only for IPv4 and IPv6, and xt_realm is intended only for IPv4.

89) Out-of-bounds read (CVE-ID: CVE-2026-52999)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause incorrect logging behavior.

The vulnerability exists due to an out-of-bounds read in nf_osf_match_one() in nfnetlink_osf when processing TCP option matching across multiple fingerprints. A remote attacker can send specially crafted network traffic to cause incorrect logging behavior.

The issue is triggered when NF_OSF_LOGLEVEL_ALL is configured and matching continues after an earlier fingerprint match.

90) NULL pointer dereference (CVE-ID: CVE-2026-52998)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in nf_osf_ttl() when processing packets for TTL checks. A remote attacker can send a specially crafted packet to cause a denial of service.

91) Improper Initialization (CVE-ID: CVE-2026-52995)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in net/rds connection information handling when processing getsockopt requests for RDS connection information. A local user can query RDS IB connection information to disclose sensitive information.

Exploitation requires access to AF_RDS and an RDMA-capable network device, and occurs when connection state causes only part of the output structure to be populated.

92) Double free (CVE-ID: CVE-2026-52993)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in tipc_buf_append() when validating a reassembled skb after tipc_msg_validate() reallocates it. A local user can trigger the error-handling path with a crafted TIPC message to cause a denial of service.

93) Out-of-bounds write (CVE-ID: CVE-2026-52992)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in adfs_map_layout() when parsing a crafted ADFS image during filesystem probe. A local user can provide a crafted image with a zero zone count to cause a denial of service.

The issue affects new-format ADFS images and is triggered before the disc record is used.

94) Improper resource shutdown or release (CVE-ID: CVE-2026-52990)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in fsnotify_recalc_mask() when handling concurrent mark attach and detach operations. A local user can trigger the race condition to cause a denial of service.

The issue can manifest as a hung task during unmount operations.

95) Out-of-bounds read (CVE-ID: CVE-2026-52989)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds condition in nvmet_tcp_build_pdu_iovec() and the NVMe target TCP receive path when processing crafted PDU length or offset values. A remote attacker can send a specially crafted network PDU to cause a denial of service.

The issue occurs because a fatal error is not propagated to callers, leaving cmd->recv_msg.msg_iter uninitialized before subsequent receive handling uses it.

96) Out-of-bounds read (CVE-ID: CVE-2026-52986)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the nf_conntrack_sip SIP message parser when parsing non-NUL-terminated SIP packet data containing crafted port values. A remote attacker can send a specially crafted SIP packet to cause a denial of service.

The issue involves port parsing in epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request(), where parsing could reach the buffer limit without a trailing character.

97) Use of Uninitialized Variable (CVE-ID: CVE-2026-52985)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in nsim_dev_trap_skb_build when building a dummy sk_buff IP header. A local user can trigger the vulnerable code path to disclose sensitive information.

98) Resource exhaustion (CVE-ID: CVE-2026-52984)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in netem_enqueue() in the netem scheduler when handling reordered packets. A local user can trigger packet reordering to cause a denial of service.

99) Use-after-free (CVE-ID: CVE-2026-52982)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in rtl8150_start_xmit() when submitting a USB transmit URB and updating transmit statistics. A local user can trigger concurrent URB completion to cause a denial of service.

The issue is caused by reading skb->len after usb_submit_urb() returns, while the skb may already have been freed by the completion path on another CPU in softirq context.

100) Improper resource shutdown or release (CVE-ID: CVE-2026-52981)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in neigh_xmit in the neighbour networking subsystem when handling packet transmission with an uninitialized neighbor table. A local user can trigger packet transmission in this state to cause a denial of service.

This can occur, for example, when the IPv6 neighbor table is uninitialized because IPv6 is disabled.

101) Race condition (CVE-ID: CVE-2026-52977)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in futex requeue-PI handling in kernel/futex/requeue.c when processing wait-requeue-pi and requeue-PI operations during signal or timeout wakeup. A local user can trigger concurrent futex operations to cause a denial of service.

The issue can result in a live lock where one task blocks on a hash bucket lock while another busy loops, potentially locking up the system.

102) Race condition (CVE-ID: CVE-2026-52975)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a data race in the bonding 802.3ad port-to-aggregator handling code when processing netlink requests and concurrent bonding state changes. A local user can send crafted netlink messages to trigger the race and cause a denial of service.

The issue was reported by Kernel Concurrency Sanitizer and affects access to the port->aggregator pointer in the bonding subsystem.

103) Memory leak (CVE-ID: CVE-2026-52974)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the TLS RX offload setup error path when handling a failure in device offload initialization. A local user can trigger offload RX setup failure to cause a denial of service.

The issue occurs when tls_set_device_offload_rx() fails at tls_dev_add() after the strparser has been initialized and an anchor skb has been allocated.

104) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-52970)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing reference release in nft_ct_expect_obj_eval() in the netfilter nft_ct component when processing conntrack expectation objects. A local user can trigger the vulnerable code path to cause a denial of service.

105) Out-of-bounds write (CVE-ID: CVE-2026-52969)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in kvm_reset_dirty_gfn() and the KVM dirty ring handling logic when processing rewritten dirty ring entries from a vcpu file descriptor. A local user can modify slot and offset fields in crafted dirty ring entries to cause memory corruption.

The issue is reachable from a process holding /dev/kvm and affects the legacy MMU path with shadow paging, allocated shadow roots, or a write-tracked slot.

106) Out-of-bounds write (CVE-ID: CVE-2026-52968)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds access in the KVM s390 PCI GAIT handling code when processing AIF and host alert forwarding operations. A local user can trigger crafted GAIT index usage to cause a denial of service.

The issue is caused by double-scaling pointer arithmetic that accesses element aisb*16 instead of aisb, and out-of-bounds accesses occur when aisb is 32 or greater.

107) Out-of-bounds read (CVE-ID: CVE-2026-52967)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to cause a denial of service or disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in symlink_data() in fs/smb/client/smb2file.c when parsing SMB error context data for symlink responses. A remote attacker can send a specially crafted SMB response to cause a denial of service or disclose sensitive information.

On 32-bit architectures, malformed ErrorDataLength values can also trigger an infinite loop.

108) Out-of-bounds read (CVE-ID: CVE-2026-52964)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the USB MIDI 2.0 endpoint descriptor parser when parsing a malformed USB device descriptor. An attacker with physical access can connect a specially crafted USB device to cause a denial of service.

109) Out-of-bounds read (CVE-ID: CVE-2026-52963)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in snd_usbmidi_get_ms_info() / USB MIDI endpoint descriptor scanning when parsing crafted MIDIStreaming endpoint descriptors. A local user can provide a crafted USB device descriptor to disclose sensitive information.

110) Memory leak (CVE-ID: CVE-2026-52962)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in __ceph_setxattr() when retrying extended attribute updates. A local user can trigger repeated setxattr operations to cause a denial of service.

111) Race condition (CVE-ID: CVE-2026-52961)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in __ceph_build_xattrs_blob() and ceph xattr handling when processing concurrent xattr updates and capability grant handling. A local user can trigger stale blob size state to cause a denial of service.

The issue can lead to a kernel BUG in fs/ceph/xattr.c during Ceph xattr processing.

112) Out-of-bounds read (CVE-ID: CVE-2026-52958)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in osdmap_decode() when decoding a corrupted incoming osdmap message. A remote attacker can send a specially crafted osdmap message to cause a denial of service.

The issue can occur when the max_osd value in the message exceeds the actual content of the osdmap.

113) NULL pointer dereference (CVE-ID: CVE-2026-52957)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in decode_choose_args() when processing a crafted CEPH_MSG_OSD_MAP message containing a crush_choose_arg_map with a bucket index that refers to a NULL bucket. A remote attacker can send a specially crafted message to cause a denial of service.

114) Out-of-bounds read (CVE-ID: CVE-2026-52955)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in crush_decode() when processing a CEPH_MSG_OSD_MAP message containing a crush map with mismatched bucket algorithm fields. A remote attacker can send a specially crafted CEPH_MSG_OSD_MAP message to cause a denial of service.

115) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-52954)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of duplicate rbtree keys in decode_choose_args() when processing a crafted CEPH_MSG_OSD_MAP message containing duplicate choose_args_index values. A remote attacker can send a specially crafted message to cause a denial of service.

116) Use-after-free (CVE-ID: CVE-2026-52951)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race condition in the xe dma-buf import handling in drivers/gpu/drm/xe/xe_dma_buf.c when triggering the invalidate_mappings hook during buffer object initialization or error handling. A local user can trigger dma-buf import and race the invalidate_mappings callback to cause a denial of service.

The issue can occur when importing a dma-buf from another driver such as amdgpu, and reported outcomes include NULL pointer dereference and crashes during eviction flow.

117) Improper locking (CVE-ID: CVE-2026-52936)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock management in jent_kcapi_random() when generating entropy for parallel readers. A local user can trigger concurrent requests to cause a denial of service.

The issue arises because a shared lock is held across expensive entropy collection and SHA3 conditioning operations, causing contending readers to spin and stall.

118) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-52933)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper type conversion in io_poll_get_ownership() in io_uring/poll.c when handling poll ownership checks. A local user can trigger the affected code path to cause a denial of service.

119) NULL pointer dereference (CVE-ID: CVE-2026-52925)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the VRF port removal logic when removing a port from a VRF while concurrent RCU readers access the master device. A local user can trigger concurrent network operations to cause a denial of service.

The issue occurs because an RCU reader can observe a new non-VRF master device and then dereference missing l3mdev operations.

120) Improper access control (CVE-ID: CVE-2026-52920)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass inbound IPsec policy matching restrictions.

The vulnerability exists due to improper access control in the xt_policy netfilter matcher when processing strict mode inbound policy matching. A remote attacker can send network traffic that traverses a multi-element inbound rule to bypass inbound IPsec policy matching restrictions.

The issue affects strict matching of multi-element inbound rules.

121) Improper access control (CVE-ID: CVE-2026-52911)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to access another user's session.

The vulnerability exists due to improper access control in ksmbd_session_lookup_all() when processing a binding SESSION_SETUP request. A remote user can send a crafted session lookup request to access another user's session.

The issue occurs because a connection-wide binding flag can remain set after a binding SESSION_SETUP, allowing the global session lookup path to resolve sessions not bound to that connection.

122) Use-after-free (CVE-ID: CVE-2026-46319)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a use-after-free race condition in tcf_ct_flow_table_get() in net/sched/act_ct.c when looking up a flow table and incrementing its reference count. A local user can trigger the race during act_ct initialization to escalate privileges.

The race window is very short and occurs after the flow table object is returned from the hash table lookup but before its reference count is successfully incremented.

123) Improper input validation (CVE-ID: CVE-2026-46314)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in v3d_get_extensions() and multisync extension handling in the v3d driver when processing a userspace-provided ioctl extension list. A local user can submit a self-referential extension with zero in_sync_count and out_sync_count to cause a denial of service.

The issue can result in an infinite loop in kernel context that blocks the calling thread and pegs a CPU core indefinitely.

124) Improper Initialization (CVE-ID: CVE-2026-46312)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization of vma flags in vb2_dma_sg_mmap() in the videobuf2 dma-sg memory-mapping path when mmap() is performed on an imported dma-buf. A local user can trigger the affected mmap operation to cause a denial of service.

The issue manifests as a kernel warning in drm_gem_mmap_obj() during mmap() of an imported dma-buf.

125) Out-of-bounds write (CVE-ID: CVE-2026-46307)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the ath5k driver transmit completion handling in drivers/net/wireless/ath/ath5k/base.c when processing transmit status data. A local attacker can trigger the vulnerable code path to cause a denial of service.

The out-of-bounds write overwrites the adjacent ack_signal member, and the reported effect is negligible.

126) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-46306)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of compressed protocol fields in the PPPoE flow dissector in net/core/flow_dissector.c when processing PPPoE PFC frames. A remote attacker can send a specially crafted PPPoE PFC frame to cause a denial of service.

The issue can trigger an unaligned access exception on some architectures, and it was reproduced on MIPS systems with RPS enabled even when no PPPoE session was active on the interface.

127) Improper locking (CVE-ID: CVE-2026-46304)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in nvmet_ctrl_free when freeing a controller while processing nvmet-wq work items. A local user can trigger controller teardown to cause a denial of service.

The issue can lead to a possible recursive locking condition on the nvmet-wq workqueue during NVMe target controller teardown.

128) Out-of-bounds read (CVE-ID: CVE-2026-46303)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rock_continue() in the isofs Rock Ridge continuation entry parser when parsing a crafted ISO image during mount. A remote attacker can supply a crafted ISO image with a malformed CE continuation extent to disclose sensitive information.

User interaction may be required through desktop optical auto-mount, or exploitation may require mounting the crafted ISO with administrative mount capability.

129) Use-after-free (CVE-ID: CVE-2026-46301)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the spi-topcliff-pch driver when handling driver unbind operations with pending queued work. A local user can trigger driver unbind while queued operations are still being flushed to cause a denial of service.

The issue occurs because DMA buffers may be released before the driver queue is fully flushed during device removal.

130) Improper locking (CVE-ID: CVE-2026-46299)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock management in hfsplus_fill_super() when mounting a crafted HFS+ filesystem image. A local user can trigger the error path during filesystem mount to cause a denial of service.

The issue occurs when hfsplus_cat_build_key() fails after hfs_find_init() has acquired tree->tree_lock, leading to cleanup of the tree structure while the lock is still held.

131) NULL pointer dereference (CVE-ID: CVE-2026-46296)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL-pointer dereference in the s3c64xx spi driver remove() path when unbinding the driver. A local user can trigger driver unbind to cause a denial of service.

132) Out-of-bounds write (CVE-ID: CVE-2026-46294)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to cause a buffer overflow.

The vulnerability exists due to a buffer overflow in dm-ioctl retrieve_status when processing device mapper ioctl output buffers. A local privileged user can supply a crafted buffer layout to cause a buffer overflow.

Exploitation requires issuing device mapper ioctls, and the issue does not occur accidentally with commonly used libraries because they use 8-byte-aligned buffer sizes.

133) Out-of-bounds write (CVE-ID: CVE-2026-46293)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in mpfs_ccc_register_outputs() in the Microchip PolarFire SoC clock driver when registering clock outputs. A local user can trigger registration of affected outputs to cause a denial of service.

The issue occurs during registration of the last two outputs because sparse clock IDs are packed into the hws array.

134) Improper resource shutdown or release (CVE-ID: CVE-2026-46292)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in genpd_dev_pm_detach() for virtual devices in the generic PM domain core when detaching a device from a PM domain after attachment through genpd_dev_pm_attach_by_id(). A local user can trigger device detach handling to cause a denial of service.

In worst cases, the issue may result in a NULL pointer dereference in genpd_runtime_suspend().

135) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-46291)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in hash_digest_key in the caam hash implementation when debug hex dumps are generated with CONFIG_DYNAMIC_DEBUG enabled. A local user can read exposed HMAC key bytes from debug output to disclose sensitive information.

The issue affects HMAC key material handled by the CAAM crypto driver.

136) Improper locking (CVE-ID: CVE-2026-46287)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper locking in txgbe_remove_phy in the txgbe driver when removing the module for a copper NIC with an external PHY. A local privileged user can remove the txgbe module to cause a denial of service.

The issue is triggered during module removal and results in an RTNL assertion warning in phylink_disconnect_phy().

137) Out-of-bounds read (CVE-ID: CVE-2026-46286)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the qcom lpg pwm state handling code when processing high resolution clock selection values from a register. A local user can trigger an invalid array index to cause a denial of service.

138) Use-after-free (CVE-ID: CVE-2026-46285)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in docg3_release() in the docg3 driver when releasing a platform device. A local user can trigger the release of a crafted device state to cause a denial of service.

139) NULL pointer dereference (CVE-ID: CVE-2026-46282)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the admv1013 driver property parsing logic when reading device properties during device initialization. A local user can provide crafted property values or trigger property read failures to cause a denial of service.

The issue occurs because a failed string property read leaves a string pointer uninitialized before it is compared.

140) Use-after-free (CVE-ID: CVE-2026-46280)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in dmirror_devmem_fault() and dmirror_fops_release() in lib/test_hmm.c when handling faults on stale device private pages after file close. A local user can trigger a subsequent fault on those pages to cause a denial of service.

This issue was observed when a test failure triggered a coredump that walked VMAs and faulted in stale device private pages.

141) Use-after-free (CVE-ID: CVE-2026-46274)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in io_wq_remove_pending() and hash_tail handling in io_uring when cancelling hashed bucket-0 work with a non-hashed predecessor in the work list. A local user can trigger cancellation and subsequent hashed work insertion to execute arbitrary code.

The dangling pointer can persist for the lifetime of the task because the io_wq is per-task and survives ring open and close operations.

142) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-46273)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of segmentation offload constraints in ibmveth when processing gso packets with a small mss. A local user can send specially crafted packets to cause a denial of service.

The issue is triggered when the hardware performs segmentation with more than one segment and an MSS smaller than 224 bytes; single-segment GSO packets do not trigger the affected code path.

143) Use-after-free (CVE-ID: CVE-2026-46241)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the mpc52xx spi controller driver when controller registration fails. A local user can trigger a controller registration failure to cause a denial of service.

The issue may also result in a resource leak.

144) Use-after-free (CVE-ID: CVE-2026-46238)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the BAT IV neighbor state when handling purge operations on cached originator data. A local user can trigger network state changes that cause a stale originator pointer to be dereferenced to cause a denial of service.

145) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46236)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of dma coherency restrictions in xbox_remote when performing device i/o. A local user can trigger device i/o involving the improperly placed buffer to cause a denial of service.

146) NULL pointer dereference (CVE-ID: CVE-2026-46235)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in saa7164_dev_setup() when mapping PCI BAR memory regions. A local attacker can trigger memory mapping failures to cause a denial of service.

147) Improper input validation (CVE-ID: CVE-2026-46234)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to consume more socket memory than intended.

The vulnerability exists due to improper input validation in vsock_update_buffer_size() when processing user-controlled buffer size settings. A local user can set a minimum buffer size larger than the maximum to consume more socket memory than intended.

148) NULL pointer dereference (CVE-ID: CVE-2026-46233)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in batadv_bla_purge_claims() when traversing the list of claims during concurrent claim release. A local user can trigger concurrent claim handling to cause a denial of service.

The issue occurs because a claim being released may have its backbone_gw pointer set to NULL before delayed RCU freeing completes.

149) Out-of-bounds read (CVE-ID: CVE-2026-46232)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in dualshock4_parse_report when processing a crafted HID report from a malicious device. An attacker with physical access can provide a device that misreports the number of touch reports to disclose sensitive information.

Data is exposed via evdev when the DS4_TOUCH_POINT_INACTIVE bit is set.

150) Memory leak (CVE-ID: CVE-2026-46231)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in batadv_bla_add_claim() when handling a failed claim hash insert. A local user can trigger an error path that leaks a reference to a backbone_gw object to cause a denial of service.

151) Out-of-bounds read (CVE-ID: CVE-2026-46230)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the amdgpu vcn3 decoder message parser when parsing decoder messages from a buffer object. A local user can supply a specially crafted decoder message to disclose sensitive information.

152) Improper Initialization (CVE-ID: CVE-2026-46229)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in the KFD VRAM allocation path when allocating VRAM buffers for compute kernels. A local user can allocate VRAM buffers and observe stale data from prior use to disclose sensitive information.

Stale page table remnants may be exposed in user buffers.

153) Use-after-free (CVE-ID: CVE-2026-46227)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free and type confusion in sctp_sendmsg() SCTP_SENDALL path when iterating associations after sctp_sendmsg_to_asoc() drops and reacquires the socket lock. A local user can trigger concurrent association migration or freeing to execute arbitrary code.

The issue is reachable with no effective capabilities, and the type-confusion path can lead to a controlled indirect call via the outqueue.sched->init_sid pointer.

154) Improper resource shutdown or release (CVE-ID: CVE-2026-46226)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the fsl spi controller driver when the driver is unbound. A local user can trigger driver unbind while the controller is still registered to cause a denial of service.

155) Improper resource shutdown or release (CVE-ID: CVE-2026-46225)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the rspi driver controller deregistration logic when the driver is unbound. A local user can trigger driver unbind while the controller is still registered to cause a denial of service.

156) Reachable assertion (CVE-ID: CVE-2026-46220)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to reachable assertion use in sdma_v4_0_ring_emit_fence() when processing crafted DRM_IOCTL_AMDGPU_CS submissions. A local user can submit a specially crafted command submission request to cause a denial of service.

The issue can trigger a fatal kernel panic in a scheduler worker thread when a misaligned fence writeback address reaches the fence emission path.

157) Use-after-free (CVE-ID: CVE-2026-46219)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in the mpc52xx SPI driver state machine work handling when processing an unbind operation after an interrupt schedules work. A local attacker can trigger device unbinding while scheduled work remains pending to execute arbitrary code.

158) Out-of-bounds read (CVE-ID: CVE-2026-46218)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ib_get_value and ib_set_value when processing indirect buffer data at predefined offsets. A local user can supply a specially crafted indirect buffer to cause a denial of service.

The issue affects the uvd, vce, and vcn code paths.

159) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46214)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in virtio_transport_recv_listen() when handling connection attempts with a transport mismatch. A remote attacker can trigger repeated transport mismatch failures to cause a denial of service.

After enough such failures, the listener rejects all new connections because the accept queue backlog count remains permanently incremented.

160) Use-after-free (CVE-ID: CVE-2026-46212)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in batadv_bla_del_backbone_claims() when deleting backbone claims. A local user can trigger claim deletion to cause a denial of service.

161) NULL pointer dereference (CVE-ID: CVE-2026-46211)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in msm_ioctl_gem_info_get_metadata() when handling a metadata retrieval ioctl request after memory allocation failure. A local user can trigger allocation failure and invoke the ioctl to cause a denial of service.

162) Integer overflow (CVE-ID: CVE-2026-46209)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform out-of-bounds read or write operations.

The vulnerability exists due to an integer overflow in drm_gem_fb_init_with_funcs() when initializing framebuffer plane dimensions for sub-sampled pixel formats. A local user can create a specially crafted framebuffer configuration to perform out-of-bounds read or write operations.

The issue can occur for certain pixel format and dimension combinations where plane height calculation truncates instead of rounding up, causing the GEM object size check to accept an undersized object.

163) Use-after-free (CVE-ID: CVE-2026-46208)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tp_meter session handling during mesh teardown when processing tp_meter sessions as a mesh interface is being removed. A local user can trigger tp_meter activity during interface teardown to cause a denial of service.

164) Use of uninitialized resource (CVE-ID: CVE-2026-46207)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in virtio_transport_build_skb() when processing non-linear skbs for delivery to the vsockmon tap device. A local attacker can trigger handling of a specially crafted non-linear skb to disclose sensitive information.

The issue affects payload copying to the monitor interface, where no payload is copied and data remains uninitialized.

165) Race condition (CVE-ID: CVE-2026-46206)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in tp_meter when starting new sender or receiver sessions after mesh_state has left BATADV_MESH_ACTIVE. A local user can start a new tp_meter sender or receiver session during teardown to cause a denial of service.

166) Improper access control (CVE-ID: CVE-2026-46205)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform unauthorized ioctl operations.

The vulnerability exists due to improper access control in private ioctl handlers when handling ioctl commands. A local user can invoke a non-zero private ioctl command to perform unauthorized ioctl operations.

167) Out-of-bounds read (CVE-ID: CVE-2026-46204)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the amdgpu vcn4 IB parser when parsing IB data. A local user can provide a specially crafted IB to disclose sensitive information.

168) Improper resource shutdown or release (CVE-ID: CVE-2026-46201)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in xe_gem_prime_import() when handling dma-buf imports after xe_dma_buf_init_obj() fails. A local user can trigger an error during dma-buf import to cause a denial of service.

169) Improper resource shutdown or release (CVE-ID: CVE-2026-46200)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mpc52xx spi controller driver when the driver is being unbound. A local user can trigger driver unbind operations to cause a denial of service.

170) Out-of-bounds read (CVE-ID: CVE-2026-46199)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the drm/amdgpu vcn4 decoder message parser when parsing a decoder message from a buffer object. A local user can provide a specially crafted decoder message to disclose sensitive information.

171) Integer overflow (CVE-ID: CVE-2026-46198)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an integer overflow in batadv_iv_ogm_send_to_if when processing aggregated OGM packets. A local user can trigger the flawed size calculation to disclose sensitive information.

172) Out-of-bounds read (CVE-ID: CVE-2026-46197)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the SVM ioctl handler when processing a user-controlled attribute count. A local user can supply a crafted ioctl request to cause a denial of service.

173) Improper resource shutdown or release (CVE-ID: CVE-2026-46196)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in tracepoint_add_func() when handling tracepoint registration failures after invoking ext->regfunc(). A local user can trigger a func_add() failure during probe installation to cause a denial of service.

For syscall tracepoints, the issue can leave syscall tracing state enabled and impose persistent syscall entry and exit overhead until reboot.

174) Race condition (CVE-ID: CVE-2026-46194)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the f2fs extent tree handling in __destroy_extent_node() and __update_extent_tree_range() when concurrent inode drop and writeback operations occur. A local user can trigger concurrent writeback during extent node destruction to cause a denial of service.

The issue can trigger f2fs_bug_on() because new extent nodes may be inserted into the same extent tree while extent nodes are being destroyed, and EX_BLOCK_AGE updates were left unprotected.

175) Incorrect calculation (CVE-ID: CVE-2026-46193)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of ESN high bits in async callbacks in the AH implementation when processing AH packets with ESN enabled using an asynchronous AH implementation. A local user can send specially crafted AH traffic to cause a denial of service.

The issue affects both IPv4 and IPv6 AH paths, and exploitation requires ESN to be enabled with an asynchronous AH implementation selected.

176) Out-of-bounds write (CVE-ID: CVE-2026-46191)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in fbcon_rotate_font() and the rotated font buffer handling in fbcon when printing to a rotated console after console rotation reallocation fails. A local user can print a high-enough character code to overflow the font buffer to cause a denial of service.

Exploitation requires a console to be using rotation and the font reallocation during rotation to fail.

177) Out-of-bounds read (CVE-ID: CVE-2026-46190)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in spi_nor_params_show() when displaying SPI NOR parameters through debugfs. A local attacker can trigger access to debugfs output to disclose sensitive information.

The issue is caused by passing the byte size of an array of pointers instead of the actual element count, which can permit reads past the end of the names array on 64-bit systems when certain flag bits are set.

178) Double free (CVE-ID: CVE-2026-46189)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in pvrdma_alloc_ucontext() error path when handling ucontext allocation failures. A local user can trigger the error path to cause a denial of service.

179) Use-after-free (CVE-ID: CVE-2026-46187)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the rsi wifi driver kthread handling logic when stopping a kernel thread after it has already self-exited. A local user can trigger the race condition to cause a denial of service.

The issue occurs in the rare case where self-exit via kthread_complete_and_exit() happens before an external stop via kthread_stop().

180) Out-of-bounds read (CVE-ID: CVE-2026-46186)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in virtbt_rx_handle() and Bluetooth HCI packet classification when processing a backend-supplied RX packet with an insufficient header length. A local user can provide a specially crafted RX completion with a truncated packet to disclose sensitive information.

The issue can be triggered when the virtio Bluetooth device has an active CIS_LINK, BIS_LINK, or PA_LINK connection.

181) Improper input validation (CVE-ID: CVE-2026-46184)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in detect_usb_format() when processing class-specific USB descriptor fields from a connected device. An attacker with physical access can provide a crafted USB device with bNrChannels set to 0 to cause a denial of service.

The issue can lead to a kernel crash in playback_urb_complete() and capture_urb_complete() because a zero frame_bytes value is later used as a divisor.

182) Use-after-free (CVE-ID: CVE-2026-46180)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the brcmfmac watchdog task handling when stopping the watchdog task. A local user can trigger the watchdog task shutdown to cause a denial of service.

183) Division by zero (CVE-ID: CVE-2026-46179)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to divide by zero in compressed stream pointer reporting when reporting the pointer for an unconfigured stream. A local user can trigger pointer operations on an unconfigured compressed stream to cause a denial of service.

184) Improper resource shutdown or release (CVE-ID: CVE-2026-46178)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in mlx4_ib_create_srq() when handling error conditions during SRQ creation. A local user can trigger an error during SRQ creation to cause a denial of service.

185) Excessive Iteration (CVE-ID: CVE-2026-46177)

CWE-ID: CWE-834 - Excessive Iteration

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper restriction of excessive iteration in the ipmi driver when processing event and receive message fetches from a BMC that continues reporting available data. A local user can trigger interaction with a malfunctioning or malicious BMC to cause a denial of service.

The issue can also be triggered when the si interface attention state remains stuck and repeatedly causes flag fetch handling.

186) Use-after-free (CVE-ID: CVE-2026-46176)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free and double free in mlx5_ib_dev_res_srq_init() when handling an error during SRQ initialization after ib_create_srq() fails for the second SRQ. A local user can trigger the faulty initialization path to cause a denial of service.

The issue occurs because freed and error-pointer SRQ values are stored and later dereferenced during queue pair creation and cleanup.

187) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-46174)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause instruction corruption.

The vulnerability exists due to improper isolation of shared resources in Zen2 op cache when executing code on the system. A local user can run code locally to cause instruction corruption.

188) Use-after-free (CVE-ID: CVE-2026-46173)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to use-after-free in make_task_dead()/do_task_dead() task exit handling when an already-exiting task oopses during task exit. A local user can trigger an oops in a file_operations::release handler to cause memory corruption.

This can result in two tasks running on the same stack.

189) Memory leak (CVE-ID: CVE-2026-46172)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in xfrm6_rcv_encap() when processing IPv6 packets that trigger an error route lookup. A remote attacker can send specially crafted packets to cause a denial of service.

Repeated packets hitting this path leak dst entries.

190) Use of Uninitialized Variable (CVE-ID: CVE-2026-46169)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uninitialized memory use in hfs_brec_read() and catalog record handling in the hfsplus filesystem code when mounting a corrupted filesystem. A local user can mount a specially crafted filesystem image to cause a denial of service.

191) Improper locking (CVE-ID: CVE-2026-46168)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in timestamp socket option handling when setting timestamp-related socket options. A local user can invoke timestamp socket option operations to cause a denial of service.

192) Heap Inspection (CVE-ID: CVE-2026-46167)

CWE-ID: CWE-244 - Improper Clearing of Heap Memory Before Release ('Heap Inspection')

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to uninitialized heap memory exposure in the usblp driver LPGETSTATUS ioctl path when processing a status response from a connected USB printer. An attacker with physical access can cause a malicious printer to return zero bytes in response to a status request to disclose sensitive information.

The issue occurs because the status buffer may contain stale heap data before the first LPGETSTATUS ioctl call.

193) Double free (CVE-ID: CVE-2026-46164)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in create_space_info_sub_group() when handling an error from kobject_init_and_add(). A local user can trigger the error path to cause a denial of service.

194) Out-of-bounds read (CVE-ID: CVE-2026-46163)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in b43legacy_rx() when processing received frames with a firmware-controlled key index. A remote attacker can supply a crafted key index value to disclose sensitive information.

195) Division by zero (CVE-ID: CVE-2026-46161)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to divide-by-zero in setup_geo() when processing a user-provided layout parameter with zero far_copies and the improved far set layout selected. A local user can supply a crafted layout value to cause a denial of service.

The issue is triggered when far_copies is zero under the improved far set layout.

196) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46160)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause filesystem corruption and a denial of service.

The vulnerability exists due to improper state update in the btrfs directory unlink handling when removing a directory and later fsyncing it through an open file descriptor. A local user can remove a directory, retain a file descriptor to it, and trigger fsync to cause filesystem corruption and a denial of service.

The issue can cause log replay to fail with an -EIO error when the filesystem is mounted.

197) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-46159)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a time-of-check time-of-use race in btrfs_ioctl_space_info() when processing a space information ioctl request while block groups are concurrently removed. A local user can trigger the ioctl and race concurrent block group removal to disclose sensitive information.

The issue can result in copying uninitialized kmalloc heap bytes to userspace.

198) Race condition (CVE-ID: CVE-2026-46157)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a data race in the ALSA pcm oss subsystem when accessing the runtime.oss.trigger field concurrently. A local user can trigger concurrent access to confuse operation and cause a denial of service.

The issue involves a bit field, so concurrent writes may overwrite other bit fields as well.

199) Race condition (CVE-ID: CVE-2026-46152)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause incorrect packet processing.

The vulnerability exists due to a race condition in ieee80211_invoke_fast_rx() when processing packets in parallel RX paths. A local user can trigger concurrent packet processing to cause incorrect packet processing.

This issue arises because concurrent callers share a single rx_result instance, which can be overwritten between ieee80211_rx_mesh_data() and the subsequent switch on the result.

200) Use of uninitialized resource (CVE-ID: CVE-2026-46151)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in the usblp driver when processing a short IEEE 1284 GET_DEVICE_ID control response from a connected USB printer. An attacker with physical access can connect a specially crafted device that returns a truncated response with a forged length field to disclose sensitive information.

The leaked data may be exposed through the ieee1284_id sysfs attribute and the IOCNR_GET_DEVICE_ID ioctl.

201) Improper access control (CVE-ID: CVE-2026-46150)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass permission checks.

The vulnerability exists due to improper access control in fsnotify_get_mark_safe() when processing fanotify permission events. A local user can trigger permission events in the presence of an unrelated detached mark to bypass permission checks.

202) Out-of-bounds read (CVE-ID: CVE-2026-46149)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tg_pt_gp_members_show() when formatting and copying LUN paths to a sysfs reader. A local user can read the affected sysfs entry with a long fabric WWN value to disclose sensitive information.

When CONFIG_FORTIFY_SOURCE is enabled, exploitation triggers fortify_panic() instead of leaking adjacent stack contents.

203) Improper input validation (CVE-ID: CVE-2026-46146)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in convert_chmap_v3() when parsing a malformed USB audio descriptor. A local user can connect or present a specially crafted USB audio device to trigger an endless loop and cause a denial of service.

204) Out-of-bounds write (CVE-ID: CVE-2026-46145)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to overwrite kernel memory.

The vulnerability exists due to an out-of-bounds write in the RDMA/mana rx hash key handling when processing a user-supplied uAPI structure. A local user can supply a crafted rx_hash_key_len value to overwrite kernel memory.

205) Improper resource shutdown or release (CVE-ID: CVE-2026-46144)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in mana_ib_create_qp_rss() when handling queue pair creation errors. A local user can trigger an error during queue pair creation to cause a denial of service.

206) Improper resource shutdown or release (CVE-ID: CVE-2026-46143)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in q6apm-lpass-dai when prepare is called multiple times for the playback path. A local user can repeatedly trigger prepare to cause a denial of service.

207) Improper access control (CVE-ID: CVE-2026-46142)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access to a restricted register in net: libwx when initializing a virtual function device. A local user can initialize a virtual function to cause a denial of service.

The issue is triggered when a virtual function attempts to read the PF-restricted register WX_CFG_PORT_ST, leading to a system hang.

208) Use of uninitialized resource (CVE-ID: CVE-2026-46139)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uninitialized memory in build_sec_desc() when building an ACL descriptor. A local user can trigger construction of a security descriptor with a non-zero reserved field to cause a denial of service.

The issue can cause chmod to fail with EINVAL when the malformed security descriptor is rejected.

209) Out-of-bounds read (CVE-ID: CVE-2026-46138)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hci_le_create_big_complete_evt when processing a crafted LE_Create_BIG_Complete event. A remote attacker can send a specially crafted Bluetooth controller event to cause a denial of service.

The issue can also result in an infinite loop while hci_dev_lock is held when the event contains fewer bis_handle entries than expected or num_bis is zero.

210) Race condition (CVE-ID: CVE-2026-46137)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in mptcp_pm_add_timer() when handling ADD_ADDR retransmission timer callbacks. A local user can trigger concurrent access to cause a denial of service.

211) Integer underflow (CVE-ID: CVE-2026-46136)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer underflow in the clc buffer length handling in the mt7921 driver when retrieving the country power setting. A local user can trigger the vulnerable code path to cause a denial of service.

The issue may result in an almost infinite loop or an invalid power setting that causes driver initialization failure.

212) Out-of-bounds read (CVE-ID: CVE-2026-46133)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rxe_icrc_hdr() and opcode handling in the Soft RoCE receive path when processing a specially crafted UDP packet with an unknown RDMA opcode. A remote attacker can send a specially crafted UDP packet to trigger an out-of-bounds read and cause a denial of service.

The issue can be triggered without authentication after the RDMA RXE interface is enabled, and no queue pair or connection setup is required.

213) Use of Uninitialized Variable (CVE-ID: CVE-2026-46132)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to uninitialized stack memory in rtnl_fill_vfinfo when handling RTM_GETLINK requests with an IFLA_EXT_MASK attribute carrying RTEXT_FILTER_VF. A local attacker can send a crafted netlink request to disclose sensitive information.

The issue can leak up to 26 bytes of uninitialized kernel stack per virtual function per request to userspace.

214) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-46131)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper check of nested EPT/NPT state in KVM x86 slow flush hypercalls when handling hypercalls from a nested guest. A local user can trigger the affected hypercall path to cause a denial of service.

Exploitation requires a nested virtualization scenario in which an L2 guest is running.

215) Double free (CVE-ID: CVE-2026-46129)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in create_space_info() when handling an error after a failed kobject_init_and_add() call. A local user can trigger the vulnerable error path to cause a denial of service.

216) Improper input validation (CVE-ID: CVE-2026-46128)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ipmi event message buffer response handling when processing event message buffer responses from a BMC. A local user can trigger processing of a malformed or empty response to cause a denial of service.

Some BMCs may return an empty message instead of an error when events are fetched.

217) NULL pointer dereference (CVE-ID: CVE-2026-46127)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ocrdma_copy_pd_uresp() when handling error conditions. A local user can trigger an error path to cause a denial of service.

218) Double free (CVE-ID: CVE-2026-46126)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() when unwinding error paths during queue pair creation. A local user can trigger a failure during queue pair creation to cause a denial of service.

219) Use-after-free (CVE-ID: CVE-2026-46125)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in debugfs when handling failed connection preparation for mlo connections. A local user can trigger connection preparation failure and access the affected debugfs state to cause a denial of service.

The issue occurs when debugfs is enabled and an interface is reset from mld to non-mld, which recreates its debugfs entries.

220) Improper input validation (CVE-ID: CVE-2026-46124)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper input validation in isofs_export_iget when processing block numbers from NFS file handles. A remote user can send a crafted NFS file handle to disclose sensitive information.

Exploitation requires an authenticated NFS peer and affects isofs exported over NFS from loop-mounted images.

221) Out-of-bounds read (CVE-ID: CVE-2026-46123)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in virtbt_rx_work() and virtbt_rx_handle() when processing device-reported receive lengths from the virtio Bluetooth backend. A local attacker can provide a crafted length value to cause the kernel to read uninitialized memory and disclose sensitive information.

The issue can be triggered when the backend reports a receive length larger than the 1000-byte buffer exposed to the device, or when it reports an empty completion with a zero length.

222) Out-of-bounds read (CVE-ID: CVE-2026-46122)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in b43_rx() when processing firmware-provided key index values. A local attacker can supply an invalid key index to disclose sensitive information.

The issue occurs because the firmware-controlled key index can exceed the dev->key[] array size of 58 entries.

223) Use-after-free (CVE-ID: CVE-2026-46121)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in DAMON sysfs memcg_path file handling when performing concurrent reads and writes through separate open files. A local user can trigger concurrent access to a freed buffer to cause a denial of service.

The issue affects user-driven direct reads and writes, while reads performed during parameter committing are separately synchronized.

224) Use-after-free (CVE-ID: CVE-2026-46120)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ip6erspan_changelink() when changing link configuration after network namespace migration. A local user can trigger tunnel reinsertion into the wrong per-netns hash to cause a denial of service.

The issue is reachable from an unprivileged user namespace.

225) Improper input validation (CVE-ID: CVE-2026-46117)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to improper input validation in mana_ib_create_qp_rss() when processing user-supplied work queue configurations through the RDMA uAPI. A local user can specify work queues sharing the same completion queue to corrupt kernel memory.

226) Use-after-free (CVE-ID: CVE-2026-46116)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __xfrm_state_delete when deleting xfrm_state list entries during xfrm_state lifecycle handling. A local user can trigger repeated deletion of the same xfrm_state object to cause a denial of service.

The issue was reproduced under syzkaller load during network namespace cleanup in the xfrm subsystem.

227) Out-of-bounds read (CVE-ID: CVE-2026-46114)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in atomic_write_reply() in the RDMA rxe responder when processing a crafted ATOMIC_WRITE request with a zero-length logical payload. A remote attacker can send a specially crafted ATOMIC_WRITE request to disclose sensitive information.

The issue can leak kernel tailroom bytes into the attacker's memory region, including recognizable kernel strings and partial pointer words.

228) Use-after-free (CVE-ID: CVE-2026-46113)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in KVM shadow paging when handling guest page table changes between VM entries. A local user can modify guest page tables to create a stale reverse-mapping entry and trigger a stale rmap walk to cause a denial of service.

This can be triggered during operations such as dirty logging or MMU notifier invalidations.

229) Improper locking (CVE-ID: CVE-2026-46112)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to corrupt memory.

The vulnerability exists due to improper locking in hns_roce_create_qp_common() and hns_roce_qp_remove() when handling error unwind during queue pair creation. A local user can trigger the error path to corrupt memory.

230) Use-after-free (CVE-ID: CVE-2026-46111)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in create_big_sync/create_big_complete in the Bluetooth hci_conn handling code when processing BIG creation completion after an asynchronous operation on a stale connection. A local attacker can trigger BIG creation and cause the kernel to dereference a freed connection pointer to cause a denial of service.

231) NULL pointer dereference (CVE-ID: CVE-2026-46110)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in stmmac_rx() and stmmac_rx_zc() in the stmmac driver when processing receive descriptors after RX memory exhaustion. A local attacker can trigger memory starvation and network receive processing to cause a denial of service.

The issue occurs when dirty descriptors with OWN=0 and NULL buffers are mistaken for completed descriptors.

232) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-46108)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the ipmi:si driver when handling message allocation failures. A local user can trigger a message allocation failure to cause a denial of service.

233) Improper update of reference count (CVE-ID: CVE-2026-46107)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in the dm-thin rebalance_children function when rebalancing internal btree nodes with a shared child node. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because grandchild node reference counts are not increased when the shared child node is retained, which can lead to "device mapper: space map common: unable to decrement block" errors.

234) Race condition (CVE-ID: CVE-2026-46106)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in eventfs remount handling when walking events during remount operations. A local user can trigger concurrent remount and event creation or removal operations to cause a denial of service.

The issue occurs because the walk over eventfs children is performed without the required eventfs mutex and SRCU protection, which can lead to dereference of reclaimed or poisoned list entries.

235) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46103)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource lifetime management in the ucan USB driver control message buffer when drivers are unbound without physical device disconnection. A local user can trigger driver unbind conditions to cause a denial of service.

This can occur during probe deferral or configuration changes.

236) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-46102)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in strp_abort_strp() when aborting the stream parser after a message assembly timeout. A remote attacker can trigger repeated aborts with partially assembled messages to cause a denial of service.

The issue leaks a reference to a partially assembled message held in strp->skb_head.

237) Improper input validation (CVE-ID: CVE-2026-46101)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in nft_bitwise when initializing left and right shift expressions with a zero shift operand. A local user can create a malformed rule to cause a denial of service.

The issue is triggered in the control plane before malformed rules reach the packet path.

238) Use-after-free (CVE-ID: CVE-2026-46099)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in seg6 and rpl lwtunnels when processing IPv6 routing lookups and caching a NOREF destination entry. A local user can trigger a race condition to cause a denial of service.

Exploitation requires PREEMPT_RT without PREEMPT_RT_NEEDS_BH_LOCK and a concurrent task able to release a shared nexthop per-cpu route entry.

239) Use-after-free (CVE-ID: CVE-2026-46098)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the caif client teardown logic when handling remote shutdown and subsequent socket destruction. A remote attacker can trigger repeated teardown to cause a denial of service.

240) Out-of-bounds read (CVE-ID: CVE-2026-46094)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in check_xattrs() when processing crafted ext4 extended attribute entries. A local attacker can provide a malformed xattr layout to trigger a read beyond the valid xattr region to disclose sensitive information.

241) NULL pointer dereference (CVE-ID: CVE-2026-46092)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a NULL pointer in the rtw88 PCI probing routine when probing an 8821CE device on a root bus without an upstream PCI bridge. A local user can install or attach a device in a crafted PCI topology to cause a denial of service.

The issue is triggered only on systems where the 8821CE device is present on a root bus and no upstream PCI-to-PCI bridge exists.

242) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46091)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of dma coherency in igorplugusb when processing a usb control request. A local user can trigger a crafted interaction with the usb device to cause a denial of service.

243) Use-after-free (CVE-ID: CVE-2026-46090)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the ALSA aloop peer runtime handling when processing a format-change stop during concurrent stream operations. A local user can trigger concurrent playback start and capture close operations to cause a denial of service.

The issue occurs because a stale peer substream pointer may be used after the capture runtime is detached or freed.

244) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-46089)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of partial discard requests in zram when processing discard operations. A local user can issue a partial discard request to cause a denial of service.

The issue can cause the calling process to sleep indefinitely in submit_bio_wait().

245) Improper input validation (CVE-ID: CVE-2026-46088)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper buffer length validation in snd_ctl_elem_init_enum_names() when parsing enumeration names from a buffer. A local user can provide a crafted buffer with insufficient remaining length to trigger a kernel panic.

The issue is triggered on systems using CONFIG_FORTIFY_SOURCE where fortified strnlen() checks the remaining object size before the return value is examined.

246) NULL pointer dereference (CVE-ID: CVE-2026-46086)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in br_fdb_fillbuf() when reading bridge forwarding database entries through the brforward_read() sysfs path during a concurrent local FDB update. A local user can trigger concurrent access to cause a denial of service.

The issue arises because RCU readers can observe inconsistent values of f->dst across a check and a later dereference.

247) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46084)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in RSS queue pair destruction in mana_ib when destroying an RSS queue pair while traffic continues to arrive and the VF interface is subsequently brought up. A local user can destroy an RSS queue pair and trigger interface reinitialization while traffic is still being received to cause a denial of service.

The issue involves stale vPort RX steering configuration in firmware that can direct RX completions to reused TX completion queues.

248) Improper resource shutdown or release (CVE-ID: CVE-2026-46083)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in spi device setup when registering a device after spi_setup() fails. A local user can trigger device setup failure to cause a denial of service.

249) Improper handling of exceptional conditions (CVE-ID: CVE-2026-46082)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in KVM SVM instruction emulation when processing the INVLPGA instruction with EFER.SVME cleared. A local user can execute the INVLPGA instruction in a guest context to cause a denial of service.

250) Resource exhaustion (CVE-ID: CVE-2026-46080)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in ocfs2 direct I/O completion handling when processing direct I/O write completion. A local user can trigger direct I/O operations that exhaust journal transaction credits to cause a denial of service.

A crash during extent tree updates may leave stale blocks beyond EOF.

251) Double free (CVE-ID: CVE-2026-46079)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in the rbd device add error-handling path when handling a failure after device_add() succeeds but device_add_disk() fails. A local user can trigger the vulnerable teardown sequence by writing to /sys/bus/rbd/add_single_major to cause a denial of service.

Exploitation was reproduced when fault injection was confined to the __add_disk() range.

252) Out-of-bounds read (CVE-ID: CVE-2026-46078)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the EROFS directory entry handling code when parsing a crafted EROFS image with a trailing directory entry containing an invalid name offset. A local user can provide a specially crafted EROFS image to disclose sensitive information.

The issue occurs because an unchecked name offset can cause an underflow in the length calculation used by strnlen(), leading to a read past the directory block.

253) Improper synchronization (CVE-ID: CVE-2026-46077)

CWE-ID: CWE-662 - Improper Synchronization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper synchronization in atmel-tdes DMA output handling when processing cryptographic operations. A local user can trigger DMA output processing to disclose sensitive information.

This can result in stale cache data being returned on non-coherent platforms.

254) Improper access control (CVE-ID: CVE-2026-46076)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to bypass hypercall interception controls.

The vulnerability exists due to improper access control in KVM nested SVM handling when processing VMMCALL from an L2 guest. A remote user can invoke an unhandled VMMCALL to bypass hypercall interception controls.

Exploitation requires an active nested virtualization scenario where L2 is running, L1 does not intercept VMMCALL, nested_svm_l2_tlb_flush_enabled() is true, and the hypercall is not one of the supported Hyper-V hypercalls.

255) Use-after-free (CVE-ID: CVE-2026-46075)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the atmel-sha204a remove path when handling device removal with queued hwrng read callbacks. A local user can trigger access to the device during removal to cause a denial of service.

256) Out-of-bounds read (CVE-ID: CVE-2026-46073)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the powerz hwmon driver when handling a signal interruption during USB transfer completion. A local user can trigger a signal interruption and cause the driver to read from an unfilled transfer buffer to disclose sensitive information.

257) Out-of-bounds read (CVE-ID: CVE-2026-46072)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in run_unpack() when mounting a crafted NTFS image with truncated run data in an MFT attribute. A local user can mount a specially crafted NTFS image to disclose sensitive information.

258) Out-of-bounds read (CVE-ID: CVE-2026-46070)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() when processing corrupted journal metadata blocks. A local user can provide a corrupted journal with payload size fields that extend beyond the metadata block boundary to disclose sensitive information.

259) Use-after-free (CVE-ID: CVE-2026-46069)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mwifiex_adapter_cleanup() when cleaning up the adapter while the wakeup timer callback is still executing. A local user can trigger device removal during this race condition to cause a denial of service.

260) Memory leak (CVE-ID: CVE-2026-46068)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in nx842 crypto context handling when allocating or freeing bounce buffers. A local user can trigger the vulnerable code path to cause a denial of service.

261) Use-after-free (CVE-ID: CVE-2026-46065)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fbdev deferred I/O handling when accessing a memory mapping after device hot-unplug. A local user can keep an active mapping of graphics memory and access it after hot-unplug to cause a denial of service.

Access to the invalidated mapping may result in a SIGBUS signal.

262) Out-of-bounds read (CVE-ID: CVE-2026-46064)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to a heap-based buffer over-read in ibmasm_send_i2o_message() when processing a crafted dot command header from a user-supplied buffer. A local privileged user can supply a small buffer with inflated header fields to disclose sensitive information.

The over-read data is forwarded to the service processor over MMIO.

263) Deadlock (CVE-ID: CVE-2026-46063)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in shadow stack signal frame handling during sigreturn when reading the shadow stack signal frame from userspace. A local user can trigger a page fault during sigreturn to cause a denial of service.

The issue can occur when a writer on another CPU is waiting on the mmap lock, leading to a deadlock in the fault handling path.

264) Integer overflow (CVE-ID: CVE-2026-46062)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in run_unpack() when processing crafted ntfs metadata. A local user can provide a specially crafted ntfs image to trigger the overflow and cause a denial of service.

The issue was found by fuzzing.

265) Deadlock (CVE-ID: CVE-2026-46061)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in jbd2_journal_cancel_revoke() when handling filesystem operations on filesystems with a block size smaller than the page size. A local user can trigger the deadlock to cause a denial of service.

The issue can cause the system to hang.

266) Use-after-free (CVE-ID: CVE-2026-46058)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to use-after-free in the amphion vpu driver m2m handling when releasing and scheduling the same m2m context concurrently. A local user can trigger concurrent job abort and device run operations to cause a denial of service.

The issue can result in a kernel panic due to a read from freed memory.

267) Use-after-free (CVE-ID: CVE-2026-46056)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in SSP passkey handlers when handling Bluetooth SSP passkey and keypress notification events. A local user can trigger concurrent connection teardown during event processing to cause a denial of service.

268) Double free (CVE-ID: CVE-2026-46053)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in __rds_rdma_map() when copying the generated cookie back to user space. A local user can trigger a copy error after memory region registration succeeds to cause a denial of service.

269) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-46052)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of negative dentries in fs/ceph/dir.c when processing Ceph lookup or atomic_open operations with reused cached negative dentries. A local user can trigger lookup paths that call d_add() on an already-hashed negative dentry to cause a denial of service.

The issue can corrupt the dcache hash bucket, potentially creating a self-loop that causes __d_lookup() to spin forever and trigger RCU stall reports.

270) Improper locking (CVE-ID: CVE-2026-46051)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in retry_aligned_read() when processing overlapped stripes. A local user can trigger overlapped stripe handling to cause a denial of service.

271) Integer underflow (CVE-ID: CVE-2026-46050)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow in the md/raid10 request handling logic when processing nowait I/O requests during an array check operation. A local user can issue nowait I/O on the same array while a check operation is running to cause a denial of service.

The issue can cause the md resync thread and other requests to become stuck waiting on the barrier state.

272) Improper Initialization (CVE-ID: CVE-2026-46049)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in spdif_passthru_playback_get_resources() when handling S/PDIF passthrough playback setup for 32000 Hz. A local user can trigger audio playback setup to cause a denial of service.

The issue can cause the calculation loop to spin indefinitely because the PLL rate remains 0 after card initialization.

273) Use-after-free (CVE-ID: CVE-2026-46047)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the qrtr namespace remove callback when handling packets during driver removal. A local user can trigger packet delivery during driver removal to cause a denial of service.

The issue occurs in a race window after the workqueue is destroyed and before the socket is released.

274) Improper resource shutdown or release (CVE-ID: CVE-2026-46046)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ext4_xattr_inode_dec_ref_all() when decrementing extended attribute inode references. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because a buffer head obtained through ext4_get_inode_loc() is not released with brelse(), resulting in a refcount leak when block_csum is false.

275) Improper resource shutdown or release (CVE-ID: CVE-2026-46044)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the ssif kthread cleanup logic when handling error conditions after creating the ssif kthread but before starting the ssif interface. A local user can trigger an error condition during ssif interface initialization to cause a denial of service.

276) Improper locking (CVE-ID: CVE-2026-46041)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in hdlc_tx_frames() and hdlc_append() when processing frames for transmission. A local user can trigger transmission of frames to cause a denial of service.

The issue can trigger a "BUG: scheduling while atomic" condition.

277) Improper resource shutdown or release (CVE-ID: CVE-2026-46040)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in inotify_new_watch() when handling a failure from fsnotify_add_inode_mark_locked(). A local user can repeatedly trigger watch creation failures to cause a denial of service.

The issue can exhaust the max_user_watches limit with -ENOSPC even when no watches are active.

278) Memory leak (CVE-ID: CVE-2026-46038)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in ctrl_cmd_bye() when processing a BYE packet from a node. A remote attacker can send a BYE packet to trigger a memory leak and cause a denial of service.

279) Out-of-bounds read (CVE-ID: CVE-2026-46037)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the ipv4 icmp reply handling logic when processing extended echo replies. A remote attacker can send a specially crafted icmp packet to cause a denial of service.

280) Out-of-bounds read (CVE-ID: CVE-2026-46033)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in the authencesn ESN encrypt/decrypt paths when handling AF_ALG requests with a too-short authentication tag inherited from an ahash digest size of 1 to 3 bytes. A local user can select an ahash with a digest size of 1 to 3 bytes and trigger ESN tail handling to cause a denial of service.

281) Improper locking (CVE-ID: CVE-2026-46031)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in ks8851_irq() when processing interrupts while transmit softirq processing is triggered during critical sections. A local user can trigger network activity that causes the driver to re-enter the transmit path and deadlock the kernel.

The issue occurs in the ks8851 driver and results in a deadlock involving ks8851_start_xmit_par() while the driver lock is already held.

282) Improper Initialization (CVE-ID: CVE-2026-46027)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper access to uninitialized state in smc_clc_wait_msg() when handling a CLC decline during an early handshake stage before link group association. A remote attacker can send a specially crafted decline message to cause a denial of service.

The issue occurs for first-contact declines received before link group setup has completed.

283) Improper input validation (CVE-ID: CVE-2026-46026)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the qrtr nameserver lookup handling when processing NEW_LOOKUP messages over the same socket. A local user can send a flood of NEW_LOOKUP messages to cause a denial of service.

The issue is limited to local clients.

284) NULL pointer dereference (CVE-ID: CVE-2026-46024)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ceph_handle_auth_reply() when handling a crafted CEPH_MSG_AUTH_REPLY message. A remote attacker can send a specially crafted auth reply message to cause a denial of service.

The issue is triggered when both the protocol and result fields in the message are zero.

285) Integer overflow (CVE-ID: CVE-2026-46023)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to integer overflow in create_dirty_log() when parsing a device mapper table string. A local user can supply a crafted param_count value to trigger out-of-bounds reads on the argv array to disclose sensitive information.

286) Out-of-bounds read (CVE-ID: CVE-2026-46022)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ibmasm_handle_mouse_interrupt() when handling a mouse interrupt with out-of-range queue reader or writer indices from MMIO registers. A remote privileged user can write a crafted out-of-range value to the reader or writer MMIO register before asserting an interrupt to cause a denial of service.

For sufficiently large index values, the resulting MMIO access can fall outside the PCI BAR mapping and trigger a machine check exception.

287) Use-after-free (CVE-ID: CVE-2026-46021)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in thermal_set_governor() and thermal_zone_device_unregister() when handling concurrent governor updates via sysfs during thermal zone unregistration. A local user can trigger a governor update race to cause a denial of service.

The issue can occur if thermal_zone_device_register_with_trips() fails after adding a thermal governor to the thermal zone being registered.

288) Improper resource shutdown or release (CVE-ID: CVE-2026-46019)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in atmel_aes_buff_cleanup when cleaning up AES buffer allocations. A local user can trigger allocation and cleanup operations to cause a denial of service.

289) Improper input validation (CVE-ID: CVE-2026-46018)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper input validation in parse_uac2_sample_rate_range() when parsing a malformed uac2 range response from a usb audio device. A local attacker can provide a specially crafted uac2 range response to cause a denial of service.

The issue can trigger repeated kernel log messages while device probing still holds register_mutex.

290) NULL pointer dereference (CVE-ID: CVE-2026-46016)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the xlnx remoteproc receive callback when processing a received message. A local user can trigger the callback with a NULL message pointer to cause a denial of service.

291) Improper locking (CVE-ID: CVE-2026-46015)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper notification handling in inet_csk_listen_stop() when migrating an established child socket between listeners in the same SO_REUSEPORT group. A local user can trigger listener migration to cause poll()/epoll_wait() waiters and blocking accept() callers to remain asleep indefinitely.

Nonblocking accept() is not affected because it checks the accept queue directly.

292) Improper resource shutdown or release (CVE-ID: CVE-2026-46012)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in rxkad_verify_response() when processing RxRPC authentication responses. A local user can trigger the vulnerable code path to cause a denial of service.

293) Use-after-free (CVE-ID: CVE-2026-46011)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the mtk_jpeg_release() release path when closing the device while queued or running jpeg work is still pending. A local user can close the device during JPEG encode or decode operations to cause a denial of service.

The issue is caused by a race condition between the release path and the workqueue callback.

294) Improper resource shutdown or release (CVE-ID: CVE-2026-46009)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the pci-epf-ntb endpoint function driver when handling link setup or teardown operations. A local user can trigger .allow_link failure or .drop_link handling to cause a denial of service.

295) Memory corruption (CVE-ID: CVE-2026-46007)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory buffer restrictions in the powerz hwmon driver DMA transfer buffer when performing DMA operations. A local user can trigger DMA activity to cause a denial of service.

The issue arises because the transfer buffer may share a cacheline with a following mutex on affected architectures.

296) Integer overflow (CVE-ID: CVE-2026-46006)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in nouveau_gem_pushbuf_reloc_apply() when validating relocation bounds checks. A local user can provide a crafted relocation offset to cause a denial of service.

297) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-46005)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in xfs_alloc_buftarg() when handling an error path. A local user can trigger the vulnerable error condition to cause a denial of service.

298) Use-after-free (CVE-ID: CVE-2026-46004)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the caiaq driver setup_card() error handling when probing the device. A local user can trigger a probe error to cause a denial of service.

The issue occurs because execution continues after freeing the sound card during certain error paths.

299) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-46003)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource allocation in the qrtr nameserver when handling node registration requests. A remote attacker can register random nodes to exhaust memory and cause a denial of service.

300) Improper input validation (CVE-ID: CVE-2026-46002)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ext2_iget() when loading a crafted ext2 filesystem image containing an inode with zero i_nlink, non-zero i_mode, and zero i_dtime. A local user can mount or otherwise present a specially crafted filesystem image to trigger kernel warnings and cause a denial of service.

The issue is triggered when the malformed inode reaches VFS name operations such as unlink, rename, or rmdir.

301) Out-of-bounds read (CVE-ID: CVE-2026-45999)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in z_erofs_lz4_handle_overlap() when processing a crafted EROFS image during LZ4 inplace decompression. A local user can mount a crafted image and trigger decompression to disclose sensitive information.

The issue occurs for illegal extents where partial decoding is disabled and m_llen is smaller than m_plen, causing an unsigned underflow in the outpages minus inpages calculation.

302) Improper resource shutdown or release (CVE-ID: CVE-2026-45997)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in sd_probe() error handling when device_add(&disk_dev) fails. A local user can trigger a device addition failure to cause a denial of service.

303) Use-after-free (CVE-ID: CVE-2026-45996)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the spi: imx driver when unbinding the driver. A local user can trigger driver unbinding to cause a denial of service.

304) Out-of-bounds read (CVE-ID: CVE-2026-45994)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in command_file_write() when processing a crafted dot command buffer. A local user can supply header fields that cause the declared command size to exceed the allocated buffer to disclose sensitive information.

Kernel heap memory may be leaked to the service processor through an out-of-bounds memcpy_toio() operation.

305) Heap-based buffer overflow (CVE-ID: CVE-2026-45991)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in part_descs_loc[] handling in handle_partition_descriptor() when mounting a crafted UDF image with repeated partition descriptors. A local user can supply a specially crafted UDF image to cause a denial of service.

306) Use-after-free (CVE-ID: CVE-2026-45989)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in testdrv_probe() when processing a device node obtained from a PCI device after applying an overlay. A local user can trigger the vulnerable code path to cause a denial of service.

307) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-45987)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state synchronization in nested SVM interrupt shadow handling when restoring nested virtual machine state. A local user can trigger restoration of nested state with KVM_SET_VCPU_EVENTS preceding KVM_SET_NESTED_STATE to cause a denial of service.

The issue affects L2 guests, where an incorrectly restored interrupt shadow can cause the vCPU to hang.

308) Memory leak (CVE-ID: CVE-2026-45986)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in cc_mac_digest() when handling a hash request finalization failure. A local user can trigger a failure condition to cause a denial of service.

309) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-45985)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper extent state handling in ext4_split_convert_extents() when allocating blocks during within-EOF direct I/O and writeback with dioread_nolock enabled. A local user can trigger a failed direct I/O write that splits an unwritten extent to disclose sensitive information.

The issue can occur when a temporary ENOSPC condition happens during extent splitting, causing inconsistency between the on-disk extent state and the extent status tree.

310) Untrusted Pointer Dereference (CVE-ID: CVE-2026-45958)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to access arbitrary kernel memory.

The vulnerability exists due to improper access of a user pointer in vidi_connection_ioctl() when handling a user-supplied edid pointer. A local user can supply a crafted pointer to access arbitrary kernel memory.

311) Use-after-free (CVE-ID: CVE-2026-45956)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service or potentially execute arbitrary code.

The vulnerability exists due to use-after-free in vidi_connection_ioctl() when handling ioctl requests and looking up the vidi context from incorrect driver data. A local user can trigger the vulnerable ioctl path to cause a denial of service or potentially execute arbitrary code.

The issue stems from using the exynos-drm master device driver data instead of the vidi component device context.

312) NULL pointer dereference (CVE-ID: CVE-2026-45943)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in z_erofs_decompress_pcluster() when processing inline data for ztailpacking pclusters during file reads. A local user can read a crafted erofs image to cause a denial of service.

The issue may occur if a fatal signal arrives while read_mapping_folio() is running.

313) Race condition (CVE-ID: CVE-2026-45942)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ext4 buddy bitmap handling when processing mixed huge-page workloads and concurrent page migration. A local user can trigger filesystem activity that hits the race window to cause a denial of service.

The issue can lead to ext4 e4b bitmap inconsistency reports and false-positive corruption reports during stress conditions.

314) Improper locking (CVE-ID: CVE-2026-45924)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock management in ksmbd_vfs_kern_path_end_removing() error handling when processing error paths after starting file removal operations. A local user can trigger error conditions to cause a denial of service.

The issue can result in deadlocks and leaked locks due to inode locks and references not being properly released.

315) Double free (CVE-ID: CVE-2026-45920)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in ext4 block allocation handling when processing filesystem shutdown error paths. A local user can trigger a filesystem shutdown during block allocation operations to cause a denial of service.

The issue can lead to an inconsistent dirty cluster counter state and trigger a kernel warning in ext4_put_super().

316) NULL pointer dereference (CVE-ID: CVE-2026-45911)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the cdns3 driver resume path when switching roles during resume. A local user can trigger a role change while the system is resuming to cause a denial of service.

The issue occurs when the driver switches to host mode during resume and the xhci-hcd device probe is deferred.

317) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-45899)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the ext4 extent status tree when splitting extents. A local user can trigger a split extent failure to cause a denial of service.

318) Information disclosure (CVE-ID: CVE-2026-45858)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper handling of partially valid extents in ext4_split_extent_at() in the ext4 filesystem when allocating initialized blocks from a large unwritten extent or splitting an unwritten extent during end I/O conversion. A local user can trigger extent splitting to expose stale data and disclose sensitive information.

The issue occurs when a split in the middle of an unwritten extent fails due to temporary lack of space, causing part of the extent to be marked written while stale data remains.

319) Resource exhaustion (CVE-ID: CVE-2026-45855)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in libata-scsi when issuing non-NCQ commands while NCQ commands are in flight on host adapters using multiple submission queues. A local user can issue non-NCQ commands under constant NCQ load to cause a denial of service.

The issue can result in very long delays or complete starvation of non-NCQ commands in the worst case.

320) NULL pointer dereference (CVE-ID: CVE-2026-45846)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in bareudp_fill_metadata_dst() when processing Open vSwitch packet execution on a bareudp device that is down. A local user can send a crafted netlink request to trigger a kernel crash and cause a denial of service.

The issue occurs on the IPv6 path when the code uses bareudp->sock after it has been cleared during device shutdown.

321) NULL pointer dereference (CVE-ID: CVE-2026-45845)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in taprio class dump handling when deleting a TAPRIO child qdisc and requesting a class dump. A local user can delete an explicit child qdisc and trigger a class dump to cause a denial of service.

Exploitation is reachable in a network namespace with CAP_NET_ADMIN, and on systems with unprivileged user namespaces enabled, user interaction is not required.

322) Out-of-bounds read (CVE-ID: CVE-2026-45844)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause incorrect packet filtering decisions.

The vulnerability exists due to an out-of-bounds read in arp_packet_match() when parsing ARP payloads on IEEE1394 interfaces. A local user can send a specially crafted ARP packet to cause incorrect packet filtering decisions.

The issue occurs because IPv4-over-IEEE1394 ARP omits the target hardware address field, causing rule evaluation to use incorrect bytes for target address comparisons.

323) Out-of-bounds read (CVE-ID: CVE-2026-45843)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in slhc_uncompress() when parsing a short VJ-compressed TCP header with optional fields requested in the change byte. A remote attacker can send a specially crafted compressed packet to disclose sensitive information.

The over-read bytes are incorporated into cached connection state and may be reflected into subsequent reconstructed packets.

324) NULL pointer dereference (CVE-ID: CVE-2026-45842)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the SLIP/PPP VJ receive handling code when processing inbound VJ-compressed or VJ-uncompressed frames after installing a malformed VJ state with zero receive slots. A local user can configure PPP compression state through /dev/ppp and trigger processing of a frame selecting slot 0 to cause a denial of service.

The issue is reachable through PPPIOCSMAXCID from an unprivileged user namespace.

325) Division by zero (CVE-ID: CVE-2026-45841)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to divide-by-zero in nf_osf_match_one() in nfnetlink_osf when processing a subsequent matching TCP SYN after a crafted fingerprint is added via nfnetlink. A local user can add a fingerprint with a zero wss value to trigger a kernel panic.

Exploitation requires CAP_NET_ADMIN privileges.

326) Improper input validation (CVE-ID: CVE-2026-45840)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the openvswitch vport netlink reply helpers when handling a crafted upcall PID array in vport mutation operations. A local user can supply an oversized PID array to trigger a kernel BUG and cause a denial of service.

On systems with unprivileged user namespaces enabled, the issue is reachable via unshare -Urn.

327) Out-of-bounds read (CVE-ID: CVE-2026-45839)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in bpf_core_parse_spec() when processing a crafted BPF program containing negative CO-RE accessor indices. A local privileged user can load a specially crafted BPF program to cause a denial of service.

The issue is reachable during BPF_PROG_LOAD on systems with CONFIG_DEBUG_INFO_BTF enabled.

328) Out-of-bounds read (CVE-ID: CVE-2026-45838)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in cgroup_storage_get_next_key() when processing end-of-list conditions for cgroup storage map keys. A local user can trigger the function on the last list element to disclose sensitive information.

The issue occurs because the code reads a key from a bogus pointer that aliases internal map fields and copies the result to userspace.

329) NULL pointer dereference (CVE-ID: CVE-2026-45836)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in l2cap_sock_get_sndtimeo_cb() when handling Bluetooth L2CAP socket operations. A local user can trigger the vulnerable code path to cause a denial of service.

330) NULL pointer dereference (CVE-ID: CVE-2026-45835)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in l2cap_sock_new_connection_cb() when handling a new Bluetooth L2CAP connection. A remote attacker can trigger a crafted connection attempt to cause a denial of service.

331) NULL pointer dereference (CVE-ID: CVE-2026-45834)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in l2cap_sock_state_change_cb() when handling Bluetooth L2CAP socket state changes. A local user can trigger the vulnerable callback to cause a denial of service.

332) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43502)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in rds_message_purge() in the net/rds subsystem when cleaning up a failed zerocopy send before the message is queued. A local user can trigger an early zerocopy send failure to cause a denial of service.

The issue occurs after user pages have been pinned but before the message is attached to the sending socket.

333) Use-after-free (CVE-ID: CVE-2026-43499)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in remove_waiter() when rolling back a proxy lock from futex_requeue(). A local user can trigger the affected rtmutex slowlock and proxy-lock rollback path to cause a denial of service.

The issue can leave waiter task state uncleared and operate on the wrong top priority waiter task.

334) Use-after-free (CVE-ID: CVE-2026-43497)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to read and write freed kernel memory.

The vulnerability exists due to a use-after-free in the udlfb framebuffer mmap handling when replacing the framebuffer while a userspace mapping remains active and the device is later disconnected. A local user can trigger framebuffer reallocation through FBIOPUT_VSCREENINFO and then access stale mapped pages to read and write freed kernel memory.

Exploitation requires an existing userspace mmap of the framebuffer, and the stale mapping remains usable after USB disconnect.

335) NULL pointer dereference (CVE-ID: CVE-2026-43496)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the sch_red qdisc dequeue logic when processing queued packets through child qdiscs whose peek() callback is qdisc_peek_dequeued(). A local user can trigger network traffic through a crafted qdisc hierarchy to cause a kernel panic.

The issue occurs when red qdisc has child qdiscs such as qfq and a parent qdisc retrieves an skb using a peek operation followed by dequeue.

336) Out-of-bounds read (CVE-ID: CVE-2026-43495)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in t7xx_port_enum_msg_handler and t7xx_parse_host_rt_data when parsing modem-supplied messages. A remote attacker can send a specially crafted modem message to disclose sensitive information.

The issue can be triggered by a malformed message with an invalid port_count field or inconsistent feature data length.

337) Integer underflow (CVE-ID: CVE-2026-43492)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer underflow in mpi_read_raw_from_sgl() when processing a crafted scatterlist during a KEYCTL_PKEY_ENCRYPT system call. A local user can supply an input buffer of zeroes with a larger out_len than in_len to cause a denial of service.

The issue can cause the kernel to spin forever, resulting in soft lockup splats.

338) Improper input validation (CVE-ID: CVE-2026-43491)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the qrtr namespace service when handling NEW_SERVER messages. A remote attacker can send a flood of NEW_SERVER messages to cause a denial of service.

Exploitation can exhaust memory by registering excessive servers for a node.

339) Out-of-bounds read (CVE-ID: CVE-2026-43490)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in smb_inherit_dacl() when processing a parent directory DACL from the security descriptor xattr during ACE inheritance. A remote user can provide a malformed inheritable ACE with an invalid SID length to cause a denial of service.

The issue occurs because the ACE can advertise more SID subauthorities than are actually present, which can lead to reads past the ACE and incorrect inherited ACE size accounting.

340) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43488)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in xhci_irq() when handling a host controller error during UAS storage device plug/unplug scenarios. A local user can trigger repeated device plug/unplug events to cause a denial of service.

The issue can result in an interrupt storm that leads to severe system-level faults.

341) Race condition (CVE-ID: CVE-2026-43484)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mmc core claim and retune flag handling when processing concurrent asynchronous operations. A local user can trigger concurrent flag updates to cause a denial of service.

The issue can trigger a spurious WARN_ON(!host->claimed) due to shared-word coupling between the claimed and retune control flags.

342) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43483)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the KVM SVM AVIC/CR8 interception logic when activating or deactivating AVIC. A local user can trigger guest operations that lead to a dangling CR8 write intercept to cause a denial of service.

The issue affects SVM and can be fatal to Windows guests when combined with a TPR synchronization bug.

343) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-43480)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper check for exceptional conditions in acp3x_5682_init() when acquiring clocks. A local user can trigger the vulnerable code path to cause a denial of service.

The issue could lead to dereferencing error pointers in rt5682_clk_enable().

344) Out-of-bounds write (CVE-ID: CVE-2026-43476)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in sps30_i2c_read_meas() when processing measurement data from the device. A local user can trigger the vulnerable code path to cause a denial of service.

345) Improper locking (CVE-ID: CVE-2026-43475)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in storvsc_queuecommand in the hv_storvsc driver when processing SCSI I/O on systems with PREEMPT_RT enabled. A local user can trigger crafted I/O activity to cause a denial of service.

Exploitation requires a Linux guest running on Hyper-V with PREEMPT_RT enabled.

346) NULL pointer dereference (CVE-ID: CVE-2026-43473)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the mpi3mr driver request and reply queue cleanup logic when handling failed queue creation during resource cleanup. A local user can trigger queue creation failure and subsequent cleanup to cause a denial of service.

347) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43472)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in unshare_fs() when handling unshare(2) requests with CLONE_NEWNS together with additional namespace flags that can fail after mount namespace creation. A local user can invoke unshare(2) in this state to cause a denial of service.

The issue can leave the calling process with pwd and root pointing to detached isolated mounts after unshare(2) fails, such as after an -ENOMEM error during cgroup namespace setup.

348) NULL pointer dereference (CVE-ID: CVE-2026-43471)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ufshcd_add_command_trace() when handling command trace data after ufshcd_mcq_req_to_hwq() returns NULL. A local attacker can trigger this condition to cause a denial of service.

349) Improper locking (CVE-ID: CVE-2026-43469)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the xprtrdma receive handling logic when exiting early from receive work request posting. A local user can trigger memory pressure conditions to cause a denial of service.

The issue can cause the system to hang because the re_receiving counter is not decremented on certain early exit paths, preventing completion during transport drain.

350) Deadlock (CVE-ID: CVE-2026-43468)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in net/mlx5 eswitch event handling when processing eswitch mode changes and queued work items. A local user can trigger eswitch mode changes to cause a denial of service.

351) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43467)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource handling in the net/mlx5 switchdev mode transition logic when moving a device to switchdev mode on hardware without IPsec support. A local user can trigger a switchdev mode change to cause a denial of service.

The issue occurs when the driver attempts to clean up IPsec resources even though the device does not support IPsec.

352) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43466)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the mlx5e transmit queue recovery logic when handling a TX error CQE during SQ recovery. A local user can trigger a TX error CQE recovery flow to cause a denial of service.

The issue can desynchronize the DMA FIFO producer and consumer counters, leading to stale DMA addresses being unmapped and a kernel warning.

353) Use-after-free (CVE-ID: CVE-2026-43459)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in snd_soc_dapm_stream_event() when handling delayed work during sound card unbind while a PCM stream is open. A local user can trigger a sound card unbind in this state to cause a denial of service.

The issue occurs because a PCM close path can schedule new delayed work after the earlier workqueue flush and before DAPM widgets are removed.

354) Use-after-free (CVE-ID: CVE-2026-43458)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the caif_serial line discipline TX path when calling tty_write_room(). A local user can trigger the vulnerable code path to cause a denial of service.

The issue is triggered by a reproducer that causes a KASAN slab-use-after-free in pty_write_room() on access to tty->link->port.

355) Improper resource shutdown or release (CVE-ID: CVE-2026-43457)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mctp i2c receive path when handling received packets while midev->allow_rx is false. A local user can trigger packet reception in this state to cause a denial of service.

356) Type Confusion (CVE-ID: CVE-2026-43456)

CWE-ID: CWE-843 - Type confusion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to type confusion in bond_setup_by_slave() when handling header operations for a bonded non-Ethernet slave device. A local user can enslave a non-Ethernet device such as a GRE tunnel to a bond and trigger packet transmission to cause a denial of service.

The issue is triggered because header callbacks from the slave device are invoked with the bond device context, causing device-specific private data to be interpreted as the wrong type.

357) Race condition (CVE-ID: CVE-2026-43455)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to a race condition in mctp_flow_prepare_output() when processing transmit path operations that access key->dev without holding key->lock. A local user can trigger concurrent operations to cause a resource leak.

358) Out-of-bounds read (CVE-ID: CVE-2026-43453)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in pipapo_drop() when processing nftables set data. A local attacker can trigger the vulnerable code path to disclose sensitive information.

The issue occurs on the last iteration when evaluating rulemap[i + 1].n, causing a read 4 bytes past the end of the stack-allocated rulemap array.

359) Out-of-bounds read (CVE-ID: CVE-2026-43452)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the xt_tcpudp and xt_dccp option walkers when parsing malformed TCP or DCCP options. A remote attacker can send a specially crafted packet to cause a denial of service.

360) Memory leak (CVE-ID: CVE-2026-43451)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in nfqnl_recv_verdict() in nfnetlink_queue when parsing bridge VLAN attributes for PF_BRIDGE packets. A remote attacker can send a specially crafted netfilter queue verdict message to cause a denial of service.

Repeated triggering can exhaust kernel memory by leaking an nf_queue_entry, its associated sk_buff, and related references.

361) Out-of-bounds read (CVE-ID: CVE-2026-43450)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in nfnl_cthelper_dump_table() when handling netlink dump requests after a previously saved helper entry is deleted between dump rounds. A local user can trigger the affected dump logic to cause a denial of service.

The issue is triggered when the saved "last" helper is deleted between dump rounds, causing a restart path to bypass the loop bounds check.

362) Out-of-bounds read (CVE-ID: CVE-2026-43449)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in nvme_dbbuf_set when handling queue index calculations. A local user can trigger nvme queue initialization or reset operations to cause a denial of service.

The issue excludes index 0 because it is the admin queue.

363) Race condition (CVE-ID: CVE-2026-43448)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nvme_poll_irqdisable() when handling concurrent device disable and IRQ polling operations. A local user can trigger the race to cause a denial of service.

The issue can lead to an unbalanced IRQ enable warning in the kernel.

364) Off-by-one (CVE-ID: CVE-2026-43445)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in the e1000 and e1000e TX buffer DMA cleanup logic when handling DMA mapping errors. A local user can trigger DMA mapping failures to cause a denial of service.

365) NULL pointer dereference (CVE-ID: CVE-2026-43441)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the bonding driver IPv6 neighbor advertisement validation path when processing IPv6 NS/NA packets on a slave while ARP/NS validation is enabled and IPv6 is disabled. A remote attacker can send a specially crafted IPv6 NS/NA packet to trigger a kernel crash and cause a denial of service.

Exploitation requires the system to be booted with the 'ipv6.disable=1' parameter and bonding ARP/NS validation to be enabled.

366) Race condition (CVE-ID: CVE-2026-43439)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in css_task_iter handling in the cgroup task iteration logic when iterating tasks concurrently with task migration between css_set lists. A local user can trigger task migration while cgroup.procs is being read to cause a denial of service.

Successful exploitation requires a very small race window between task migration and iteration, and may lead to crashes or infinite loops.

367) Use-after-free (CVE-ID: CVE-2026-43437)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in snd_pcm_drain() when handling a linked stream runtime after releasing the stream lock. A local user can trigger a concurrent close() on the linked stream's file descriptor to cause a denial of service.

The issue occurs because the drain path dereferences stale runtime fields from a linked stream after the runtime can be freed by concurrent unlink and detach operations.

368) NULL pointer dereference (CVE-ID: CVE-2026-43436)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in scarlett2_find_fc_interface() in the ALSA usb-audio driver when parsing a malformed USB descriptor for Scarlett2 mixer interfaces. A local attacker can provide a specially crafted USB descriptor to cause a denial of service.

369) Memory leak (CVE-ID: CVE-2026-43432)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in xhci_disable_slot() when handling error paths. A local user can trigger the vulnerable error path to cause a denial of service.

Triggering the issue requires specific hardware conditions or an abnormal device state.

370) Race condition (CVE-ID: CVE-2026-43430)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the usb yurex driver probe routine when probing the device. A local user can connect a crafted or timing-sensitive USB device to cause a denial of service.

371) Resource exhaustion (CVE-ID: CVE-2026-43429)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of user-controlled timeout values in the usbtmc driver when processing ioctl commands. A local user can supply an arbitrarily long timeout value to hang a kernel thread indefinitely and cause a denial of service.

The issue affects usb_bulk_msg() calls that use unkillable waits.

372) Improper resource shutdown or release (CVE-ID: CVE-2026-43428)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in usbcore when handling USB message timeouts. A local user can trigger an excessively long synchronous timeout to cause a denial of service.

Exploitation can leave a task stuck in an uninterruptible wait until the target device is unplugged.

373) Race condition (CVE-ID: CVE-2026-43427)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a race condition in the cdc-wdm read code path when processing read operations. A local user can trigger the race and read uninitialized memory to disclose sensitive information.

374) Use-after-free (CVE-ID: CVE-2026-43426)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the renesas_usbhs interrupt handler when handling an interrupt during device removal. A local user can trigger device removal while an interrupt is pending to cause a denial of service.

The issue occurs in a race window after driver resources have been freed but before the driver is fully unbound.

375) Improper resource shutdown or release (CVE-ID: CVE-2026-43425)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in mdc800_device_read() when handling USB read timeouts. A local user can trigger a timeout and resubmit the same URB while it is still active to cause a denial of service.

The issue is triggered on a subsequent read operation after a prior timeout leaves the download URB in flight.

376) NULL pointer dereference (CVE-ID: CVE-2026-43424)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the USB Target driver f_tcm BOT command and request processing paths when handling crafted Bulk-Only Transport commands during a race window where the nexus is not established or has just been dropped. An attacker with physical access can send a specially crafted USB request to cause a denial of service.

The issue occurs if requests arrive before the nexus is fully established or immediately after it is dropped.

377) NULL pointer dereference (CVE-ID: CVE-2026-43421)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the f_ncm usb gadget network device lifecycle handling when disconnecting or unbinding the gadget device. A local user can trigger a crafted gadget disconnect or unbind sequence to cause a denial of service.

The issue occurs because the network device can outlive its parent gadget device, leaving dangling sysfs links.

378) Race condition (CVE-ID: CVE-2026-43420)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ceph_unlink() when processing asynchronous unlink operations. A local user can trigger concurrent unlink completion handling to cause a denial of service.

Only the asynchronous unlink code path is affected.

379) Memory leak (CVE-ID: CVE-2026-43419)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in ceph_mdsc_build_path() when handling error paths. A local user can trigger the vulnerable code path to cause a denial of service.

380) Race condition (CVE-ID: CVE-2026-43415)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ufshcd_rtc_work() and the UFS suspend path when suspending UFS devices. A local user can trigger UFS suspend while the delayed RTC work is still running to cause a denial of service.

The issue can trigger an asynchronous SError that leads to a kernel panic on affected systems.

381) NULL pointer dereference (CVE-ID: CVE-2026-43413)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the hisi_sas user_scan() handling path when processing a user-initiated scan request. A local user can write a crafted scan request via sysfs to trigger a kernel crash and cause a denial of service.

The issue is triggered because the driver supports only one channel, but scanning proceeds to an additional channel value.

382) Improper resource shutdown or release (CVE-ID: CVE-2026-43412)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the q6apm ASoC component removal logic when handling ADSP stop and start events. A local user can trigger ADSP stop and start sequences to cause a denial of service.

The issue can result in a kernel NULL pointer dereference and crash during the next rebind after teardown.

383) Division by zero (CVE-ID: CVE-2026-43411)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to divide-by-zero in tipc_sk_filter_connect() when handling a rejected SYN on the retry path after processing a TIPC_CONN_TIMEOUT value less than 4. A local user can set a small conn_timeout value via setsockopt and trigger the retry path to cause a denial of service.

The issue results in a kernel oops or panic.

384) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43409)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in kprobes module callback handling when removing modules after ftrace has been disabled by errors. A local user can remove a module containing kprobe probes to cause a denial of service.

The issue is triggered after ftrace has been killed due to an error condition.

385) Improper Initialization (CVE-ID: CVE-2026-43408)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in ceph_mdsc_build_path() callers when handling error paths after building Ceph path information. A local user can trigger a failed ceph_mdsc_build_path() call and subsequent ceph_mdsc_free_path_info() use of an uninitialized ceph_path_info structure to cause a denial of service.

The issue may occur because ceph_mdsc_build_path() initializes the structure only on success, while callers may still free it after an error.

386) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-43405)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of signedness conversion in ceph_monmap_decode() when parsing an incoming monitor map message. A remote attacker can send a specially crafted message with a very large num_mon value to cause a denial of service.

The issue can trigger an attempt to allocate an excessively large chunk of memory and results in -ENOMEM being returned instead of rejecting the input as invalid.

387) Improper resource shutdown or release (CVE-ID: CVE-2026-43397)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in samsung_dsim_host_attach() when handling attach error paths after calling drm_bridge_add(). A local user can trigger an attach failure to cause a denial of service.

The issue occurs when samsung_dsim_register_te_irq() or pdata->host_ops->attach() fails after the bridge has already been added.

388) Improper resource shutdown or release (CVE-ID: CVE-2026-43395)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in xe_sync_entry_parse() when parsing sync entries. A local user can trigger a parse failure after partial initialization to cause a denial of service.

389) Out-of-bounds read (CVE-ID: CVE-2026-43387)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rtw_get_ie_ex() when parsing untrusted frame data. A remote attacker can send a specially crafted frame to disclose sensitive information.

390) Out-of-bounds read (CVE-ID: CVE-2026-43386)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rtw_restruct_wmm_ie when parsing input. A local user can supply crafted input to disclose sensitive information.

391) Improper locking (CVE-ID: CVE-2026-43382)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in batadv_v_elp_get_throughput() and batadv_get_real_netdev() when cancelling a delayed work item while the RTNL lock is already held. A local user can trigger the affected code path to cause a denial of service.

The issue can result in a deadlock during ELP metric worker processing for cfg80211 interfaces.

392) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-43381)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of runtime-suspended devices in nouveau dpcd aux transfer handling when accessing /dev/drm_dp_* while the device is asleep. A local user can access the drm dp device interface while the device is runtime suspended to cause a denial of service.

The issue is triggered when the GPU device is in a runtime suspended state.

393) Stack-based buffer overflow (CVE-ID: CVE-2026-43380)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in q54sj108a2_debugfs_read when reading debugfs data. A local user can read the debugfs file to cause a denial of service.

394) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-43377)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in generate_smb3signingkey() and generate_smb3encryptionkey() when debug authentication logging is enabled during SMB3 signing and encryption key generation. A local user can access generated logs containing session, signing, encryption, and decryption key bytes to disclose sensitive information.

Only systems with KSMBD_DEBUG_AUTH logging enabled are affected by this exposure.

395) Improper resource shutdown or release (CVE-ID: CVE-2026-43373)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in NCSI RX and AEN handlers when processing invalid AEN packets or unresolved NCSI responses. A remote attacker can send specially crafted network packets to cause a denial of service.

396) Improper resource shutdown or release (CVE-ID: CVE-2026-43372)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the PTP IRQ setup logic when handling failures during IRQ setup. A local user can trigger request_threaded_irq() failure during PTP message IRQ initialization to cause a denial of service.

397) Race condition (CVE-ID: CVE-2026-43371)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the macb driver transmit ring handling when resuming transmission after transmit has been disabled. A local user can trigger network transmission during this state to cause a denial of service.

The issue can leave transmission stuck until a new packet is queued, and queued packets may be silently lost with associated skb memory not being released.

398) Use-after-free (CVE-ID: CVE-2026-43370)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race in VM acquire when parent and child processes sharing a drm_file both try to acquire the same VM after fork(). A local user can trigger concurrent VM acquisition to cause a denial of service.

The issue occurs in scenarios involving fork() with shared drm_file state between parent and child processes.

399) Integer overflow (CVE-ID: CVE-2026-43368)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in the i915 GEM shmem scatterlist handling when populating a scatterlist table with folio-backed pages for a GEM shmem object of size 4 gb or more. A local user can trigger a page fault on a specially crafted large object to cause a denial of service.

The issue can occur if the total byte length recorded in a single scatterlist reaches or crosses the 4 gb limit, leading to an unexpected premature end of the object's backing pages.

400) Improper input validation (CVE-ID: CVE-2026-43366)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state validation in the io_uring kernel buffer recycling logic when recycling a previously grabbed buffer. A local user can trigger recycling of a buffer after the target buffer list has changed type to cause a denial of service.

This can occur when the request is forced via io-wq.

401) Improper input validation (CVE-ID: CVE-2026-43365)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause filesystem corruption and a denial of service.

The vulnerability exists due to improper input validation in XFS log roundoff handling when mounting or recovering a crafted XFS filesystem with a malformed superblock. A local user can provide a specially crafted filesystem image to cause filesystem corruption and a denial of service.

The issue can result in corrupt logs and an unmountable filesystem on systems using 4k physical sectors.

402) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43363)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper hardware state management in lapic_resume() when resuming from s2ram. A local user can trigger a suspend and resume cycle to cause a denial of service.

This occurs when firmware re-enables x2apic mode while the kernel continues using the xapic interface, which can lead to system hangs on bare metal systems.

403) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43362)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to corrupt data.

The vulnerability exists due to improper handling of in-place encryption in SMB2_write() when retrying write operations after replayable errors. A remote user can trigger write retries over an unstable SMB connection to corrupt data.

The issue is most likely to be observed when unstable connections cause reconnects and repeated write attempts.

404) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-43361)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of item size limits in btrfs snapshot creation for received subvolumes when snapshotting a previously received subvolume repeatedly. A local user can create many snapshots of a received subvolume to cause a denial of service.

The issue can abort a transaction and force the filesystem into read-only mode. Exploitation does not require CAP_SYS_ADMIN and relies on operations permitted by inode_owner_or_capable().

405) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43360)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of name hash collisions in btrfs directory item insertion when creating files with colliding names. A local user can create multiple specially crafted filenames with the same hash to cause a denial of service.

Successful exploitation aborts the transaction and remounts the filesystem read-only.

406) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43359)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of item overflow in set received ioctl when processing repeated received UUID values for subvolumes. A local user can invoke the ioctl with the same received UUID for many subvolumes to cause a denial of service.

The issue can abort a transaction and remount the filesystem in read-only mode. Exploitation requires ownership of the subvolume and does not require administrative privileges.

407) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43357)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the mpu3050 gyroscope driver power management logic when resuming the device for preenable operations. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the driver may access hardware that failed to resume, and the device usage count may be incremented even on failure.

408) Improper resource shutdown or release (CVE-ID: CVE-2026-43355)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the bh1780 light sensor driver when handling read operations that encounter an error. A local user can trigger an error during a read operation to cause a denial of service.

409) Out-of-bounds read (CVE-ID: CVE-2026-43350)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in parse_dacl() when parsing ACE SIDs returned by an SMB server. A remote attacker can send a specially crafted ACE with a truncated NFS mode SID to disclose sensitive information.

The issue occurs because an ACE with only two subauthorities can still match the NFS mode SID pattern, leading to a read of sid.sub_auth[2] past the end of the ACE.

410) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43345)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper register field definition in the IPA GSI event ring configuration logic when initializing event rings on IPA v5.0+ hardware. A local user can trigger channel operations that wait for transfer completion to cause a denial of service.

The issue can cause runtime suspend, system suspend, and remoteproc stop operations to hang indefinitely, and the IPA data path may become non-functional.

411) Improper resource shutdown or release (CVE-ID: CVE-2026-43343)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in geth_free in the usb gadget f_subset function when unlinking the function and reconfiguring attributes via configfs. A local user can unlink the function and attempt to configure attributes via configfs to cause a denial of service.

412) Race condition (CVE-ID: CVE-2026-43342)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to race condition in RNDIS class/subclass/protocol options in f_rndis when accessing configfs concurrently. A local user can perform concurrent configfs operations to cause a denial of service.

This issue was identified during code inspection.

413) Improper locking (CVE-ID: CVE-2026-43340)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock initialization in the comedi_device spinlock handling in the COMEDI subsystem when reattaching a COMEDI device to different low-level drivers via the COMEDI_DEVCONFIG ioctl command. A local user can issue crafted device configuration operations to cause a denial of service.

The issue affects COMEDI devices created when the comedi.comedi_num_legacy_minors parameter is non-zero, and inconsistent lock states are reported when different low-level drivers use mismatched spin-lock locking levels.

414) Use-after-free (CVE-ID: CVE-2026-43339)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in addrconf_permanent_addr() when handling an exceptional condition in IPv6 address configuration. A local user can trigger the warning path to cause a denial of service.

415) Resource exhaustion (CVE-ID: CVE-2026-43338)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in btrfs qgroup ioctls when processing quota group operations. A local user can create many quota groups on a nearly full btrfs filesystem to cause a denial of service.

The issue can trigger a transaction abort with -ENOSPC during delayed reference processing.

416) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-43336)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to missing zeroization of sensitive data in the ChaCha implementation in lib/crypto/chacha when processing cryptographic state on the stack. A local user can read residual stack memory to disclose sensitive information.

The permuted state is sufficient to reconstruct the original state, including the key.

417) Improper access control (CVE-ID: CVE-2026-43334)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass man-in-the-middle protection during Bluetooth pairing.

The vulnerability exists due to improper access control in the Bluetooth SMP pairing response handling when processing a pairing request. A remote attacker can initiate a pairing request that omits MITM requirements to bypass man-in-the-middle protection during Bluetooth pairing.

Exploitation is possible when the local side requires high security and the selected pairing method becomes inconsistent with the responder's security policy.

418) NULL pointer dereference (CVE-ID: CVE-2026-43333)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the BPF verifier check_mem_access() handling of PTR_TO_BUF pointers when processing direct memory access to nullable map iterator key and value pointers. A local user can trigger direct dereference of a NULL pointer to cause a denial of service.

The issue occurs on stop callbacks where map iterator ctx->key and ctx->value can be NULL.

419) Race condition (CVE-ID: CVE-2026-43332)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the thermal zone device registration error path when handling a failed thermal zone device registration after the device has already been registered. A local user can hold a reference to the thermal zone device's kobject to cause a denial of service.

The issue arises if user space obtains a reference before the error path completes, which can lead to premature freeing of the associated thermal zone structure.

420) Out-of-bounds read (CVE-ID: CVE-2026-43330)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds read in the caam crypto driver when processing HMAC keys longer than the block size. A local user can supply a specially crafted long HMAC key to cause memory corruption.

The issue occurs because the copied key buffer is rounded to DMA cache alignment, which can result in reading past the end of the source key buffer.

421) Memory corruption (CVE-ID: CVE-2026-43329)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper restriction of operations within the bounds of a memory buffer in flowtable hardware offload action handling when processing IPv6 flowtable offload configurations with multiple actions. A remote attacker can trigger a flow configuration that exceeds the supported number of actions to cause a denial of service.

The issue can be reached in IPv6 setups involving combinations of ethernet mangling, NAT, double VLAN for QinQ, redirect, and tunnel-related actions.

422) Double free (CVE-ID: CVE-2026-43328)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in cpufreq_dbs_governor_init() when handling a failure from kobject_init_and_add(). A local user can trigger the error path to cause a denial of service.

423) Race condition (CVE-ID: CVE-2026-43327)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a locking and synchronization error in dummy-hcd when handling an emulated USB reset during driver unbind. A local user can trigger a race condition to cause a denial of service.

The issue can lead to an addressing exception and kernel crash when usb_gadget_udc_reset() is invoked with a NULL driver argument.

424) Race condition (CVE-ID: CVE-2026-43324)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the dummy-hcd driver callback handling when disabling emulated interrupts during gadget driver unbind. A local user can trigger gadget unbind operations to cause a denial of service.

The issue can result in a callback handler still running while the gadget driver is being unbound.

425) Out-of-bounds read (CVE-ID: CVE-2026-43281)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in fw_mbox_index_xlate() when processing device tree mailbox definitions with #mbox-cells = <0> and no fw_xlate or of_xlate handler. A local user can supply a crafted device tree configuration to cause a denial of service.

The issue occurs when the default translation function is used for the mailbox controller.

426) Improper input validation (CVE-ID: CVE-2026-43265)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper state validation in KVM x86 nested virtualization handling when processing userspace-supplied MP_STATE or injected events for a blocked vCPU while L2 is active. A remote user can place the vCPU into an invalid state to cause a denial of service.

The issue can result in a spurious userspace exit, typically with KVM_EXIT_UNKNOWN, after exiting a blocking state.

427) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43252)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the mptcp in-kernel path manager when handling crafted netlink requests that remove endpoints. A local user can send a specially crafted netlink message to cause a denial of service.

428) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-43245)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory allocation in ntfs dentry comparison and hash handling when processing filesystem path lookups. A local user can trigger blocking allocation in this context to cause a denial of service.

429) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-43162)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in __tegra_channel_try_format() when handling error paths after v4l2_subdev_call() failures. A local user can trigger the affected code path to cause a denial of service.

430) Improper input validation (CVE-ID: CVE-2026-43129)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ima_restore_measurement_list() when restoring the previous kernel's IMA measurement buffer during kexec boot. A local user can boot a second-stage kernel with a limiting command line such as "mem=" to cause a denial of service.

This issue occurs on x86_64 systems during early restore of the measurement list.

431) Double free (CVE-ID: CVE-2026-43120)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in rereg_user_mr when re-registering a memory region with IB_MR_REREG_TRANS set. A local user can trigger an error after a new umem is allocated and then call ibv_dereg_mr to cause a denial of service.

The issue occurs because a released umem reference remains non-NULL and is released again on the deregistration path.

432) Race condition (CVE-ID: CVE-2026-43119)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a data race in hdev->req_status handling in the Bluetooth hci_sync subsystem when processing concurrent command synchronization operations across workqueues and event completion paths. A local user can trigger concurrent operations to cause a denial of service.

The issue arises because accesses occur from different workqueues and completion or abort paths that can run concurrently on different CPUs.

433) Out-of-bounds read (CVE-ID: CVE-2026-43113)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in wl1251_tx_packet_cb() when processing firmware completion data. A local user can provide a crafted completion ID to cause a denial of service.

434) Out-of-bounds read (CVE-ID: CVE-2026-43112)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in cifs_sanitize_prepath when parsing path strings containing only delimiters or no path content. A local user can supply a crafted path string to cause a denial of service.

The issue can be triggered by an empty string or a string such as "/".

435) Use-after-free (CVE-ID: CVE-2026-43111)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in roccat_report_event when iterating over the device readers list during concurrent device access. A local user can trigger concurrent access to the roccat device to cause a denial of service.

The issue arises from a race condition with roccat_release() removing and freeing a reader while it is still being accessed.

436) Out-of-bounds read (CVE-ID: CVE-2026-43110)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in brcmf_fweh_handle_if_event() when handling firmware-provided IF events. A remote attacker can supply a crafted bsscfg index to cause a denial of service.

437) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43109)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in shstk_pop_sigframe() when handling signal frames. A local user can trigger an error from mmap_read_lock_killable() to cause a denial of service.

438) Improper input validation (CVE-ID: CVE-2026-43107)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in xfrm_get_ae() and xfrm_aevent_msgsize() when handling malformed netlink interactions for xfrm aevent messages. A local user can send a malformed netlink interaction to cause a denial of service.

The issue is triggered for states with if_id set, where the reply skb size calculation does not account for the XFRMA_IF_ID attribute.

439) Memory leak (CVE-ID: CVE-2026-43105)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in vc4 hang state handling when freeing hang state data. A local user can trigger creation of hang states to cause a denial of service.

440) Memory leak (CVE-ID: CVE-2026-43104)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in vc4_save_hang_state() when handling an early return condition. A local user can trigger the error path to cause a denial of service.

441) Improper input validation (CVE-ID: CVE-2026-43103)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the lapbether device event handling when processing network device type change events. A local user can trigger a device type change to cause a denial of service.

The issue occurs because lapbeth_data_transmit() expects the underlying device type to be ARPHRD_ETHER.

442) NULL pointer dereference (CVE-ID: CVE-2026-43099)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in icmp_build_probe() when processing probe requests that use an IPv6 interface identifier while the IPv6 stack is inactive. A remote attacker can send a specially crafted probe request to cause a denial of service.

The issue occurs when IPv6 support is configured as a module and is not loaded.

443) NULL pointer dereference (CVE-ID: CVE-2026-43098)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in s3fwrn82_uart_read() when processing received uart data. A local user can trigger allocation failure during frame reception to cause a denial of service.

444) NULL pointer dereference (CVE-ID: CVE-2026-43094)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the ixgbevf Hyper-V MAC operations table when probing the device on Hyper-V virtual machines. A local user can trigger device initialization to cause a denial of service.

The issue occurs because the negotiate_features callback is missing from the Hyper-V-specific operations table.

445) Improper input validation (CVE-ID: CVE-2026-43093)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in xdp_umem_reg() when registering UMEM with insufficient headroom and tailroom. A local user can supply a crafted UMEM configuration to cause a denial of service.

The issue can leave insufficient space for a minimum-sized ethernet frame and may corrupt skb_shared_info stored at the end of an XSK frame when multi-buffer operation is involved.

446) Improper input validation (CVE-ID: CVE-2026-43092)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in AF_XDP bind handling when binding a zero-copy pool configuration. A local user can supply a configuration where the device MTU exceeds the usable UMEM frame space to cause a denial of service.

The issue arises when tailroom and headroom reduce the usable chunk space, and hardware receive buffer chain length constraints can further prevent the configured MTU from being supported.

447) Use-after-free (CVE-ID: CVE-2026-43091)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in xfrm policy_bydst hash tables during network namespace teardown when concurrent RCU-protected policy lookups are performed. A local user can trigger network namespace teardown while the tables are still being accessed to cause a denial of service.

The issue occurs because the memory can be freed before an RCU grace period has elapsed.

448) Improper Initialization (CVE-ID: CVE-2026-43089)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in build_mapping() when copying xfrm_usersa_id structures to userspace. A local user can trigger the affected code path to disclose sensitive information.

The issue is caused by a one-byte padding hole after the proto field that is not cleared before the structure is copied out.

449) Use of uninitialized resource (CVE-ID: CVE-2026-43088)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an information exposure caused by uninitialized memory in PF_KEY export paths when exporting aligned sockaddr payloads for certain PF_KEY messages. A local user can trigger affected PF_KEY message handling to disclose sensitive information.

The issue affects the SADB_ACQUIRE, SADB_X_NAT_T_NEW_MAPPING, and SADB_X_MIGRATE export paths, while state and policy dump builders are not affected.

450) NULL pointer dereference (CVE-ID: CVE-2026-43086)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ip_vs_add_service error handling when processing a crafted IPVS service configuration that causes ip_vs_start_estimator() to fail after a scheduler has been successfully bound. A local user can trigger the vulnerable error path to cause a denial of service.

The issue results in a kernel panic.

451) Use of uninitialized resource (CVE-ID: CVE-2026-43085)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an uninitialized memory use in nfnetlink_log NLMSG_DONE terminator handling when batching multiple NFLOG messages. A local user can trigger generation of a crafted NLMSG_DONE message to disclose sensitive information.

Four bytes of stale kernel heap data are leaked to userspace in the NLMSG_DONE message body when the queue length is greater than one.

452) Use-after-free (CVE-ID: CVE-2026-43084)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in nfnetlink_queue when processing queue verdicts in parallel. A local user can send crafted netfilter queue verdict messages to trigger a kernel crash.

The issue occurs because an nf_queue_entry may be freed on one CPU while still being encountered by another CPU walking the shared list.

453) Out-of-bounds write (CVE-ID: CVE-2026-43082)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the txgbe driver property_entry handling when processing property_entry lists. A local user can trigger allocation of a property_entry list without space for the required null terminator to cause a denial of service.

454) Improper input validation (CVE-ID: CVE-2026-43081)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in GENERIC_CMD register field masks in the net/ipa component when handling stop commands for the MPSS remote processor while IPA is active. A local user can trigger the affected operation to cause a denial of service.

The issue was observed as a kernel WARN when sending a stop command to the MPSS remote processor while IPA was up.

455) Integer overflow (CVE-ID: CVE-2026-43080)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in l2tp_xmit_core when processing oversized PPPoL2TP packets with UDP encapsulation. A local user can send an oversized packet to trigger a kernel warning and cause a denial of service.

The issue occurs because the UDP length field is 16-bit and the oversized length value is truncated.

456) Out-of-bounds write (CVE-ID: CVE-2026-43079)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in uncore_pci_pmu_register() when parsing the discovery table for offline dies. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can be triggered when NUMA is disabled and the system boots with fewer CPUs than the number of CPUs in die 0.

457) Use-after-free (CVE-ID: CVE-2026-43076)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ocfs2_dir_foreach_blk_id() when processing a corrupted ocfs2 filesystem inode with inline data. A local user can mount or supply a crafted filesystem image to cause a denial of service.

The issue is triggered when an inode's i_size exceeds the actual inline data capacity, causing directory entry iteration to go beyond the inline data buffer.

458) Out-of-bounds write (CVE-ID: CVE-2026-43075)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in ocfs2_write_end_inline when processing writes during copy_file_range splice fallback on a corrupted ocfs2 filesystem mounted on a loop device. A local user can trigger the kernel to write past the inode block buffer to cause a denial of service.

The issue is caused by trusting the on-disk id_count field beyond the physical maximum inline data capacity.

459) Use-after-free (CVE-ID: CVE-2026-43074)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ep_free() in eventpoll.c when handling concurrent eventpoll operations. A local user can trigger a race condition to cause a denial of service.

460) Improper access control (CVE-ID: CVE-2026-43073)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the __copy_user_nocache() function when performing kernel memory copies with a user-copy interface. A local user can trigger the vulnerable code path to cause a denial of service.

The issue arises from misuse of a function intended for specialized memory copying with exception handling for user space accesses.

461) Improper input validation (CVE-ID: CVE-2026-43072)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in vc4 drm driver interrupt handling when initializing platform interrupts by name. A local user can trigger an error condition that causes a negative IRQ value to be used to cause a denial of service.

462) Improper resource shutdown or release (CVE-ID: CVE-2026-43069)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in download_firmware() in the hci_ll bluetooth driver when processing invalid firmware content returned by request_firmware(). A local user can trigger the use of invalid firmware content to cause a denial of service.

463) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-43068)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of corrupted block group metadata in ext4_mb_find_by_goal() when allocating blocks in ext4. A local user can trigger block allocation on a corrupted ext4 filesystem to cause a denial of service.

The issue can lead to delayed block allocation failures and data loss warnings when the filesystem repeatedly requests blocks from a corrupted block group.

464) Improper resource shutdown or release (CVE-ID: CVE-2026-43066)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ext4_fc_replay_inode() when replaying inode updates during ext4 fast commit recovery. A local user can trigger error paths that leak a buffer head reference to cause a denial of service.

The issue occurs on multiple error paths after obtaining the inode location buffer head.

465) Improper resource shutdown or release (CVE-ID: CVE-2026-43065)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ext4_mb_release() discard work handling when remounting an ext4 filesystem from discard to nodiscard and immediately unmounting it. A local user can mount the filesystem with discard, delete a large number of files, remount it with nodiscard, and immediately unmount it to cause a denial of service.

Exploitation requires a specific sequence of filesystem mount, remount, and unmount operations while queued discard work is still pending.

466) Improper resource shutdown or release (CVE-ID: CVE-2026-43064)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the idxd DSA/IAA device workqueue handling when releasing a device object. A local user can trigger release of a crafted or repeatedly created device object to cause a denial of service.

467) Type Confusion (CVE-ID: CVE-2026-43062)

CWE-ID: CWE-843 - Type confusion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to type confusion in l2cap_ecred_reconf_rsp() when processing L2CAP_ECRED_RECONF_RSP packets. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue causes valid packets to be rejected and may read the result field from an incorrect offset when the packet is large enough to pass the length check.

468) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43061)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the 8250 serial DMA transmit handling when terminating a DMA transaction asynchronously. A local user can trigger cancellation of a transmit DMA transaction to cause a denial of service.

The issue can leave transmit DMA permanently stalled because the tx_running state is not cleared if the completion callback does not run.

469) Use-after-free (CVE-ID: CVE-2026-43060)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in nft_ct when removing referenced conntrack objects while packets remain enqueued in nfqueue. A local user can trigger processing of packets that retain stale references to cause a denial of service.

The issue involves references to conntrack zone templates, timeout policies, or helpers held by queued packets.

470) Use-after-free (CVE-ID: CVE-2026-43059)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in Bluetooth MGMT command complete handlers when processing command completion paths. A local user can trigger concurrent pending command handling to cause a denial of service.

The issue involves list corruption in mgmt_add_adv_patterns_monitor_complete() and incorrect freeing of other pending mesh commands in set_mesh_complete().

471) Use of Uninitialized Variable (CVE-ID: CVE-2026-43058)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() when processing struct arguments passed by value. A local user can trigger the affected code path to disclose sensitive information.

472) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-43057)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of checksum offload fallback in the IPv6 GSO fallback logic when processing tunneled IPv6 traffic with extension headers or without an inner IP protocol. A local user can send specially crafted packets to cause a denial of service.

The issue affects tunneled traffic, including cases where the inner header rather than the outer network header must be validated.

473) Use-after-free (CVE-ID: CVE-2026-43056)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in add_adev() when handling an error path after auxiliary_device_add() fails. A local user can trigger the failure condition to cause a denial of service.

474) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43054)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in tcm_loop_target_reset() when handling SCSI target reset recovery. A local user can trigger a reset while commands remain in flight to cause a denial of service.

The issue can leak a LUN reference and cause configfs LUN unlink to hang in D-state.

475) Improper access control (CVE-ID: CVE-2026-43052)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause unintended side effects in wireless configuration.

The vulnerability exists due to improper access control in ieee80211_tdls_oper when handling NL80211_TDLS_ENABLE_LINK operations for non-TDLS stations. A local user can trigger the operation on a non-TDLS station to cause unintended side effects in wireless configuration.

476) Out-of-bounds read (CVE-ID: CVE-2026-43051)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in wacom_intuos_bt_irq when processing Bluetooth HID reports. A remote attacker can send a specially crafted short report to disclose sensitive information.

Report ID 0x03 requires at least 22 bytes, and report ID 0x04 requires at least 32 bytes.

477) Use-after-free (CVE-ID: CVE-2026-43050)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sock_def_readable() when accessing priv->lecd during concurrent socket teardown. A local user can trigger a race condition to cause a denial of service.

The issue occurs because concurrent code paths dereference priv->lecd without protection while lec_atm_close() clears the pointer and the socket may be freed via RCU.

478) Use-after-free (CVE-ID: CVE-2026-43049)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the logitech-hidpp force feedback initialization path when probing the Logitech G920 Driving Force Racing Wheel for Xbox One and userspace continues to access sysfs or /dev/input references after initialization failure. A local user can trigger force feedback initialization failure and use dangling references to cause a denial of service.

The issue occurs if force feedback initialization fails before the userspace infrastructure has been torn down.

479) Out-of-bounds write (CVE-ID: CVE-2026-43047)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service or perform an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in the HID multitouch feature report handling when processing a device response to a feature request. An attacker with physical access can provide a malicious device that responds with a mismatched report ID to cause a denial of service or perform an out-of-bounds write.

The issue is triggered when a device returns a different report ID than the one originally requested.

480) Improper input validation (CVE-ID: CVE-2026-43046)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the btrfs root item handling and relocation recovery code when mounting a btrfs filesystem containing corrupted metadata. A local user can mount a crafted filesystem image to cause a denial of service.

The issue is triggered during relocation recovery at mount time when a root item contains a non-zero drop_progress.objectid together with a zero drop_level.

481) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-43044)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to corrupt memory.

The vulnerability exists due to improper memory allocation in the caam crypto driver when processing HMAC keys longer than the block size. A local user can supply a specially crafted long HMAC key to corrupt memory.

The issue occurs because the buffer size was not allocated using the rounded DMA cache alignment size.

482) NULL pointer dereference (CVE-ID: CVE-2026-43043)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the crypto scatterwalk code when processing sendmsg() operations that chain a new scatter/gather list after an existing list is filled exactly to MAX_SGL_ENTS. A local user can send crafted messages through the AF_ALG interface to cause a denial of service.

The issue is triggered when a subsequent sendmsg() allocates a new scatter/gather list after the previous list's last data entry remains incorrectly marked as the end, leading to a kernel panic.

483) Memory leak (CVE-ID: CVE-2026-43041)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in qrtr_tx_flow when handling radix tree node allocation failures. A local user can trigger allocation failures that leave orphaned internal nodes in the tree to cause a denial of service.

484) Improper Initialization (CVE-ID: CVE-2026-43040)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper initialization in ndisc_ra_useropt when processing router advertisements with user options. A remote attacker can send a specially crafted router advertisement to disclose sensitive information.

The issue affects the RTM_NEWNDUSEROPT netlink message because padding fields in the nduseroptmsg structure are not zeroed before being exposed.

485) Use of uninitialized resource (CVE-ID: CVE-2026-43036)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper handling of packet header data in gso_features_check() when processing packets injected through PF_PACKET paths. A local attacker can inject a specially crafted packet to cause a denial of service.

The issue occurs because the IPv4 header access may rely on skb header offsets that are not always safe for direct dereference in this context.

486) Improper Initialization (CVE-ID: CVE-2026-43035)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in tc_chain_fill_node() when building netlink messages. A local user can trigger the kernel to generate a netlink message to disclose sensitive information.

Kernel heap memory may be exposed to userspace through the 4-byte tcm_info field of struct tcmsg.

487) Improper input validation (CVE-ID: CVE-2026-43032)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper input validation in pn532_receive_buf() when processing malformed UART traffic. A local attacker can send a continuous stream of bytes without a valid frame header to cause a denial of service.

488) Improper input validation (CVE-ID: CVE-2026-43030)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state validation in regsafe() when verifying pointers to packet. A local user can load a specially crafted bpf program to cause a denial of service.

489) Improper Null Termination (CVE-ID: CVE-2026-43028)

CWE-ID: CWE-170 - Improper Null Termination

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in x_tables when processing names supplied to functions that expect c-strings. A local user can provide a name that lacks a nul terminator to cause a denial of service.

490) Use-after-free (CVE-ID: CVE-2026-43027)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in nf_conntrack_helper_unregister and expectation handling in netfilter nf_conntrack_helper when unregistering a helper while stale expectations remain. A local user can trigger helper unregistration and subsequent expectation access to cause a denial of service.

The issue is triggered because expectations referencing the helper survive cleanup and are later dereferenced during expectation dumps or packet-driven conntrack initialization.

491) Use of Uninitialized Variable (CVE-ID: CVE-2026-43026)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in ctnetlink expectation handling when processing a netlink message without CTA_EXPECT_NAT. A remote user can send a specially crafted netlink message to disclose sensitive information.

The issue can cause stale data from a previous slab allocation to be exposed in a dumped CTA_EXPECT_NAT attribute, and it is relevant only when NAT support is enabled.

492) Out-of-bounds read (CVE-ID: CVE-2026-43025)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the ctnetlink expectation handling code when processing netlink requests that create expectations with a helper different from the existing master conntrack helper. A remote user can send a specially crafted netlink request to disclose sensitive information.

The issue can allow reading kernel memory bytes beyond the expectation boundary.

493) Improper input validation (CVE-ID: CVE-2026-43024)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in nf_tables verdict handling when processing nftables rules. A local user can create a rule with an immediate NF_QUEUE verdict to cause a denial of service.

The issue is reachable in the arp family even though queue support is not provided there.

494) Race condition (CVE-ID: CVE-2026-43023)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to use-after-free in sco_sock_connect() when handling concurrent connect() calls on the same Bluetooth SCO socket. A local user can issue concurrent connect() syscalls on the same socket to cause a denial of service.

The issue can revive a BT_CLOSED and SOCK_ZAPPED socket back to BT_CONNECT during concurrent execution.

495) Stack-based buffer overflow (CVE-ID: CVE-2026-43020)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in the Bluetooth MGMT Long Term Key load and reply handling logic when processing a crafted management LTK record with an oversized enc_size value. A remote user can supply a specially crafted LTK record to overflow a reply stack buffer to cause a denial of service or execute arbitrary code.

496) Use-after-free (CVE-ID: CVE-2026-43019)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in set_cig_params_sync when accessing hci_conn objects concurrently. A local user can trigger concurrent operations to cause a denial of service.

497) Use-after-free (CVE-ID: CVE-2026-43018)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in hci_le_remote_conn_param_req_evt when handling Bluetooth LE remote connection parameter request events. A local attacker can trigger concurrent connection handling to cause a denial of service.

498) Improper input validation (CVE-ID: CVE-2026-43017)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the Bluetooth MGMT mesh send handler when processing a crafted MGMT_OP_MESH_SEND command. A local user can send a specially crafted command with a truncated advertising payload length to cause a denial of service.

The issue arises because the supplied flexible adv_data[] array bytes may not match the embedded adv_data_len field, allowing the async mesh send path to read past the end of the queued command buffer.

499) Use-after-free (CVE-ID: CVE-2026-43016)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in sk_psock_verdict_data_ready() when processing sendmsg operations on AF_UNIX sockets. A local user can send crafted messages through a socketpair to trigger the use-after-free and cause a denial of service.

500) Use-after-free (CVE-ID: CVE-2026-43015)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the macb PCI glue driver clock handling during device removal when unregistering the driver and triggering a runtime resume callback. A local user can unload the affected module to trigger a use-after-free and cause a denial of service.

The issue is triggered during driver removal because a runtime resume callback may still access registered clock objects after the platform device has been unregistered.

501) Improper resource shutdown or release (CVE-ID: CVE-2026-43014)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the macb network driver clock registration handling when unregistering fixed rate clocks. A local user can trigger the affected code path to cause a denial of service.

502) NULL pointer dereference (CVE-ID: CVE-2026-43013)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mlx5_ldev_add_debugfs() when accessing debugfs entries created without a valid LAG context. A local user can access a specially exposed debugfs interface to cause a denial of service.

The issue occurs when debugfs entries are created even though no valid ldev pointer is available.

503) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43012)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the mlx5 eswitch switchdev mode handling when processing devlink eswitch mode change requests. A local user can trigger a switchdev mode failure and rollback sequence to cause a kernel BUG.

Exploitation requires the ability to issue devlink eswitch mode change operations on the affected device.

504) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43007)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the qaic DBC deactivation handling when processing a device deactivation transaction after the owning user has exited. A local user can terminate the owning process and then request activation of a network to cause a denial of service.

The issue can leave the host out of sync with available DBCs, causing a subsequent user process to hang while waiting for the DBC to become unused.

505) Improper Privilege Management (CVE-ID: CVE-2026-31788)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges and modify kernel memory contents, breaking secure boot protections.

The vulnerability exists due to improper access control in the Xen privcmd driver when handling hypercalls from user space processes in an unprivileged domU running with secure boot enabled. A local user can exploit this by issuing arbitrary hypercalls to escalate privileges and modify kernel memory, compromising the integrity of the secure boot environment.

Exploitation requires the user to have root privileges within the unprivileged domU guest. The impact is particularly severe when secure boot is enabled, as it allows bypassing memory integrity protections.

506) Observable discrepancy (CVE-ID: CVE-2026-31781)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper restriction of speculative execution in drm_compat_ioctl when processing a user-controlled pointer used as an index into a function pointer table. A local user can supply a crafted index value to disclose sensitive information.

The issue affects the drm compat ioctl path.

507) Heap-based buffer overflow (CVE-ID: CVE-2026-31780)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the wilc1000 SSID scan buffer handling when processing configured SSIDs to scan. A local user can provide a crafted set of SSIDs to trigger a heap-based overwrite to cause a denial of service or execute arbitrary code.

The issue is caused by an integer wraparound in the buffer size calculation, where the accumulated SSID length can exceed the range of an 8-bit value before memory is allocated and copied.

508) Out-of-bounds read (CVE-ID: CVE-2026-31779)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in iwl_mvm_nd_match_info_handler() when processing a crafted notification packet. A local user can supply a notification with an insufficient packet length to disclose sensitive information.

509) Out-of-bounds read (CVE-ID: CVE-2026-31778)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the ALSA caiaq init_card path when processing a crafted USB device product name. An attacker with physical access can connect a specially crafted USB device to disclose sensitive information.

The issue is triggered by a product name containing many non-ASCII, non-space characters, which can cause a non-null-terminated string to be scanned past the end of a stack buffer.

510) Improper Authentication (CVE-ID: CVE-2026-31773)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass authentication requirements.

The vulnerability exists due to improper authentication state handling in the Bluetooth SMP legacy responder STK handling in smp_random() when processing Just Works or Confirm legacy pairing. A remote attacker can initiate a legacy pairing sequence that results in an unauthenticated STK being stored as authenticated to bypass authentication requirements.

The issue affects the legacy responder path and occurs when high security is requested but the pairing flow does not achieve MITM authentication.

511) Stack-based buffer overflow (CVE-ID: CVE-2026-31772)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in hci_le_big_create_sync when processing a crafted ISO socket configuration. A local user can bind an ISO socket with a large number of BIS entries and call listen() to cause a denial of service.

The issue is triggered when the number of BIS entries is between 18 and 31, leading to a stack out-of-bounds write in the HCI command sync worker.

512) Division by zero (CVE-ID: CVE-2026-31770)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in occ_show_power_1() when reading power sensor data before any samples have been collected. A local user can trigger access to the affected sensor path to cause a denial of service.

This can occur during early boot when the sensor block is present but has not yet been updated.

513) Memory corruption (CVE-ID: CVE-2026-31768)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory handling in the ti-adc161s626 SPI read path when performing spi_read() operations. A local user can trigger the vulnerable code path to cause a denial of service.

514) Division by zero (CVE-ID: CVE-2026-31767)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a divide-by-zero error in the i915 dsi driver when determining display timing values in command mode. A local user can trigger driver loading on a system using the affected display configuration to cause a denial of service.

The issue occurs on some machines when the adjusted htotal becomes so small that line_time_us is calculated as zero.

515) Improper resource shutdown or release (CVE-ID: CVE-2026-31763)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mpu3050 gyroscope driver IRQ teardown logic when removing the driver or tearing down IRQ handling. A local user can trigger the vulnerable code path to cause a denial of service.

516) Improper resource shutdown or release (CVE-ID: CVE-2026-31762)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in mpu3050_trigger_probe() in drivers/iio/gyro/mpu3050-core.c when handling trigger registration failures after setting up an interrupt handler. A local user can trigger the vulnerable error path to cause a denial of service.

517) Race condition (CVE-ID: CVE-2026-31761)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mpu3050 gyroscope driver probe function when registering the iio device during device initialization. A local user can trigger concurrent access during initialization to cause a denial of service.

518) Double free (CVE-ID: CVE-2026-31759)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in ulpi_register_interface() when handling a device registration failure. A local user can trigger the vulnerable error path to cause a denial of service.

519) Use-after-free (CVE-ID: CVE-2026-31758)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in usbtmc_release when handling pending anchored URBs during device release. A local user can trigger release while anchored URBs are still pending to cause a denial of service.

520) Improper locking (CVE-ID: CVE-2026-31756)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock management in dwc2_hsotg_udc_stop() when stopping the USB gadget controller. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can result in a deadlock because a spin unlock operation is performed without the required lock being held, after which the lock may remain held for a later locking operation in the same function.

521) NULL pointer dereference (CVE-ID: CVE-2026-31755)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in __cdns3_gadget_ep_queue() when queueing requests on a disabled or unconfigured gadget endpoint. A local user can trigger the vulnerable code path to cause a denial of service.

522) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-31754)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the cdns3 gadget role-switch handling when switching from a failed gadget initialization to host mode via sysfs. A local user can trigger a role switch after gadget startup failure to cause a denial of service.

The issue can result in a synchronous external abort in xhci_gen_setup() during host controller setup.

523) Out-of-bounds read (CVE-ID: CVE-2026-31752)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in br_nd_send when parsing malformed neighbor discovery options. A remote attacker can send a specially crafted neighbor solicitation packet to cause a denial of service.

524) Improper input validation (CVE-ID: CVE-2026-31751)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper hardware presence validation in the dt2815 driver when handling COMEDI_DEVCONFIG ioctl requests with arbitrary I/O port addresses. A local user can attach the driver to a non-existent I/O port to cause a denial of service.

The issue can result in a kernel page fault during write operations when no hardware is present at the specified port.

525) NULL pointer dereference (CVE-ID: CVE-2026-31749)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the ni_atmio16d driver detach handler when cleaning up after a failed attach operation. A local user can trigger a failed attach operation to cause a denial of service.

The issue occurs because the detach path may call the reset routine before the device has been fully initialized.

526) Out-of-bounds read (CVE-ID: CVE-2026-31748)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in me2600_xilinx_download() when parsing a crafted firmware file. A local user can provide a specially crafted firmware file to cause a denial of service.

The issue occurs because the data stream length is read from the first 4 bytes of the firmware and the function reads data from offset 16 without verifying that the supplied firmware contains the full data stream.

527) Out-of-bounds read (CVE-ID: CVE-2026-31747)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in me4000_xilinx_download() when parsing a crafted firmware file. A local user can supply a specially crafted firmware file to cause a denial of service.

The issue occurs because the function reads a length value from the first 4 bytes of the firmware and then reads data from offset 16 onward without ensuring the supplied firmware is large enough to contain the declared data stream.

528) Race condition (CVE-ID: CVE-2026-31741)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the rz-mtu3-cnt sysfs enable handler when processing repeated writes to the enable file. A local user can write repeated enable or disable values to cause a denial of service.

Writing 0 repeatedly can underflow the runtime PM usage count and lead to register access while clocks are off. Writing 0 while PWM is in progress can stop PWM without the counter owning the underlying MTU3 channel.

529) Race condition (CVE-ID: CVE-2026-31740)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the rz-mtu3 counter sub-driver when probing shared hardware channels with the PWM sub-driver. A local user can trigger concurrent or ordered driver probing to cause a denial of service.

The issue affects channels shared between the counter and PWM drivers, where the counter sub-driver may perform runtime PM actions on the wrong device instance depending on probe order.

530) Out-of-bounds read (CVE-ID: CVE-2026-31738)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in vxlan_na_create when parsing neighbor discovery options. A remote attacker can send a specially crafted packet to cause a denial of service.

531) Improper resource shutdown or release (CVE-ID: CVE-2026-31737)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ftgmac100_alloc_rings() when opening the network device. A local user can trigger an open failure to cause a denial of service.

532) Use-after-free (CVE-ID: CVE-2026-31731)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the thermal core when handling thermal zone removal during resume. A local user can trigger a race condition to cause a denial of service.

The issue occurs because delayed work associated with a thermal zone may continue running after the thermal zone object has been freed.

533) Double free (CVE-ID: CVE-2026-31730)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in fastrpc_init_create_static_process() and fastrpc_rpmsg_remove() when handling the INIT_CREATE_STATIC ioctl error path followed by rpmsg device removal or unbind. A local user can trigger the INIT_CREATE_STATIC ioctl error path and subsequently cause the rpmsg device to be removed or unbound to cause a denial of service.

534) Out-of-bounds read (CVE-ID: CVE-2026-31729)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds array access in ucsi_connector_change() when processing a malformed connector number reported in the CCI. An attacker with physical access can connect a malicious or malfunctioning device to trigger the out-of-bounds access and cause a denial of service.

The issue occurs because the connector number is a 7-bit field that can exceed the number of connectors allocated by the device.

535) Race condition (CVE-ID: CVE-2026-31728)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the u_ether gadget driver when handling concurrent disconnect and stop operations. A local user can trigger concurrent gether_disconnect() and eth_stop() execution to cause a denial of service.

The issue can lead to a kernel NULL pointer dereference followed by a hardlockup.

536) NULL pointer dereference (CVE-ID: CVE-2026-31726)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to a NULL pointer dereference in the uvc gadget driver release and disconnect paths when resuming or aborting a suspend during gadget unbind. A local user can trigger a power management transition during device unbind to cause a denial of service.

The issue occurs because freezing user space processes can abort the unbind wait early, after which the V4L2 release path may access a nullified gadget pointer.

537) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-31725)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the f_ecm net_device lifecycle handling when unbinding the gadget function. A local user can trigger bind and unbind cycles to cause a denial of service.

The issue can leave dangling sysfs symlinks after the parent gadget device is destroyed while the network device remains registered.

538) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-31724)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the f_eem usb gadget net_device lifecycle handling when unbinding and rebinding the gadget function. A local user can trigger bind and unbind cycles to cause a denial of service.

The issue results in dangling sysfs symlinks because the net_device survives after its parent gadget device is destroyed.

539) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-31723)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the f_subset usb gadget network device handling when unbinding the gadget function. A local user can trigger bind and unbind cycles to cause a denial of service.

The issue results in dangling sysfs symlinks because the net_device survives after its parent gadget device is destroyed.

540) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-31722)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the f_rndis net_device lifecycle handling when unbinding and rebinding the gadget function. A local user can trigger bind and unbind cycles to cause a denial of service.

The issue results in dangling sysfs symlinks because the net_device survives after its parent gadget device is destroyed.

541) Improper Initialization (CVE-ID: CVE-2026-31721)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization of wait queues in f_hid when re-binding the UDC while a previously opened /dev/hidg0 file descriptor remains registered with epoll. A local user can use the file descriptor in epoll operations across unbind and rebind events to cause a denial of service.

The issue is triggered when the same file descriptor is used with EPOLL_CTL_ADD before unbinding and with EPOLL_CTL_DEL after rebinding.

542) Stack-based buffer overflow (CVE-ID: CVE-2026-31720)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in f_audio_complete() in the f_uac1_legacy USB gadget function driver when handling host-controlled USB control requests. A remote attacker can send a specially crafted USB control request with an oversized length value to cause a denial of service.

The issue arises because request data is copied into a fixed-size 4-byte stack variable using a host-influenced length.

543) Out-of-bounds write (CVE-ID: CVE-2026-31716)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in journal replay file record handling in fs/ntfs3 when processing a corrupted filesystem during journal replay. A local user can provide a crafted filesystem image with invalid file record metadata to cause a denial of service.

The issue occurs when the file record used size is smaller than a validated attribute offset or larger than the record size, causing length calculations for memmove operations to underflow.

544) Use-after-free (CVE-ID: CVE-2026-31715)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in f2fs_write_end_io() and f2fs_in_warm_node_list() when handling concurrent write completion and unmount operations. A local user can trigger the race condition to cause a denial of service.

The issue can lead to a NULL pointer dereference and kernel panic during processing of F2FS checkpoint data pages.

545) Improper resource shutdown or release (CVE-ID: CVE-2026-31714)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in f2fs_rename() when handling rename operations. A local user can trigger a memory leak by invoking crafted rename activity to cause a denial of service.

546) Out-of-bounds read (CVE-ID: CVE-2026-31712)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in smb_check_perm_dacl() when processing a crafted DACL during SMB permission checks. A remote user can set a crafted ACL on a file they own and trigger a subsequent CREATE request to cause a denial of service.

The issue is reachable by an authenticated SMB client with permission to set an ACL on a file, and it is not pre-authentication. The out-of-bounds read is not reflected to the attacker, but KASAN reports and kernel state corruption are possible.

547) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-31711)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in ksmbd_tcp_new_connection() when handling TCP connections that trigger transport allocation failure. A remote attacker can hold open connections with large RFC1002 lengths to cause a denial of service.

The issue is reachable pre-authentication over TCP port 445, and repeated allocation failures can exhaust the connection slot counter until subsequent connection attempts are rejected for the remainder of the boot.

548) Out-of-bounds read (CVE-ID: CVE-2026-31709)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in cifsacl DACL rewrite helpers when processing a server-supplied truncated DACL. A remote attacker can send a malformed ACL response to cause a denial of service.

The issue occurs because the incoming DACL body and each ACE were not structurally validated before chmod/chown security descriptor rebuild paths walked the ACE list.

549) Out-of-bounds read (CVE-ID: CVE-2026-31708)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in smb2_ioctl_query_info() when processing a crafted QUERY_INFO response from an SMB server. A remote attacker can return a malformed response with an OutputBufferLength larger than the actual response buffer to disclose sensitive information.

550) Integer overflow (CVE-ID: CVE-2026-31707)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in ipc_validate_msg() when validating daemon response messages. A local user can supply a specially crafted daemon response with a wrapped size value to cause a denial of service.

The issue affects multiple response types, including RPC request, share config request, and extended login request handling, and negative ngroups values can influence size computation.

551) Improper input validation (CVE-ID: CVE-2026-31706)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in smb_inherit_dacl() when processing a tampered parent directory DACL xattr during SMB2 CREATE. A remote user can trigger inheritance of a crafted security.NTACL value to cause a denial of service.

Exploitation requires a parent directory security.NTACL xattr to be tampered while preserving the hash bytes so the xattr check passes.

552) Out-of-bounds write (CVE-ID: CVE-2026-31705)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in smb2_get_ea() when processing crafted QUERY_INFO compound requests. A remote user can send a specially crafted request to cause a denial of service.

The issue occurs when EA alignment padding is applied after an EA value exactly fills the remaining response buffer, causing 1 to 3 bytes to be written past the boundary into adjacent kernel heap memory.

553) Integer overflow (CVE-ID: CVE-2026-31704)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an integer overflow in set_posix_acl_entries_dacl() and set_ntacl_dacl() when processing files with many POSIX ACL entries. A local user can create a file with many POSIX ACL entries to cause memory corruption.

The accumulated DACL size can wrap past 65535, causing subsequent writes to overwrite earlier ACE entries and resulting in a truncated DACL size value.

554) Use-after-free (CVE-ID: CVE-2026-31702)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in f2fs_compress_write_end_io() when handling compressed writeback completion during a concurrent unmount. A local user can trigger the race condition to cause a denial of service.

The issue occurs in the compressed writeback completion path and requires a race with filesystem unmount activity.

555) Use-after-free (CVE-ID: CVE-2026-31701)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ALSA caiaq driver card free callback when handling device teardown after a disconnect. A local user can trigger asynchronous cleanup after the USB device has been disconnected to cause a denial of service.

The issue occurs because the driver stores a pointer to the parent USB device without taking a reference, and the cleanup path may dereference the freed usb_device.

556) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-31700)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass safety checks.

The vulnerability exists due to a time-of-check time-of-use race condition in tpacket_snd() when processing a mmap'd vnet_hdr in the TPACKET TX path with PACKET_VNET_HDR enabled. A local user can modify vnet_hdr fields in the shared ring buffer between validation and use to bypass safety checks.

Only the TPACKET TX path is affected.

557) Out-of-bounds read (CVE-ID: CVE-2026-31699)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the sev_ioctl_do_pek_csr ioctl handler when processing a PEK CSR retrieval request after a failed firmware command. A local user can supply a too-small userspace buffer and length to trigger a copy to userspace that discloses sensitive information.

The issue occurs when the firmware reports an invalid length for the requested blob.

558) Out-of-bounds read (CVE-ID: CVE-2026-31698)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in sev_ioctl_do_pdh_export when handling a PDH certificate export ioctl after a firmware command failure caused by an invalid length. A local user can provide a userspace buffer and length that are too small to trigger copying beyond the kernel-allocated buffer to disclose sensitive information.

The issue occurs when retrieving the PDH certificate and the firmware reports the required size after the supplied userspace buffer is too small.

559) Out-of-bounds read (CVE-ID: CVE-2026-31697)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in sev_ioctl_do_get_id2 in the ccp/sev ioctl handler when handling a request to retrieve the CPU ID with a userspace buffer and length that are too small after a firmware command failure. A local user can issue a specially crafted ioctl request to disclose sensitive information.

The issue occurs when the firmware command fails due to an invalid length and the kernel still copies the firmware-required byte count to userspace.

560) Improper input validation (CVE-ID: CVE-2026-31696)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in rxrpc_preparse() when parsing non-XDR key payloads. A local user can provide a crafted key payload with an oversized ticket length to cause a denial of service.

The issue is triggered later when the key is read via rxrpc_read(), causing the token size calculation to exceed AFSTOKEN_LENGTH_MAX and hit a WARN_ON().

561) Use-after-free (CVE-ID: CVE-2026-31695)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the virt_wifi net device handling when performing ethtool operations on a virt_wifi device that is being unregistered. A local user can send a specially crafted netlink message to trigger the use-after-free and cause a denial of service.

The issue occurs because the device parent reference may point to freed memory during unregister processing.

562) Heap-based buffer overflow (CVE-ID: CVE-2026-31694)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in fuse_add_dirent_to_cache() when processing directory entries returned by a FUSE server. A remote attacker can return a specially crafted directory entry with an oversized name length to cause a denial of service.

The issue occurs when a serialized directory entry exceeds a single page size and is copied into the readdir cache.

563) Improper Initialization (CVE-ID: CVE-2026-31689)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in edac_mc_alloc() when handling a failed mci->pvt_info allocation. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs because put_device() may invoke the device release function before device initialization has completed.

564) Double free (CVE-ID: CVE-2026-31686)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in kasan_free_pxd() when freeing kasan page table entries during memory unmapping. A local user can trigger the vulnerable code path to cause a denial of service.

The issue was observed on powerpc systems with 64K page size where PUD tables can be allocated from the pgtable-2^9 slab cache.

565) Out-of-bounds read (CVE-ID: CVE-2026-31684)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in tcf_csum_act() when processing packets with nested in-payload VLAN headers. A remote attacker can send a specially crafted packet to cause a denial of service.

566) Heap-based buffer overflow (CVE-ID: CVE-2026-31683)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a buffer overflow in batman-adv OGM aggregation handling when aggregating forwarded packets after OGM aggregation state is toggled at runtime. A local user can trigger aggregation with insufficient skb tailroom to cause a denial of service.

567) Out-of-bounds read (CVE-ID: CVE-2026-31681)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ports_match_v1() in the xt_multiport netfilter module when processing malformed multiport v1 rules. A local user can supply a crafted rule with invalid range encoding to cause a denial of service.

568) Use-after-free (CVE-ID: CVE-2026-31680)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ip6fl_seq_show() when reading /proc/net/ip6_flowlabel concurrently with flowlabel release. A local user can trigger concurrent access to dereference freed option state and cause a denial of service.

The issue occurs because the flowlabel remains reachable through the global hash table under RCU after its option state has been freed.

569) Improper input validation (CVE-ID: CVE-2026-31679)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in openvswitch SET/SET_MASKED action handling for OVS_KEY_ATTR_MPLS when processing crafted MPLS action payload lengths. A local user can send a specially crafted request to cause a denial of service.

570) Race condition (CVE-ID: CVE-2026-31678)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the openvswitch tunnel device destruction path when destroying a tunnel vport after device unregistration. A local user can trigger concurrent access to a detached device reference to cause a denial of service.

571) Resource exhaustion (CVE-ID: CVE-2026-31677)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in af_alg_get_rsgl() when processing recvmsg calls with data extraction into the RX scatterlist. A local user can send a specially crafted recvmsg request to cause a denial of service.

572) Out-of-bounds read (CVE-ID: CVE-2026-31675)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in netem_enqueue() when processing fully non-linear packets sent over an IPIP tunnel through an AF_PACKET TX_RING. A local user can send a specially crafted packet to cause a denial of service.

573) Out-of-bounds read (CVE-ID: CVE-2026-31674)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rt_mt6() when processing a malformed rt match rule with an oversized addrnr value. A local user can install a specially crafted rule to cause a denial of service.

574) Use-after-free (CVE-ID: CVE-2026-31673)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in UNIX_DIAG_VFS handling in af_unix when processing UNIX diagnostic lookups. A local user can trigger a race condition to cause a denial of service.

575) Improper resource shutdown or release (CVE-ID: CVE-2026-31672)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the rt2x00usb USB driver when unbinding the driver from a USB interface without physically disconnecting the device. A local user can trigger driver unbind conditions to cause a denial of service.

This can occur during probe deferral or configuration changes.

576) Improper Initialization (CVE-ID: CVE-2026-31671)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in build_report() when copying a xfrm_user_report structure to userspace. A local user can trigger the affected code path to disclose sensitive information.

The issue is caused by uninitialized padding bytes in the structure being exposed to userspace.

577) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-31670)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the rfkill event handling logic when userspace creates rfkill events without consuming them from the rfkill file descriptor. A local user can create an unlimited number of pending rfkill events to cause a denial of service.

The issue can lead to an out-of-memory condition on systems configured to allow userspace to create such events.

578) Improper locking (CVE-ID: CVE-2026-31667)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock management in the uinput force-feedback handling path when processing force-feedback operations and device lifecycle events. A local user can trigger a circular locking dependency to cause a denial of service.

The issue can be triggered when using a force-feedback gamepad with uinput.

579) Use-after-free (CVE-ID: CVE-2026-31665)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in nft_ct_timeout_obj_destroy() when destroying timeout objects during concurrent packet processing. A local user can trigger concurrent packet processing and object destruction to cause a denial of service.

The issue arises because other CPUs may still hold RCU-protected references to the timeout object.

580) Use of uninitialized resource (CVE-ID: CVE-2026-31664)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in build_polexpire() when sending netlink multicast notifications to XFRMNLGRP_EXPIRE listeners. A local user can receive a crafted expiration notification to disclose sensitive information.

The issue leaks trailing padding bytes from struct xfrm_user_polexpire to userspace.

581) Integer underflow (CVE-ID: CVE-2026-31662)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow in tipc_group_proto_rcv() when handling duplicate or stale GRP_ACK_MSG messages. A remote attacker can send duplicate group acknowledgment messages to cause a denial of service.

After the counter wraps, group broadcasts on the affected socket remain blocked until the group is recreated.

582) Improper resource shutdown or release (CVE-ID: CVE-2026-31661)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in the brcmsmac driver when freeing DMA-coherent memory. A local user can trigger the vulnerable code path to cause a denial of service.

583) NULL pointer dereference (CVE-ID: CVE-2026-31660)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in pn532_receive_buf() when processing received bytes. A local user can trigger an allocation failure during frame reception to cause a denial of service.

584) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-31658)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in tse_start_xmit() when handling DMA mapping failures. A local user can trigger DMA mapping failures to cause a denial of service.

585) Use-after-free (CVE-ID: CVE-2026-31656)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in intel_engine_park_heartbeat when racing the heartbeat worker and request retirement paths while releasing engine->heartbeat.systole. A local user can trigger concurrent request retirement and heartbeat handling to cause a denial of service.

The issue arises because the same systole request can be released twice after a stale non-NULL pointer is observed in a non-atomic read-and-clear sequence.

586) Improper resource shutdown or release (CVE-ID: CVE-2026-31655)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper power management in imx8mp-blk-ctrl when handling the NoC ADB400 port power down handshake. A local user can trigger the affected power management path to cause a denial of service.

587) NULL pointer dereference (CVE-ID: CVE-2026-31651)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the vub300 mmc driver disconnect handler when disconnecting the device. A local user can trigger a device disconnect to cause a denial of service.

The issue may also lead to a use-after-free condition.

588) Integer overflow (CVE-ID: CVE-2026-31648)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an integer overflow in filemap_map_pages() when mapping file-backed folios during a race with file size truncation. A local user can trigger the race to cause memory corruption.

The issue can cause mappings to extend beyond the large folio size and corrupt fields of pages that do not belong to that folio.

589) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-31646)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an error pointer in lan966x_fdma_rx_alloc_page_pool() when creating a page pool. A local user can trigger page_pool_create() failure to cause a denial of service.

The issue can lead to a kernel oops when the error pointer is dereferenced through xdp_rxq_info_reg_mem_model() and page_pool_use_xdp_mem().

590) Improper resource shutdown or release (CVE-ID: CVE-2026-31645)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in lan966x_fdma_rx_alloc() and lan966x_fdma_init() when handling error paths after page pool creation. A local user can trigger allocation failures to cause a denial of service.

591) Race condition (CVE-ID: CVE-2026-31642)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in rxrpc call removal from the rxnet->calls list when reading /proc/net/rxrpc/calls. A local user can trigger access to the procfs entry during concurrent call deletion to cause a denial of service.

592) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-31639)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in rxrpc_alloc_client_call() and rxrpc_destroy_call() when creating and destroying a client call. A local user can trigger client call creation to cause a denial of service.

593) NULL pointer dereference (CVE-ID: CVE-2026-31638)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of a NULL pointer reference in rxrpc_input_packet_on_conn() when processing a to-client packet after the current client call on the channel has already been torn down. A remote attacker can send a crafted packet to cause a denial of service.

The issue occurs on the client-side implicit-end error path when chan->call is NULL and no call reference was acquired.

594) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-31634)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in rxrpc_server_keyring() when handling RxRPC server keyring setup. A local user can trigger the vulnerable code path to cause a denial of service.

595) Use-after-free (CVE-ID: CVE-2026-31629)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc() when handling sockets in the LLCP_CLOSED state. A local user can trigger the affected code path to cause a denial of service.

596) Information disclosure (CVE-ID: CVE-2026-31628)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to improper isolation of partial divider results in x86 CPU handling when executing division operations on Zen1 processors. A local attacker can run a thread that observes residual partial results from previous operations to disclose sensitive information.

Exploitation requires another thread to access leaked partial results left by a previous operation under certain circumstances.

597) Improper input validation (CVE-ID: CVE-2026-31627)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the s3c24xx i2c driver when processing SMBUS messages. A local user can provide a specially crafted SMBUS message with an invalid size field to cause a denial of service.

598) Use of Uninitialized Variable (CVE-ID: CVE-2026-31626)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in rtw_BIP_verify() when processing BIP data. A local user can trigger the function with crafted input to cause a denial of service.

599) NULL pointer dereference (CVE-ID: CVE-2026-31625)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in alps_raw_event() when processing raw HID events. A local user can trigger the vulnerable code path to cause a denial of service.

600) Integer overflow (CVE-ID: CVE-2026-31624)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an undefined shift caused by improper input validation in s32ton() when processing a malicious HID report descriptor during output report construction. A local attacker can supply a broken HID device with an oversized report_size field to cause a denial of service.

The issue is triggered when an output report is built via hid_output_field() or hid_set_field().

601) Out-of-bounds write (CVE-ID: CVE-2026-31623)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in rx_complete() in the cdc-phonet driver when processing bulk transfers from a malicious USB device claiming to be a CDC Phonet modem. An attacker with physical access can send an unbounded sequence of full-page bulk transfers to cause a denial of service.

602) Heap-based buffer overflow (CVE-ID: CVE-2026-31622)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in digital_in_recv_sdd_res() when processing crafted NFC-A SDD and SEL responses from a peer device. A remote attacker can send crafted responses to cause a denial of service.

The issue occurs because the peer device can control the number of NFC-A anti-collision cascade rounds and the amount of data appended to target->nfcid1 on each round.

603) Out-of-bounds read (CVE-ID: CVE-2026-31619)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the efr_status_names[] string array lookup in the ALSA fireworks driver when processing a device-supplied EFW response status value. A local user can supply a crafted status value from a firewire device to cause a denial of service.

604) Division by zero (CVE-ID: CVE-2026-31618)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to divide-by-zero in the tdfxfb driver when handling FBIOPUT_VSCREENINFO requests. A local user can submit crafted screen information to trigger a kernel crash and cause a denial of service.

605) Integer underflow (CVE-ID: CVE-2026-31617)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an integer underflow in ncm_unwrap_ntb() in the f_ncm USB gadget component when processing a host-supplied NTB header. An attacker with physical access can provide a crafted NTB header with a too-small block length and out-of-bounds indexes to disclose sensitive information.

The issue can cause adjacent kernel memory to be copied into a network skb.

606) Out-of-bounds write (CVE-ID: CVE-2026-31616)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in pn_rx_complete() when processing an unbounded sequence of full-page USB OUT transfers. A remote attacker can send a crafted sequence of full-page USB OUT transfers to cause memory corruption.

The issue affects a Linux gadget exposing a Phonet function and occurs when each transfer is exactly PAGE_SIZE bytes, preventing the skb from being reset.

607) Improper input validation (CVE-ID: CVE-2026-31615)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in standard request handlers in the renesas_usb3 USB gadget driver when processing host-supplied standard USB requests. A remote attacker can send a specially crafted request with an invalid endpoint index to cause a denial of service.

608) Out-of-bounds read (CVE-ID: CVE-2026-31613)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the SMB client symlink response parser when parsing a crafted symlink error response from an untrusted server. A remote attacker can send a specially crafted SMB response to disclose sensitive information.

The exposed heap bytes are UTF-16-decoded into the symlink target and returned to userspace via readlink(2).

609) Out-of-bounds read (CVE-ID: CVE-2026-31612)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in smb2_get_ea() when handling crafted SMB2 extended attribute requests. A remote attacker can send a specially crafted request to disclose sensitive information.

Uninitialized heap values may be leaked to the client.

610) Out-of-bounds read (CVE-ID: CVE-2026-31611)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to modify file permissions.

The vulnerability exists due to an out-of-bounds read in parse_dacl() when processing a crafted security descriptor containing an ACE SID with only two sub-authorities that matches the sid_unix_NFS_mode prefix. A remote attacker can send a specially crafted security descriptor to modify file permissions.

The issue occurs when the crafted ACE is placed at the end of the security descriptor, causing 4 bytes past the end of the ACL to be read and masked into the low 9 bits as the file's POSIX mode.

611) Memory leak (CVE-ID: CVE-2026-31610)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in smb2_sess_setup() SPNEGO negotiation handling when processing a malformed SPNEGO negotiation token. A remote attacker can send a specially crafted negotiation blob to cause a denial of service.

The issue is reachable pre-authentication, and malformed later elements in the same token can leave an allocated mechToken uncleared after both SPNEGO grammars fail.

612) Use-after-free (CVE-ID: CVE-2026-31606)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the f_hid hid gadget character device handling when unbinding and binding the gadget while the /dev/hidg* device remains open. A local user can keep the device open and trigger unbind and bind operations to cause a denial of service.

613) Division by zero (CVE-ID: CVE-2026-31605)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to divide-by-zero in the udlfb driver when handling FBIOPUT_VSCREENINFO ioctl requests. A local user can submit crafted screen information values to trigger a kernel crash and cause a denial of service.

614) Memory leak (CVE-ID: CVE-2026-31604)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the rtw88 USB driver probe path when handling device initialization failures. A local user can trigger a probe failure to cause a denial of service.

615) Division by zero (CVE-ID: CVE-2026-31603)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in ps_to_hz() when handling a FBIOPUT_VSCREENINFO request with a zero pixclock value. A local user can supply crafted screen information to trigger a division by zero and cause a denial of service.

616) Out-of-bounds write (CVE-ID: CVE-2026-31602)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in ct_vm_map() in the ALSA ctxfi driver when handling large aggregate memory allocations for playback streams. A local user can trigger crafted allocation patterns through ioctl operations to cause a denial of service.

The issue is triggered on AMD64 systems when aggregate memory allocations exceed the single-page table coverage limit.

617) NULL pointer dereference (CVE-ID: CVE-2026-31599)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in vidtv_channel_pmt_match_sections when handling a memory allocation failure from vidtv_psi_pmt_stream_init. A local user can trigger the vulnerable code path to cause a denial of service.

618) Deadlock (CVE-ID: CVE-2026-31598)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an inconsistent lock ordering that can lead to deadlock in ocfs2 unlink and direct I/O write completion handling when concurrent unlink and dio_end_io_write operations are performed. A local user can trigger concurrent file operations to cause a denial of service.

619) Use-after-free (CVE-ID: CVE-2026-31597)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in ocfs2_fault() when handling a page fault that returns VM_FAULT_RETRY. A local user can trigger a concurrent munmap() during fault handling to cause a denial of service.

620) Improper input validation (CVE-ID: CVE-2026-31596)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ocfs2_group_extend when handling a crafted filesystem through the resize ioctl. A local user can trigger the resize operation on a crafted filesystem image to cause a denial of service.

The issue occurs because an invalid global bitmap inode can reach the JBD2-managed buffer path and lead to a kernel BUG instead of a clean failure.

621) Race condition (CVE-ID: CVE-2026-31595)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the epf_ntb_cmd_handler work handler in pci-epf-vntb when cleaning up endpoint controller resources. A local user can trigger the vulnerable cleanup path to cause a denial of service.

622) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-31594)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the pci-epf-vntb endpoint function driver when handling endpoint link setup or teardown failures. A local user can trigger link operations that cause duplicate resource teardown to cause a denial of service.

The issue can result in a kernel oops when .allow_link fails or when .drop_link is performed.

623) Integer overflow (CVE-ID: CVE-2026-31590)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an integer overflow condition in sev_pin_memory() when processing a KVM_MEMORY_ENCRYPT_REG_REGION ioctl request with a crafted size value. A local user can submit a specially crafted ioctl request to cause a kernel warning.

The issue is reachable from userspace through the KVM SEV memory encryption region registration interface.

624) Use-after-free (CVE-ID: CVE-2026-31588)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in complete_emulated_mmio() when servicing an emulated MMIO write that splits a page boundary across MMIO pages. A local user can trigger crafted KVM_RUN operations to cause a denial of service.

The issue occurs for write payloads of 8 bytes or less and is most visible when the second KVM_RUN is performed by a separate task.

625) Use-after-free (CVE-ID: CVE-2026-31587)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the q6apm ASoC component registration logic when unregistering dynamically registered dais from ASoC topology. A local user can trigger device unbind or removal conditions to cause a denial of service.

626) Use-after-free (CVE-ID: CVE-2026-31586)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in cgwb_release_workfn() when releasing writeback resources and later dereferencing wb->blkcg_css after dropping its last reference. A local user can trigger the race condition to cause a denial of service.

The issue is race-dependent and can be observed as a KASAN-reported slab-use-after-free in blkcg_unpin_online().

627) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-31585)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in vidtv_start_feed() when handling a start_streaming failure. A local user can trigger a start_streaming failure to cause a denial of service.

The issue can corrupt the nfeeds counter and may leave partially allocated mux and channel resources uncleared when the stop path returns early.

628) Use-after-free (CVE-ID: CVE-2026-31584)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fops_vcodec_release() and the mtk_venc_worker workqueue handler when releasing an encoder context while queued or running encode work is still active. A local user can trigger the encoder release path during encode operations to cause a denial of service.

The issue is caused by a race condition between the release path and the workqueue lifecycle after the multimedia job is considered complete.

629) Use-after-free (CVE-ID: CVE-2026-31583)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in em28xx_v4l2_open() when opening a V4L2 device while racing with initialization error handling or device teardown. A local user can trigger concurrent operations to cause a denial of service or execute arbitrary code.

The race condition can also lead to a NULL pointer dereference.

630) Use-after-free (CVE-ID: CVE-2026-31582)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the powerz hwmon driver when handling a USB device disconnect followed by a read operation. A local user can disconnect the device and trigger a subsequent read to cause a denial of service.

The issue occurs after the freed URB pointer is dereferenced during device access after disconnection.

631) Use-after-free (CVE-ID: CVE-2026-31581)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in usb6fire_chip_abort() in the ALSA 6fire USB driver when handling device disconnect. A local user can trigger a device disconnect to cause a denial of service.

The issue occurs because the card private data may be freed synchronously when no file handles are open, after which the code accesses the freed chip structure.

632) Use-after-free (CVE-ID: CVE-2026-31580)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in cached_dev.sb_bio when handling superblock write completion while the device is being stopped. A local user can stop the device during a superblock write to cause a denial of service.

633) Use-after-free (CVE-ID: CVE-2026-31578)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the as102_usb driver release path when handling a previously opened device file during device deregistration or disconnect. A local user can open the device node before deregistration and later close the file descriptor to cause a denial of service.

The issue can also result in a double free when the final open file descriptor is released after the device structure was already freed on the probe error path.

634) NULL pointer dereference (CVE-ID: CVE-2026-31577)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in nilfs_mdt_save_to_shadow_map() when handling NILFS_IOCTL_CLEAN_SEGMENTS immediately after mount before any btree operation has occurred on the DAT inode. A local user can invoke the ioctl in that state to cause a denial of service.

The issue occurs because the DAT inode's i_assoc_inode may remain uninitialized until a btree operation is performed.

635) Use-after-free (CVE-ID: CVE-2026-31576)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the hackrf driver when handling ioctl and release operations on an already-open device file after device unregistration. A local user can keep a device file descriptor open and trigger ioctl or close operations to cause a denial of service.

New open() calls are blocked after device unregistration, but already-open file descriptors and in-flight I/O remain valid until the final reference is released.

636) Race condition (CVE-ID: CVE-2026-31575)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in mfill_atomic_hugetlb() when handling userfaultfd hugetlb faults. A local user can trigger faults on different addresses within the same huge page to cause a denial of service.

The issue can corrupt the reservation map and trigger the BUG_ON in resv_map_release().

637) Out-of-bounds write (CVE-ID: CVE-2026-31570)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service or corrupt memory.

The vulnerability exists due to an out-of-bounds write in cgw_csum_crc8_rel() when processing CAN gateway crc8 checksum configuration with crafted negative indices. A local user can supply crafted checksum index values to cause a denial of service or corrupt memory.

Exploitation requires CAP_NET_ADMIN to configure the can-gw crc8 checksums.

638) Use-after-free (CVE-ID: CVE-2026-31566)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in amdgpu_amdkfd_submit_ib() when waiting for GPU job completion after submitting a GPU job. A local user can trigger the vulnerable code path to cause a denial of service.

639) Deadlock (CVE-ID: CVE-2026-31565)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in the irdma RDMA subsystem when executing a netdev reset while RDMA applications have active connections. A local user can trigger a netdev reset during active RDMA connections to cause a denial of service.

The issue occurs during device removal in iWARP mode when client cleanup creates a circular dependency involving QP reference counting.

640) Improper resource shutdown or release (CVE-ID: CVE-2026-31563)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the macb TX SKB freeing logic when freeing transmitted socket buffers in an IRQ-disabled context. A local user can trigger network traffic processing to cause a denial of service.

641) Race condition (CVE-ID: CVE-2026-31557)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in async event work handling on the nvmet workqueue when freeing an NVMe target controller during queue disconnect processing. A local user can trigger queue disconnect and controller cleanup to cause a denial of service.

The issue arises from recursive locking when async event work is flushed from the same worker processing nvmet-wq.

642) Improper locking (CVE-ID: CVE-2026-31556)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock release in xchk_quota_item when handling quota scrub error processing. A local user can trigger an early return that leaves dq->q_qlock held to cause a denial of service.

643) Use-after-free (CVE-ID: CVE-2026-31555)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a stale pointer in futex_lock_pi() retry path in kernel/futex/core.c when retrying priority-inheritance futex locking after owner exit handling. A local user can trigger repeated futex_lock_pi() operations to cause a kernel warning and crash.

644) Use-after-free (CVE-ID: CVE-2026-31554)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sys_futex_requeue() when using different flags in a requeue operation. A local user can invoke the affected futex requeue operation with mismatched flags to cause a denial of service.

645) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-31552)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in wlcore_tx_work_locked() when processing transmit frames after memory allocation for skb headroom fails. A local user can trigger memory allocation failure during packet transmission to cause a denial of service.

The issue can lead to an infinite retry loop and a CPU soft lockup.

646) Race condition (CVE-ID: CVE-2026-31551)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in aql_enable_write in the mac80211 debugfs interface when handling concurrent write operations to debugfs. A local user can perform concurrent writes to the aql control file to cause a denial of service.

647) Resource exhaustion (CVE-ID: CVE-2026-31550)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper timeout handling in bcm2835_asb_control() when handling runtime power management suspend operations for V3D. A local user can trigger intensive workloads to cause a denial of service.

The issue can leave V3D in a broken state, leading to bus faults or system hangs on later accesses.

648) NULL pointer dereference (CVE-ID: CVE-2026-31549)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the cp2615 driver probe routine when probing a malicious USB device that lacks a serial string. An attacker with physical access can connect a specially crafted device to trigger a NULL pointer dereference and cause a denial of service.

649) Race condition (CVE-ID: CVE-2026-31548)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in cfg80211 PMSR handling when closing the nl80211 socket that originated a PMSR request while the interface is concurrently being torn down. A local user can trigger concurrent abort processing and interface teardown to cause a denial of service.

The issue can result in the driver's abort_pmsr callback operating on a torn-down interface.

650) NULL pointer dereference (CVE-ID: CVE-2026-31546)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in bond_debug_rlb_hash_show when reading debugfs entries for RLB hash-table entries with no assigned slave. A local user can read the affected debugfs entry to cause a denial of service.

The issue occurs when an entry remains on the rx_hashtbl_used_head list with its slave pointer set to NULL.

651) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-31545)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource handling in the nxp-nci driver GPIO handling logic when operating GPIOs connected to I2C GPIO expanders. A local user can trigger the vulnerable code path to cause a denial of service.

The issue results in a kernel WARN_ON condition.

652) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-31542)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of deconfigured sockets in UV hub info structure allocation when allocating UV hub info structures for a socket mapped to SOCK_EMPTY. A local user can trigger allocation in this state to cause a denial of service.

653) NULL pointer dereference (CVE-ID: CVE-2026-31540)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the i915 driver suspend handling path when suspending a system without i915 driver firmware binaries present. A local user can trigger a suspend operation to cause a denial of service.

The issue occurs because the set_default_submission function pointer may be unset and still dereferenced during suspend.

654) Use-after-free (CVE-ID: CVE-2026-31532)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in raw_rcv() when processing CAN frames after a raw CAN socket is released. A local user can trigger concurrent socket release and packet reception to cause a denial of service.

The issue involves the percpu uniq storage referenced through RCU-delayed receiver deletion.

655) Use-after-free (CVE-ID: CVE-2026-31530)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in cxl_detach_ep() when handling concurrent endpoint detach operations and switch port removal. A local user can trigger concurrent device detach and port unregistration to cause a denial of service.

This issue is reproducible when reloading cxl_acpi in QEMU with CXL devices present.

656) Out-of-bounds read (CVE-ID: CVE-2026-31528)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds memory access in x86_pmu_del() when rolling back a failed group_sched_in() operation for a group whose leader is a software event. A local user can trigger a failed group scheduling operation to cause a denial of service.

The issue occurs because inherited events may use the wrong PMU context for grouped events.

657) Use-after-free (CVE-ID: CVE-2026-31527)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the platform driver core driver_override handling when probing a driver through __driver_attach__(). A local user can trigger concurrent access to the driver_override field to cause a denial of service.

658) Integer overflow (CVE-ID: CVE-2026-31525)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to access out-of-bounds map values.

The vulnerability exists due to improper handling of signed integer minimum values in the BPF interpreter's signed 32-bit division and modulo handlers when processing crafted BPF operations that use INT_MIN. A local user can load a crafted BPF program to access out-of-bounds map values.

The issue is caused by a verifier and interpreter mismatch in range tracking for signed 32-bit division and modulo operations.

659) Out-of-bounds read (CVE-ID: CVE-2026-31524)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in asus_report_fixup() when copying the HID report descriptor. A local user can attach or interact with a crafted device descriptor to cause a denial of service.

660) Race condition (CVE-ID: CVE-2026-31523)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nvme-pci polled queue handling when polling a queue during a reset while queue mappings are being updated. A local user can change the polled queue count at run time to trigger double completions and cause a denial of service.

The issue occurs during a brief window before the block layer has updated the queue maps.

661) Memory leak (CVE-ID: CVE-2026-31522)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in magicmouse_report_fixup() when processing HID report descriptors. A local user can trigger the vulnerable code path to cause a denial of service.

662) Out-of-bounds read (CVE-ID: CVE-2026-31521)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in simplify_symbols() when parsing a crafted module ELF file with an invalid section index. A local user can load a specially crafted module to cause a denial of service.

This can be triggered when the module ELF legitimately uses SHN_XINDEX or when the file is corrupted.

663) Memory leak (CVE-ID: CVE-2026-31520)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in apple_report_fixup() in the HID apple driver when processing crafted HID report descriptors. A local user can connect or emulate a crafted HID device to cause a denial of service.

664) Race condition (CVE-ID: CVE-2026-31519)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in btrfs subvolume lookup and orphan cleanup handling when looking up a subvolume after dentry cache eviction with concurrent delayed iputs and unlink activity. A local user can trigger concurrent filesystem operations to cause a denial of service.

The issue can result in a negative dentry being created for a valid subvolume, causing filesystem operations on that subvolume to fail and potentially abort the filesystem.

665) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-31518)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in esp_output_tail_tcp when handling a full espintcp TX queue with asynchronous crypto. A local user can trigger packet processing errors to cause a denial of service.

The issue occurs when asynchronous crypto is used instead of synchronous crypto.

666) Use-after-free (CVE-ID: CVE-2026-31516)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in xfrm_hash_rebuild() when processing an XFRM_MSG_NEWSPDINFO request that queues policy_hthresh.work during net namespace teardown. A local user can send a specially crafted XFRM_MSG_NEWSPDINFO request to cause a denial of service.

667) Heap-based buffer overflow (CVE-ID: CVE-2026-31515)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a buffer overflow in pfkey_send_migrate() when processing migration requests with invalid old or new address families. A local user can trigger the vulnerable code path to cause a denial of service.

668) Out-of-bounds read (CVE-ID: CVE-2026-31512)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in l2cap_ecred_data_rcv() when processing a crafted L2CAP Enhanced Credit Based Flow Control data packet with less than 2 bytes of data. A remote attacker can send a specially crafted Bluetooth packet to disclose sensitive information.

669) Use-after-free (CVE-ID: CVE-2026-31511)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mgmt_add_adv_patterns_monitor_complete when handling Bluetooth management operations. A local user can trigger a crafted sequence of management operations to cause a denial of service.

The issue can be triggered by subsequent list traversal that dereferences freed memory.

670) NULL pointer dereference (CVE-ID: CVE-2026-31510)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in l2cap_sock_ready_cb when handling L2CAP connection state changes. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can lead to a kernel panic.

671) Improper locking (CVE-ID: CVE-2026-31509)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper lock handling issue in nci_close_device when flushing rx_wq and tx_wq while holding req_lock. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can result in a circular locking dependency and has been observed during execution of the nci selftest on debug kernels.

672) Race condition (CVE-ID: CVE-2026-31508)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the openvswitch port teardown code when unregistering a netdevice. A local user can trigger netdevice unregistration to cause a denial of service.

The issue can occur on PREEMPT_RT kernels if the device is freed before unregistration completes.

673) Double free (CVE-ID: CVE-2026-31507)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in smc_rx_pipe_buf_release() and SMC splice pipe buffer handling when duplicating splice pipe buffers with tee(2) or splice_pipe_to_pipe(). A local user can duplicate an SMC splice buffer to cause a denial of service.

The issue can trigger a slab-use-after-free that leads to a NULL-pointer dereference and kernel panic.

674) Double free (CVE-ID: CVE-2026-31506)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in the WoL irq handling in the bcmasp network driver when freeing interrupt resources. A local user can trigger the vulnerable code path to cause a denial of service.

675) Out-of-bounds write (CVE-ID: CVE-2026-31505)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in iavf_get_ethtool_stats() when handling concurrent ethtool channel and statistics operations. A local user can issue crafted ethtool requests to cause a denial of service.

The issue can be triggered when "ethtool -L" and "ethtool -S" are executed simultaneously during queue reconfiguration.

676) Improper access control (CVE-ID: CVE-2026-31503)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the UDP socket bind conflict check when binding a wildcard address after multiple sockets are already bound to the same local port. A local user can bind sockets to multiple specific local addresses on the same port and then bind a wildcard address to bypass conflict detection and cause a denial of service.

The issue affects IPv6 wildcard, IPv4 wildcard, and IPv4-mapped wildcard addresses when the bind bucket count exceeds 10.

677) Type Confusion (CVE-ID: CVE-2026-31502)

CWE-ID: CWE-843 - Type confusion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to type confusion in team header_ops handling when processing header operations on non-Ethernet ports. A local user can trigger crafted network device interactions to cause a denial of service.

The issue can be triggered in stacked non-Ethernet topologies where inherited header callbacks are invoked with the wrong net_device context.

678) Use-after-free (CVE-ID: CVE-2026-31500)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in btintel_hw_error() when handling a hardware error concurrently with device close operations. A local user can trigger a race condition to cause a denial of service.

The issue occurs because synchronous HCI command paths manipulate shared request state concurrently.

679) Deadlock (CVE-ID: CVE-2026-31499)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in l2cap_conn_del() when canceling delayed work items. A local user can trigger Bluetooth L2CAP connection deletion while the associated timer work is executing to cause a denial of service.

680) Resource exhaustion (CVE-ID: CVE-2026-31498)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the Bluetooth L2CAP ERTM implementation when processing configuration requests and segmenting user-supplied protocol data. A remote attacker can send specially crafted L2CAP configuration data to cause a denial of service.

The issue can be triggered during channel reconfiguration in the connected state, and a zero remote_mps value can lead to an infinite loop that exhausts available memory.

681) Out-of-bounds read (CVE-ID: CVE-2026-31497)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the btusb driver SCO alternate setting lookup in btusb_work() when processing transparent voice settings with more than three active SCO links. A local user can trigger Bluetooth connection states that cause the driver to index past the end of the alts[] table to cause a denial of service.

682) Improper access control (CVE-ID: CVE-2026-31496)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in nf_conntrack_expect proc handling when reading proc entries. A local user can read expectation entries from other network namespaces to disclose sensitive information.

683) Improper input validation (CVE-ID: CVE-2026-31495)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ctnetlink when handling netlink attribute values. A local user can send a specially crafted netlink message to cause a denial of service.

The issue involves invalid TCP state, window scale, and flag values accepted through ctnetlink attributes.

684) Out-of-bounds write (CVE-ID: CVE-2026-31494)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in gem_get_ethtool_stats when handling ethtool statistics requests for devices with fewer active queues than the maximum supported queues. A local user can send a crafted ioctl request to cause a denial of service.

685) Improper Initialization (CVE-ID: CVE-2026-31492)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in irdma_create_qp and irdma_destroy_qp when handling a failure from ib_copy_to_udata during queue pair creation. A local user can trigger an error during queue pair creation to cause a denial of service.

686) Double free (CVE-ID: CVE-2026-31489)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in meson_spicc_remove() when removing the SPI controller. A local user can trigger the removal path to cause a denial of service.

687) Use-after-free (CVE-ID: CVE-2026-31488)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the amdgpu display manager stream handling logic when processing KMS commits involving DSC validation and unrelated mode changes. A local user can trigger a crafted display configuration change to cause a denial of service.

The issue can occur when MST/DSC configuration changes happen in the same commit as a separate mode change, leading to incorrect stream lifetime handling when the stream is later disabled.

688) Use-after-free (CVE-ID: CVE-2026-31487)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the SPI driver_override handling when matching drivers during device probing. A local user can trigger driver probing to cause a denial of service.

689) Use-after-free (CVE-ID: CVE-2026-31485)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the spi-fsl-lpspi driver when tearing down DMA channels during controller removal while a SPI transfer is running. A local user can trigger a concurrent SPI transfer to cause a denial of service.

690) Observable discrepancy (CVE-ID: CVE-2026-31483)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper restriction of speculative execution in syscall dispatch table handling when processing a user-controlled syscall number. A local user can supply a crafted syscall number to disclose sensitive information.

691) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-31482)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper clearing of sensitive information in s390 kernel entry handlers when handling kernel entry. A local user can observe residual register contents to disclose sensitive information.

The issue affects the r12 register on s390 systems.

692) Deadlock (CVE-ID: CVE-2026-31480)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in the osnoise cpu hotplug handling logic when processing cpu hotplug events while osnoise sleep paths contend for interface_lock. A local user can trigger cpu hotplug activity to cause a denial of service.

693) Memory leak (CVE-ID: CVE-2026-31477)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in smb2_lock() when handling error paths after list_del() detaches smb_lock from lock_list. A local user can trigger unexpected error conditions in lock and unlock processing to cause a denial of service.

The issue affects both the non-UNLOCK path on unexpected vfs_lock_file() errors and the UNLOCK path when vfs_lock_file() returns -ENOENT.

694) NULL pointer dereference (CVE-ID: CVE-2026-31477)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in smb2_lock() when processing SMB lock rollback operations after allocation failure. A local user can trigger allocation failure during lock rollback to cause a denial of service.

695) Improper access control (CVE-ID: CVE-2026-31476)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper access control in ksmbd session binding handling when processing a multichannel session binding request failure. A remote attacker can send a binding request with a wrong password to cause a denial of service.

The issue occurs because the target session looked up during binding can belong to another connection's user.

696) Use-after-free (CVE-ID: CVE-2026-31474)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in isotp_sendmsg() when closing an ISO-TP socket while a transmission is still in progress and the close wait is interrupted by a signal. A local user can trigger a race condition to cause a denial of service.

697) Use-after-free (CVE-ID: CVE-2026-31473)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the media request and videobuf queue handling code when reinitializing media requests concurrently with queue teardown. A local user can trigger concurrent MEDIA_REQUEST_IOC_REINIT and VIDIOC_REQBUFS(0) operations to cause a denial of service.

Only request-capable devices are affected.

698) Out-of-bounds read (CVE-ID: CVE-2026-31470)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the tdx guest quote handling logic when copying a host-controlled quote buffer to guest userspace. A local user can trigger quote retrieval to disclose sensitive information.

The leak may cross container protection boundaries in deployments exposing per-container configs-tsm-report interfaces.

699) Use-after-free (CVE-ID: CVE-2026-31469)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the virtio_net driver transmit path when transmitting packets after the network namespace is destroyed while previously queued skbs are still pending. A local user can trigger packet transmission and network namespace teardown to cause a denial of service.

The issue occurs when the virtio_net driver is configured with napi_tx disabled and the device's IFF_XMIT_DST_RELEASE flag is cleared.

700) Resource exhaustion (CVE-ID: CVE-2026-31467)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the erofs bio completion path when processing decompression in process context. A local user can trigger memory pressure during this operation to cause a denial of service.

The issue can lead to a deadlock when memory reclaim causes swap I/O through submit_bio_wait.

701) Race condition (CVE-ID: CVE-2026-31466)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in softleaf_to_folio() and softleaf_to_page() when handling migration entries during concurrent folio splitting and zap_nonpresent_ptes() processing. A local user can trigger the race to cause a denial of service.

The issue can result in VM_WARN_ON_ONCE() being triggered, and on systems before commit 93976a20345b it can manifest as a BUG_ON().

702) Out-of-bounds read (CVE-ID: CVE-2026-31464)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ibmvfc_alloc_targets() when processing a discover targets MAD response from a VIO server. A remote attacker can return a crafted num_written value exceeding max_targets to disclose sensitive information.

The out-of-bounds data is embedded in Implicit Logout and PLOGI MADs sent back to the VIO server.

703) Improper input validation (CVE-ID: CVE-2026-31458)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper input validation in damon_sysfs_handle_cmd() when handling sysfs commands after nr_contexts is set to 0. A local privileged user can write crafted values to sysfs control files to cause a denial of service.

The issue is triggered while DAMON is running, and commands other than OFF can dereference contexts_arr[0] after the contexts directory is made empty.

704) Race condition (CVE-ID: CVE-2026-31455)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in xfs_unmount_flush_inodes() when unmounting an XFS filesystem while background reclaim and inodegc are still running. A local user can trigger filesystem unmount operations to cause a denial of service.

The issue occurs because inodegc can dirty and insert inodes into the AIL during the flush, while background reclaim can race to abort and free dirty inodes.

705) Use-after-free (CVE-ID: CVE-2026-31454)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in xfs_inode_item_push() and xfs_qm_dquot_logitem_push() when performing buffer I/O after dropping the AIL lock in push callbacks. A local user can trigger log item reclaim and subsequent dereference of a freed li_ailp pointer to cause a denial of service.

706) Use-after-free (CVE-ID: CVE-2026-31453)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in xfsaild_push_item tracepoint handling when processing log item push callbacks after the AIL lock is dropped. A local user can trigger background inode reclaim or dquot shrinker activity to cause a denial of service.

707) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-31452)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in ext4_setattr() when processing truncate operations that grow a file beyond inline storage capacity. A local user can truncate a file with inline data to a large size and trigger a write operation to cause a denial of service.

The issue occurs when an inode retains the inline data flag even though the file size exceeds the actual inline capacity, leading to a kernel BUG_ON() during sendfile()-triggered writes.

708) Reachable assertion (CVE-ID: CVE-2026-31451)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of oversized inline data in ext4_read_inline_folio when reading inline data from a crafted ext4 filesystem. A local user can trigger processing of inline data whose size exceeds PAGE_SIZE to cause a denial of service.

709) Race condition (CVE-ID: CVE-2026-31450)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ext4_inode_attach_jinode() when handling concurrent fast commit flush operations. A local user can trigger concurrent filesystem activity to cause a denial of service.

The issue occurs because a jinode pointer may be observed as non-NULL before its associated i_vfs_inode field is initialized, leading to a kernel crash when the fast commit flush path dereferences it.

710) Out-of-bounds read (CVE-ID: CVE-2026-31449)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ext4_ext_correct_indexes when processing a corrupted or crafted on-disk extent header. A local user can supply a crafted filesystem image to disclose sensitive information.

711) Improper input validation (CVE-ID: CVE-2026-31447)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ext4 mount handling when mounting a crafted ext4 filesystem with bigalloc enabled and s_first_data_block set to a non-zero value. A local user can mount a specially crafted filesystem image to cause a denial of service.

712) Use-after-free (CVE-ID: CVE-2026-31446)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in ext4 update_super_work when racing with filesystem unmount. A local user can trigger error notification activity during unmount to cause a denial of service.

The issue occurs because sysfs notification may access a freed kernfs_node after sysfs teardown during the race.

713) Improper resource shutdown or release (CVE-ID: CVE-2026-31441)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in idxd workqueue reset handling when resetting a workqueue. A local user can trigger a workqueue reset to cause a denial of service.

714) Improper resource shutdown or release (CVE-ID: CVE-2026-31440)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the idxd dmaengine driver when removing a device after a reset. A local user can trigger device removal to cause a denial of service.

The issue occurs because the reset clears configuration registers before event log memory deallocation is checked.

715) Improper handling of exceptional conditions (CVE-ID: CVE-2026-31439)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in the xdma driver regmap initialization logic when initializing mmio regmap access. A local user can trigger the vulnerable initialization path to cause a denial of service.

716) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-31438)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of unsupported iterator types in netfs_limit_iter() when writing a core dump to a 9P filesystem. A local user can crash a process to trigger kernel handling of an ITER_KVEC iterator and cause a denial of service.

717) Memory leak (CVE-ID: CVE-2026-31434)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in create_space_info_sub_group() and check_removing_space_info() when removing sub-group space_info sysfs objects. A local user can trigger creation and removal of these elements to cause a denial of service.

The issue can be reproduced with the blktests zbd/009 test case on systems built with CONFIG_DEBUG_KMEMLEAK.

718) Out-of-bounds write (CVE-ID: CVE-2026-31433)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in get_file_all_info() when processing a compound QUERY_DIRECTORY + QUERY_INFO (FILE_ALL_INFORMATION) request. A remote user can send a specially crafted compound request to cause a denial of service.

The issue is triggered when the first command in the compound request consumes nearly the entire maximum transaction size.

719) Out-of-bounds write (CVE-ID: CVE-2026-31432)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in smb2_get_info_sec() and build_sec_desc() when processing compound requests that include QUERY_INFO for security descriptors. A remote user can send a specially crafted compound request to cause a denial of service.

The issue is triggered when an earlier command in the same compound request consumes most of the response buffer, such as a READ request preceding QUERY_INFO(Security).

720) Out-of-bounds read (CVE-ID: CVE-2026-31430)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the X.509 extension parser when parsing a certificate with an empty Basic Constraints or Key Usage extension. A local user can submit a specially crafted certificate through the keyrings(7) API to cause a denial of service.

721) Double free (CVE-ID: CVE-2026-31429)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a cross-cache free in skb_kfree_head() when freeing KFENCE-allocated skb head data. A local user can trigger allocation and freeing of a specially sized skb head object to cause a denial of service.

Exploitation requires KFENCE to be enabled.

722) Use of Uninitialized Variable (CVE-ID: CVE-2026-31428)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized padding in the NFULA_PAYLOAD netlink attribute in nfnetlink_log when constructing packet messages for the NFLOG netlink socket. A local user can read the leaked padding bytes to disclose sensitive information.

The issue leaks stale heap contents to userspace when the payload length is not 4-byte aligned.

723) Use of Uninitialized Variable (CVE-ID: CVE-2026-31427)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause incorrect SDP address rewriting.

The vulnerability exists due to use of uninitialized memory in process_sdp in nf_conntrack_sip when processing SDP bodies. A remote attacker can send a specially crafted SDP message to cause incorrect SDP address rewriting.

When stack auto-initialization is enabled, the rewritten session-level addresses may become 0.0.0.0; otherwise, stale stack data may be used.

724) Use-after-free (CVE-ID: CVE-2026-31426)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in acpi_ec_space_handler() when handling AML evaluation that accesses an EC OpRegion field after probe deferral leaves a stale handler context. A local user can trigger a sysfs read that causes AML to touch an EC OpRegion to cause a denial of service.

The issue occurs on reduced-hardware EC platforms when the GPIO IRQ provider defers probing.

725) NULL pointer dereference (CVE-ID: CVE-2026-31425)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rds_ib_get_mr() when processing sendmsg() requests with the RDS_CMSG_RDMA_MAP control message on a connection before IB connection establishment. A local user can send a specially crafted sendmsg request to cause a denial of service.

The issue occurs on a fresh outgoing connection before the rdma_cm_id and queue pair have been created.

726) Improper access control (CVE-ID: CVE-2026-31424)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in xt_check_match/xt_check_target extension validation in x_tables when processing ARP chains through nft_compat. A local user can load a match or target with incompatible hook assumptions to cause a denial of service.

The issue can result in a NULL pointer dereference and kernel panic when extensions registered with NFPROTO_UNSPEC are used on ARP hooks with different semantics.

727) Division by zero (CVE-ID: CVE-2026-31423)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a divide-by-zero error in rtsc_min() in the HFSC scheduler when processing crafted traffic control parameters. A local user can supply values that make the truncated divisor become zero to cause a denial of service.

The issue is triggered in the concave-curve intersection path.

728) NULL pointer dereference (CVE-ID: CVE-2026-31422)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in flow_change() in the cls_flow classifier when creating a flow filter without a fully qualified baseclass on a shared block. A local user can create such a flow filter to cause a denial of service.

729) NULL pointer dereference (CVE-ID: CVE-2026-31421)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in fw_classify() in the cls_fw packet classifier when classifying a packet after attaching an empty cls_fw filter to a shared block using the old method without TCA_OPTIONS. A local user can attach such a filter and trigger packet classification with a nonzero major skb mark to cause a denial of service.

The issue occurs because shared blocks leave block->q NULL in the old-method path.

730) Integer overflow (CVE-ID: CVE-2026-31417)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in the x25 packet reassembly logic when accumulating fragmented packets. A local user can send specially crafted packets to cause a denial of service.

731) Incorrect calculation (CVE-ID: CVE-2026-31416)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper calculation of netlink header size in nfnetlink_log when processing netlink messages. A local user can send a specially crafted netlink message to cause a denial of service.

The issue results in a kernel warning and the affected netlink message being dropped, with no other explicitly stated effects.

732) Integer overflow (CVE-ID: CVE-2026-31415)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in ip6_datagram_send_ctl() when processing repeated IPV6_DSTOPTS control messages. A local user can send specially crafted ancillary data to cause a denial of service.

Exploitation can trigger a kernel panic through skb_under_panic(), and unprivileged exploitation is possible in environments where unprivileged user namespaces are enabled and the attacker can obtain namespaced CAP_NET_RAW.

733) Use-after-free (CVE-ID: CVE-2026-31414)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in nf_conntrack_expect when dumping the helper name via ctnetlink or /proc. A local user can trigger access to freed conntrack helper state to cause a denial of service.

The issue involves unsafe use of nfct_help() without holding a reference to the master conntrack.

734) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-31413)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear

The vulnerability allows a local user to access out-of-bounds map memory.

The vulnerability exists due to improper handling of scalar state forking in maybe_fork_scalars() when processing BPF_OR operations with a constant source operand. A local user can execute a crafted BPF program to access out-of-bounds map memory.

The issue is caused by a verifier/runtime divergence when the destination register has a signed range of [-1, 0].

735) Integer overflow (CVE-ID: CVE-2026-31412)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to cause memory corruption or out-of-bounds access.

The vulnerability exists due to integer overflow in check_command_size_in_blocks() when processing crafted SCSI READ or WRITE commands from a USB host. A remote attacker can send a specially crafted command requesting a large amount of data to cause memory corruption or out-of-bounds access.

The issue occurs because a left shift of the command-derived data size by the logical block size can wrap around and truncate the resulting byte count.

736) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-31409)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to bypass session isolation.

The vulnerability exists due to improper state management in the ksmbd connection binding state when processing a multichannel SMB2_SESSION_SETUP request with SMB2_SESSION_REQ_FLAG_BINDING that fails. A remote user can send a failed binding request to bypass session isolation.

The issue occurs because subsequent ksmbd_session_lookup_all() calls fall back to the global sessions table after the connection remains in a binding state.

737) Use-after-free (CVE-ID: CVE-2026-31408)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in sco_recv_frame() when processing Bluetooth SCO frames during concurrent socket closure. A local user can trigger a race condition to cause a denial of service.

The issue occurs because the socket reference is not held after releasing sco_conn_lock() before accessing sk->sk_state.

738) Improper input validation (CVE-ID: CVE-2026-31407)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the sctp netlink attribute handling when processing crafted netlink attributes. A remote attacker can supply an invalid CTA_PROTOINFO_SCTP_STATE value to cause a denial of service.

739) Out-of-bounds read (CVE-ID: CVE-2026-31407)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the sctp and ctnetlink netlink attribute handling when processing crafted netlink attributes. A remote attacker can send specially crafted netlink messages to disclose sensitive information.

The issue is caused by missing validation of user-supplied netlink attribute values before they are used by the kernel.

740) Out-of-bounds read (CVE-ID: CVE-2026-31405)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds read in handle_one_ule_extension() extension handler tables when processing network-controlled ULE extension header data. A remote attacker can send a specially crafted SNDU with an extension header type value of 255 to execute arbitrary code.

The out-of-bounds value may be dereferenced and called as a function pointer.

741) Use-after-free (CVE-ID: CVE-2026-31403)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the /proc/fs/nfs/exports proc entry handling when reading from a still-open file descriptor after the associated network namespace is torn down. A local user can keep the file descriptor open across namespace teardown and perform subsequent reads to cause a denial of service.

The issue occurs because the open file captures the current network namespace and stores its export cache without holding a reference to the namespace for the lifetime of the file descriptor.

742) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-31400)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in cache_release when closing a reader file descriptor during a partial read of a cache_request. A local user can close a file descriptor in that state to cause a denial of service.

The issue occurs because the request readers count is decremented without freeing the cache_request when the count reaches zero and CACHE_PENDING is clear, which can result in a memory leak.

743) Use-after-free (CVE-ID: CVE-2026-31399)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in nd_async_device_register() when handling asynchronous device initialization after device_add() failure. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the parent pointer may be accessed after the device reference count drops to zero. No user interaction is required.

744) Use-after-free (CVE-ID: CVE-2026-31396)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the macb PTP clock handling code when handling ethtool get_ts_info requests while the network interface is present but the PTP clock has been destroyed. A local user can issue a crafted ioctl request to trigger a use-after-free access and cause a denial of service.

The issue is reachable through the get_ts_info ethtool call and affects the Linux kernel macb network driver PTP clock lifecycle.

745) NULL pointer dereference (CVE-ID: CVE-2026-31394)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ieee80211_chan_bw_change for AP_VLAN stations when processing channel bandwidth changes during CSA. A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue affects stations on AP_VLAN interfaces such as 4addr WDS clients, where link reservation data can remain zero-initialized with a NULL channel pointer.

746) Out-of-bounds read (CVE-ID: CVE-2026-31393)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to disclose adjacent memory contents.

The vulnerability exists due to an out-of-bounds read in l2cap_information_rsp() when processing a truncated L2CAP_INFO_RSP packet with a successful result. A remote attacker can send a specially crafted Bluetooth L2CAP response to disclose adjacent memory contents.

The issue occurs because the code reads response payload data beyond the validated fixed header length for L2CAP_IT_FEAT_MASK and L2CAP_IT_FIXED_CHAN cases.

747) Improper access control (CVE-ID: CVE-2026-31392)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to gain access to a share using incorrect credentials.

The vulnerability exists due to improper access control in the smb client session matching logic when processing cifs mounts with sec=krb5 and a username mount option. A local user can mount another share with a different username option to gain access to a share using incorrect credentials.

The issue occurs when Kerberos mounts reuse an SMB session from a previous mount even though a different username was specified, which can cause a mount that should fail with -ENOKEY to proceed with the first user's session.

748) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-31391)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the atmel-sha204a crypto driver when memory allocation fails during read handling. A local user can trigger memory allocation failure conditions to cause a denial of service.

The issue can block future reads because tfm_count is not decremented after an out-of-memory condition.

749) Use-after-free (CVE-ID: CVE-2026-31389)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the spi controller registration logic when handling controller registration failure. A local attacker can trigger controller registration failure to cause a denial of service.

The issue occurs if per-cpu statistics allocation fails during controller registration, which can lead to use-after-free of driver resources and unclocked register accesses.

750) NULL pointer dereference (CVE-ID: CVE-2026-23475)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL-pointer dereference in the spi controller sysfs attributes when handling sysfs attribute access before controller statistics allocation. A remote attacker can access the affected sysfs attributes during this window to cause a denial of service.

The issue occurs because controller per-cpu statistics are not allocated until after the controller has been registered, creating a race window that can crash the kernel.

751) Out-of-bounds read (CVE-ID: CVE-2026-23474)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the RedBoot partition table parser when parsing a RedBoot partition table. A local attacker can trigger the parser with crafted partition table data to cause a denial of service.

The issue can lead to a kernel warning and boot crash on systems built with CONFIG_FORTIFY_SOURCE enabled and a recent compiler.

752) Deadlock (CVE-ID: CVE-2026-23470)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in the soft reset sequence in the drm/imagination driver when handling interrupts. A local user can trigger a soft reset to cause a denial of service.

The issue results in a deadlock because the soft reset sequence is executed from the threaded IRQ handler.

753) Improper input validation (CVE-ID: CVE-2026-23468)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the amdgpu BO list handling when processing the bo_number field from userspace. A local user can supply an excessive number of BO list entries to cause a denial of service.

The issue can lead to excessive memory allocation and unnecessarily long list processing times.

754) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-23465)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause data loss.

The vulnerability exists due to improper handling of directory entry logging in btrfs directory logging when logging the parent directory of a conflicting inode during fsync and log replay conditions. A local user can create and remove directories and files and trigger fsync operations to cause data loss.

After a power failure and log replay, newly created directory entries may be missing because the parent directory can be marked as logged without its new dentries being recorded.

755) Memory leak (CVE-ID: CVE-2026-23464)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a memory leak in mpfs_sys_controller_probe() when probing the system controller device. A local attacker can trigger an error path that fails to free allocated memory to cause a denial of service.

This issue occurs if of_get_mtd_device_by_node() fails after memory for sys_controller has been allocated.

756) Race condition (CVE-ID: CVE-2026-23463)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in qman_destroy_fq when freeing and reallocating dynamic fqids. A local user can trigger concurrent qman_destroy_fq() and qman_create_fq() operations to cause a denial of service.

The issue occurs when QMAN_FQ_FLAG_DYNAMIC_FQID is set and may trigger a WARN_ON() due to inconsistent fq_table state during fqid reuse.

757) Use-after-free (CVE-ID: CVE-2026-23462)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the HIDP subsystem when handling a user->remove callback without dropping the l2cap_conn reference. A local user can trigger the affected code path to cause a denial of service.

The issue is in the Linux kernel Bluetooth HIDP code path and is evidenced by a kernel crash trace during connection cleanup.

758) Use-after-free (CVE-ID: CVE-2026-23461)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in l2cap_unregister_user when accessing conn->users and conn->hchan concurrently with l2cap_conn_del(). A local attacker can trigger a race condition to cause a denial of service.

The issue is caused by inconsistent locking on the l2cap_conn structure and may also result in list corruption.

759) NULL pointer dereference (CVE-ID: CVE-2026-23460)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in rose_transmit_link in the ROSE socket implementation when closing a socket after a second connect() call is issued while the first connection attempt is still in progress. A local user can trigger repeated connect() calls and then close the socket to cause a denial of service.

The issue occurs when the socket is in TCP_SYN_SENT state and the reconnect path leaves rose->state as ROSE_STATE_1 with rose->neighbour set to NULL before the close path reaches rose_transmit_link().

760) Use-after-free (CVE-ID: CVE-2026-23458)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in ctnetlink_dump_exp_ct() and ctnetlink_exp_ct_dump_table() when handling multi-round netlink dump requests. A local user can trigger a netlink dump that spans multiple recvmsg() calls to cause a denial of service.

The issue occurs because a conntrack pointer stored in callback data is dereferenced after its reference is dropped, and the second dump round can access the freed object via nfct_help(ct). The proof of concept shows a slab-use-after-free read detected by KASAN.

761) Integer overflow (CVE-ID: CVE-2026-23457)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer truncation in nf_conntrack_sip when parsing the SIP Content-Length header in sip_help_tcp() over TCP. A remote attacker can send a specially crafted SIP message with an oversized Content-Length value to cause a denial of service.

On 64-bit systems, a Content-Length value exceeding UINT_MAX can be truncated before the SIP message boundary is computed, causing trailing TCP segment data to be treated as a second SIP message and processed through the SDP parser.

762) Out-of-bounds read (CVE-ID: CVE-2026-23456)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in decode_int() in nf_conntrack_h323 when parsing malformed H.323/RAS packets. A remote attacker can send a specially crafted packet to disclose sensitive information.

The issue can result in a 1-4 byte slab out-of-bounds read.

763) Use-after-free (CVE-ID: CVE-2026-23454)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in mana_hwc_destroy_channel() when tearing down hardware channels while interrupt handlers are still executing. A local attacker can trigger concurrent channel teardown and interrupt handling to cause a denial of service.

The issue is caused by a race condition where caller_ctx may be freed before the completion queue and event queue are destroyed, which can lead to a use-after-free or NULL pointer dereference in mana_hwc_handle_resp().

764) Use-after-free (CVE-ID: CVE-2026-23452)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in pm_runtime_work() when handling device removal during runtime power management. A local user can trigger a race condition involving device removal to cause a denial of service.

The issue is caused by dereferencing the dev->parent pointer after the parent device has been freed. It is reproducible sporadically with blktest block/001 and results in a KASAN-reported slab-use-after-free.

765) Double free (CVE-ID: CVE-2026-23449)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in teql_master_xmit in the TEQL qdisc handling code when resetting a TEQL device with a lockless qdisc as root while racing with the datapath. A local user can trigger concurrent qdisc operations to cause a denial of service.

The issue can lead to kernel crashes. Exploitation requires local access to interact with the affected traffic control functionality.

766) Out-of-bounds read (CVE-ID: CVE-2026-23448)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in cdc_ncm_rx_verify_ndp16() and cdc_ncm_rx_fixup() when parsing a crafted NDP16 structure in a received NTB. A remote attacker can send a specially crafted network packet to disclose sensitive information.

The issue occurs because the DPE array size check does not account for ndpoffset, allowing DPE entries near the end of the buffer to extend past the skb data buffer and be read out of bounds.

767) Out-of-bounds read (CVE-ID: CVE-2026-23447)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in cdc_ncm_rx_verify_ndp32() when processing a crafted NDP32 structure in a received NTB. A remote attacker can send a specially crafted network packet to disclose sensitive information.

The issue occurs because the DPE array size is validated against the total skb length without accounting for ndpoffset, allowing reads beyond the intended bounds when the NDP32 is placed near the end of the NTB.

768) Improper locking (CVE-ID: CVE-2026-23446)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper control of interaction with the power management subsystem in aqc111_suspend when handling a suspend callback. A local attacker can trigger a suspend operation to cause a denial of service.

The issue can lead to a hung task in rpm_resume and block another task holding rtnl_lock, which can lock up the networking stack.

769) Memory leak (CVE-ID: CVE-2026-23444)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper memory management in ieee80211_tx_prepare_skb() when processing transmit skbs. A local attacker can trigger an error path that does not free an skb to cause a denial of service.

The issue affects the first error path where ieee80211_tx_prepare() returns TX_DROP, resulting in inconsistent skb handling compared to the other error paths.

770) NULL pointer dereference (CVE-ID: CVE-2026-23442)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in seg6_hmac_validate_skb() and ipv6_srh_rcv() when processing SRv6 paths on a device without IPv6 configuration. A remote attacker can send specially crafted IPv6 traffic to cause a denial of service.

The issue occurs when __in6_dev_get() returns NULL, such as on a device with no IPv6 configuration, including after device unregister or when the MTU is below the IPv6 minimum MTU.

771) Race condition (CVE-ID: CVE-2026-23441)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause unexpected behavior and incorrect results.

The vulnerability exists due to a race condition in the IPSec ASO context handling in the mlx5e driver when processing concurrent IPSec offload ASO operations. A local user can trigger concurrent query or update operations to cause unexpected behavior and incorrect results.

The issue arises because a shared DMA-mapped context is used for ASO operations and can be overwritten before earlier hardware processing completes.

772) Race condition (CVE-ID: CVE-2026-23440)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the net/mlx5e IPSec ESN update handling path when processing ESN wrap events in IPSec full offload mode. A local user can trigger duplicate ESN update handling to cause a denial of service.

Processing the same event twice can incorrectly increment the ESN high-order bits and program invalid ESN state into hardware, resulting in anti-replay failures and a complete halt of IPSec traffic.

773) NULL pointer dereference (CVE-ID: CVE-2026-23439)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in udp_sock_create6() and its caller fou_create() when handling netlink requests with CONFIG_IPV6 disabled. A local privileged user can send a specially crafted netlink request to cause a denial of service.

Only privileged users can trigger the issue, and exploitation requires a kernel built with CONFIG_IPV6 disabled.

774) NULL pointer dereference (CVE-ID: CVE-2026-23438)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mvpp2_bm_switch_buffers() when switching between per-cpu and shared buffer pool modes. A local user can trigger a buffer mode switch, such as by changing the MTU across the jumbo frame threshold, to cause a denial of service.

The issue occurs when the CM3 SRAM resource is not present in the device tree, leaving priv->cm3_base NULL while flow control updates are still attempted.

775) Race condition (CVE-ID: CVE-2026-23434)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nand_lock() and nand_unlock() when serializing lock and unlock operations against other NAND operations. A local user can trigger concurrent NAND operations to cause a denial of service.

The issue occurs because chip->ops.lock_area and unlock_area are called without holding the NAND device lock, which can result in cmd_pending conflicts on the NAND controller during concurrent UBI/UBIFS background erase or write operations.

776) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-23426)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a device node reference leak in logicvc_drm_config_parse() when parsing the "layers" node from the device tree. A local user can trigger the vulnerable code path to cause a denial of service.

The issue results from a missing release of the reference returned by of_get_child_by_name(). No user interaction is required.

777) Improper locking (CVE-ID: CVE-2026-23420)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in wlcore when handling wireless operations. A local user can trigger the affected code path to cause a denial of service.

The issue is caused by unlocking wl->mutex without ensuring that it is locked first.

778) Deadlock (CVE-ID: CVE-2026-23419)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a circular locking dependency in rds_tcp_tune when upgrading network reference counting while holding the socket lock. A local user can trigger the vulnerable code path to cause a denial of service.

The issue is caused by memory allocation occurring under the socket lock, creating a lock dependency with fs_reclaim in the Linux kernel RDS TCP code path.

779) Memory leak (CVE-ID: CVE-2026-23418)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in drm/xe/reg_sr when handling an xa_store() failure on the error path. A local user can trigger the error condition to cause a denial of service.

The issue occurs on an error path involving a newly allocated entry that is not freed when storage fails.

780) Memory leak (CVE-ID: CVE-2026-23414)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in tls_decrypt_async_wait() and the async_hold queue when processing pending asynchronous TLS decrypt operations. A local user can trigger a partial failure during message hold handling to cause a denial of service.

This issue results in a memory leak because cloned skbs added to the async_hold queue may not be released in some fallback paths after pending AEAD operations are synchronized. No user interaction is required.

781) Use-after-free (CVE-ID: CVE-2026-23413)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the clsact qdisc when handling init and destroy rollback after a replacement failure. A local attacker can trigger a replacement failure during clsact initialization to cause a denial of service.

The issue occurs because ingress may be initialized before egress initialization fails, after which destroy logic can operate on stale state from the previous clsact instance.

782) Use-after-free (CVE-ID: CVE-2026-23412)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in nfnl_hook_dump_one when dumping hooks via nfnetlink_hooks during concurrent access. A local attacker can trigger concurrent hook dump activity to cause a denial of service.

The issue is triggered by a race condition involving concurrent readers and may lead to a kernel crash.

783) Improper resource shutdown or release (CVE-ID: CVE-2026-23401)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of SPTE updates in KVM MMU when installing emulated MMIO SPTEs. A local user can trigger a page fault after host userspace modifies guest memory mappings to switch from memslot to emulated MMIO, leading to an attempt to mark an already present SPTE as MMIO, which results in a kernel warning and potential guest crash. A local user can send a specially crafted request to cause a denial of service.

The issue arises when KVM fails to drop the existing shadow-present SPTE before installing an MMIO SPTE, resulting in inconsistent MMU state and triggering a kernel warning that can crash the guest.

784) Memory leak (CVE-ID: CVE-2026-23399)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in the nf_tables subsystem when handling stateful expressions in dynamic sets. A local user can trigger a memory leak by causing a failure during the cloning of stateful expressions, leading to unbounded memory consumption over time.

The issue occurs in the nft_dynset component when GFP_ATOMIC allocation fails, leaving the first stateful expression unreleased.

785) NULL pointer dereference (CVE-ID: CVE-2026-23398)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the icmp_tag_validation function when handling ICMP Fragmentation Needed error messages with a quoted inner IP header containing an unregistered protocol number. A remote attacker can send a specially crafted ICMP packet to cause a kernel panic in softirq context.

Exploitation requires the target system to have ip_no_pmtu_disc set to 3 (hardened PMTU mode).

786) Out-of-bounds read (CVE-ID: CVE-2026-23397)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the nfnetlink_osf component when handling TCP option fingerprints. A remote attacker can send a specially crafted request to cause a denial of service.

Exploitation involves sending malicious TCP packets with zero-length options or MSS options with length less than 4, leading to null pointer dereference and out-of-bounds reads during packet matching.

787) NULL pointer dereference (CVE-ID: CVE-2026-23396)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper pointer dereference in the mesh_matches_local() function in the Linux kernel's mac80211 subsystem when handling Wi-Fi mesh action frames. An attacker with physical access can send a specially crafted CSA action frame that includes a valid Mesh ID IE but omits the Mesh Configuration IE to cause a kernel NULL pointer dereference, resulting in a system crash.

The vulnerability specifically affects Wi-Fi mesh mode processing and requires the attacker to be within radio range to transmit the malicious frame. No authentication or user interaction is required for exploitation.

788) Out-of-bounds write (CVE-ID: CVE-2026-23395)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the Bluetooth L2CAP component when handling L2CAP_ECRED_CONN_REQ packets. A remote attacker can send a specially crafted sequence of L2CAP connection requests with the same command identifier to cause an overflow in channel allocation, leading to a denial of service.

Exploitation requires proximity to initiate a Bluetooth connection. The issue arises from failure to check for duplicate command identifiers during Enhanced Credit Control connection setup.

789) Resource exhaustion (CVE-ID: CVE-2026-23391)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the netfilter xt_CT module when handling packet queueing. A local user can trigger the queuing of packets that reference templates, which, upon removal of the template, are not properly flushed, leading to resource exhaustion and system instability.

Templates such as connection tracking helpers or timeout policies may be removed during module unloading or via nfnetlink_cttimeout, leaving packets enqueued without valid references.

790) Missing release of memory after effective lifetime (CVE-ID: CVE-2026-23389)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in the ice_set_ringparam() function when processing ring parameter configuration. A local user can trigger improper memory deallocation to cause a denial of service.

Exploitation requires access to the network interface control functionality, which is typically available to local users with network configuration privileges.

791) Out-of-bounds write (CVE-ID: CVE-2026-23388)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper input validation in the Squashfs filesystem component when processing a crafted filesystem image. A local user can mount a malicious Squashfs image to cause a general protection fault and crash the system.

Exploitation requires the ability to mount a specially crafted filesystem image, which typically requires user privileges but not root access.

792) Use-after-free (CVE-ID: CVE-2026-23387)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to a use-after-free error within the cs42l43_pin_probe() function in drivers/pinctrl/cirrus/pinctrl-cs42l43.c. A local user can trigger a double-put use-after-free error and crash the OS kernel.

793) Out-of-bounds write (CVE-ID: CVE-2026-23386)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a boundary error in the gve_tx_clean_pending_packets() function in the Google Virtual Ethernet (gve) driver when handling packet transmission cleanup in DQ-QPL mode. A local user can trigger improper buffer cleanup by causing the transmission path to fail, leading to out-of-bounds memory access and system crash.

The issue arises because the function incorrectly uses the RDA buffer cleanup path in QPL mode, resulting in accessing memory beyond the bounds of the dma array, which shares storage with tx_qpl_buf_ids. This can be triggered during normal operation under specific error conditions.

794) Unchecked Error Condition (CVE-ID: CVE-2026-23383)

CWE-ID: CWE-391 - Unchecked Error Condition

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper memory alignment in the BPF JIT compiler when handling 64-bit atomic operations on arm64. A local user can trigger execution of a specially crafted BPF program to cause a torn read of a 64-bit jump target, leading to control flow hijacking and arbitrary code execution.

Exploitation requires the ability to load and execute BPF programs, which is typically available to unprivileged users in modern Linux distributions with CONFIG_BPF_JIT enabled.

795) NULL Pointer Dereference (CVE-ID: CVE-2026-23382)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper pointer validation in HID subsystem raw_event callbacks when processing input from unclaimed HID devices. A remote attacker can send specially crafted HID reports to trigger a NULL pointer dereference and crash the system.

Exploitation does not require user interaction or prior authentication.

796) NULL Pointer Dereference (CVE-ID: CVE-2026-23381)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the bridge component when handling packets. A remote attacker can send a specially crafted ICMPv6 Neighbor Discovery packet to trigger a kernel NULL pointer dereference.

IPv6 must be disabled via the 'ipv6.disable=1' kernel parameter for the vulnerability to be exploitable.

797) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-23379)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ets_offload_change function when handling traffic control (tc) commands for ETS qdisc offloading. A local user can send a specially crafted request to trigger a divide-by-zero error, leading to a kernel oops and system crash.

The issue arises from unsigned 32-bit integer overflows in 'q_sum' and 'q_psum' variables during WRR weight computation, which can result in division by zero in the offload path.

798) Out-of-bounds write (CVE-ID: CVE-2026-23378)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to improper memory access in the net/sched: act_ife component when updating metadata lists during packet processing. A local user can send a specially crafted request to trigger out-of-bounds memory write via the ife_tlv_meta_encode function.

Exploitation requires the ability to configure or trigger traffic control (tc) actions within the kernel, which is typically available to local users with sufficient privileges to manipulate network scheduling policies.

799) Out-of-bounds read (CVE-ID: CVE-2026-23375)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the file_thp_enabled() function when handling files on anonymous inodes via processing memory operations. A local user can trigger memory operations such as MADV_COLLAPSE or rely on khugepaged activity to cause a kernel crash or trigger erroneous memory failure reports.

Exploitation does not require elevated privileges but requires the ability to create or access files on anonymous inodes such as guest_memfd or secretmem. The impact includes system crash or spurious memory failure warnings in the kernel log.

800) Improper Synchronization (CVE-ID: CVE-2026-23374)

CWE-ID: CWE-662 - Improper Synchronization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service or potentially execute arbitrary code.

The vulnerability exists due to improper synchronization in the blktrace component when handling block I/O tracing operations. A local user can trigger a use of __this_cpu_read/write in a preemptible context to cause a kernel BUG and system crash.

The issue arises in process context where preemption is enabled, violating the requirement for preemption to be disabled when accessing per-CPU variables via __this_cpu_read/write. This can lead to undefined behavior including memory corruption.

801) Use After Free (CVE-ID: CVE-2026-23372)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to use-after-free in the NFC raw socket (rawsock) component when handling socket teardown. A local user can trigger a race condition by terminating a process during active NFC transmission, leading to use-after-free or leaked references.

Exploitation requires an active NFC transmission and process interruption via signal such as SIGKILL.

802) Exposure of Private Information ('Privacy Violation') (CVE-ID: CVE-2026-23370)

CWE-ID: CWE-359 - Exposure of Private Information ('Privacy Violation')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper output neutralization in the dell-wmi-sysman driver when handling password data. A local user can access kernel logs to disclose sensitive information.

The vulnerability specifically involves the logging of plaintext passwords via a hex dump in the set_new_password() function, which could expose current and new passwords.

803) NULL Pointer Dereference (CVE-ID: CVE-2026-23369)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the i2c_i801 driver when handling ACPI I/O operations during system boot. A local user can trigger concurrent access to the i801 ACPI I/O handler, leading to a situation where the bus lock mechanism attempts to access a deregistered memory region, resulting in a kernel NULL pointer dereference and system crash.

Exploitation occurs during early boot when multiple udev threads concurrently collect device information, and no additional privileges beyond standard system access are required.

804) Incorrect Register Defaults or Module Parameters (CVE-ID: CVE-2026-23368)

CWE-ID: CWE-1221 - Incorrect Register Defaults or Module Parameters

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking order in the phy_led_triggers_register function when handling LED triggers during PHY device probe. A local user can trigger a system call that leads to conflicting lock acquisition sequences, resulting in an AB-BA deadlock between the RTNL mutex and the triggers_list_lock, ultimately causing a kernel deadlock and system hang.

The issue arises when LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are both enabled, allowing conflicting lock acquisition orders depending on execution context.

805) Use of Uninitialized Variable (CVE-ID: CVE-2026-23367)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper initialization in the radiotap parser component when processing radiotap headers with undefined fields. A local user can provide a specially crafted radiotap header containing undefined field 18 to trigger uninitialized memory access and potentially execute arbitrary code.

The issue arises because iterator->_next_ns_data is not initialized when handling undefined fields in the standard radiotap namespace, leading to use of uninitialized data during subsequent checks.

806) Uncontrolled Recursion (CVE-ID: CVE-2026-23365)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the kalmia USB driver when handling USB endpoints during device probing. A remote attacker can connect a malicious USB device with unexpected endpoint configurations to cause a denial of service.

Exploitation does not require authentication or user interaction beyond physically connecting the device; however, the attack vector is considered local due to physical access requirement.

807) Observable discrepancy (CVE-ID: CVE-2026-23364)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to obtain sensitive information.

The vulnerability exists due to improper timing handling in the ksmbd component when comparing message authentication codes (MACs). A local user can leverage timing differences during MAC comparison to infer sensitive information.

Exploitation requires local access and the ability to trigger MAC comparisons through the ksmbd subsystem.

808) Out-of-bounds write (CVE-ID: CVE-2026-23363)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the mt7925_mac_write_txwi_80211 function when handling Wi-Fi management frames. A remote attacker can send a specially crafted 802.11 frame with a short length to trigger an out-of-bounds access and crash the system.

Exploitation does not require authentication or user interaction.

809) Memory corruption (CVE-ID: CVE-2026-23362)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in the CAN BCM (Broadcast Manager) subsystem when handling runtime updates of bcm_op structures. A local user can send a specially crafted request to trigger a use of an uninitialized spinlock, leading to a system crash.

The issue specifically occurs in the bcm_rx_setup() function, where the bcm_tx_lock is not initialized when the RX_RTR_FRAME flag is set, which can lead to undefined behavior during lock operations.

810) Improper Synchronization (CVE-ID: CVE-2026-23361)

CWE-ID: CWE-662 - Improper Synchronization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service, disclose sensitive information, and potentially execute arbitrary code.

The vulnerability exists due to improper synchronization in the PCI driver's MSI-X interrupt handling when unmapping the outbound ATU entry. A local user can trigger the dw_pcie_ep_raise_msix_irq() function to raise an MSI-X interrupt via a posted write transaction that may not complete before the associated ATU entry is unmapped, leading to memory corruption or IOMMU faults.

The issue arises because the writel() operation used to generate the PCI posted write transaction can return before the write reaches its destination, creating a race condition with the subsequent unmap operation. This can result in memory corruption on the host system, including potential access to unauthorized memory regions or system instability.

811) Improper Resource Shutdown or Release (CVE-ID: CVE-2026-23360)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the NVMe subsystem when handling controller resets. A local user can trigger a controller reset to cause a denial of service due to an admin queue leak.

The issue arises when nvme_alloc_admin_tag_set() is called during a controller reset while a previous admin queue still exists, leading to resource exhaustion over time.

812) Out-of-bounds write (CVE-ID: CVE-2026-23359)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a boundary error in the BPF devmap component when handling upper device interface indices. A local user can trigger a stack-out-of-bounds write by creating more than MAX_NEST_DEV (8) macvlans on a device with an XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS and sending a packet to the device, leading to memory corruption.

To exploit this vulnerability, the attacker must have the ability to create macvlan devices and attach XDP programs, which requires local access and privileges to perform network configuration.

813) On-Chip Debug and Test Interface With Improper Access Control (CVE-ID: CVE-2026-23357)

CWE-ID: CWE-1191 - On-Chip Debug and Test Interface With Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper sequence of operations in the mcp251x CAN driver when handling error paths during device open. A local user can trigger the mcp251x_open function error path, which calls free_irq() while holding the mpc_lock mutex, leading to a deadlock if an interrupt is pending, resulting in a denial of service.

Exploitation requires access to the CAN device interface and the ability to trigger the error path in mcp251x_open.

814) Unchecked Return Value to NULL Pointer Dereference (CVE-ID: CVE-2026-23356)

CWE-ID: CWE-690 - Unchecked Return Value to NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of reference counting in the DRBD (Distributed Replicated Block Device) subsystem when processing I/O operations that cross activity log extent boundaries. A local user can trigger a sequence of I/O operations that result in an invalid reference count state, leading to a kernel BUG_ON condition and system crash.

The issue arises because the function drbd_al_begin_io_nonblock() may fail to acquire activity log references even when expected to succeed, yet continues execution without returning an error, resulting in inconsistent reference tracking during later I/O completion.

815) Type conversion (CVE-ID: CVE-2026-23352)

CWE-ID: CWE-704 - Type conversion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper memory management in the EFI boot services memory release mechanism when processing memory map initialization during system boot. A local attacker can trigger the early release of boot services memory before deferred memory map initialization is complete, leading to unfreed memory pages and a memory leak.

The issue specifically occurs on systems with CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled, where memblock_free_late() skips uninitialized pages, resulting in a significant memory leak—up to approximately 140MB on constrained systems like EC2 t3a.nano instances with only 512MB RAM.

816) Resource exhaustion (CVE-ID: CVE-2026-23347)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the CAN USB driver (f81604) when handling URB (USB Request Block) anchoring in the read bulk callback. A local user can trigger improper submission of an unanchored URB to cause a denial of service.

Exploitation requires local system access and interaction with the affected USB CAN device driver.

817) Integer overflow (CVE-ID: CVE-2026-23343)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code or cause a denial of service due to memory corruption.

The vulnerability exists due to improper input validation in the XDP (eXpress Data Path) subsystem when handling packet tailroom calculations. A local user can trigger a negative tailroom value that is interpreted as a large unsigned integer, leading to out-of-bounds memory access during XDP frame processing.

The issue arises when Ethernet drivers report fragment sizes smaller than the actual truesize, causing incorrect tailroom computation in functions such as bpf_xdp_frags_increase_tail().

818) Use After Free (CVE-ID: CVE-2026-23340)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a use-after-free in the network scheduler (qdisc) component when resetting transmit queues for lockless qdiscs during changes in the number of real transmit queues. A local user can trigger a race condition between qdisc_reset() and the packet dequeue path, leading to use-after-free and potential execution of arbitrary code or system crash.

Exploitation requires the ability to modify network interface queue configurations, which typically requires local user privileges. The issue affects systems using lockless qdiscs such as pfifo_fast, especially under high network load and frequent queue resizing operations.

819) Missing release of memory after effective lifetime (CVE-ID: CVE-2026-23339)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in the nfc: nci component when handling early error paths in nci_transceive(). A local user can trigger error conditions to cause memory leaks.

Memory leaks occur due to failure to free socket buffer (skb) on early error returns, leading to gradual resource exhaustion.

820) Use After Free (CVE-ID: CVE-2026-23336)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a use-after-free error in the cfg80211 component when unregistering a wiphy device. A local user can trigger the cancellation of rfkill_block work during wiphy unregistration to execute arbitrary code or cause a denial of service.

The issue arises because the rfkill_block work is not properly cancelled when the wiphy is being unregistered, leading to a use-after-free condition upon subsequent access.

821) Exposure of sensitive information to an unauthorized actor (CVE-ID: CVE-2026-23335)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization of stack memory in the RDMA/irdma subsystem when handling user-space requests. A local user can trigger the creation of an address handle via the irdma_create_user_ah() function to disclose up to 4 bytes of kernel stack memory.

The uninitialized reserved field in the irdma_create_ah_resp structure is copied to user space without being zeroed, leading to a kernel stack information leak.

822) Improper input validation (CVE-ID: CVE-2026-23334)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the CAN USB driver (f81604) when handling interrupt URB messages. A local user can provide a specially crafted interrupt URB message with incorrect length to cause a denial of service.

823) Improper Resource Shutdown or Release (CVE-ID: CVE-2026-23330)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the NFC subsystem when closing a device. A local user can trigger a memory leak by closing an NFC device while a data exchange is pending, leading to resource exhaustion over time.

Memory is not properly released when a pending data exchange is left uncompleted during device closure, resulting in a gradual loss of available memory.

824) Out-of-bounds write (CVE-ID: CVE-2026-23325)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the mt7996_mac_write_txwi_80211 function when handling Wi-Fi management frames. A remote attacker can send a specially crafted 802.11 frame with a short length to trigger an out-of-bounds write access and crash the system.

Exploitation does not require authentication or user interaction.

825) Improper Resource Shutdown or Release (CVE-ID: CVE-2026-23324)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the USB CAN driver (etas_es58x) when handling URB (USB Request Block) anchoring in the read bulk callback. A local user can trigger improper submission of an unanchored URB to cause a denial of service.

Exploitation requires access to the CAN device interface and the ability to trigger USB read operations.

826) Incomplete Blacklist to Cross-Site Scripting (CVE-ID: CVE-2026-23321)

CWE-ID: CWE-692 - Incomplete Blacklist to Cross-Site Scripting

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the MPTCP subsystem when handling endpoint removal. A local user can send a specially crafted sequence of netlink commands to trigger a kernel warning and system instability.

The attacker must be able to create and remove MPTCP endpoints with specific flags and manipulate connection states, which requires access to the MPTCP netlink interface.

827) Use After Free (CVE-ID: CVE-2026-23319)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code or escalate privileges.

The vulnerability exists due to a use-after-free in the bpf_trampoline_link_cgroup_shim component when handling BPF trampoline link operations. A local user can trigger a race condition to exploit a dangling reference in the cgroup shim trampoline program list and achieve arbitrary code execution or privilege escalation.

The issue arises because the reference count is reduced to zero and the resource is released before all references are fully cleaned up, creating a window where an already-freed resource can be accessed.

828) Out-of-bounds read (CVE-ID: CVE-2026-23318)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in the ALSA usb-audio driver when handling USB audio descriptors from a UAC3 device. An attacker with physical access can connect a malicious USB device presenting a truncated UAC3 header to cause out-of-bounds reads, leading to a denial of service.

Exploitation requires physical access to attach a malicious USB device.

829) NULL Pointer Dereference (CVE-ID: CVE-2026-23317)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code and escalate privileges.

The vulnerability exists due to improper error handling in the vmw_translate_ptr functions in the drm/vmwgfx subsystem when translating pointers. A local user can trigger a use of an uninitialized pointer to cause out-of-bounds memory accesses and execute arbitrary code.

Successful exploitation may lead to privilege escalation and system compromise.

830) Out-of-bounds write (CVE-ID: CVE-2026-23315)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the mt76_connac2_mac_write_txwi_80211 function when handling Wi-Fi management frames. A remote attacker can send a specially crafted 802.11 frame with an undersized payload to trigger an out-of-bounds write access.

Exploitation does not require authentication or user interaction.

831) Resource exhaustion (CVE-ID: CVE-2026-23313)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the i40e NAPI poll tracepoint when handling network packets. A local user can trigger the tracepoint to cause a preempt count leak, leading to a denial of service.

The issue arises from using get_cpu() without a corresponding put_cpu() in the tracepoint, which results in an increment of the preempt count that is never decremented.

832) Uncontrolled Recursion (CVE-ID: CVE-2026-23312)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the kaweth USB driver when handling USB endpoints during device probing. A remote attacker can connect a malicious USB device with invalid or unexpected endpoint configurations to cause a denial of service.

Exploitation does not require authentication or user interaction beyond physically connecting the device; however, the attack vector is considered remote as it targets kernel-level USB subsystem handling.

833) Improper Access Control (CVE-ID: CVE-2026-23310)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the bonding driver when changing the xmit_hash_policy to vlan+srcmac while an XDP program is loaded on a bond interface in 802.3ad or balance-xor mode. A local user can change the xmit_hash_policy to cause an inconsistent state, leading to failure in uninstalling the XDP program and triggering a kernel warning during bond device destruction.

The attacker must have the ability to configure bonding interface settings, which requires local access and privileges to modify network device parameters.

834) Incomplete Blacklist to Cross-Site Scripting (CVE-ID: CVE-2026-23308)

CWE-ID: CWE-692 - Incomplete Blacklist to Cross-Site Scripting

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of interrupt masking in the pinctrl driver when loading the equilibrium GPIO controller. A local user can trigger the loading of the driver, resulting in repeated kernel warning messages being logged, which may degrade system stability and generate unnecessary log entries.

The issue arises because the function 'eqbr_irq_mask_ack()' indirectly calls 'gpiochip_disable_irq()' through 'eqbr_irq_mask()', leading to spurious warnings during initialization. This behavior does not occur in similar drivers, indicating inconsistent interrupt handling.

835) Out-of-bounds read (CVE-ID: CVE-2026-23307)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ems_usb_read_bulk_callback() function in the CAN USB driver when handling USB bulk callback data. A local user can provide specially crafted USB input to cause memory access beyond the buffer bounds, leading to a system crash.

The attacker must have local system access and the ability to interact with the CAN USB driver via USB interface.

836) Use After Free (CVE-ID: CVE-2026-23306)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code and escalate privileges.

The vulnerability exists due to a use-after-free in the pm8001_queue_command() function in the SCSI subsystem when handling SCSI commands during a phy down or device gone state. A local user can trigger a double free by issuing a command that leads to the erroneous return of -ENODEV after the task has already been freed, resulting in memory corruption that could lead to arbitrary code execution or privilege escalation.

The vulnerability specifically affects the pm8001 SAS controller driver and requires the ability to issue SCSI commands, which is typically available to local users with access to storage devices.

837) NULL Pointer Dereference (CVE-ID: CVE-2026-23304)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the ipv6 routing subsystem when processing IPv6 packets. A remote attacker can send a specially crafted IPv6 packet to trigger a null pointer dereference in ip6_rt_get_dev_rcu(), leading to a system crash.

Exploitation does not require authentication or user interaction and occurs within the network stack during packet processing.

838) Cleartext Storage of Sensitive Information (CVE-ID: CVE-2026-23303)

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper output neutralization in the cifs_set_cifscreds function when handling debug logging. A local user can enable debug logging to disclose sensitive information.

The exposure of plaintext usernames and passwords occurs when debug logging is enabled, which may be accessible to local users with access to kernel logs.

839) Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CVE-ID: CVE-2026-23302)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in socket state handling when processing network operations. A local user can trigger concurrent access to socket state variables to cause a denial of service.

The issue arises from improper synchronization of sk->sk_data_ready and sk->sk_write_space pointers during concurrent access by multiple CPUs.

840) NULL Pointer Dereference (CVE-ID: CVE-2026-23300)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the IPv6 routing subsystem when handling a standalone IPv6 nexthop object referencing the loopback device. A local user can create a specially crafted IPv6 nexthop and reference it from an IPv4 route to trigger a NULL pointer dereference in __mkroute_output(), leading to a system crash.

Successful exploitation may result in a kernel panic and denial of service.

841) Loop with Unreachable Exit Condition ('Infinite Loop') (CVE-ID: CVE-2026-23298)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop in the ucan driver when processing zero-length messages from a ucan device. A local user can connect a specially crafted ucan device to trigger an infinite loop in ucan_read_bulk_callback(), causing the system to hang.

842) Incorrect Control Flow Scoping (CVE-ID: CVE-2026-23296)

CWE-ID: CWE-705 - Incorrect Control Flow Scoping

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference counting in the SCSI core subsystem when handling tagset reference counts during SCSI host teardown. A local user can trigger the removal of a SCSI host to cause a denial of service.

Repeated triggering of the issue may lead to system instability or hang due to unbounded reference accumulation.

843) NULL Pointer Dereference (CVE-ID: CVE-2026-23293)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the VXLAN network driver when handling packets. A local user can send a specially crafted IPv6 packet into a VXLAN interface when IPv6 is disabled at boot time to trigger a kernel NULL pointer dereference and crash the system.

Exploitation requires the ability to inject packets into the VXLAN interface, which is typically available to local users or processes with network access.

844) On-Chip Debug and Test Interface With Improper Access Control (CVE-ID: CVE-2026-23292)

CWE-ID: CWE-1191 - On-Chip Debug and Test Interface With Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking mechanism in the SCSI target subsystem when handling configuration file writes. A local user can provide a specially crafted configuration input to cause recursive semaphore locking, leading to a system crash or hang.

Exploitation requires access to the target's configuration filesystem (configfs) and the ability to write to the db_root parameter. No additional privileges beyond standard configfs access are required.

845) Use of Incorrectly-Resolved Name or Reference (CVE-ID: CVE-2026-23291)

CWE-ID: CWE-706 - Use of Incorrectly-Resolved Name or Reference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference counting in the NFC pn533 USB driver when handling device disconnection. A local user can disconnect a USB NFC device to cause a dangling reference, leading to a denial of service.

The issue arises because the USB interface reference obtained during driver probe is not properly released upon disconnection.

846) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-23290)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the pegasus USB driver when handling USB endpoints during device probing. A remote attacker can connect a malicious USB device with invalid or unexpected endpoint configurations to cause a denial of service.

Exploitation does not require authentication or user interaction beyond physically connecting the device; however, the attack vector is considered local due to physical access requirement.

847) Improper Resource Shutdown or Release (CVE-ID: CVE-2026-23289)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper resource management in the IB/mthca subsystem when handling system calls. A local user can trigger a failed system call path to disclose sensitive information.

The issue arises from a missing mthca_unmap_user_db() call during error handling in mthca_create_srq(), leading to a resource leak that could expose system memory.

848) Resource exhaustion (CVE-ID: CVE-2026-23287)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of interrupt completion in the irqchip/sifive-plic component when changing interrupt affinity settings. A local user can trigger a scenario where interrupt completion is silently ignored, leading to a frozen interrupt state and resulting in a denial of service.

The issue arises specifically when interrupt affinity is modified concurrently with interrupt handling, causing the UART port or other interrupt-driven devices to become unresponsive.

849) NULL Pointer Dereference (CVE-ID: CVE-2026-23286)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the ATM LANE (LAN Emulation) module when handling VCC closure. A local user can trigger the closure of a shared atm_vcc, which is referenced by multiple lec_arp_table entries, causing a null-ptr-deref crash during subsequent cleanup attempts.

The issue arises because the cleanup function lec_arp_clear_vccs() does not verify whether the associated private data (vpriv) has already been released, leading to a crash upon dereferencing a NULL pointer in a later iteration.

850) NULL Pointer Dereference (CVE-ID: CVE-2026-23285)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the DRBD (Distributed Replicated Block Device) component when handling a local read error. A local user can trigger a specially crafted I/O operation to cause a denial of service.

Exploitation requires access to the DRBD subsystem and the ability to initiate block device I/O operations.

851) Improper Resource Shutdown or Release (CVE-ID: CVE-2026-23284)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the mtk_eth_soc driver when handling eBPF program setup errors. A local user can trigger the mtk_open routine failure in mtk_xdp_setup() to cause a denial of service.

Successful exploitation may lead to system crash or network interface disruption.

852) Use After Free (CVE-ID: CVE-2026-23281)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to use-after-free in lbs_free_adapter() function in the Linux kernel's libertas Wi-Fi driver when handling timer cleanup during device adapter release. A local user can trigger the release of the adapter structure while timer callbacks are still executing, leading to access of freed memory and potential execution of arbitrary code or system crash.

Exploitation requires the ability to trigger device cleanup, which is typically available to users with access to network device interfaces.

853) NULL Pointer Dereference (CVE-ID: CVE-2026-23279)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mesh_rx_csa_frame() function in the mac80211 subsystem when handling received CSA action frames. A remote user can send a specially crafted SPECTRUM_MGMT/CHL_SWITCH action frame that omits the Mesh Channel Switch Parameters IE but includes valid Mesh ID and Mesh Configuration IEs to cause a kernel NULL pointer dereference.

Exploitation requires an established mesh peer link (PLINK_ESTAB) and no additional authentication beyond open mesh peering.

854) NULL Pointer Dereference (CVE-ID: CVE-2026-23277)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the teql network scheduler component when handling packet transmission through a gretap tunnel configured as a TEQL slave. A remote attacker can send a specially crafted network request to trigger a NULL pointer dereference in iptunnel_xmit, leading to a kernel page fault and system crash.

Exploitation does not require authentication or elevated privileges. The issue arises because the skb->dev field is not updated to the slave device before transmission, causing iptunnel_xmit_stats to access uninitialized tstats via a NULL pointer.

855) Uncontrolled Recursion (CVE-ID: CVE-2026-23276)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in tunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) when handling network packets in a specific tunnel and bonding configuration. A remote attacker can send specially crafted network traffic that triggers infinite recursion between bond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), leading to kernel stack overflow and system crash.

The issue specifically occurs when a bond device in broadcast mode has GRE tap interfaces as slaves and those GRE tunnels route back through the bond, causing multicast/broadcast traffic to trigger unbounded recursion. The existing XMIT_RECURSION_LIMIT is insufficient because tunnel recursion consumes more stack per level due to route lookups and full IP output processing.

856) Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CVE-ID: CVE-2026-23271)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code, escalate privileges, and cause a denial of service.

The vulnerability exists due to a race condition in the perf subsystem when handling performance events. A local user can trigger a use-after-free condition during event overflow processing to execute arbitrary code, escalate privileges, and cause a denial of service.

The issue arises from improper synchronization between __perf_event_overflow() and perf_remove_from_context(), where the overflow handler may access memory after it has been freed by context removal routines. The attacker must be able to create and manipulate perf events, which typically requires low-privileged user access to the perf subsystem.

857) Use After Free (CVE-ID: CVE-2026-23270)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to improper memory management in the act_ct action handling within the net/sched subsystem when processing packets in the egress path. A local user can attach the act_ct action to non-clsact/ingress qdiscs and trigger packet classification that returns TC_ACT_CONSUMED while the socket buffer (skb) is still held by the defragmentation engine, leading to a use-after-free condition.

The vulnerability specifically arises when act_ct is used in contexts not designed to handle TC_ACT_CONSUMED, particularly outside clsact/ingress qdiscs and shared blocks. Exploitation requires the ability to configure traffic control (tc) actions, implying local access and privileges to modify qdisc configurations.

858) Out-of-bounds read (CVE-ID: CVE-2026-23255)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the /proc/net/ptype component when handling RCU-protected network device references. A local attacker can exploit a race condition during iteration of packet types to cause a denial of service.

The issue arises from missing RCU protection when accessing pt->dev in ptype_seq_show() and ptype_seq_next(), allowing concurrent modifications to trigger an RCU stall.

859) Exposure of resource to wrong sphere (CVE-ID: CVE-2026-23253)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the dvb_ringbuffer component when reopening a DVR device. A local user can open a specially crafted DVR device to cause a denial of service.

The issue arises because dvb_dvr_open() reinitializes the shared waitqueue head, which can orphan existing waitqueue entries from io_uring poll or epoll, leading to stale pointers and potential system instability.

860) Out-of-bounds write (CVE-ID: CVE-2026-23246)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a boundary error in the wifi: mac80211 component when handling ML Reconfiguration elements. A remote attacker can send a specially crafted wireless packet to execute arbitrary code.

Exploitation involves sending a malicious ML Reconfiguration element with a link_id value of 15, which exceeds the valid index range of the link_removal_timeout array, resulting in a stack-based out-of-bounds write.

861) Buffer over-read (CVE-ID: CVE-2026-23245)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in the net/sched: act_gate component when handling action replacement while the hrtimer callback or dump path is walking the schedule list. A local user can trigger a race condition to cause a denial of service.

Exploitation requires access to the network scheduling subsystem and occurs due to lack of proper synchronization during parameter updates.

862) Resource exhaustion (CVE-ID: CVE-2026-23244)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the nvme_pr_read_keys() function when processing a user-provided num_keys value. A local user can send a specially crafted request with a large num_keys value to cause excessive memory allocation attempts, leading to a denial of service.

Exploitation requires local system access and the ability to invoke NVMe ioctl commands. No authentication beyond standard system access is required.

863) Use-after-free (CVE-ID: CVE-2026-23227)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the vidi_store_connection(), vidi_connection_ioctl(), vidi_detect(), vidi_get_modes() and vidi_remove() functions in drivers/gpu/drm/exynos/exynos_drm_vidi.c. A local user can escalate privileges on the system.

864) Use-after-free (CVE-ID: CVE-2026-23226)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the check_session_id(), ntlm_authenticate() and krb5_authenticate() functions in fs/smb/server/smb2pdu.c. A local user can escalate privileges on the system.

865) NULL pointer dereference (CVE-ID: CVE-2026-23207)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the handle_cpu_based_xfer(), handle_dma_based_xfer() and tegra_qspi_isr_thread() functions in drivers/spi/spi-tegra210-quad.c. A local user can perform a denial of service (DoS) attack.

866) Use-after-free (CVE-ID: CVE-2026-23171)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the bond_enslave() function in drivers/net/bonding/bond_main.c. A local user can escalate privileges on the system.

867) Improper locking (CVE-ID: CVE-2026-23157)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the fs/btrfs/extent_io.h. A local user can perform a denial of service (DoS) attack.

868) Input validation error (CVE-ID: CVE-2026-23154)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the tcp6_gso_segment() function in net/ipv6/tcpv6_offload.c. A local user can perform a denial of service (DoS) attack.

869) Infinite loop (CVE-ID: CVE-2026-23138)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the __ftrace_trace_stack() function in kernel/trace/trace.c. A local user can perform a denial of service (DoS) attack.

870) Improper locking (CVE-ID: CVE-2026-23118)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the rxkad_issue_challenge() function in net/rxrpc/rxkad.c. A local user can perform a denial of service (DoS) attack.

871) Use-after-free (CVE-ID: CVE-2026-23104)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ice_deinit_features() and ice_remove() functions in drivers/net/ethernet/intel/ice/ice_main.c. A local user can escalate privileges on the system.

872) Use-after-free (CVE-ID: CVE-2026-23066)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rxrpc_recvmsg() function in net/rxrpc/recvmsg.c. A local user can escalate privileges on the system.

873) Use-after-free (CVE-ID: CVE-2026-23004)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rt6_uncached_list_add() function in net/ipv6/route.c. A local user can escalate privileges on the system.

874) NULL pointer dereference (CVE-ID: CVE-2026-22993)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the drivers/net/ethernet/intel/idpf/idpf_txrx.h. A local user can perform a denial of service (DoS) attack.

875) NULL pointer dereference (CVE-ID: CVE-2026-22985)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the idpf_send_get_stats_msg() and idpf_send_get_set_rss_lut_msg() functions in drivers/net/ethernet/intel/idpf/idpf_virtchnl.c. A local user can perform a denial of service (DoS) attack.

876) NULL pointer dereference (CVE-ID: CVE-2026-22981)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the idpf_init_mac_addr(), idpf_vport_dealloc(), idpf_init_task(), idpf_check_reset_complete(), idpf_set_vport_state() and idpf_init_hard_reset() functions in drivers/net/ethernet/intel/idpf/idpf_lib.c. A local user can perform a denial of service (DoS) attack.

877) Improper resource shutdown or release (CVE-ID: CVE-2025-71288)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mtk-smi common probe path when handling late probe failure or driver unbind. A local user can trigger repeated probe deferral or unbind conditions to cause a denial of service.

878) Improper resource shutdown or release (CVE-ID: CVE-2025-71287)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mtk-smi larb probe logic when handling probe failures or driver unbind operations. A local user can trigger repeated probe deferral or unbind conditions to cause a denial of service.

879) Resource exhaustion (CVE-ID: CVE-2025-71269)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the btrfs filesystem's qgroup data reservation handling when processing file writes that trigger a fallback from inline extent creation. A local user can perform file operations that cause an ENOSPC condition during inline extent creation, leading to incorrect release of qgroup data reservations while still proceeding with the normal COW path, resulting in unbalanced quota accounting and potential denial of service.

The attacker must have the ability to write to a btrfs filesystem and trigger space allocation under conditions of low available space; this typically requires low-privileged local access but does not require administrative privileges beyond standard user write permissions.

880) Use-after-free (CVE-ID: CVE-2025-71221)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mmp_pdma_residue() function in drivers/dma/mmp_pdma.c. A local user can escalate privileges on the system.

881) Memory leak (CVE-ID: CVE-2025-71203)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the do_trap_ecall_u() function in arch/riscv/kernel/traps.c. A local user can perform a denial of service (DoS) attack.

882) Infinite loop (CVE-ID: CVE-2025-71161)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the function in drivers/md/dm-verity-target.c. A local user can perform a denial of service (DoS) attack.

883) Improper locking (CVE-ID: CVE-2025-71152)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the dsa_port_parse_of(), dev_find_class(), dsa_switch_release_ports() and dsa_switch_shutdown() functions in net/dsa/dsa.c. A local user can perform a denial of service (DoS) attack.

884) Incorrect calculation (CVE-ID: CVE-2025-68736)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the is_access_to_paths_allowed(), maybe_remove() and collect_domain_accesses() functions in security/landlock/fs.c. A local user can perform a denial of service (DoS) attack.

885) Resource management error (CVE-ID: CVE-2025-68334)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the drivers/platform/x86/amd/pmc/pmc.h. A local user can perform a denial of service (DoS) attack.

886) Resource management error (CVE-ID: CVE-2025-68239)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the bm_register_write() function in fs/binfmt_misc.c. A local user can perform a denial of service (DoS) attack.

887) Resource management error (CVE-ID: CVE-2025-68175)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the mxc_isi_video_init_channel(), mxc_isi_vb2_stop_streaming(), mxc_isi_video_s_fmt() and mxc_isi_video_release() functions in drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c. A local user can perform a denial of service (DoS) attack.

888) Input validation error (CVE-ID: CVE-2025-40150)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the do_garbage_collect() and f2fs_gc_range() functions in fs/f2fs/gc.c. A local user can perform a denial of service (DoS) attack.

889) Use-after-free (CVE-ID: CVE-2025-40135)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ip6_autoflowlabel() and ip6_xmit() functions in net/ipv6/ip6_output.c. A local user can escalate privileges on the system.

890) Memory leak (CVE-ID: CVE-2025-39764)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ctnetlink_expect_event(), ctnetlink_exp_dump_table(), ctnetlink_exp_ct_dump_table(), ctnetlink_dump_exp_ct() and ctnetlink_get_expect() functions in net/netfilter/nf_conntrack_netlink.c. A local user can perform a denial of service (DoS) attack.

891) Input validation error (CVE-ID: CVE-2025-38426)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the amdgpu_ras_eeprom_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c. A local user can perform a denial of service (DoS) attack.

892) Improper error handling (CVE-ID: CVE-2025-22116)

CWE-ID: CWE-388 - Error Handling

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the idpf_stop() and idpf_init_task() functions in drivers/net/ethernet/intel/idpf/idpf_lib.c. A local user can perform a denial of service (DoS) attack.

893) Use of uninitialized resource (CVE-ID: CVE-2025-21709)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the mt_set_in_rcu() function in kernel/fork.c, within the register_for_each_vma() function in kernel/events/uprobes.c. A local user can perform a denial of service (DoS) attack.