SB2026072366 - Ubuntu update for linux-ibm

Description

This security bulletin contains information about 801 vulnerabilities.

1) Improper privilege management (CVE-ID: CVE-2025-54518)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper privilege management in x86 CPU opcode cache handling when executing code on affected AMD Fam17h CPUs. A local user can execute code to escalate privileges.

The issue can permit escalation across privilege boundaries including userspace to kernel and guest to host, and only AMD Fam17h CPUs based on the Zen2 microarchitecture are believed to be affected.

2) Out-of-bounds read (CVE-ID: CVE-2026-64186)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform an out-of-bounds memory access.

The vulnerability exists due to an out-of-bounds access in AMD IOMMU debugfs handlers when parsing user-supplied debugfs offset values. A local user can provide a sufficiently large value that becomes negative to perform an out-of-bounds memory access.

The issue affects the iommu_mmio_write() and iommu_capability_write() paths in the AMD IOMMU debugfs interface.

3) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-64185)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in sysfs_update_group() and internal_create_group() when handling updates to a named sysfs group after create_files() fails. A local user can trigger an update operation that causes file creation to fail to cause a denial of service.

The issue affects the update path for an already existing named sysfs group, which may be silently removed instead of left intact.

4) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64184)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper release of a resource in damon_sysfs_memcg_path_to_id() in mm/damon/sysfs-schemes.c when iterating memory cgroups and breaking out of the mem_cgroup_iter() loop early. A local user can trigger the affected code path to cause a denial of service.

The issue results from a leaked cgroup reference because mem_cgroup_iter_break() is not called before exiting the iteration.

5) NULL pointer dereference (CVE-ID: CVE-2026-64183)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the EFI runtime workqueue handling for ACPI PRM calls when invoking EFI runtime calls during early initialization. A local user can trigger early PRM-related runtime calls to cause a denial of service.

The issue occurs when ACPI PRM accesses happen before the EFI runtime workqueue has been allocated during system initialization.

6) Improper resource shutdown or release (CVE-ID: CVE-2026-64182)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in memblk_nr_poison_inc() and memblk_nr_poison_sub() in drivers/base/memory.c when updating poison accounting for a memory block. A local user can trigger repeated successful memory block lookups to cause a denial of service.

7) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64181)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of special page table mappings in __vm_normal_page() when processing huge PMD or PUD mappings on architectures without pmd_special()/pud_special() support. A local user can trigger memory management operations involving huge zero folios to cause a denial of service.

This issue is exposed on x86 32-bit systems with THP enabled.

8) Improper resource shutdown or release (CVE-ID: CVE-2026-64180)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in remove_memory_blocks_and_altmaps() in mm/memory_hotplug.c when removing memory blocks and their altmaps. A local user can trigger memory block removal operations to cause a denial of service.

9) Improper resource shutdown or release (CVE-ID: CVE-2026-64179)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ipc_imem_init() when handling error paths after ipc_protocol_init(). A local user can trigger initialization failures to cause a denial of service.

10) Use-after-free (CVE-ID: CVE-2026-64178)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to a use-after-free in the bnep_add_connection function when reading dev->name during connection setup while a concurrent connection deletion tears down the net_device. A local privileged user can trigger concurrent bnep_add_connection and bnep_del_connection operations to disclose sensitive information.

Exploitation requires CAP_NET_ADMIN and a tight race window during net_device teardown.

11) Improper locking (CVE-ID: CVE-2026-64177)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in pep_do_rcv() in net/phonet/pep.c when forwarding an skb to a child socket via sk_receive_skb(). A local user can trigger socket backlog processing that acquires the child socket lock with bottom halves enabled to cause a denial of service.

The issue can lead to an inconsistent lock state and a self-deadlock on the same CPU when packets are received for the same child socket.

12) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64176)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect rate encoding in the iwlwifi mvm TX rate handling code when processing transmit rate settings on older devices. A local user can trigger use of malformed TX_CMD rate values to cause a denial of service.

The issue affects older devices that still use version 1 rate encoding, and firmware may assert or crash when handling beacon rates.

13) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64175)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper state management in iwl_mld_tx_from_txq() when processing transmit queues during a firmware restart. A local attacker can trigger high-throughput network traffic while the firmware is restarting to cause a denial of service.

The issue can lead to excessive CPU consumption and memory pressure from rapid skb allocation churn and slab fragmentation after a firmware crash.

14) Infinite loop (CVE-ID: CVE-2026-64174)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper loop state management in cfg80211_merge_profile() when processing a specially crafted malicious beacon containing split Multi-BSSID non-transmitted BSS profile elements. A remote attacker can send a specially crafted beacon to cause a denial of service.

The issue can cause the kernel to spend excessive time in the affected function for each beacon received.

15) Improper resource shutdown or release (CVE-ID: CVE-2026-64173)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in tracing_map_elt_free() in kernel/trace/tracing_map.c when handling allocation failures during tracing map element initialization. A local user can trigger an allocation failure path to cause a denial of service.

16) Improper locking (CVE-ID: CVE-2026-64172)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper hardware state handling in KVM SVM AVIC IPI virtualization when emulating ICR writes on Hygon Family 18h CPUs. A local user can trigger inter-processor interrupts from a guest to cause a denial of service.

The issue can lead to hung vCPUs and unbounded delays in guest execution.

17) Improper resource shutdown or release (CVE-ID: CVE-2026-64171)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the tegra i2c transfer function in drivers/i2c/busses/i2c-tegra.c when handling an i2c transfer after a runtime power management reference is acquired and mutex locking fails. A local user can trigger the error path to cause a denial of service.

The issue prevents the device from entering runtime suspend.

18) Improper handling of exceptional conditions (CVE-ID: CVE-2026-64170)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error pointers in the spi-qup DMA initialization logic when handling DMA setup failures during driver probe. A local user can trigger a DMA setup failure and subsequent probe error or driver unbind to cause a denial of service.

The issue can lead to dereferencing an error pointer or attempting to release a DMA channel a second time.

19) NULL pointer dereference (CVE-ID: CVE-2026-64169)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error pointers in the ep93xx SPI driver DMA channel setup logic when handling DMA setup failures during device probe or later driver cleanup paths. A local user can trigger DMA setup failure conditions to cause a denial of service.

The driver may later dereference an error pointer during subsequent probe error handling or driver unbind after falling back to PIO mode.

20) NULL pointer dereference (CVE-ID: CVE-2026-64168)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an error pointer dereference in the sprd spi driver probe error-handling path when handling DMA setup failure during probe. A local user can trigger a probe path that falls back from DMA to PIO mode and reaches late error handling to cause a denial of service.

The issue occurs because the driver may attempt to release DMA channels after DMA setup has failed.

21) Improper input validation (CVE-ID: CVE-2026-64167)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in kho_fill_kimage() when preparing a crash kernel kexec image. A local user can load a crash kernel image to cause a denial of service.

The issue occurs because KHO metadata may be populated outside the small reserved crash kernel memory region, leading to a fault during kho_memory_init().

22) NULL pointer dereference (CVE-ID: CVE-2026-64166)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the arm_ffa bus match callback when registering a buggy FF-A driver without an id_table. A local user can register a crafted FF-A driver to cause a denial of service.

23) NULL pointer dereference (CVE-ID: CVE-2026-64165)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in intcp_init_early when performing early initialization before the memory management subsystem is initialized. A local attacker can trigger the vulnerable initialization path to cause a denial of service.

The issue affects ARM Integrator/CP systems using Device Tree, and the failure may manifest as either a kernel crash or an -ENOMEM condition that prevents sched_clock_register from being called.

24) Improper resource shutdown or release (CVE-ID: CVE-2026-64164)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the btrfs_sync_file trace event in include/trace/events/btrfs.h when handling file sync operations with the trace event enabled. A local user can trigger the vulnerable trace event to cause a denial of service.

Exploitation requires the btrfs_sync_file trace event to be enabled.

25) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64163)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state reset in lib/tests/test_kprobes.c when running the kprobes sanity tests multiple times. A local user can trigger repeated test runs to cause a denial of service.

The issue occurs because static kprobe and kretprobe objects retain leftover address and flag data between test runs, which leads to failed re-registration and an eventual kernel crash.

26) Improper Initialization (CVE-ID: CVE-2026-64162)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in idpf_ptp_init() and the PTP auxiliary worker when scheduling PTP worker execution before initializing read_dev_clk_lock. A local user can trigger the vulnerable code path to cause a denial of service.

The issue is triggered by a race condition where the auxiliary worker can immediately access the lock before initialization, leading to a kernel lockdep warning.

27) Improper resource shutdown or release (CVE-ID: CVE-2026-64161)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in icssm_prueth_probe() in the TI ICSSM PRU Ethernet driver when handling a failed of_property_read_u32() call during device probe. A local user can trigger the vulnerable probe path to cause a denial of service.

28) Race condition (CVE-ID: CVE-2026-64160)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in netfslib size handling when concurrently updating or reading remote_i_size and zero_point. A local user can trigger concurrent filesystem operations to cause a denial of service.

The issue can corrupt i_size_seqcount and make subsequent i_size_read() calls loop forever, and the advisory highlights 32-bit systems as affected by tearing concerns.

29) Incorrect calculation (CVE-ID: CVE-2026-64159)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause incorrect file reads.

The vulnerability exists due to improper handling of file size state in netfs_release_folio() when releasing a folio while uncommitted page cache data exists beyond the folio and the on-server EOF falls within that folio. A local user can trigger this condition through crafted file operations to cause incorrect file reads.

This was observed on cifs with the default cache option and no fscache.

30) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64158)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in netfs_perform_write() when handling buffered writes on files opened for reading and writing. A local user can perform write operations that trigger write streaming disablement to cause a denial of service.

The issue is related to write streaming behavior in the netfs subsystem and was observed to cause failures in generic/522 xfstest scenarios.

31) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64157)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause data corruption.

The vulnerability exists due to improper state update in netfs_invalidate_folio() when partially invalidating a streaming-write folio. A local user can trigger partial invalidation of cached dirty data to cause data corruption.

32) Improper locking (CVE-ID: CVE-2026-64156)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in netfs_writeback_single() and afs_single_writepages() when processing writeback operations under lock contention with WB_SYNC_NONE. A local user can trigger writeback in a way that causes skipped writes to leave directory or link data improperly handled, resulting in a denial of service.

This issue is described as theoretical for directories because the afs_single_writepages() path serializes access with validate_lock.

33) Improper resource shutdown or release (CVE-ID: CVE-2026-64155)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ath11k WMI WOW command handling in drivers/net/wireless/ath/ath11k/wmi.c when sending WOW host wakeup and WOW enable commands. A local user can trigger error paths to cause a denial of service.

34) Improper resource shutdown or release (CVE-ID: CVE-2026-64154)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in a6xx_gpu_init() when handling error paths after parsing the qcom,gmu phandle. A local user can trigger an error condition to cause a denial of service.

35) Unchecked Return Value (CVE-ID: CVE-2026-64153)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error codes in msm_iommu_map() in the drm/msm iommu mapping logic when mapping scatter-gather tables. A local user can trigger an error condition to cause a denial of service.

36) Improper Initialization (CVE-ID: CVE-2026-64152)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the iommu mapping error-handling logic in drivers/iommu/iommu.c when handling partial mapping failures with iommu_debug enabled. A local user can trigger a mapping error that leads to an unmatched unmap operation to cause a denial of service.

Exploitation requires iommu_debug to be enabled.

37) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-64151)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a missing page size check in iommupt page table mapping logic when mapping a range with PAGE_SIZE. A local user can trigger the affected mapping path to cause a denial of service.

The issue arises when PAGE_SIZE is missing from the pgsize_bitmap during use of the fast path.

38) Improper locking (CVE-ID: CVE-2026-64150)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock management in nft_inner_restore_tun_ctx in net/netfilter/nft_inner.c when handling an error path during nft_inner tunnel context restoration. A local user can trigger the error condition to cause a denial of service.

39) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-64149)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource validation in dma_map_resource() and dma-debug handling when mapping MMIO resources that share a sparse memory section with RAM. A local user can trigger the vulnerable code path to cause a denial of service.

This can occur on ARM64 systems with SPARSEMEM where MMIO addresses have struct pages in the same section as RAM, leading to a warning and DMA_MAPPING_ERROR during device probe.

40) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64148)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in pdsc_devcmd_wait() when handling firmware crash or command timeout conditions. A local user can trigger the vulnerable code path to cause a denial of service.

The issue causes stale success status to be returned instead of propagating an error, which can prevent proper recovery handling.

41) NULL pointer dereference (CVE-ID: CVE-2026-64147)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error pointers and a missing reference release in pds_core debugfs handling when performing firmware reset recovery or checking for an existing debugfs entry. A local user can trigger the vulnerable code path to cause a denial of service.

The crash condition occurs when CONFIG_DEBUG_FS is disabled.

42) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64146)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in erofs_init_inode_xattrs() in the EROFS xattr handling code when parsing crafted filesystem metadata. A local user can trigger error paths that leak a folio reference to cause a denial of service.

The issue occurs on certain error paths after a metabuf has been acquired during inode xattr initialization.

43) Memory leak (CVE-ID: CVE-2026-64145)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in wilc_wlan_firmware_download() in the wilc1000 wireless driver when handling a bus acquire failure during firmware download. A local user can trigger the affected error path to cause a denial of service.

44) Improper resource shutdown or release (CVE-ID: CVE-2026-64144)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the btmtk USB Bluetooth driver when handling failed or killed control urbs. A local user can trigger error paths to cause a denial of service.

45) Improper access control (CVE-ID: CVE-2026-64143)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause permanent hardware damage to the battery.

The vulnerability exists due to improper access control in the uniwill-laptop battery charging limit feature when forcing the driver to enable the charging threshold interface on unsupported devices. A local user can enable the charging limit through the force module parameter to cause permanent hardware damage to the battery.

The issue affects some older device models that do not properly implement the charging threshold interface.

46) Use-after-free (CVE-ID: CVE-2026-64142)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in ksmbd durable handle management and m_fp_list walkers when processing concurrent durable-handle expiration and file lookup operations. A remote user can trigger concurrent durable handle expiration and lookup activity to cause a denial of service and potentially execute arbitrary code.

The issue involves a race between the durable scavenger and walkers such as ksmbd_lookup_fd_inode() and share-mode checks, and exploitation requires access to SMB operations that exercise durable handles.

47) NULL pointer dereference (CVE-ID: CVE-2026-64141)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in compare_guid_key() in fs/smb/server/oplock.c when processing SMB2 CREATE requests with a lease context after session teardown on the same TCP connection. A remote user can send crafted SMB2 session and create requests to cause a denial of service.

Exploitation requires a successful SMB2 SESSION_SETUP and a share configured with durable handles enabled.

48) NULL pointer dereference (CVE-ID: CVE-2026-64140)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in proc_show_files() when reading /proc/fs/ksmbd/files after an SMB2 client opens a file with a durable v2 handle and issues SMB2 SESSION_LOGOFF. A remote user can establish an SMB2 session and trigger the vulnerable state to cause a denial of service.

Exploitation requires a share configured with durable handles enabled, and the crash occurs during the interval before the durable scavenger removes the disconnected file pointer.

49) Memory leak (CVE-ID: CVE-2026-64139)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in set_posix_acl_entries_dacl() in ksmbd when processing a malicious or malformed file with enough POSIX ACL entries to trigger the DACL size overflow check. A remote attacker can send or access a crafted file to cause a denial of service.

The issue occurs because cleanup is skipped when overflow handling breaks out of ACE-building loops.

50) Out-of-bounds read (CVE-ID: CVE-2026-64138)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the ksmbd smbacl.c ACL inheritance logic when processing owner and group SIDs from a parent security descriptor. A remote user can provide a specially crafted parent security descriptor to cause a denial of service.

The issue occurs during ACL inheritance in ksmbd.

51) Improper access control (CVE-ID: CVE-2026-64137)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to affect service availability.

The vulnerability exists due to improper access control in the CIFS SWN netlink notify handler when sending witness notification commands. A local user can send crafted RESOURCE_CHANGE or CLIENT_MOVE notifications to affect service availability.

The intended sender is the cifs.witness helper, but any local process could send notifications to the in-kernel witness handler.

52) Improper access control (CVE-ID: CVE-2026-64137)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the CIFS SWN generic netlink multicast group when joining the multicast group and receiving registration messages. A local user can join the CIFS_GENL_MCGRP_SWN group to disclose sensitive information.

For NTLM-authenticated mounts, exposed registration messages may include the username, domain, and password attributes copied from the CIFS session.

53) Race condition (CVE-ID: CVE-2026-64136)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in smb2_find_smb_sess_tcon_unlocked() when handling SMB tree connection lookups. A local user can trigger concurrent access to corrupt tc_count handling and cause a denial of service.

54) Stack-based buffer overflow (CVE-ID: CVE-2026-64135)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in adm1266_nvmem_read_blackbox() when processing an SMBus block response from a device. A local user can return a block length larger than the allocated buffer to cause a denial of service.

The issue occurs before the return-length check rejects an unexpected response.

55) NULL pointer dereference (CVE-ID: CVE-2026-64134)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the ALSA PCM interleaved_copy() function when handling silencing operations with NULL data. A local user can trigger a crafted PCM data transfer path to cause a denial of service.

The issue is architecture-dependent and was reported to cause failures on RISC-V systems.

56) Out-of-bounds read (CVE-ID: CVE-2026-64133)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the find_control() function in the ALSA asihpi driver when reading cached control information with an out-of-range control index. A local user can provide a crafted control index to cause a denial of service.

57) Use-after-free (CVE-ID: CVE-2026-64132)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ipv6 hop-by-hop ioam processing in ipv6_hop_ioam() when handling crafted ipv6 packets that trigger skb_ensure_writable() buffer reallocation. A local user can send a specially crafted packet to cause a denial of service.

The issue occurs because the hdr pointer is not refreshed after the skb data buffer is reallocated, while the trace pointer is recalculated.

58) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-64131)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper check for unusual or exceptional conditions in mm/memory.c unmap path when unmapping device-private or exclusive pages from private file-backed mappings. A local user can trigger memory migration and unmapping operations to cause a denial of service.

The issue can result in a kernel warning during process teardown.

59) Improper Initialization (CVE-ID: CVE-2026-64130)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization of memory tags in the huge zero folio when allocating huge zero folios with init_on_free enabled and __GFP_ZEROTAGS handling skips tag clearing. A local user can map affected memory to disclose sensitive information.

The issue affects arm64 systems using memory tagging extension, and exposure occurs because the huge zero folio is mapped through a special PMD path that does not initialize tags on first user-space mapping.

60) Improper locking (CVE-ID: CVE-2026-64129)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in migrate_vma_insert_huge_pmd_page() in mm/migrate_device.c when handling an error from check_stable_address_space() after acquiring the PMD spinlock. A local user can trigger the affected code path to cause a denial of service.

The issue can leave the PMD spinlock permanently held, resulting in a deadlock.

61) NULL pointer dereference (CVE-ID: CVE-2026-64128)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in iso_recv() in the Bluetooth ISO subsystem when processing an ISO_END frame without a prior ISO_START on a fresh ISO connection. A remote attacker can send a specially crafted Bluetooth ISO frame sequence to cause a denial of service.

For BIS, exploitation does not require pairing and can be triggered by a broadcaster on the air.

62) Information disclosure (CVE-ID: CVE-2026-64127)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an information leak caused by incorrect size and source-pointer arguments in l2cap_ecred_reconfigure() in the Bluetooth L2CAP subsystem when sending an L2CAP_ECRED_RECONFIGURE_REQ packet to a paired Bluetooth peer. A remote attacker can trigger ecred reconfiguration handling to disclose sensitive information.

The malformed packet copies bytes from kernel stack memory and can expose a kernel stack address to the peer. Exploitation requires Bluetooth connectivity with a paired peer.

63) Out-of-bounds read (CVE-ID: CVE-2026-64126)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the Bluetooth MGMT add_ext_adv_data() handler when processing a crafted MGMT_OP_ADD_EXT_ADV_DATA command with inconsistent length fields. A local privileged user can send a specially crafted management command to disclose sensitive information.

Exploitation requires CAP_NET_ADMIN in the initial user namespace, and exposed memory may be read back via MGMT_OP_GET_ADV_INSTANCE.

64) Improper Initialization (CVE-ID: CVE-2026-64125)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper hardware state management in bcmgenet_eee_enable_set in the Broadcom GENET network driver when enabling energy-efficient ethernet settings. A local user can enable the affected settings to cause a denial of service.

On affected systems, RX traffic can stop flowing while the link remains up, and on some boards the resulting corruption can lead to a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit.

65) Out-of-bounds read (CVE-ID: CVE-2026-64124)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in net_devmem_bind_dmabuf() and related devmem indexing logic when processing a dma-buf bind request with a non-page-aligned size or scatter-gather length. A local user can provide a crafted dma-buf to trigger out-of-bounds access and cause a denial of service.

The non-page-aligned size condition affects TX handling, while the scatter-gather length condition affects both RX and TX.

66) Use-after-free (CVE-ID: CVE-2026-64123)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information or cause a denial of service.

The vulnerability exists due to a use-after-free in the hsr node table handling code when processing generic-netlink node-list or node-status operations concurrently with RTM_DELLINK teardown. A local user can trigger concurrent netlink operations to disclose sensitive information or cause a denial of service.

The generic-netlink reader accesses node entries under RCU and may retain a node pointer while teardown frees the same entry.

67) Use-after-free (CVE-ID: CVE-2026-64122)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mlx5e_tx_reporter_timeout_recover() in the mlx5 driver when recovering from a transmit timeout. A local user can trigger a transmit-timeout recovery condition to cause a denial of service.

68) Out-of-bounds read (CVE-ID: CVE-2026-64121)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ifb_get_ethtool_stats in the IFB network driver when handling ethtool statistics requests on a device with more RX queues than TX queues. A local user can request ethtool statistics for a crafted asymmetric IFB device to disclose sensitive information.

Exploitation requires an IFB device configuration where the RX queue count exceeds the TX queue count.

69) NULL pointer dereference (CVE-ID: CVE-2026-64120)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in net/ethtool/phy.c when processing ethtool phy reply data after memory allocation failure. A local user can trigger memory allocation failures that leave string pointers NULL to cause a denial of service.

The issue can lead to a kernel panic when phy_reply_size() calls strlen() on a NULL name pointer.

70) Race condition (CVE-ID: CVE-2026-64119)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper concurrent modification of an rcu-protected list in l2tp_session_unhash() when handling concurrent L2TP session get, create, and delete operations on the same tunnel. A local user can issue crafted concurrent netlink commands to cause a denial of service.

Exploitation can pin a host CPU indefinitely and stall RCU grace periods, and the issue is reachable from a standard unshare sandbox when l2tp_core is loaded.

71) Double free (CVE-ID: CVE-2026-64118)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in qed_cid_map_free() in the QLogic qed driver context management code when handling failed CID bitmap allocations. A local user can trigger the failing allocation path to cause a denial of service.

Exploitation requires device-specific setup to reach the affected allocation failure path.

72) Use-after-free (CVE-ID: CVE-2026-64117)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ieee80211_invoke_fast_rx() when processing mesh forwarding in the unicast forward path. A local user can trigger mesh data handling that causes freed memory to be accessed to cause a denial of service.

The issue occurs because skb->cb storage is reused by mesh forwarding code before the caller finishes consuming the RX status, and the no-route path can free the skb before the stale status is accessed.

73) NULL pointer dereference (CVE-ID: CVE-2026-64116)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ipv6_hop_ioam() when processing an IPv6 IOAM Hop-by-Hop option during concurrent interface teardown. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because IPv6 interface state can be cleared concurrently through RCU, allowing __in6_dev_get(skb->dev) to return NULL while the packet is being handled.

74) Use-after-free (CVE-ID: CVE-2026-64115)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in vmci_transport_recv_connecting_server() and vmci_transport_recv_listen() when processing a peer reset during the connection handshake. A remote attacker can send a reset packet during the handshake to cause a denial of service.

The issue is triggered by a race involving pending socket cleanup in the VMCI vsock transport.

75) Out-of-bounds read (CVE-ID: CVE-2026-64114)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in the raw_send_hdrinc IPv4 packet handling in the Linux kernel when processing a malformed IP_HDRINCL packet with an IPv4 header length value less than 5. A local user can send a specially crafted packet through a raw socket to cause a denial of service.

Exploitation requires CAP_NET_RAW. Triggering the reproduced crash path also requires a matching xfrm AH policy on the outgoing route, and loopback does not reach the affected path.

76) Use-after-free (CVE-ID: CVE-2026-64113)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ixgbevf_clean_rx_irq() when processing received frames that trigger VEPA multicast source pruning. A local user can trigger this code path to cause a denial of service.

The issue occurs in NAPI softirq context when a freed skb is reused on the next loop iteration because the pointer is not cleared before continuing.

77) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-64112)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in the rbd lock_dwork handling in drivers/block/rbd.c when unmapping an image while exclusive lock work is being queued. A local user can trigger image unmap operations during concurrent I/O activity to cause a denial of service.

The issue can result in lock acquisition work executing after device and image release operations have freed or reset internal state.

78) Improper locking (CVE-ID: CVE-2026-64111)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass security restrictions.

The vulnerability exists due to improper locking in lsm_set_self_attr() when setting a process security attribute. A local user can invoke the syscall while the process is being ptraced to bypass security restrictions.

This affects SELinux and AppArmor checks related to ptrace during security context transitions.

79) Memory leak (CVE-ID: CVE-2026-64110)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in igc_fpe_xmit_smd_frame() when handling failure of transmit descriptor initialization. A local user can trigger the error path to cause a denial of service.

Exploitation requires access to trigger the affected driver functionality on systems using an Intel I226 adapter.

80) Use-after-free (CVE-ID: CVE-2026-64109)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in unix_stream_data_wait() in net/unix/af_unix.c when processing racing recv() operations on the same AF_UNIX stream socket. A local user can trigger concurrent peek and normal receive operations to cause a denial of service.

Exploitation requires a race condition between a peeking recv() call and a normal recv() call on the same socket.

81) Use-after-free (CVE-ID: CVE-2026-64108)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free condition in the cifs deferred file close handling when processing deferred file close work during unmount. A local user can open and close a file and trigger unmount activity to cause a denial of service.

The issue can be triggered because deferred close work may run after the filesystem is being unmounted, leading to a busy dentry warning.

82) NULL pointer dereference (CVE-ID: CVE-2026-64107)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in pcm512x_overclock_xxx_put() in the pcm512x codec driver when handling mixer control operations. A local user can trigger the vulnerable control path to cause a denial of service.

83) Improper input validation (CVE-ID: CVE-2026-64106)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in vgic_its_restore_dte() when restoring an ITS Device Table Entry. A remote user can supply a restored DTE with an out-of-range Size field to cause a denial of service.

Exploitation requires the ability to restore crafted KVM ITS device state on arm64 systems.

84) Improper resource shutdown or release (CVE-ID: CVE-2026-64105)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in kvm_vgic_vcpu_init error handling in arch/arm64/kvm/arm.c when creating a virtual CPU and initialization fails after private IRQ allocation. A local user can trigger a failed virtual CPU creation sequence to cause a denial of service.

The issue occurs when redistributor iodev registration fails after private IRQs have already been allocated.

85) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64104)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of pages left in an unknown encryption state in drivers/virt/coco/sev-guest/sev-guest.c when handling extended report requests and memory encryption state transitions. A local user can trigger failures in set_memory_encrypted() or set_memory_decrypted() to cause a denial of service.

The issue affects pages that may remain in an unencrypted or otherwise unknown state and therefore cannot be safely returned for general reuse.

86) Use-after-free (CVE-ID: CVE-2026-64103)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the isci completion tasklet in the ISCI driver when removing a device or unloading the driver while queued tasklet processing is still possible. A local user can trigger device removal or driver unload to cause a denial of service.

The stale callback may dereference ihost and access ihost->smu_registers after the host lifetime ends.

87) Integer underflow (CVE-ID: CVE-2026-64102)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service and disclose kernel memory contents.

The vulnerability exists due to an integer underflow in the Soft-iWARP receive path (siw_get_hdr/siw_tcp_rx_data) when processing a malformed iWARP FPDU with an MPA length smaller than the fixed header length for the opcode. A remote user can send a specially crafted FPDU to cause a denial of service and disclose kernel memory contents.

The issue is triggered by a malicious connected siw peer, and the negative signed length is later promoted to size_t during skb_copy_bits processing.

88) Out-of-bounds read (CVE-ID: CVE-2026-64101)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in pdsfc_fw_rpc() when parsing a device-specific RPC input buffer. A local user can supply a truncated RPC buffer to disclose sensitive information.

89) Improper locking (CVE-ID: CVE-2026-64100)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in msm_gem_shrinker_scan in the drm/msm GPU memory shrinker when reclaiming memory under shrinker context. A local user can trigger GPU memory reclaim activity to cause a denial of service.

The issue is triggered when fs_reclaim is already held and the shrinker attempts to acquire dma reservation locks, leading to a deadlock.

90) Use-after-free (CVE-ID: CVE-2026-64099)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the v3d CPU job ioctl error path when handling CPU job submission failures. A local user can trigger an error path with crafted CPU job submissions to cause a denial of service.

The same error path can also trigger a NULL dereference and leak one sync object reference per query.

91) Improper locking (CVE-ID: CVE-2026-64098)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() when updating planes and flushing framebuffer resources. A local user can trigger error conditions that leave the dma_resv lock unheld and then reach fence-list updates to cause a denial of service.

The issue can race with concurrent readers or writers and corrupt the dma_resv fence list. The reported trigger used fault injection on the DRM_IOCTL_MODE_CURSOR path.

92) Out-of-bounds read (CVE-ID: CVE-2026-64097)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() when parsing a malformed VBIOS GPIO pin LUT table. A local attacker can supply a crafted VBIOS image with an invalid structuresize field to disclose sensitive information.

93) Use-after-free (CVE-ID: CVE-2026-64096)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in batadv_mcast_purge_orig() and orig_node RCU release handling when releasing orig_node entries while concurrent RCU readers are still accessing multicast-related references. A local user can trigger concurrent access to freed entries to cause a denial of service.

The issue affects RCU-protected readers accessing references such as orig->mcast_want_all_ipv6_node after the referenced entries have been removed and freed.

94) Race condition (CVE-ID: CVE-2026-64095)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the batman-adv bridge loop avoidance subsystem when handling concurrent backbone gateway state changes and request tracking. A local user can trigger concurrent operations to cause a denial of service.

The issue stems from non-atomic updates to request state and the bla.num_requests counter across multiple concurrent code paths.

95) NULL pointer dereference (CVE-ID: CVE-2026-64094)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in batman-adv bridge loop avoidance claim handling in net/batman-adv/bridge_loop_avoidance.c when sending an ARP request after a primary interface is decoupled from its mesh interface. A local user can trigger this race condition to cause a denial of service.

The issue occurs when the primary hard interface is accessed without rtnl_lock held and its mesh interface pointer becomes NULL during the operation.

96) Race condition (CVE-ID: CVE-2026-64093)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in batman-adv tp_meter timer handling in batadv_tp_sender_cleanup() when shutting down the sender timer during cleanup. A local user can trigger timer re-arming after cleanup to cause a denial of service.

The issue occurs because the timer may be re-armed after its reference has already been released.

97) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-64091)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to an out-of-bounds write in batadv_tt_prepare_tvlv_local_data in the batman-adv translation table handling when generating local TT TVLV data for reported VLANs. A local user can trigger concurrent VLAN translation table entry changes to cause a denial of service.

The issue arises from a time-of-check time-of-use condition where the number of non-empty VLANs can increase after buffer sizing but before the buffer is filled.

98) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64090)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of empty vlan responses in batman-adv translation table handling when processing indirect translation table replies from the global tt state. A remote attacker can trigger indirect translation table responses containing empty vlan data to cause a denial of service.

The issue affects replies generated indirectly by another node using the global tt state rather than only direct local translation table responses.

99) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-64089)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an integer signedness error in batadv_send_my_tt_response() and batadv_tt_prepare_tvlv_local_data() when processing a translation table changeset length value larger than 32767. A local user can trigger the vulnerable code path to disclose sensitive information.

The issue occurs because a negative sign-extended length can cause a full-sized buffer to be allocated while only a small portion is populated, leaving the remaining bytes uninitialized.

100) Use of Uninitialized Variable (CVE-ID: CVE-2026-64088)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in batadv_send_other_tt_response() and batadv_tt_prepare_tvlv_global_data() when handling tt changeset response data. A remote attacker can trigger processing of an oversized tt_buff_len value to disclose sensitive information.

The issue is caused by a signed integer field wrapping to a negative value and then being widened with sign extension, resulting in a fully allocated buffer that is only partially initialized.

101) Out-of-bounds write (CVE-ID: CVE-2026-64087)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in adm1266_nvmem_read_blackbox() when processing a malformed BLACKBOX_INFO response. A local user can provide a device response with an implausible blackbox record count to cause a denial of service.

The issue can be triggered by a non-responsive slave returning 0xff, bus corruption, or firmware bugs in the device response.

102) Out-of-bounds write (CVE-ID: CVE-2026-64086)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in adm1266_pmbus_block_xfer() and read_buf in the adm1266 PMBus driver when processing a max-length block read response with a PEC byte. A local user can trigger the driver to process a crafted response to cause a denial of service.

The same condition can also cause an out-of-bounds read during the subsequent PEC comparison.

103) Out-of-bounds write (CVE-ID: CVE-2026-64085)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in adm1266_nvmem_read_blackbox() when processing device-supplied blackbox records. A local user can provide a device response with more than 64 bytes in a trailing record to cause a denial of service.

The issue occurs because the helper may write up to 255 bytes into a 64-byte record slot before the returned length is validated.

104) Out-of-bounds write (CVE-ID: CVE-2026-64084)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information and corrupt memory.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in adm1266_gpio_get_multiple() in the adm1266 PMBus driver when iterating a caller-supplied gpio mask. A local user can trigger access to bits beyond the end of the supplied mask and bits arrays to disclose sensitive information and corrupt memory.

The iteration uses a PMBus command value as the scan bound instead of the number of PDIO pins.

105) Use of Uninitialized Variable (CVE-ID: CVE-2026-64083)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an uninitialized stack memory exposure in the adm1266 GPIO accessors when processing short block-read responses from the device. A local user can trigger a short block-read response to disclose sensitive information.

The leaked bits can reach userspace through gpiolib interfaces including sysfs and character-device ioctls.

106) Use of Uninitialized Variable (CVE-ID: CVE-2026-64082)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to corrupt register state and disclose kernel stack contents.

The vulnerability exists due to use of uninitialized stack data in compat_riscv_gpr_set() and compat_restore_sigcontext() when handling failed user memory copies. A local user can provide crafted user-supplied register or signal context data that triggers a copy failure to corrupt register state and disclose kernel stack contents.

The issue affects the RISC-V compatibility signal and ptrace handling paths.

107) Out-of-bounds read (CVE-ID: CVE-2026-64081)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the arm ffa framework notification handler when processing malformed framework notification messages from the shared RX buffer. A local user can provide a crafted notification message to cause a denial of service.

The issue involves validation of the indirect message offset and size fields, including rejection of zero-length payloads and invalid non-header payload alignment.

108) Use-after-free (CVE-ID: CVE-2026-64080)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in arm ffa notification handlers in drivers/firmware/arm_ffa/driver.c when handling notification callbacks during concurrent notifier unregistration. A local user can trigger notification handling while causing a notifier entry to be unregistered and freed to cause a denial of service.

The issue affects both the framework and non-framework notification paths.

109) Race condition (CVE-ID: CVE-2026-64079)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to a NULL pointer dereference in netfilter x_tables table registration and teardown when registering tables concurrently with per-network namespace exit. A local user can trigger concurrent table registration and namespace cleanup to cause a denial of service.

The issue occurs because a table can become visible in the per-netns list before valid hook operations are assigned, allowing the pre_exit path to pass a NULL ops pointer to hook unregistration.

110) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64078)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the netfilter x_tables table unregistration logic when handling set/getsockopt operations during table teardown. A local user can trigger concurrent table access during module or network namespace teardown to cause a denial of service.

The issue occurs because a table detached during the pre-exit stage is no longer visible on the active per-network table list while teardown is still in progress.

111) Race condition (CVE-ID: CVE-2026-64077)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ebtables table registration and unregistration logic when handling table initialization and teardown. A local user can trigger ebtables operations to cause a denial of service.

The issue involves exposure of a partially filled table structure and unsafe teardown ordering in the bridge netfilter ebtables subsystem.

112) Race condition (CVE-ID: CVE-2026-64076)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ebtables initialization in net/bridge/netfilter/ebtables.c when registering and exposing sockopts globally during module initialization. A local user can trigger access to the exposed sockopts during the initialization window to cause a denial of service.

113) Use-after-free (CVE-ID: CVE-2026-64075)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in unregister_fprobe() when unregistering and releasing an fprobe. A local user can trigger fprobe operations and release the fprobe after unregistering it to cause a denial of service.

The issue can occur in fprobe event and sample module code.

114) Out-of-bounds write (CVE-ID: CVE-2026-64074)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in statmount_mnt_idmap when handling mount ID mapping data in a seq_file buffer. A local user can trigger an integer count state that bypasses overflow detection to cause a denial of service.

The issue results in a 1-byte NULL out-of-bounds write on a dynamically allocated seq buffer.

115) Use-after-free (CVE-ID: CVE-2026-64073)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in irq_work_single() when synchronizing irq_work on PREEMPT_RT systems. A local user can trigger concurrent irq_work activity and free the work structure after BUSY is cleared to cause a denial of service.

The issue affects non-HARD irq_work processed by per-CPU kthreads on PREEMPT_RT.

116) Improper resource shutdown or release (CVE-ID: CVE-2026-64072)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in nvme_map_user_request() in drivers/nvme/host/ioctl.c when handling integrity mapping failures for user requests. A local user can trigger an integrity mapping failure to cause a denial of service.

117) Use-after-free (CVE-ID: CVE-2026-64071)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in nvme_free_host_mem() when handling an error path during nvme_probe(). A local user can trigger repeated cleanup of host memory state to cause a denial of service.

This occurs when host memory buffer setup succeeds but a subsequent I/O error causes nvme_free_host_mem() to be invoked twice, leading to a kernel NULL pointer dereference. The issue was reproducible on Thunderbolt-attached NVMe devices with intermittent PCIe link instability.

118) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64070)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in sysfs show() callbacks in arch/powerpc/perf/hv-gpci.c when handling repeated sysfs reads. A local user can repeatedly read the affected sysfs entries to cause a denial of service.

On CONFIG_PREEMPT=y kernels, repeated successful reads can leave preemption disabled and a subsequent user-mode page fault may be forced to SIGSEGV, with the resulting coredump triggering a kernel scheduling while atomic condition.

119) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64069)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of failed read subrequest cancellation in fs/netfs read handling when preparing DIO or single-read subrequests. A local user can trigger read operations that cause subrequest preparation to fail to cause a denial of service.

The issue affects cancellation paths for both direct I/O reads and single-read dispatch.

120) Improper locking (CVE-ID: CVE-2026-64068)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in netfs_retry_read_subrequests() and netfs_retry_write_stream() when retrying read and write subrequests. A local user can trigger concurrent subrequest operations to cause a denial of service.

121) Race condition (CVE-ID: CVE-2026-64067)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing memory barriers in netfs subrequest list handling when processing netfs read and write subrequests locklessly. A local user can trigger concurrent read or write operations to cause a denial of service.

The issue affects access to stream->subrequests and subreq->flags in netfs_collect_read_results(), netfs_collect_write_results(), and related queueing logic.

122) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64066)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in netfs_read_to_pagecache() when processing buffered read subrequests. A local user can trigger a subrequest failure to cause a denial of service.

123) Race condition (CVE-ID: CVE-2026-64065)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in netfs_write_begin() when handling write operations through the netfs and ceph write path. A local user can trigger the kernel BUG with crafted write activity to cause a denial of service.

The issue manifests as a VM_BUG_ON_FOLIO condition that can lead to an invalid opcode exception and kernel crash.

124) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64064)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in netfs_invalidate_folio() when handling a folio that was dirtied by a streaming write and then truncated before being read via mmap(). A local user can truncate the file and trigger a subsequent mmap read to cause a kernel oops and denial of service.

Exploitation requires a local sequence involving streaming writes followed by truncation and mmap-based access.

125) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64063)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to corrupt file data.

The vulnerability exists due to improper state management in netfs_perform_write() when handling streaming writes that overwrite partially written folios. A local user can perform crafted write operations to corrupt file data.

The issue can be triggered on netfs-backed filesystems such as cifs with the default cache option, and was observed when a streaming write page is later overwritten entirely or partially by a single write().

126) Improper locking (CVE-ID: CVE-2026-64062)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in netfs_advance_writethrough() when processing write-through operations on folios. A local user can trigger write-through activity to cause a deadlock and deny service.

The issue involves interaction with mmapped reads and writes during folio writeback handling.

127) Use-after-free (CVE-ID: CVE-2026-64061)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in netfs_read_gaps() when processing buffered reads with a sink folio. A local user can trigger the flaw to cause a denial of service.

The issue was detected by KASAN as a write-after-free during kernel handling of data received over a TCP socket.

128) Memory leak (CVE-ID: CVE-2026-64060)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in netfs_write_begin() when handling an error from netfs_wait_for_read(). A local user can trigger an error condition during a write operation to cause a denial of service.

129) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64059)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in netfs_perform_write() when handling folio private data during buffered writes. A local user can trigger repeated writes that cause multiple private-data attachments and reference leaks to cause a denial of service.

The issue can leak folio references, netfs_folio structures, or netfs_group references under certain write-handling conditions.

130) Race condition (CVE-ID: CVE-2026-64058)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in netfs_read_folio() when handling a folio with ongoing writeback. A local user can trigger concurrent read and writeback activity to cause a denial of service.

131) Race condition (CVE-ID: CVE-2026-64057)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in afs_get_link() and AFS symbolic link handling when processing symbolic link access and validation. A local user can trigger concurrent symbolic link operations to cause a denial of service.

The issue involves races between multiple get_link() calls, missing RCU barriering during RCU pathwalk, and concurrent updates to symlink contents from server-side changes.

132) Race condition (CVE-ID: CVE-2026-64056)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in gmac_rx() in the cortina gemini ethernet driver when processing fragmented packets on systems using both ethernet ports. A local user can trigger concurrent packet reception to cause a denial of service.

The issue arises because a packet assembly sk_buff was shared between the two ports.

133) Improper Initialization (CVE-ID: CVE-2026-64055)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the gmac_rx() NAPI poll function when assembling packets from a ring buffer. A local user can trigger processing of fragmented packets across poll cycles to cause a denial of service.

The issue occurs when the ring buffer is completely emptied before a packet has been fully assembled.

134) Double free (CVE-ID: CVE-2026-64054)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in net_shaper_nl_group_doit() when processing a GROUP request with duplicate NET_SHAPER_A_LEAVES entries. A local user can supply the same leaf handle twice to cause a denial of service.

The issue occurs when multiple supplied leaves reference the same parent, causing the same old-parent pointer to be stored twice in the cleanup list.

135) Out-of-bounds read (CVE-ID: CVE-2026-64053)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in bio_integrity_copy_user() and the block layer integrity handling when processing bio integrity metadata during read or write operations. A local user can trigger the vulnerable code path to cause an out-of-bounds read.

The issue occurs because bip_vcnt can exceed bip_max_vcnt, causing gap-merge checks to read past the bip_vec[] flexible array; on read operations the access remains in bounds but reaches a saved user bvec instead of the bounce segment.

136) NULL pointer dereference (CVE-ID: CVE-2026-64052)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in bio_integrity_map_user() when mapping user-supplied integrity data with partially pinned pages. A local user can trigger partial page pinning to cause a denial of service.

137) Use-after-free (CVE-ID: CVE-2026-64051)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in qaic_gem_object_mmap when mapping a buffer object into memory with scatter-gather segments that extend beyond the virtual memory area. A local user can trigger the mapping of an oversized buffer object to cause a denial of service.

The issue occurs because memory beyond the requested virtual memory area can remain mapped after munmap() unmaps only the virtual memory area region.

138) Use-after-free (CVE-ID: CVE-2026-64050)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the dpu_writeback_init writeback connector initialization in the msm drm driver when interacting with the wb connector after driver teardown while a reference to the drm device is retained. A local user can keep a userspace reference to the drm device and interact with the wb connector to cause a denial of service.

139) NULL pointer dereference (CVE-ID: CVE-2026-64049)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in adreno_get_param() in the drm/msm/adreno driver when querying UBWC-related parameters on platforms without UBWC configuration. A local user can request UBWC-related parameters to cause a denial of service.

The issue affects a2xx through a4xx Adreno generations that do not support UBWC.

140) NULL pointer dereference (CVE-ID: CVE-2026-64048)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in smc_v2_determine_accepted_chid and smc_conn_create when processing a crafted SMC-Dv2 accept reply with CHID 0. A remote attacker can send a specially crafted reply to trigger a kernel fault and cause a denial of service.

Exploitation requires a malicious peer to reply to an SMC-Dv2-only proposal.

141) Off-by-one (CVE-ID: CVE-2026-64047)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in tls_push_record() in the net/tls subsystem when chaining a wrapped sk_msg scatterlist ring. A local user can trigger the wrapped ring condition to cause a denial of service.

The issue occurs when the sk_msg scatterlist ring wraps with sg.end less than sg.start.

142) Improper input validation (CVE-ID: CVE-2026-64046)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the net/tls plaintext scatter-gather list handling when processing TLS 1.3 records with a plain text scatter-gather list that wraps and has end = 0. A local user can trigger a chain-after-chain scatterlist layout to cause a denial of service.

The issue affects the case where the wrapping slot is reused for chaining to the content type entry, creating illegal input for the crypto subsystem.

143) Use-after-free (CVE-ID: CVE-2026-64045)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ovpn_tcp_close() in the OpenVPN TCP transport handling code when closing a TCP socket concurrently with peer removal. A local user can trigger peer removal while closing the TCP file descriptor to cause a denial of service.

The issue occurs because a peer pointer obtained during an RCU read-side critical section is used after that section has ended.

144) Use-after-free (CVE-ID: CVE-2026-64044)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ovpn_nl_peer_new_doit() and the ovpn peer reference handling when processing peer creation error paths for TCP peers. A local user can trigger concurrent socket activity during peer creation failure handling to cause a denial of service.

The issue affects the TCP path, where the peer may remain reachable through sk_user_data before detachment, and exploitation depends on concurrent in-flight userspace or strparser-driven access to the peer.

145) Race condition (CVE-ID: CVE-2026-64043)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ovpn interface peer management code when adding a new peer via netlink during interface deletion. A local user can send a specially crafted netlink message to cause a denial of service.

The issue can cause the netdevice to hang and prevent its unregistration during teardown.

146) Improper access control (CVE-ID: CVE-2026-64042)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to access unreserved PCI BAR resources.

The vulnerability exists due to improper access control in the vfio PCI DMABUF export path when creating a DMABUF for a BAR region. A local user can request export of a BAR region whose PCI resources were not reserved to access unreserved PCI BAR resources.

147) Stack-based buffer overflow (CVE-ID: CVE-2026-64041)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in fs210x_effect_scene_info() when copying a string into uinfo->value.enumerated.name. A local attacker can provide a crafted source string to cause a denial of service.

148) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64040)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error codes in cachefiles_get_directory() in fs/cachefiles/namei.c when handling directory creation failures from vfs_mkdir(). A local user can trigger a directory creation failure to cause a denial of service.

149) Out-of-bounds read (CVE-ID: CVE-2026-64039)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in msm_disp_state_print_regs and related snapshot dumping logic when processing unaligned DSI register regions. A local user can trigger snapshotting of a specially positioned unaligned region to cause a denial of service.

The issue occurs because some DSI data regions are shifted by 4 bytes, causing the last registers in the region to be handled incorrectly.

150) Use-after-free (CVE-ID: CVE-2026-64038)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the lm90 hwmon driver when processing delayed alert and alarm work during device unbind or probe failure. A local user can trigger the affected driver teardown race to cause a denial of service.

The issue occurs in a window where the hwmon device has been unregistered and freed before the delayed works are cancelled.

151) Use-after-free (CVE-ID: CVE-2026-64037)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service and trigger a use-after-free.

The vulnerability exists due to a use-after-free in iwl_mld_tx_tso_segment() in the iwlwifi MLD driver when processing TSO segmentation with AMSDU disabled for a TID. A local user can trigger TSO segmentation that produces zero subframes to cause a denial of service and trigger a use-after-free.

The issue occurs when the AMSDU length field is set to the sentinel value 1, which causes gso_size to become 0 and leads to excessive packet segmentation and TX completion activity.

152) Out-of-bounds read (CVE-ID: CVE-2026-64036)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in the css_rstat_updated() BPF kfunc when processing a caller-provided cpu argument. A local privileged user can pass an invalid cpu value to trigger an out-of-bounds access and cause a denial of service.

Exploitation requires a BPF iter/cgroup program with CAP_BPF and CAP_PERFMON.

153) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64035)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in igc_fpe_init_smd_frame() when initializing SMD transmit frames. A local user can trigger transmission of an SMD skb to cause a denial of service.

The issue arises because a reused igc_tx_buffer entry may retain a stale XDP or XSK type, causing TX completion to use the wrong cleanup path.

154) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-64034)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to bypass bounds validation.

The vulnerability exists due to a time-of-check time-of-use double-fetch in mana_hwc_rx_event_handler() and mana_hwc_handle_resp() when reading hwc_msg_id from a DMA-coherent buffer. A remote attacker can modify the DMA-visible hwc_msg_id value between reads to bypass bounds validation.

Exploitation requires hardware or a host environment able to alter shared, unencrypted DMA-coherent memory between the check and the subsequent use, such as in confidential VM environments.

155) Use-after-free (CVE-ID: CVE-2026-64033)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in rtrs_srv_create_path_files() cleanup logic when handling an error path during sysfs path file creation. A local user can trigger a failure in a later cleanup step to cause a denial of service.

The issue occurs before the function returns success, in a failure path where sysfs root folders may already exist and the kobject may already have been initialized.

156) Use-after-free (CVE-ID: CVE-2026-64032)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the bridge multicast handling in net/bridge/br_multicast.c when removing a bridge port after toggling multicast snooping states. A local user can trigger bridge port state transitions that leave a multicast context enabled on a freed bridge port to cause a denial of service.

The issue occurs when per-VLAN multicast snooping is enabled and global multicast snooping is toggled in a way that leaves both per-port and per-{port, VLAN} multicast contexts enabled on the same port.

157) Race condition (CVE-ID: CVE-2026-64031)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the erofs managed cache handling in z_erofs_fill_bio_vec() and z_erofs_bind_cache() when processing unaligned compressed extents from a crafted image. A local user can provide a crafted image to trigger duplicate managed folio additions and cause a denial of service.

This only impacts unaligned data compression, such as with the -E48bit feature and zstd compression.

158) Out-of-bounds read (CVE-ID: CVE-2026-64030)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ieee80211_ml_epcs when processing an EPCS Enable Response action frame with a crafted PER_STA_PROFILE subelement containing link_id 15. A remote attacker can send a specially crafted action frame to cause a denial of service.

The unsolicited-notification path is reachable when EPCS is already enabled, and no prior client request is required when dialog_token is 0.

159) Use-after-free (CVE-ID: CVE-2026-64029)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in seq_ump_process_event() and snd_rawmidi_kernel_write1() when processing sequencer events during concurrent output teardown. A local user can trigger concurrent event delivery and output close operations to cause a denial of service.

The issue arises from a race condition between the event_input path and the last output unuse path, where the rawmidi substream runtime may be freed while still in use.

160) Use-after-free (CVE-ID: CVE-2026-64027)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the net_shaper subsystem when handling concurrent shaper lookups and updates. A local user can trigger a race condition to cause a denial of service.

The issue stems from non-atomic validity marking of XArray entries, which can allow a reader to observe a stale valid state for a replaced entry.

161) Memory corruption (CVE-ID: CVE-2026-64026)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause pagecache corruption.

The vulnerability exists due to memory corruption in the Linux kernel RxRPC recvmsg handling when decrypting locally transmitted DATA packets processed through splice(). A local user can trigger crafted local packet handling to cause pagecache corruption.

The issue affects in-place decryption of shared packet data, and MSG_PEEK may influence which packet is decrypted and require re-decryption during subsequent recvmsg() processing.

162) Use-after-free (CVE-ID: CVE-2026-64025)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in sk_psock_verdict_data_ready in the Linux kernel BPF sockmap/skmsg handling when processing socket data with a TLS RX context present. A local user can trigger the race condition to cause a denial of service or execute arbitrary code.

Exploitation requires a socket to be inserted into a sockmap before TLS RX is configured.

163) Race condition (CVE-ID: CVE-2026-64024)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to predict TCP initial sequence numbers.

The vulnerability exists due to improper state management in the Linux kernel TCP input path when processing TCP packets that transition from TIME_WAIT handling and are later dropped before request processing. A remote attacker can send packets that trigger these drop paths and then send a subsequent SYN on the same CPU to predict TCP initial sequence numbers.

The issue occurs because a non-zero TIME_WAIT-derived ISN can remain stored after several packet-drop conditions, including policy, filter, checksum, and header validation failures.

164) Use-after-free (CVE-ID: CVE-2026-64023)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the gpio aggregator lookup table handling in drivers/gpio/gpio-aggregator.c when processing concurrent lookup operations during error cleanup. A local user can trigger a race condition that causes gpiod_find() to dereference freed memory to cause a denial of service.

The issue occurs when a concurrent thread reaches gpiod_match_lookup_table() before the lookup table entry is removed.

165) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64022)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the gpio aggregator configfs deactivation path when deactivating the aggregator. A local user can deactivate an aggregator created through configfs to cause a denial of service.

Only aggregators created using configfs are affected.

166) Improper resource shutdown or release (CVE-ID: CVE-2026-64021)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in xe_oa_stream_open_ioctl() when handling an ioctl request with an exec queue whose width is greater than 1. A local user can send a crafted ioctl request to cause a denial of service.

The leaked exec queue reference can keep both the exec queue and the file private state pinned indefinitely.

167) Memory leak (CVE-ID: CVE-2026-64020)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the nvme pci p2p memory mapping handling when processing p2p memory-backed nvme requests. A local user can trigger repeated affected operations to cause a denial of service.

168) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64019)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the nvme-pci data setup path when handling DMA mapping for PRP, SGL, or metadata descriptors. A local user can trigger data setup errors to cause a denial of service.

The issue occurs when allocation of tracking or descriptor structures fails, or when an invalid bio_vec is detected during PRP mapping.

169) Out-of-bounds read (CVE-ID: CVE-2026-64018)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in mana_hwc_rx_event_handler() when processing hardware-modifiable WQE contents from DMA-coherent memory. A local attacker can modify the derived rx_req_idx value to cause a denial of service.

In confidential VMs such as SEV-SNP and TDX, the affected DMA-coherent memory is shared unencrypted and hardware can modify WQE contents at any time.

170) Use-after-free (CVE-ID: CVE-2026-64017)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in blk-mq cached request handling in block/blk-mq.c when submitting a bio while a cached request is peeked and the task sleeps before it is removed from the plug list. A local user can trigger request handling that hits this race condition to cause a denial of service.

The issue occurs when a plug flush frees cached requests before the cached request is popped for use.

171) Race condition (CVE-ID: CVE-2026-64015)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in find_key_to_update in the keyring code when looking up keys for update without holding the RCU read lock. A local user can trigger concurrent key lookup and garbage-collection activity to cause a denial of service.

The issue affects persistent key handling, which uses a different locking model.

172) Out-of-bounds read (CVE-ID: CVE-2026-64014)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the nexio_read_data() function in the usbtouchscreen driver when processing a crafted device interrupt packet with falsified length fields. An attacker with physical access can provide a malicious USB device that reports oversized data_len and x_len values to disclose sensitive information and cause a denial of service.

Kernel memory contents may be exposed to userspace through reported ABS_X and ABS_Y input events.

173) Improper resource shutdown or release (CVE-ID: CVE-2026-64013)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the ACPI button driver removal handler when handling ACPI notify events after driver removal. A local user can trigger ACPI notify on the affected device after removing the driver to cause a denial of service.

A subsequent probe of the same device with the same driver may also fail.

174) NULL pointer dereference (CVE-ID: CVE-2026-64012)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the sch_sfb packet scheduler when dequeuing packets from child qdiscs after a peek operation. A local user can trigger network traffic processing through a crafted qdisc hierarchy to cause a denial of service.

Exploitation requires the sfb scheduler to have child qdiscs whose peek callback uses qdisc_peek_dequeued().

175) Use-after-free (CVE-ID: CVE-2026-64011)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in llcp_sock_release() when releasing an LLCP socket in connecting state. A local user can trigger socket release in that state to cause a denial of service.

176) Use-after-free (CVE-ID: CVE-2026-64010)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race condition in nfc_llcp_recv_cc() when processing an NFC LLCP connection acceptance packet concurrently with socket release. A local user can trigger concurrent connection handling and socket release to cause a denial of service.

The issue occurs during a connection state transition when a socket can be moved from the connecting_sockets list to the sockets list after it has already been unlinked and marked for destruction.

177) Integer underflow (CVE-ID: CVE-2026-64009)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow leading to an out-of-bounds write in the esp component, specifically xfrm_state_mtu(), when processing a UDP datagram through an IPv4 ESP tunnel SA with attacker-controlled parameters. A local user can install a crafted IPv4 ESP tunnel SA and send a UDP datagram through the tunnel to cause a denial of service.

The issue involves a negative length being sign-extended to size_t before being passed to memset() in esp_output_fill_trailer().

178) Use-after-free (CVE-ID: CVE-2026-64008)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in rocket_ioctl_create_bo() and subsequent GEM handle lookups when processing ioctl requests with a dangling GEM handle. A local user can trigger create_bo failure conditions and then reuse the stale handle in later ioctls to cause a denial of service.

Exploitation requires access to the affected device interface and use of a freed handle through PREP_BO, FINI_BO, or SUBMIT operations.

179) Use-after-free (CVE-ID: CVE-2026-64007)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to cause memory corruption or a denial of service.

The vulnerability exists due to a use-after-free in synproxy_tstamp_adjust() in the netfilter synproxy implementation when processing crafted TCP packets that trigger header rewriting on a cloned or non-linear skb. A remote attacker can send a specially crafted packet to cause memory corruption or a denial of service.

The issue affects checksum updates after the packet buffer is made writable, which can result in a write to freed slab memory or a transmitted packet with a stale checksum.

180) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64006)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of overlapping registers in nf_tables bitwise and byteorder operations when processing crafted nf_tables register operations. A local user can create overlapping source and destination register operations to cause incorrect packet filtering behavior and a denial of service.

Exploitation requires the ability to configure nf_tables rules.

181) Improper Initialization (CVE-ID: CVE-2026-64005)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the SMC hash tables in net/smc/af_smc.c when initializing the SMC subsystem. A local user can trigger use of corrupted hash list state to cause a denial of service.

The issue can occur when the hash tables are re-initialized after hash entries already exist and are in use, potentially resulting in a corrupted list.

182) Race condition (CVE-ID: CVE-2026-64004)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the AF_IUCV getsockopt handler when racing recvmsg() with getsockopt(SO_MSGSIZE). A local user can trigger concurrent socket operations to cause a denial of service.

The issue can lead to a NULL pointer dereference in the kernel.

183) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64003)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state handling in scsi_run_host_queues() when processing requeued commands during SCSI host recovery and device removal. A local user can trigger SCSI error recovery and device removal conditions to cause a denial of service.

The issue can leave requeued requests stuck and cause the affected device removal process to hang.

184) Use-after-free (CVE-ID: CVE-2026-64002)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ipv4_sysctl_exit_net() when unregistering the IPv4 sysctl table while sysctl handlers may still access sysctl_local_reserved_ports. A local user can trigger access to the freed sysctl entry to cause a denial of service.

The issue affects access to /proc/sys/net/ipv4/ip_local_reserved_ports during network namespace sysctl teardown.

185) Use-after-free (CVE-ID: CVE-2026-64001)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in snd_pcm_oss_proc_write() and snd_pcm_oss_look_for_setup() when handling proc writes followed by a later OSS device open. A local user can trigger a proc write error that leaves a stale setup_list entry and then open an OSS device to dereference freed memory to cause a denial of service.

The issue arises because a newly allocated setup entry may be linked into setup_list before task name allocation completes.

186) Out-of-bounds read (CVE-ID: CVE-2026-64000)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in supervision frame handling in net/hsr/hsr_forward.c when processing truncated supervision frames. A remote attacker can send a specially crafted frame to cause a denial of service.

187) Memory leak (CVE-ID: CVE-2026-63999)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in rss_prepare_get() in net/ethtool/rss.c when handling a get_rxfh operation failure. A local user can trigger an error path to cause a denial of service.

188) Improper resource shutdown or release (CVE-ID: CVE-2026-63998)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the ethtool module flash operation handler when handling a module firmware flash request that fails validation. A local user can trigger a validation failure to cause a denial of service.

189) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-63997)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in module_flash_fw_schedule() in net/ethtool/module.c when handling module firmware flash errors. A local user can trigger an error during a firmware flash operation to cause a denial of service.

190) Out-of-bounds write (CVE-ID: CVE-2026-63996)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to out-of-bounds write in cmis_cdb_process_reply() when processing a crafted CDB reply from an SFP module. An attacker with physical access can provide a malicious SFP module that returns an overlong reply to cause a denial of service.

The issue can be triggered by a malicious module, and the advisory notes that buggy hardware or corrupted reads may also reach the vulnerable condition.

191) Out-of-bounds write (CVE-ID: CVE-2026-63995)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in cmis_fw_update_start_download() when processing a CMIS module firmware management features reply. An attacker with physical access can provide a malicious module response with an oversized start command payload value to cause memory corruption.

A malicious module or a corrupted response can trigger the issue during CMIS firmware update handling.

192) Use-after-free (CVE-ID: CVE-2026-63994)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() when processing tunnel PMTU ICMP and ICMPv6 packet generation. A local user can trigger skb_cow() reallocation while stale network header pointers are still used to cause a denial of service.

193) Use-after-free (CVE-ID: CVE-2026-63993)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the vxlan_xmit_one function in drivers/net/vxlan/vxlan_core.c when processing packets after skb_tunnel_check_pmtu() updates the skb head. A local user can trigger the vulnerable code path to execute arbitrary code.

194) Out-of-bounds read (CVE-ID: CVE-2026-63992)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in iptunnel_pmtud_check_icmp() when processing ICMP packets without a valid transport header. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because the function may be called while the skb transport header is not set.

195) NULL pointer dereference (CVE-ID: CVE-2026-63991)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in send_mcast_pkt() in the Bluetooth 6LoWPAN subsystem when processing multicast packets. A local user can trigger a memory allocation failure that leads to dereferencing a NULL skb pointer in send_pkt() to cause a denial of service.

196) NULL pointer dereference (CVE-ID: CVE-2026-63990)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null-pointer dereference in the bonding driver when enslaving a CAN device to a bonding master. A local user can enslave a virtual CAN device to a bonding master to cause a denial of service.

The issue can be triggered with a virtual CAN device such as vxcan, and subsequent socket cleanup operations may access invalid CAN receiver state.

197) Improper locking (CVE-ID: CVE-2026-63989)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock management in the bridge netlink configuration path when processing bridge port netlink attributes. A local user can send a specially crafted netlink message to cause a kernel BUG due to sleeping in atomic context.

The issue is triggered when changing certain bridge port flags that lead to a call to dev_set_promiscuity().

198) Improper locking (CVE-ID: CVE-2026-63988)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock management in brport_store() in the bridge sysfs interface when handling sysfs attribute writes that change bridge port flags and invoke dev_set_promiscuity(). A local user can write crafted values to affected bridge port sysfs attributes to cause a kernel BUG from sleeping in atomic context.

The issue affects non-STP bridge port attributes, while the STP-related path_cost and priority attributes are handled separately.

199) Out-of-bounds write (CVE-ID: CVE-2026-63987)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in ethnl_update_profile() in the ethtool coalesce handling code when processing a user-controlled Netlink nested attribute list for ETHTOOL_A_PROFILE_IRQ_MODERATION. A local user can send a specially crafted Netlink request with excessive nested profile entries to cause a denial of service.

The number of nested entries is entirely user-controlled, while the destination buffer is allocated for only NET_DIM_PARAMS_NUM_PROFILES entries.

200) NULL pointer dereference (CVE-ID: CVE-2026-63986)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an error pointer in net/ethtool/tsinfo.c when processing ethtool tsinfo dump requests. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because a failed prepare operation can leave no generic netlink message to cancel, leading to a kernel crash when an error pointer is passed to genlmsg_cancel().

201) Improper input validation (CVE-ID: CVE-2026-63985)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in fallback_set_params() in the ethtool EEPROM Netlink fallback path when processing module EEPROM read parameters. A local user can supply an offset and length combination that exceeds the EEPROM bounds to cause a denial of service.

The issue affects the Netlink fallback path for reading module EEPROM and may lead to unexpected behavior in drivers or device firmware.

202) Integer overflow (CVE-ID: CVE-2026-63984)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to corrupt memory in a forwarded packet.

The vulnerability exists due to an integer overflow in ipv6_rpl_srh_decompress() and ipv6_rpl_srh_rcv() when processing a crafted IPv6 RPL source routing header. A remote attacker can send a specially crafted packet to corrupt memory in a forwarded packet.

The issue occurs because the computed hdrlen value can truncate to zero for a large segment count, causing the compressed header to overlap the decompressed routing data.

203) Uncontrolled Recursion (CVE-ID: CVE-2026-63983)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in netem packet duplication handling in the netem qdisc when processing duplicated packets through a qdisc tree containing another netem instance. A local user can trigger packet duplication to cause a denial of service.

Exploitation can exhaust stack or memory when packet duplication is enabled and duplicated packets are re-enqueued through another netem in the tree.

204) Infinite loop (CVE-ID: CVE-2026-63982)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper loop detection in act_mirred in the traffic control subsystem when processing mirred redirect actions to ingress. A local user can configure redirect rules that create a mirred loop to cause a denial of service.

The issue occurs because loop state can be lost when packets are deferred into the backlog during ingress redirection.

205) Stack-based buffer overflow (CVE-ID: CVE-2026-63981)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack overflow in tcf_mirred_act() when processing mirred blockcast actions on shared TC egress blocks. A local user can create dummy devices, attach clsact qdiscs with shared blocks, and install mirred blockcast filters to cause a denial of service.

Exploitation is reachable via user and network namespaces created with unshare(CLONE_NEWUSER | CLONE_NEWNET), which grants CAP_NET_ADMIN in the new network namespace.

206) Improper locking (CVE-ID: CVE-2026-63980)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the net/handshake subsystem when canceling a TLS handshake from softirq context while the same lock is held in process context on the same CPU. A local user can trigger a TLS handshake cancellation race to cause a denial of service.

The issue results in a deadlock.

207) Use-after-free (CVE-ID: CVE-2026-63979)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the net/handshake accept-side request handling code when processing queued handshake requests during concurrent cancellation. A local user can trigger a race condition to cause a denial of service.

The issue occurs because the accept side dereferences req->hr_sk->sk_socket->file after the request is removed from the pending list, while a concurrent cancellation path can release sock->file, clear sk_socket, or free the associated struct socket.

208) Race condition (CVE-ID: CVE-2026-63978)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in net/handshake request draining during net namespace exit when canceling pending handshake requests concurrently with namespace teardown. A local user can trigger concurrent handshake request cancellation and net namespace destruction to cause a denial of service.

The issue affects pending handshake requests that have not yet been accepted and can result in list corruption or a request being freed while still linked on the drain loop's local list.

209) Race condition (CVE-ID: CVE-2026-63977)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the zl3073x DPLL device change notification handling in drivers/dpll/zl3073x/dpll.c when unregistering a DPLL device during notification processing. A local user can trigger device change notifications during device teardown to cause a denial of service.

The issue could result in dereferencing a freed or NULL dpll_dev pointer.

210) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-63976)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in the Bluetooth L2CAP ECRED reconfiguration response handler when processing a replayed failure response after a successful reconfiguration. A remote attacker can replay a failure response with a stale ident value to cause a denial of service.

The issue can destroy an already-established channel by causing the kernel to match a subsequent response against a recycled ident value.

211) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-63975)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of channel deletion during list iteration in l2cap_ecred_conn_rsp in the Bluetooth L2CAP subsystem when processing a crafted L2CAP credit-based connection response with an already-assigned destination CID. A remote attacker can send a specially crafted Bluetooth packet to cause a denial of service.

The issue occurs when a duplicate destination CID is received for an L2CAP extended credit based connection response.

212) Race condition (CVE-ID: CVE-2026-63974)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in hci_dev_close_sync() in the Bluetooth HCI subsystem when closing a device during the reset path. A local user can trigger Bluetooth device reset and close operations to cause a denial of service.

213) NULL pointer dereference (CVE-ID: CVE-2026-63973)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mana network driver teardown path when cleaning up after a partial queue allocation failure. A local user can trigger queue allocation failure and subsequent teardown handling to cause a denial of service.

The issue can be reached through multiple teardown paths, including device removal, MTU change recovery, and internal error handling.

214) NULL pointer dereference (CVE-ID: CVE-2026-63972)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mana_detach() when handling queue reset recovery after a previous detach succeeded but attach failed. A local user can trigger queue reset handling to cause a denial of service.

The issue occurs when the port is already in a detached state and transmit and receive queue resources have already been freed.

215) Race condition (CVE-ID: CVE-2026-63971)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in sctp_wait_for_connect() in the SCTP socket implementation when waiting for an association to reach established state while another thread peels off the association to a new socket. A local user can trigger association migration during this window to cause a denial of service.

Exploitation requires concurrent access from another thread while the socket lock is dropped and re-acquired.

216) Improper resource shutdown or release (CVE-ID: CVE-2026-63970)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in virtio_transport_alloc_skb() in the vsock/virtio transport when processing fixed-buffer vectored zerocopy input that hits MAX_SKB_FRAGS. A local user can trigger a partial attachment of managed fragments to cause a denial of service.

Exploitation occurs on the rollback path after io_sg_from_iter() returns -EMSGSIZE, causing an skb with managed fragment references but no bound uarg to be freed through the ordinary fragment unref path.

217) Infinite loop (CVE-ID: CVE-2026-63969)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a stale linked-list state in rt6_fill_node() when walking IPv6 route sibling entries during softirq-side processing. A local user can trigger route state changes to cause a CPU stall.

The issue can result in an infinite loop in the walker.

218) Infinite loop (CVE-ID: CVE-2026-63968)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in fib6_select_path() when walking IPv6 route sibling entries during softirq-side processing. A local attacker can trigger route processing to cause a denial of service.

The issue occurs because a detached sibling entry may still point into an old ring, preventing the walker from reaching its termination condition.

219) Use of Uninitialized Variable (CVE-ID: CVE-2026-63967)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory in the tagged FIFO buffer handling in st_lsm6dsx_buffer.c when copying FIFO sample data to userspace. A local user can read exposed uninitialized stack data to disclose sensitive information.

The issue affects the tagged FIFO path because a hole in the aligned stack structure is copied together with sample data and timestamp fields.

220) Use of Uninitialized Variable (CVE-ID: CVE-2026-63966)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose uninitialized kernel stack memory to userspace.

The vulnerability exists due to an uninitialized stack variable in adis16550_trigger_handler() when handling triggered buffer data collection. A local user can trigger the handler and read leaked stack bytes from the resulting userspace buffer to disclose uninitialized kernel stack memory to userspace.

Bytes 28 through 31 of the scan data buffer remain uninitialized and are exposed on each trigger due to timestamp alignment.

221) Use of Uninitialized Variable (CVE-ID: CVE-2026-63965)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an uninitialized stack-based buffer in bmp580_trigger_handler() when processing sensor scan data for userspace. A local user can read exposed scan data to disclose sensitive information.

Two bytes of stack memory may be exposed to userspace per scan because 24-bit sensor data is copied into 32-bit fields, leaving the high byte of temperature and pressure values uninitialized.

222) Improper input validation (CVE-ID: CVE-2026-63964)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper input validation in the do_flash() function in the ucsi_ccg driver when parsing a crafted firmware image without a ':' record header. A local privileged user can place a crafted firmware file under /lib/firmware and write to the do_flash sysfs attribute to cause a denial of service.

The issue can be triggered by an unsigned firmware blob reaching the flashing logic.

223) Out-of-bounds read (CVE-ID: CVE-2026-63963)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Discover Identity ACK handlers in the tcpm subsystem when processing a device-supplied VDO count. A remote attacker can provide a crafted count value to disclose sensitive information.

224) Out-of-bounds write (CVE-ID: CVE-2026-63962)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to overwrite adjacent memory.

The vulnerability exists due to an out-of-bounds write in svdm_consume_modes() when processing an unsolicited Discover Modes ACK containing crafted VDOs from a connected port partner. A remote attacker can send a crafted Discover Modes ACK to overwrite adjacent memory.

Exploitation is possible after the port partner is set because incoming Discover Modes ACK messages are consumed without being correlated to a request sent by the port.

225) Out-of-bounds read (CVE-ID: CVE-2026-63961)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the DisplayPort altmode handler when processing a malformed Status Update VDO from a connected USB Type-C device. An attacker with physical access can send a device response with an incorrect VDO count to disclose sensitive information.

The issue can cause the kernel to read uninitialized stack data and forward it elsewhere.

226) Out-of-bounds write (CVE-ID: CVE-2026-63960)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in wcove_read_rx_buffer() when processing a crafted USB Power Delivery frame from a connected port partner. An attacker with physical access can transmit a crafted 31-byte frame to cause memory corruption.

The issue occurs on the IRQ thread stack, and the final register read may write past the end of struct pd_message.

227) Out-of-bounds read (CVE-ID: CVE-2026-63959)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the tcpci_maxim RX message processing logic when processing a crafted USB Type-C/Power Delivery frame with a mismatched header data object count. An attacker with physical access can send a specially crafted frame to disclose sensitive information.

The issue occurs when a CRC-valid frame advertises more data objects in the header than are actually present in the message body.

228) Out-of-bounds write (CVE-ID: CVE-2026-63958)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in ucsi_connector_change() when handling a crafted UCSI CCI notification with an invalid connector number. A local attacker can provide a bogus connector number to trigger work scheduling on memory past the end of the connector array to cause a denial of service.

Exploitation requires control of a buggy or malicious PPM, such as EC firmware or an attached UCSI controller on supported transports.

229) Out-of-bounds write (CVE-ID: CVE-2026-63957)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the safe_serial USB serial driver when processing a malicious USB device that reports a bulk-out endpoint size smaller than eight bytes in safe mode. An attacker with physical access can connect a crafted USB device to cause memory corruption.

Exploitation requires the target system to interact with a malicious USB device operating in safe mode.

230) Improper input validation (CVE-ID: CVE-2026-63956)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service or corrupt memory.

The vulnerability exists due to improper input validation in the cypress_m8 USB serial driver when processing a malicious USB device with a too-small interrupt-out endpoint max packet size. An attacker with physical access can connect a specially crafted USB device to cause a denial of service or corrupt memory.

The issue can be triggered if a device reports an interrupt-out endpoint max packet size smaller than eight bytes.

231) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-63955)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of interrupt context checks in __get_vm_area_node() when allocating memory through vmalloc() with bottom halves disabled. A local user can trigger a code path that reaches vmalloc() in that context to cause a denial of service.

The issue is triggered by a BUG() condition when bottom halves are disabled, even though execution is not in NMI or hard IRQ context.

232) Improper Initialization (CVE-ID: CVE-2026-63954)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in hpfs_check_free_dnodes in fs/hpfs/alloc.c when handling a failure from hpfs_map_dnode_bitmap. A local user can trigger the error path to cause a denial of service.

233) Memory leak (CVE-ID: CVE-2026-63953)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in migrate_vma_insert_huge_pmd_page() when handling a PMD check failure on the error path. A local user can trigger the vulnerable code path to cause a denial of service.

234) Improper access control (CVE-ID: CVE-2026-63952)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass write sealing protections and modify a memfd that appears to be write sealed.

The vulnerability exists due to improper access control in memfd_add_seals() in mm/memfd.c when adding SEAL_EXEC to a memfd with writable mappings. A local user can add a seal combination that implies SEAL_WRITE after the writable-mapping check to bypass write sealing protections and modify a memfd that appears to be write sealed.

The issue occurs because SEAL_EXEC implies SEAL_WRITE, but the implied seal was applied only after the check for writable mappings.

235) Use-after-free (CVE-ID: CVE-2026-63951)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in zram_writeback_endio when handling bio completion during writeback operations. A local user can trigger a race condition to cause a denial of service.

The issue occurs because the writeback control structure can be freed by the writeback task before wake_up() is invoked in the bio completion handler.

236) Improper Initialization (CVE-ID: CVE-2026-63950)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in try_to_unmap_one() in mm/rmap.c when reclaiming a lazyfree anonymous folio with device-exclusive page table entries. A local user can trigger reclaim after arranging the affected memory state to cause a denial of service.

Exploitation requires a sequence involving a MAP_ANONYMOUS | MAP_DROPPABLE mapping, MADV_FREE, and making the last page device-exclusive via HMM_DMIRROR_EXCLUSIVE.

237) Out-of-bounds read (CVE-ID: CVE-2026-63949)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in linedisp_display() in the line-display auxdisplay subsystem when handling a zero-byte write to the message sysfs attribute. A local user can write zero bytes to the message sysfs attribute to cause a denial of service.

On KASAN-enabled kernels, the issue triggers an out-of-bounds report and panic.

238) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-63948)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference leak in l2cap_chan_timeout() in the Bluetooth L2CAP subsystem when handling a channel timeout with a null connection pointer. A local user can trigger this condition to cause a denial of service.

239) Out-of-bounds read (CVE-ID: CVE-2026-63947)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in hidp_input_report() when processing truncated Bluetooth HIDP input packets. A remote user can send a specially crafted truncated packet to disclose sensitive information.

Exploitation requires a paired Bluetooth device.

240) Use-after-free (CVE-ID: CVE-2026-63946)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in iso_recv_frame in the Bluetooth ISO subsystem when processing received Bluetooth ISO frames. A local user can trigger concurrent socket teardown and frame handling to cause a denial of service.

Exploitation requires a race condition between frame reception and iso_sock_kill() freeing the socket.

241) Race condition (CVE-ID: CVE-2026-63945)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to a null pointer dereference or use-after-free in iso_sock_clear_timer in the Bluetooth ISO socket handling code when closing a socket concurrently with connection deletion. A local user can trigger concurrent socket operations to cause a denial of service.

242) Use-after-free (CVE-ID: CVE-2026-63944)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in hci_le_create_cis_sync in the Bluetooth HCI synchronization logic when processing concurrent Bluetooth connection state changes during LE Create CIS handling. A local user can trigger a concurrent disconnect to cause a denial of service.

The stale pointer is dereferenced after both rcu_read_lock() and hci_dev_lock(hdev) are released, and the queued cancellation path does not match the pending work item because it is queued with NULL data but dequeued with the connection pointer.

243) Out-of-bounds read (CVE-ID: CVE-2026-63943)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in xpadone_process_packet() when processing a crafted GIP_CMD_INPUT packet from a device. An attacker with physical access can supply a malformed controller packet with a short length to cause a denial of service.

The issue is triggered by a broken or malicious controller that controls both the reported packet length and packet contents.

244) Race condition (CVE-ID: CVE-2026-63942)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the parport subsystem when port and client drivers are loaded around the same time during boot. A local user can load the lp and parport_pc modules concurrently to cause a crash.

The issue occurs because client drivers can attach to ports that are not completely initialized or are being torn down.

245) Improper access control (CVE-ID: CVE-2026-63941)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass intended vector length restrictions for a nested guest.

The vulnerability exists due to improper access control in the KVM arm64 nested virtualization SVE register handling for ZCR_EL2 when restoring SVE context for an L2 guest after handling guest hypervisor updates through ZCR_EL1. A local user can write an uncapped ZCR_EL2 value via ZCR_EL1 to bypass intended vector length restrictions for a nested guest.

The issue affects VHE guest hypervisor scenarios in nested virtualization on arm64 systems with SVE enabled.

246) Integer underflow (CVE-ID: CVE-2026-63940)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow in KVM SEV Port I/O handling in arch/x86/kvm/svm/sev.c when processing Port I/O requests with a length or count of 0. A local user can trigger a zero-length Port I/O request to cause a denial of service.

The issue affects the handling of VMGEXIT and string I/O requests in the KVM SEV implementation.

247) Heap-based buffer overflow (CVE-ID: CVE-2026-63939)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the KVM SEV GHCB scratch area handling in arch/x86/kvm/svm/sev.c when processing PSC requests with a guest-provided scratch area pointer. A local user can provide a crafted scratch area pointer and length values to cause a denial of service.

The issue occurs when the scratch area is located in the GHCB shared buffer, where only the minimum header length was tracked instead of the full effective scratch area size.

248) Out-of-bounds read (CVE-ID: CVE-2026-63938)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the KVM SEV PSC request handling in arch/x86/kvm/svm/sev.c when processing Page State Change requests with indices that exceed the effective scratch buffer size. A local user can provide a crafted PSC buffer pointer and PSC indices to cause a denial of service.

The issue arises if the guest-provided pointer is not exactly at the start of the GHCB shared buffer, which can reduce the effective size of the scratch area.

249) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-63937)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in the KVM SEV Page State Change buffer handling in arch/x86/kvm/svm/sev.c when processing guest-accessible PSC buffer entries and indices. A local user can modify buffer values during processing to cause a denial of service.

The issue involves guest-accessible PSC buffer header fields and entries used for validation and array indexing.

250) Use of Uninitialized Variable (CVE-ID: CVE-2026-63936)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in mt6358_read_imp() in the mt6359 auxadc driver when handling a failed regmap read during impedance measurement. A local user can trigger the affected measurement path to disclose sensitive information.

Stack memory contents may be reported as a measurement result if the bus read fails.

251) Division by zero (CVE-ID: CVE-2026-63935)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in the nxp_sar_adc_write_raw function in the nxp-sar-adc driver when writing the sampling_frequency sysfs attribute. A local user can write a zero or negative value to the attribute to cause a denial of service.

The issue is triggered through the IIO sysfs interface.

252) Use of Uninitialized Variable (CVE-ID: CVE-2026-63934)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access of uninitialized memory in the itg3200 triggered buffer handling path when processing i2c reads for all scan channels. A local user can read data from /dev/iio:deviceX to disclose sensitive information.

The non-buffered read_raw() path is unaffected.

253) Division by zero (CVE-ID: CVE-2026-63933)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in adis16260_write_raw in the adis16260 gyroscope driver when writing a zero value to the sampling_frequency sysfs attribute. A local user can write zero to the sampling_frequency sysfs attribute to cause a denial of service.

254) Stack-based buffer overflow (CVE-ID: CVE-2026-63932)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in mhz19b_receive_buf() when processing oversized serial replies. A local attacker can send an oversized serial reply to cause a denial of service.

Exploitation occurs before the command path validates the reply.

255) Division by zero (CVE-ID: CVE-2026-63931)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in the scd30_write_raw function when writing a zero fractional part to the sampling_frequency sysfs attribute. A local user can write a zero fractional value to the sampling_frequency sysfs attribute to cause a denial of service.

256) Use-after-free (CVE-ID: CVE-2026-63930)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in iio_hw_consumer_alloc() when cleaning up buffers in the error path. A local user can trigger the vulnerable cleanup path to cause a denial of service.

257) Memory leak (CVE-ID: CVE-2026-63929)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in iio_buffer_enqueue_dmabuf() when enqueuing DMA buffers. A local user can repeatedly enqueue DMA buffers to cause a denial of service.

The issue results in unreleased dma fence allocations for each successful buffer enqueue.

258) Out-of-bounds write (CVE-ID: CVE-2026-63928)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the omninet USB serial driver bulk-out buffer handling when processing a malicious USB device that reports a smaller endpoint max packet size than expected. An attacker with physical access can connect a crafted USB device to cause memory corruption.

The issue can lead to user-controlled slab corruption.

259) Use-after-free (CVE-ID: CVE-2026-63927)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the dwc2 USB host controller driver debug code when dequeuing a usb request block and logging its status after calling usb_hcd_giveback_urb(). A local user can trigger URB handling to cause a denial of service.

The issue occurs in debug logging within the _dwc2_hcd_urb_dequeue() path.

260) Incorrect calculation (CVE-ID: CVE-2026-63926)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper offset calculation in bpf_msg_push_data() in the sockmap BPF subsystem when inserting data into the middle of a scatterlist entry. A local user can trigger the inconsistent split layout to cause a denial of service.

Exploitation requires access to BPF sockmap functionality.

261) Integer overflow (CVE-ID: CVE-2026-63925)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to bypass replay protection.

The vulnerability exists due to an integer overflow in macsec_post_decrypt() when processing a crafted replayed frame on an XPN association with a packet number of 0xffffffff. A remote attacker can replay a captured legitimate frame to bypass replay protection.

Exploitation requires capturing a legitimate frame carrying the maximum 32-bit packet number on an XPN association.

262) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2026-63924)

CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper pointer handling in the IPv6 extension header parser in net/ipv6/exthdrs.c when processing IPv6 jumbo hop-by-hop options. A remote attacker can send a specially crafted IPv6 packet to cause a denial of service.

263) Out-of-bounds write (CVE-ID: CVE-2026-63923)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service or overwrite out-of-bounds memory.

The vulnerability exists due to an out-of-bounds write in rvu_mbox_handler_rep_event_notify and the representor event handling path when processing a crafted REP_EVENT_NOTIFY mailbox request with a sender-controlled body pcifunc value. A local user can send a specially crafted mailbox request to cause a denial of service or overwrite out-of-bounds memory.

Exploitation requires a VF attached to a PF that has been put into switchdev representor mode. For RVU_EVENT_MAC_ADDR_CHANGE, the invalid body pcifunc is used as a six-byte ether_addr_copy() target in the queued worker.

264) Use-after-free (CVE-ID: CVE-2026-63922)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free risk from stale pointer reuse in ip6_parse_tlv() in net/ipv6/exthdrs.c when parsing IPv6 TLVs containing the HAO option. A remote attacker can send a specially crafted IPv6 packet to cause a denial of service.

The issue occurs when handling a cloned skb where header expansion moves the skb head and invalidates the cached network header pointer.

265) Improper access control (CVE-ID: CVE-2026-63921)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to redirect packets across network namespaces.

The vulnerability exists due to improper access control in vti6_siocdevprivate() in the IPv6 VTI tunnel handling code when processing SIOCCHGTUNNEL requests on a migrated tunnel. A local user can supply tunnel parameters that collide with a tunnel in the creation namespace to redirect packets across network namespaces.

Exploitation is reachable from an unprivileged user namespace and can have cross-tenant scope on container hosts.

266) Out-of-bounds read (CVE-ID: CVE-2026-63920)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ip6_datagram_recv_specific_ctl() when processing IPv6 extension headers for recvmsg control messages after the hdrlen field is modified. A local user can use an nftables payload-write expression to corrupt the extension header length and trigger copying beyond the available header data to disclose sensitive information.

Exploitation is reachable from an unprivileged user namespace.

267) Use-after-free (CVE-ID: CVE-2026-63919)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in xfrm transport-mode deferred reinjection handling in net/xfrm/xfrm_input.c when processing deferred transport reinjection callbacks that use a stored network namespace pointer. A local user can trigger deferred transport reinjection with a dangling net namespace reference to cause a denial of service.

268) Use-after-free (CVE-ID: CVE-2026-63918)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a use-after-free in l2tp_session_get_by_ifname() in the l2tp core when looking up a session by interface name during an RCU-protected list walk. A local user can trigger a race condition that returns a session pointer after its reference count has reached zero to cause a use-after-free.

On PREEMPT_RT kernels, the preemption window is real between the interface name comparison and reference count increment.

269) Use-after-free (CVE-ID: CVE-2026-63917)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the vti6 tunnel handling code in net/ipv6/ip6_vti.c when changing the configuration of a vti6 device after moving it across network namespaces. A local user can move a vti6 device between namespaces and then change its link parameters to cause a denial of service.

The issue is reachable from an unprivileged user namespace and may have cross-tenant impact on container hosts.

270) Out-of-bounds write (CVE-ID: CVE-2026-63916)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in wacom_hid_set_device_mode() when handling a HID feature report where HID_DG_INPUTMODE is mapped to a field other than the first one. A local user can connect or emulate a crafted device to trigger the out-of-bounds write and cause a denial of service.

The issue occurs when the first field in the feature report has a report_count smaller than the usage index of HID_DG_INPUTMODE.

271) Out-of-bounds read (CVE-ID: CVE-2026-63915)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in HCP header parsing in nfc_hci_recv_from_llc() and nci_hci_data_received_cb() when processing a 0-byte HCP frame from an NFC peer. A remote attacker can send a malformed HCP frame to cause a denial of service.

A non-final fragmented 0-byte frame can also underflow the reassembly length to UINT_MAX and trigger skb_over_panic() during reassembly.

272) Improper access control (CVE-ID: CVE-2026-63914)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in xfrm migrate notification handling in net/xfrm/xfrm_user.c and net/key/af_key.c when broadcasting successful XFRM_MSG_MIGRATE or SADB_X_MIGRATE events across network namespaces. A local user can trigger a migration notification from a non-init network namespace to disclose sensitive information.

An IKE daemon running in the initial network namespace may receive migration notifications originating from other network namespaces, including selector, old and new endpoint addresses, and the km_address.

273) Insufficient verification of data authenticity (CVE-ID: CVE-2026-63913)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state validation in the TCP conntrack state machine in netfilter conntrack when processing a crafted SYN followed by an invalid-sequence RST packet. A remote attacker can send a specially crafted packet sequence to cause a denial of service.

The issue can prematurely terminate an active NAT entry by forcing the conntrack entry into the CLOSE state.

274) Improper input validation (CVE-ID: CVE-2026-63912)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ESP out-of-place fast path in net/ipv4/esp4.c and net/ipv6/esp6.c when processing packet data with a combined aligned data length and trailer length exceeding a page. A local user can trigger this condition to cause a denial of service.

The issue affects both IPv4 and IPv6 ESP processing paths.

275) Double free (CVE-ID: CVE-2026-63911)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in the iptfs state cloning logic in net/xfrm/xfrm_iptfs.c when destroying a cloned security association after a failed state migration. A local user can trigger state migration failure and queued packet handling to cause a denial of service.

The issue can involve shared cloned runtime objects, including queue, timer, lock, and reassembly or reorder state copied from the original security association.

276) Use-after-free (CVE-ID: CVE-2026-63911)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the iptfs state cloning logic in net/xfrm/xfrm_iptfs.c when destroying a cloned security association after a failed state migration. A local user can trigger state migration failure and queued packet handling to cause a denial of service.

The issue can involve shared cloned runtime objects, including queue, timer, lock, and reassembly or reorder state copied from the original security association.

277) Use-after-free (CVE-ID: CVE-2026-63910)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in dma_buf_fd() tracepoint handling in the dma-buf subsystem when racing a file descriptor close against tracepoint execution. A local user can trigger concurrent file descriptor operations to dereference freed memory and cause a denial of service.

Exploitation requires the ability to share the file descriptor table with a racing thread.

278) Out-of-bounds read (CVE-ID: CVE-2026-63909)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in smb_check_perm_dacl() ACE-walk loops in ksmbd when processing SMB2_CREATE operations with a crafted security descriptor. A remote attacker can send a specially crafted request to disclose sensitive information.

The issue is caused by a transposed bounds check that can leave the loop guard ineffective and permit reading ace->size even when only 0 to 3 bytes remain in the ACE data.

279) Out-of-bounds write (CVE-ID: CVE-2026-63908)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to overwrite adjacent memory.

The vulnerability exists due to an out-of-bounds write in mxt_prepare_cfg_mem in the atmel_mxt_ts driver when parsing a crafted configuration file with an object size larger than the expected object size. A local user can provide a specially crafted configuration file to overwrite adjacent memory.

The issue is caused by an incorrect boundary check on a 0-based index, which allows exactly one byte past the valid object boundary to be written.

280) Double free (CVE-ID: CVE-2026-63907)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in the uio_pci_generic_sva driver when handling a failing probe path or driver removal. A local user can trigger device initialization failure or driver removal to cause a denial of service.

The issue affects memory allocated with devm_kzalloc() that is also freed automatically by device resource management.

281) Use-after-free (CVE-ID: CVE-2026-63906)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in omap2430_probe() in the omap2430 USB driver when handling a crafted platform device state. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because a device tree node reference is released before its last access in both the success and error paths.

282) Use-after-free (CVE-ID: CVE-2026-63905)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in vudc_remove() and the vudc transfer timer handling when racing device teardown with a pending or executing timer. A local user can repeatedly trigger unbind and rebind operations while the timer is active to cause a denial of service.

The issue is triggered by a race condition during the unplug or unbind path.

283) Out-of-bounds read (CVE-ID: CVE-2026-63904)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the usbtmc interrupt notification handling in drivers/usb/class/usbtmc.c when processing interrupt-in notifications with an insufficient URB actual_length. A local attacker can provide a crafted USBTMC device that sends a short notification to disclose sensitive information.

The issue can also cause stale leftover data from a previous notification to be consumed.

284) Out-of-bounds read (CVE-ID: CVE-2026-63903)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the belkin_sa_read_int_callback() USB serial interrupt handler when processing short successful interrupt transfers. A local attacker can trigger the driver to parse a crafted short interrupt packet to disclose sensitive information.

The issue occurs because the handler treats interrupt data as a four-byte status report and reads status fields at offsets 2 and 3 even when the completed packet is shorter.

285) Out-of-bounds read (CVE-ID: CVE-2026-63902)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in cypress_read_int_callback() in the cypress_m8 USB serial driver when processing malformed short interrupt packets. A local attacker can provide a specially crafted short interrupt report to cause a denial of service.

Successful interrupt transfers can complete with fewer bytes than required for the selected Cypress packet header format.

286) Improper input validation (CVE-ID: CVE-2026-63901)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to improper input validation in the digi_acceleport USB serial driver when handling a malicious USB device that reports smaller bulk-out buffers than expected. An attacker with physical access can connect a crafted device to cause memory corruption.

The issue can lead to out-of-bounds memory accesses or slab corruption.

287) Out-of-bounds read (CVE-ID: CVE-2026-63900)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the usa49wg indat transfer parser in drivers/usb/serial/keyspan.c when parsing malformed indat packets from a USB device. A local attacker can provide a specially crafted USB device to disclose sensitive information.

The issue can cause parsing of stale or uninitialised slab data.

288) Out-of-bounds write (CVE-ID: CVE-2026-63899)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the mxuport USB serial driver when handling a malicious USB device that reports a bulk-out endpoint max packet size smaller than eight bytes. An attacker with physical access can attach a crafted device to cause memory corruption.

289) Out-of-bounds write (CVE-ID: CVE-2026-63898)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the mct_u232 USB serial driver when handling a malicious USB device that reports a smaller endpoint maximum packet size than expected. An attacker with physical access can connect a specially crafted USB device to cause memory corruption.

290) Out-of-bounds read (CVE-ID: CVE-2026-63897)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the mct_u232 USB serial driver interrupt-in transfer handler when processing short interrupt-in transfers. A local user can trigger the driver to process a specially crafted short interrupt-in packet to disclose sensitive information.

The issue can lead to stale or uninitialized slab data being exposed to user space.

291) Integer overflow (CVE-ID: CVE-2026-63896)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow leading to an out-of-bounds write in the WebUSB GET_URL handler in composite_setup() when processing a crafted USB SETUP packet. A remote attacker can send a specially crafted USB request to cause a denial of service.

Exploitation is possible against gadgets with webusb/use=1 and a landing page configured.

292) Out-of-bounds read (CVE-ID: CVE-2026-63895)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ffs_ep0_read() in the FunctionFS gadget implementation when handling a short ep0 control-OUT read. A local privileged user can trigger a short control-OUT transfer and read back uninitialized kernel heap memory to disclose sensitive information.

The issue is reachable through the FunctionFS device node and requires access to the privileged gadget daemon context. Reproducing the condition also requires bypassing normal host-side checks that usually reject short-wLength control-OUT requests before they reach the gadget.

293) Use-after-free (CVE-ID: CVE-2026-63894)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the FunctionFS DMABUF cancel and release paths when handling a concurrent request completion and detach or close operation. A local privileged user can trigger a DMABUF detach ioctl or close the FunctionFS device during request completion to cause a denial of service.

The issue is reachable from the FunctionFS device node and is not reachable from an attached USB host on the cable. Deployments may delegate the device node to a non-root gadget service.

294) Integer overflow (CVE-ID: CVE-2026-63893)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer overflow leading to an out-of-bounds read in tb_property_entry_valid() in the thunderbolt property parser when processing a crafted XDomain property block from a peer device. A remote attacker can send crafted property entries with wrapped value and length fields to disclose sensitive information.

For TEXT-typed entries using the "deviceid" or "vendorid" keys, leaked data may be exposed through the per-XDomain sysfs device_name or vendor_name attributes. The disclosed data is NUL-bounded and the attacker controls an offset rather than an absolute address.

295) Out-of-bounds read (CVE-ID: CVE-2026-63892)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read and integer underflow in __tb_property_parse_dir() in the thunderbolt property parser when parsing a crafted non-root property directory with dir_len less than 4. A local user can provide crafted property data to trigger out-of-bounds memory access and cause a denial of service.

The issue affects the non-root parsing path, where a short directory length can cause a UUID copy to read past the end of the property block and can also cause entry walking to continue out of bounds until the kernel oopses.

296) Uncontrolled Recursion (CVE-ID: CVE-2026-63891)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in __tb_property_parse_dir() in the thunderbolt property parser when processing a crafted PROPERTIES_REQUEST control-plane exchange containing chained DIRECTORY entries with a back-reference loop. A remote attacker can send crafted XDomain property data to cause a denial of service.

The issue can be triggered by an untrusted XDomain peer such as a cable, dock, in-line inspector, or adjacent host.

297) Improper input validation (CVE-ID: CVE-2026-63890)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in fcoe_ctlr_recv_clr_vlink() in drivers/scsi/fcoe/fcoe_ctlr.c when processing FIP CVL frames. A remote attacker can send a crafted FIP CVL frame with a zero-length non-critical descriptor to cause a denial of service.

Exploitation is limited to an unauthenticated layer 2 peer on the FCoE control VLAN and can block subsequent FIP frames on the affected controller.

298) Integer overflow (CVE-ID: CVE-2026-63889)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop caused by an integer truncation error in the FPIN pname walker in scsi_transport_fc when processing a crafted FPIN ELS frame. A remote attacker can send a crafted Fibre Channel fabric frame to cause a denial of service.

Exploitation requires the ability to inject Fibre Channel fabric traffic to an lpfc or qla2xxx Linux initiator, such as from a compromised switch or fabric controller, or from a same-zone N_Port on a fabric that permits source spoofing.

299) Double free (CVE-ID: CVE-2026-63888)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a double free in iscsit_handle_text_cmd() when handling a Text PDU with a bad DataDigest on connections using ErrorRecoveryLevel greater than 0. A remote user can send a specially crafted text request to cause a denial of service.

On hardened kernels the flaw can trigger a remote kernel BUG(), while on non-hardened kernels it can corrupt the slab freelist. A follow-up Text Request on the same ITT or session teardown can free the same pointer again.

300) Out-of-bounds read (CVE-ID: CVE-2026-63888)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in iscsit_handle_text_cmd() when processing Text PDUs with DataDigest enabled. A remote user can send a specially crafted text request to cause a denial of service.

The issue is triggered when DataDigest is negotiated for the connection.

301) Heap-based buffer overflow (CVE-ID: CVE-2026-63887)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in iscsi_encode_text_output() when processing iSCSI login text parameters. A remote attacker can send a specially crafted login request with many minimal key-value pairs to cause a denial of service.

The issue can be triggered by expansion of unknown keys into larger "NotUnderstood" response records during login negotiation.

302) Heap-based buffer overflow (CVE-ID: CVE-2026-63886)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in chap_server_compute_hash() in the iSCSI target CHAP authentication handling when processing a specially crafted base64-encoded CHAP_R response. A remote user can send a specially crafted CHAP authentication response to cause a denial of service.

The issue affects the BASE64 CHAP_R decoding path; the mutual CHAP CHAP_C decoding path is not affected.

303) Use-after-free (CVE-ID: CVE-2026-63884)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the i915 TTM object purge logic when purging an object during eviction after validating buffer object placement. A local user can trigger the purge path through crafted GPU memory management operations to cause a denial of service.

The issue was reported under heavy use on DG2 systems and occurs because the associated i915 TTM page vector container may be replaced while the object is still busy.

304) Integer underflow (CVE-ID: CVE-2026-63883)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose stale buffer data.

The vulnerability exists due to an integer underflow in qcom_geni_serial_handle_tx_dma() when handling a DMA completion interrupt after uart_flush_buffer() resets the transmit buffer. A local user can trigger a flush before DMA completion is processed to disclose stale buffer data.

The issue is caused by a race condition between transmit buffer flushing and delayed DMA completion handling.

305) NULL pointer dereference (CVE-ID: CVE-2026-63882)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in svm_range_set_attr in the amdkfd SVM subsystem when handling a kfd_ioctl_svm call without a prior kfd_ioctl_acquire_vm call. A local user can invoke the affected ioctl sequence to cause a denial of service.

306) Integer overflow (CVE-ID: CVE-2026-63881)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in get_queue_ids() in the amdkfd kfd debugger when processing a user-supplied queue ID array. A local user can supply crafted queue count values to cause a denial of service.

The issue affects 32-bit size_t builds.

307) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-63880)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a lock leak in AMDGPU_GEM_OP_GET_MAPPING_INFO handling in amdgpu_gem_op_ioctl() when processing a crafted DRM_IOCTL_AMDGPU_GEM_OP request that triggers memory allocation failure. A local user can invoke the affected ioctl to cause a denial of service.

Exploitation is reachable by a process with access to /dev/dri/renderD* and affects the caller's GPU context on the same VM.

308) Race condition (CVE-ID: CVE-2026-63879)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in amdgpu_hmm_range_get_pages in the AMDGPU HMM handling code when reading the notifier sequence across range processing. A local user can trigger memory invalidation during page range handling to cause a denial of service.

The issue can result in operations being performed on invalid pages.

309) Improper input validation (CVE-ID: CVE-2026-63878)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in GEM_OP GET_MAPPING_INFO handling in amdgpu_gem.c when processing a user-supplied num_entries value. A local user can supply an oversized num_entries value to cause a denial of service.

On systems configured with CONFIG_PANIC_ON_WARN=y, the issue can lead to a kernel panic.

310) NULL pointer dereference (CVE-ID: CVE-2026-63877)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the dz serial driver when initializing the first serial port. A local attacker can trigger serial port initialization to cause a denial of service.

The crash occurs because a pointer derived from a null parent-device pointer is dereferenced during early system bootstrap.

311) NULL pointer dereference (CVE-ID: CVE-2026-63876)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the zs serial driver during serial port initialization when initializing the first serial port. A local user can trigger driver initialization to cause a denial of service.

The issue can crash the kernel during system bootstrap on affected DECstation systems.

312) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-63875)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cache invalidation in arm64 TLB flushing logic when unsharing PMD tables. A local user can trigger PMD table unsharing to cause a denial of service.

The issue can leave a stale PMD page table entry in the walk cache, which may result in incorrect page table walks.

313) Use-after-free (CVE-ID: CVE-2026-63866)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mt7996_mac_sta_deinit_link() when removing a station link. A local user can trigger the cleanup of a stale wcid pointer to cause a denial of service.

314) Race condition (CVE-ID: CVE-2026-63865)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in sleepable bpf lsm hooks in kernel/bpf/bpf_lsm.c when executing the task_to_inode hook from rcu read-side critical sections. A local user can trigger the vulnerable hook to cause a denial of service.

The issue involves sleepable lsm programs being used with a hook that is invoked under rcu_read_lock().

315) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-63864)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in the BPF verifier when processing BPF programs containing tail calls. A local user can load a crafted BPF program to cause a denial of service.

316) Improper locking (CVE-ID: CVE-2026-63863)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in drm_gpusvm_scan_mm() when scanning GPU shared virtual memory ranges. A local user can trigger the affected code path to cause a denial of service.

317) Improper resource shutdown or release (CVE-ID: CVE-2026-63862)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in mtk_pcie_setup_irq() when fetching the controller IRQ after allocating IRQ domains. A local user can trigger initialization failure conditions to cause a denial of service.

318) Improper resource shutdown or release (CVE-ID: CVE-2026-63861)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mtk_snand_probe() logic of the mtk-snfi driver when handling device probe failures or device removal. A local user can trigger device initialization and cleanup paths to cause a denial of service.

319) Improper input validation (CVE-ID: CVE-2026-63860)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the RDMA/core netlink attribute handling in drivers/infiniband/core/iwpm_msg.c when processing netlink messages containing string attributes evaluated as c-strings without an enforced nul terminator. A local user can send a specially crafted netlink message to cause a denial of service.

320) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-63859)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource state management in airoha_qdma_cleanup_tx_queue() when cleaning up transmit queues. A local user can trigger transmit queue cleanup in a way that leaves DMA TX descriptors and queue indexes in an inconsistent state to cause a denial of service.

The issue affects the Airoha Ethernet driver in the Linux kernel.

321) Race condition (CVE-ID: CVE-2026-63858)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nf_tables hook handling when deleting device hooks for chains or flowtables while netlink dump path readers access the RCU-protected hook list. A local user can trigger hook deletion and concurrent netlink dump operations to cause a denial of service.

The issue affects the netfilter nf_tables subsystem and involves device hook deletion transactions.

322) Out-of-bounds read (CVE-ID: CVE-2026-63857)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in airoha_dev_xmit() when processing fragmented socket buffers. A local user can trigger transmission of a crafted fragmented packet to cause a denial of service.

The unsafe read occurs during the final loop iteration when the loop index reaches the fragment count, which may trigger a page fault.

323) Improper input validation (CVE-ID: CVE-2026-63856)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in VCN v2.0 encoder and decoder rings when processing command submission requests with user fences. A local user can submit a crafted command stream with a user fence to cause a denial of service.

The issue affects VCN v2.0 encoder and decoder rings because they do not support 64-bit user fence writes.

324) Improper input validation (CVE-ID: CVE-2026-63855)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the VCN v2.5 encoder and decoder rings when processing command submission requests with user fences. A local user can submit a crafted command submission with a user fence to cause a denial of service.

325) Improper input validation (CVE-ID: CVE-2026-63854)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the amdgpu vcn v3.0 encoder and decoder rings when processing command submission requests with user fences. A local user can submit a crafted command stream with a user fence to cause a denial of service.

The issue affects VCN v3.0 encoder and decoder rings that do not support 64-bit user fence writes.

326) Improper input validation (CVE-ID: CVE-2026-63853)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the VCN v4.0 encoder ring submission handling when processing command submissions with user fences. A local user can submit a crafted command stream with a user fence to cause a denial of service.

The issue affects VCN v4.0 encoder functionality, and stems from unsupported 64-bit user fence writes being accepted.

327) Improper input validation (CVE-ID: CVE-2026-63852)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the amdgpu VCN v4.0.3 encoder ring handling when processing command submissions with user fences. A local user can submit a crafted command stream with a user fence to cause a denial of service.

The issue affects VCN v4.0.3 encoder ring behavior because 64-bit user fence writes are not supported.

328) Improper input validation (CVE-ID: CVE-2026-63851)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the amdgpu vcn v4.0.5 encoder ring when processing command submission requests with user fences. A local user can submit a crafted command stream with a user fence to cause a denial of service.

The issue affects VCN v4.0.5 encoder functionality because 64-bit user fence writes are not supported.

329) Improper input validation (CVE-ID: CVE-2026-63850)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the amdgpu VCN v5.0.0 encoder ring when processing command submissions with user fences. A local user can submit a command stream with a user fence to cause a denial of service.

The issue affects the VCN v5.0.0 encoder ring because it does not support 64-bit user fence writes.

330) Improper input validation (CVE-ID: CVE-2026-63849)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the amdgpu VCN v5.0.1 encoder ring when processing command submissions with user fences. A local user can submit a command stream with a user fence to cause a denial of service.

The issue affects VCN v5.0.1 encoder and decoder rings that do not support 64-bit user fence writes.

331) Improper access control (CVE-ID: CVE-2026-63848)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the amdgpu JPEG v2.0 ring when processing command submission requests with user fences. A local user can submit a command stream with a user fence to cause a denial of service.

332) Improper access control (CVE-ID: CVE-2026-63847)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the amdgpu JPEG v2.5 ring command submission handling when processing command submissions with user fences. A local user can submit a command stream with a user fence to cause a denial of service.

333) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-63846)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of unsupported user fence writes in jpeg v3.0 ring handling when processing command submissions with user fences. A local user can submit a command stream with a user fence to cause a denial of service.

The issue affects JPEG v3.0 rings, which do not support 64-bit user fence writes.

334) Improper access control (CVE-ID: CVE-2026-63845)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the amdgpu JPEG v4.0 ring command submission handling when processing command submissions with user fences. A local user can submit a command stream with a user fence to cause a denial of service.

335) Improper access control (CVE-ID: CVE-2026-63844)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the amdgpu JPEG v4.0.3 ring when processing command submissions with user fences. A local user can submit a crafted command submission with a user fence to cause a denial of service.

336) Improper input validation (CVE-ID: CVE-2026-63843)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the JPEG v4.0.5 ring in the amdgpu driver when processing command submission requests with user fences. A local user can submit a crafted command submission with a user fence to cause a denial of service.

The issue affects JPEG v4.0.5 rings that do not support 64-bit user fence writes.

337) Improper access control (CVE-ID: CVE-2026-63842)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the amdgpu JPEG v5.0.0 ring when processing command submissions with user fences. A local user can submit a crafted command submission with a user fence to cause a denial of service.

338) Improper access control (CVE-ID: CVE-2026-63841)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the amdgpu JPEG v5.0.1 ring when processing command submission requests with user fences. A local user can submit a command stream with a user fence to cause a denial of service.

339) Improper input validation (CVE-ID: CVE-2026-63840)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the amdgpu JPEG v5.3.0 ring when processing command submission requests with user fences. A local user can submit a crafted command stream with a user fence to cause a denial of service.

340) Memory leak (CVE-ID: CVE-2026-63839)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in lwmi_dev_evaluate_int() in lenovo-wmi-helpers when handling a NULL retval pointer after evaluating WMI data. A local user can trigger the vulnerable code path to cause a denial of service.

341) Out-of-bounds read (CVE-ID: CVE-2026-63838)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the component_dais[] array handling in the rsnd probe logic when processing component_dais[] entries. A local user can trigger the vulnerable code path to cause a denial of service.

342) Use of Uninitialized Variable (CVE-ID: CVE-2026-63837)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in ena_phc_gettimex64() when handling a PTP ioctl after ena_com_phc_get_timestamp() returns an error. A local user can invoke the affected ioctl to disclose sensitive information.

The issue can occur when PHC is disabled or in a blocked state, and invalid hardware values may also be exposed to userspace.

343) Race condition (CVE-ID: CVE-2026-53380)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to concurrent modification of a shared buffer list in rzv2h_ivc_transfer_buffer() when processing buffers from a separate workqueue. A local user can trigger concurrent buffer list operations to cause a denial of service.

The issue affects access to rzv2h_ivc::buffers.queue because list_del() is performed outside the spinlock-protected critical section.

344) Improper resource shutdown or release (CVE-ID: CVE-2026-53379)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ov8856_init_controls() in the ov8856 media driver when adding controls fails. A local user can trigger the error condition to cause a denial of service.

345) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-53378)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in drm_colorop state handling when duplicating, destroying, or resetting colorop state. A local user can trigger state lifecycle operations to cause a denial of service.

346) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-53377)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper recovery handling in recover_worker in the drm/msm GPU driver when processing a hung GPU ring with no additional queued work. A local user can trigger a GPU hang to cause a denial of service.

The issue can occur when a single submitted job hangs a ring and the GPU remains in a hung state instead of being recovered.

347) Improper input validation (CVE-ID: CVE-2026-53376)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in kfd_ioctl_get_process_apertures_new when handling a num_of_nodes value supplied to the ioctl. A local user can supply a crafted num_of_nodes value to cause a denial of service.

348) Improper input validation (CVE-ID: CVE-2026-53375)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the amdgpu_vce_cs_reloc function when processing crafted command submission relocation data. A local user can provide invalid lo/hi indices to cause a denial of service.

The issue occurs when only one of the low or high address fields is valid, which can result in a bad address being written in firmware.

349) Improper Initialization (CVE-ID: CVE-2026-53374)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause memory corruption in GPU address translation.

The vulnerability exists due to improper initialization in the AMDGPU GART table when allocating and populating page table entries in VRAM. A local user can trigger GART mappings so that stale uninitialized entries are used to cause memory corruption in GPU address translation.

The issue arises because speculative TLB loads may consume other uninitialized entries from the same cacheline, and stale garbage page table entries may later be used by the GPU.

350) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53373)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in mmap_action_complete() and VMA cleanup handling when processing mmap_prepare() actions invoked from mmap() compatibility paths. A local user can trigger an error during a crafted mmap operation to cause a denial of service.

The issue occurs when a not-fully-established detached VMA is handled through stacked drivers or file systems such as overlayfs or shm.

351) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-53372)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a loss of dirty page tracking integrity.

The vulnerability exists due to improper state validation in PASID attachment handling for nested IOMMU domains when attaching a PASID to a nested domain with dirty tracking configured on the parent domain. A local user can attach a PASID to such a nested domain to cause a loss of dirty page tracking integrity.

The issue occurs because the kernel lacks dirty tracking support for nested domains in this configuration.

352) Out-of-bounds read (CVE-ID: CVE-2026-53371)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the ionic hca_type_show() sysfs handler when reading the node_desc sysfs attribute after a 64-byte value has been written without NUL termination. A local user can write an exactly 64-byte value and then read the sysfs file to disclose sensitive information.

The issue is triggerable from userspace because ionic supports IB_DEVICE_MODIFY_NODE_DESC.

353) Improper input validation (CVE-ID: CVE-2026-53370)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in intel_pmu_acr_late_setup() when processing user-supplied ACR masks. A local user can supply a crafted attr.config2 mask to cause a denial of service.

The issue involves incomplete validation of ACR mask bits, skipping configuration of subsequent ACR groups on invalid input, and reuse of stale hardware ACR mask state.

354) Improper input validation (CVE-ID: CVE-2026-53369)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass descriptor CRC validation.

The vulnerability exists due to improper input validation in udf_read_tagged() when parsing a crafted UDF image. A local user can supply a descriptor with an oversized descCRCLength value to bypass descriptor CRC validation.

User interaction is required to mount or otherwise process a crafted UDF image.

355) Race condition (CVE-ID: CVE-2026-53368)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause file system inconsistency.

The vulnerability exists due to a race condition in f2fs nat_entry flag handling in fs/f2fs/node.c when syncing files and writing checkpoints concurrently. A local user can trigger file write, fsync, and checkpoint activity to cause file system inconsistency.

The issue can leave an inode marked with DENT_BIT_SHIFT after it has already been checkpointed, which may be detected by fsck.

356) Insufficient Logging (CVE-ID: CVE-2026-53367)

CWE-ID: CWE-778 - Insufficient Logging

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass security auditing.

The vulnerability exists due to improper audit logging in the SELinux per-task avdcache when handling inode permission checks. A local user can trigger cached permission checks to bypass security auditing.

Some permission checks may not be audited after a previously cached check for different permissions on the same directory entry.

357) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-53365)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in virtio vsock zerocopy completion handling in net/vmw_vsock/virtio_transport_common.c when processing multi-skb MSG_ZEROCOPY sends. A local user can send a large crafted message that is fragmented into multiple skbs to cause a denial of service.

The issue can leave pinned user pages without completion notification, including when the send loop exits before the final skb is processed.

358) Memory leak (CVE-ID: CVE-2026-53364)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in hci_le_big_terminate() in the bluetooth hci connection handling component when terminating BIG synchronization state. A local user can trigger the affected code path to cause a denial of service.

The issue occurs on an early-return path when neither PA sync termination nor BIG sync termination flags are set.

359) Out-of-bounds write (CVE-ID: CVE-2026-53360)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to corrupt host kernel heap memory and disclose host heap layout information.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in KVM SEV handling in arch/x86/kvm/svm/sev.c when processing guest-controlled Page State Change requests with a scratch buffer allocated outside the GHCB shared buffer under GHCB v2+. A local user can supply crafted PSC metadata that causes the host to iterate past the allocated scratch buffer to corrupt host kernel heap memory and disclose host heap layout information.

Exploitation requires a malicious SEV-SNP guest, and the issue may also trigger use-after-free conditions across repeated VMGEXITs.

360) Improper locking (CVE-ID: CVE-2026-53358)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in l2cap_sock_cleanup_listen() when cleaning up listening L2CAP channels. A local user can trigger a race condition to cause a denial of service.

The issue involves incorrect lock ordering between conn->lock, chan->lock, and sk_lock during Bluetooth L2CAP channel cleanup.

361) Use-after-free (CVE-ID: CVE-2026-53357)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in l2cap_sock_cleanup_listen() and bt_accept_dequeue() in the Bluetooth L2CAP socket handling code when racing listen socket cleanup with a concurrent HCI disconnect. A local user can trigger a listen/close versus HCI-disconnect race to cause a denial of service.

The issue occurs during cleanup of not-yet-accepted child sockets on a listening socket.

362) NULL pointer dereference (CVE-ID: CVE-2026-53324)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mana debugfs directory creation logic when creating per-device debugfs directories for virtual functions. A local user can trigger device initialization in an environment where pdev->slot is NULL to cause a denial of service.

The issue can occur in environments such as generic VFIO passthrough or nested KVM.

363) Improper locking (CVE-ID: CVE-2026-53323)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the DSA conduit ethtool wrappers when handling ethtool operations. A local user can invoke ethtool on the affected interface to cause a denial of service.

364) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53322)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to access device BAR resources after device shutdown, potentially leading to disclosure of sensitive information, modification of data, or a denial of service.

The vulnerability exists due to improper resource shutdown sequencing in vfio_pci_core_close_device() when closing a device while DMABUF access remains active. A local user can keep accessing the device through DMABUF mappings during the shutdown window to access device BAR resources after device shutdown, potentially leading to disclosure of sensitive information, modification of data, or a denial of service.

The issue occurs in a small window after memory space enable is cleared and before DMABUF access is revoked, while the resources may be reassigned to a different driver.

365) Resource exhaustion (CVE-ID: CVE-2026-53321)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in io_uring napi busy polling when polling for events with no events found. A local user can trigger repeated busy polling to cause a denial of service.

The issue can lead to kernel complaints about a task being stuck because the polling loop lacks conditional rescheduling.

366) Improper input validation (CVE-ID: CVE-2026-53320)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in nilfs_ioctl_mark_blocks_dirty() when processing a crafted ioctl request. A local user can send a crafted ioctl request with bd_oblocknr set to 0 to cause a denial of service.

The issue can reach a WARN_ON path after a lookup returns -ENOENT and sets the compared block number to 0.

367) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-53319)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of expected error conditions in wbt_init_enable_default() when processing ioctl(BLKPG) requests during MTD partition creation. A local user can trigger memory allocation failures to cause a denial of service.

The issue results in a spurious kernel warning and stack trace rather than memory corruption.

368) NULL pointer dereference (CVE-ID: CVE-2026-53318)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7925_tx_check_aggr() when processing transmit aggregation state. A local attacker can trigger the vulnerable code path to cause a denial of service.

369) Improper input validation (CVE-ID: CVE-2026-53317)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the mt7921 wifi driver when handling station association identifiers on IFTYPE_AP interfaces. A local user can configure a station with an out-of-range AID value to cause a denial of service.

The issue was observed on 7922 hardware and only on IFTYPE_AP interfaces; IFTYPE_STATION behavior was not reported as affected.

370) NULL pointer dereference (CVE-ID: CVE-2026-53316)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ras_core_ras_interrupt_detected() when handling an error path with a null ras_core pointer. A local attacker can trigger the vulnerable error path to cause a denial of service.

371) NULL pointer dereference (CVE-ID: CVE-2026-53315)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ras_core_get_utc_second_timestamp() in the AMD RAS subsystem when handling an invalid ras_core pointer. A local user can trigger the vulnerable code path to cause a denial of service.

372) Race condition (CVE-ID: CVE-2026-53314)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the padata CPU hotplug callback handling when offlining a CPU. A local user can trigger CPU hotplug operations to cause a denial of service.

The issue occurs because the CPU offline callback was placed in a hotplug teardown state where failure is not allowed.

373) NULL pointer dereference (CVE-ID: CVE-2026-53313)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dc_dmub_srv_log_diagnostic_data() and dc_dmub_srv_enable_dpia_trace() when handling error paths. A local user can trigger the vulnerable code path to cause a denial of service.

374) Integer overflow (CVE-ID: CVE-2026-53312)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in the RISC-V IOMMU invalidation path when processing invalidation ranges with a gather end value of ULONG_MAX. A local user can trigger the overflow condition to cause a denial of service.

375) Use of Uninitialized Variable (CVE-ID: CVE-2026-53311)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in fuse_dentry_revalidate() when handling dentry revalidation during file open operations. A local user can trigger file open paths involving a dentry with an uninitialized d_time value to cause a denial of service.

The issue was identified by KMSAN and occurs when a dentry allocated by __d_alloc() is revalidated before d_time is initialized.

376) Improper Validation of Array Index (CVE-ID: CVE-2026-53310)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper access of indexable resource location in tegra234_sw_lookup_target_timeout() when handling error interrupts for a different fabric. A local attacker can trigger a cross-fabric error condition to cause a denial of service.

The issue can lead to a kernel page fault during target timeout lookup.

377) Out-of-bounds read (CVE-ID: CVE-2026-53309)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dlm_match_regions() when comparing local and remote regions. A remote attacker can trigger the vulnerable region comparison to disclose sensitive information, modify data, or cause a denial of service.

378) Use-after-free (CVE-ID: CVE-2026-53308)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to use-after-free in the max77705 power supply driver workqueue handling when processing an interrupt during driver probe error handling or device removal. A local user can trigger an interrupt in this time window to execute arbitrary code.

The issue occurs because the interrupt handler can schedule work after the workqueue has already been destroyed but before the interrupt handler is freed.

379) Improper input validation (CVE-ID: CVE-2026-53307)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in pinconf_generic_parse_dt_pinmux() when parsing the 'pinmux' property. A local user can provide an empty 'pinmux' property to cause a denial of service.

380) Off-by-one (CVE-ID: CVE-2026-53306)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hvc_iucv_get_private() in the hvc_iucv driver when handling a device index equal to the number of configured devices. A local user can trigger an off-by-one access to cause a denial of service.

The issue occurs because the bounds check permits access to hvc_iucv_table[8] when hvc_iucv_devices is 8.

381) NULL pointer dereference (CVE-ID: CVE-2026-53305)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ps883x_retimer_remove() when unbinding a device from its driver. A local user can trigger device unbinding to cause a denial of service.

382) Improper input validation (CVE-ID: CVE-2026-53304)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper input validation in the sg driver def_reserved_size module parameter handling when opening /dev/sgX after assigning an invalid value to the parameter. A local privileged user can write a negative or oversized value to the def_reserved_size sysfs parameter and then open a sg device node to cause a denial of service.

383) Out-of-bounds read (CVE-ID: CVE-2026-53303)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in f2fs_sbi_show() when reading the extension_list during sysfs access concurrent with extension list updates. A local user can trigger concurrent sysfs operations to cause a denial of service.

The issue may also result in stale data being displayed.

384) NULL pointer dereference (CVE-ID: CVE-2026-53302)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper algorithm selection in eip93_hmac_setkey() in the EIP93 crypto driver when processing AEAD setkey operations. A local user can trigger a failed setkey operation to cause a denial of service.

A subsequent crypto operation may dereference a NULL pointer in the request context and panic the kernel after the SA record is left partially initialized with zeroed digest fields.

385) NULL pointer dereference (CVE-ID: CVE-2026-53301)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the amlogic t7 reset driver when handling reset operations. A local user can trigger the vulnerable code path to cause a denial of service.

The issue affects a SoC reset implementation that is not currently used yet.

386) Use-after-free (CVE-ID: CVE-2026-53300)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the enetc NTMP command handling path when processing timed-out NTMP commands and reclaiming DMA buffers. A local user can trigger a command timeout and concurrent buffer reuse to execute arbitrary code.

The issue can result in silent memory corruption because hardware may later perform a DMA write to the physical address of a freed buffer.

387) NULL pointer dereference (CVE-ID: CVE-2026-53299)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in airoha_qdma_cleanup_tx_queue() when handling a failed queue entry list allocation in airoha_qdma_init_tx_queue(). A local user can trigger queue initialization failure to cause a denial of service.

388) NULL pointer dereference (CVE-ID: CVE-2026-53298)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in airoha_qdma_cleanup() when cleaning up a partially initialized RX queue after allocation failures in airoha_qdma_init_rx_queue(). A local user can trigger queue initialization failure to cause a denial of service.

The issue occurs because RX queue NAPI cleanup may be performed even though netif_napi_add() was never executed for the affected queue.

389) NULL pointer dereference (CVE-ID: CVE-2026-53297)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mana_remove() when handling a second invocation after a failed PM resume callback. A local user can trigger device unbind after a failed resume path to cause a denial of service.

The issue occurs because a failed resume callback does not automatically unbind the driver, allowing mana_remove() to be invoked again later.

390) Use-after-free (CVE-ID: CVE-2026-53296)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the mailbox-test driver when handling probe errors. A local user can trigger a probe error to cause a denial of service.

The issue occurs because previously obtained channels are not freed before the client structure is removed.

391) NULL pointer dereference (CVE-ID: CVE-2026-53295)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the mailbox controller channel array handling when initializing a mailbox controller without an attached channel array. A local user can trigger initialization of a mailbox controller in this state to cause a denial of service.

392) Double free (CVE-ID: CVE-2026-53294)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in mailbox-test channel handling when freeing reused channels. A local user can trigger the mailbox-test logic with an aliased RX and TX channel configuration to cause a denial of service.

The issue occurs in the special case where the RX channel is aliased to the TX channel with different MMIO.

393) Improper locking (CVE-ID: CVE-2026-53293)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in AMDGPU_INFO_READ_MMR_REG in amdgpu_kms.c when handling ioctl requests to read MMR registers. A local user can issue a crafted ioctl request to cause a denial of service.

The issue involves incorrect ordering between the reset semaphore and mm_lock, allocation while holding the reset semaphore, and failure to wait for reset completion.

394) Improper handling of exceptional conditions (CVE-ID: CVE-2026-53292)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in pn_socket_autobind() in net/phonet/socket.c when handling socket autobind during send operations. A local user can trigger a failed bind condition that reaches a BUG_ON() assertion to cause a denial of service.

The issue is reachable from a user-triggerable path and can panic the kernel when pn_socket_bind() returns -EINVAL while the socket port remains unset.

395) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-53291)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in cx_probe() in the ALSA hda/conexant driver when enabling the jack detection callback. A local user can trigger the vulnerable driver path to cause a denial of service.

The issue can lead to a kernel crash when jack events are later handled after callback registration fails.

396) Use-after-free (CVE-ID: CVE-2026-53290)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to use-after-free in xe_eu_stall_stream_close() when closing an eu stall stream. A local user can trigger the close path to execute arbitrary code or cause a denial of service.

397) NULL pointer dereference (CVE-ID: CVE-2026-53289)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ice_reset_all_vfs() when handling a failed VSI rebuild during VF reset processing. A local user can trigger a failed VSI rebuild state and cause a denial of service.

The issue can occur during NVM firmware update while the firmware is in a transitional state and Admin Queue commands fail.

398) Memory corruption (CVE-ID: CVE-2026-53288)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory mapping in early kernel mapping when initializing arm64 kernel segment page tables. A local user can trigger the vulnerable boot-time mapping condition to cause a denial of service.

The issue affects arm64 systems using 4K pages during early boot.

399) Insufficient Logging (CVE-ID: CVE-2026-53287)

CWE-ID: CWE-778 - Insufficient Logging

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to conceal capability changes in audit records.

The vulnerability exists due to incorrect data recording in __audit_log_capset() in the audit subsystem when logging CAPSET operations. A local user can modify inheritable capabilities to conceal capability changes in audit records.

This can mask preparation for a privilege-escalating exec in audit data used for compliance and forensic analysis.

400) Double free (CVE-ID: CVE-2026-53286)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free and use-after-free in idpf auxiliary device error paths when handling auxiliary device add failures. A local user can trigger a failure during auxiliary device initialization to cause a denial of service.

The issue occurs in the probe error paths of idpf_plug_vport_aux_dev() and idpf_plug_core_aux_dev().

401) Resource exhaustion (CVE-ID: CVE-2026-53285)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in dcn32_enable_phantom_plane() when allocating phantom plane state during bandwidth validation. A local user can trigger allocation of a large dc_plane_state object to cause a denial of service.

The issue can lead to a kernel crash when memory allocation reaches the vmalloc path in a preemption-restricted context.

402) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53284)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in btrfs_write_and_wait_transaction() and the dirty_pages io tree when handling failed transaction writeback. A remote attacker can trigger write errors that cause dirty extent buffer records to be released prematurely to cause a denial of service.

The issue can leave dirty extent buffers uncleared during transaction cleanup and trigger warnings during filesystem unmount.

403) Out-of-bounds read (CVE-ID: CVE-2026-53283)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in __rlookup_amd_iommu() when registering and probing PCI devices during boot. A local attacker can present a PCI device whose BDF is not described by the IVRS to cause a denial of service.

The issue can lead to a boot-time general protection fault when adjacent slab contents are dereferenced as a struct amd_iommu *.

404) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-53282)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a missing return address in x86 kexec purgatory code when processing a non-kjump kexec. A local user can trigger a non-kjump kexec to cause a denial of service.

The issue can cause purgatory to crash by attempting to access a return address above the top of its stack.

405) Use-after-free (CVE-ID: CVE-2026-53281)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a NULL pointer dereference and use-after-free in the Intel VT-d IOMMU PASID teardown logic when detaching a domain that was not attached to the IOMMU or when a PASID entry is not found. A local user can trigger teardown operations on an invalid or missing PASID association to cause a denial of service or execute arbitrary code.

The issue can also corrupt reference counts, which may prematurely drop a shared domain reference to zero for remaining active devices.

406) NULL pointer dereference (CVE-ID: CVE-2026-53280)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in pci_dev_reset_iommu_done() when re-attaching a RID domain after device reset. A local user can trigger device reset handling to cause a denial of service.

The issue occurs when default domain allocation fails during the first probe, leaving group->domain uninitialized.

407) Improper resource shutdown or release (CVE-ID: CVE-2026-53279)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the oaktrail LVDS initialization code when handling an initialization failure after obtaining an I2C adapter reference. A local user can trigger device initialization failure to cause a denial of service.

The issue can cause the kernel to hang indefinitely while waiting for an I2C adapter reference to be released.

408) NULL pointer dereference (CVE-ID: CVE-2026-53278)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in __destroy_component_cfg() in the arm mpam subsystem when disabling mpam before the configuration array has been allocated. A local user can trigger the vulnerable code path to cause a denial of service.

409) Race condition (CVE-ID: CVE-2026-53277)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in arm64 KVM page table walk handling when performing fault injection and address translation emulation. A local user can trigger page table walks without the required SRCU protection to cause a denial of service.

The issue affects calls to __kvm_at_s12() and __kvm_find_s1_desc_level() that invoke nested stage-2 and stage-1 walkers without holding kvm->srcu.

410) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-53174)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in ovl_iterate_merged() in fs/overlayfs/readdir.c when processing readdir operations on overlay-on-overlay directories. A local user can trigger nested directory iteration to cause a denial of service.

The issue is reachable through overlay-on-overlay readdir via getdents64.

411) Out-of-bounds write (CVE-ID: CVE-2026-53130)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to overwrite kernel memory.

The vulnerability exists due to an out-of-bounds write in omfs_make_empty() when processing a crafted OMFS filesystem image with s_sys_blocksize smaller than OMFS_DIR_START. A local user can mount a specially crafted filesystem image to overwrite kernel memory.

The issue is caused by an unsigned underflow in the length argument passed to memset().

412) Use-after-free (CVE-ID: CVE-2026-53129)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to use-after-free in mb_cache_destroy() and mb_cache_shrink_worker() when destroying an mbcache instance while scheduled shrink work is pending or running. A local privileged user can trigger the last put of a mounted ext2, ext4, or ocfs2 filesystem to cause a denial of service.

The issue is only reachable when the attacker can trigger teardown of the cache for a mounted filesystem.

413) Race condition (CVE-ID: CVE-2026-53128)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in drbd_adm_dump_devices() and drbd_adm_dump_peer_devices() when handling netlink dump requests with a resource filter. A local user can send a specially crafted netlink request to cause a denial of service.

414) Improper resource shutdown or release (CVE-ID: CVE-2026-53127)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in blk_revalidate_disk_zones() in block/blk-zoned.c when handling zone revalidation errors. A local user can trigger a zone revalidation failure to cause a denial of service.

415) Improper resource shutdown or release (CVE-ID: CVE-2026-53126)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in blkcg_maybe_throttle_current() when handling block cgroup throttling lookups and error paths. A local user can trigger lookup or reference acquisition failures to cause a denial of service.

The issue results from a disk reference leak that can prevent the disk object from being freed.

416) Improper locking (CVE-ID: CVE-2026-53125)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in md_attr_store() when processing a write of "clear" to the array_state sysfs attribute. A local user can write "clear" to the array_state sysfs entry to cause a denial of service.

The issue is triggered during md array teardown from the sysfs write path and results in recursive locking on kn->active.

417) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53124)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the ublk driver when recovering devices and fetching I/O commands. A local user can cause a ublk server to die after only a subset of I/Os in a queue have been fetched to cause a denial of service.

The issue occurs because per-I/O canceled flags can remain set for fetched I/Os if recovery stops before all I/Os in the queue are fetched, preventing outstanding commands from being completed during cancellation.

418) Improper locking (CVE-ID: CVE-2026-53123)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the raid456 reshape handling in the md subsystem when suspending an md device during direct I/O across the reshape position. A local user can freeze reshape and write md/suspend_lo or md/suspend_hi to trigger a deadlock and cause a denial of service.

The issue occurs because I/O can wait for reshape progress while still holding an active_io reference, preventing suspend from completing if reshape is already frozen or interrupted.

419) Deadlock (CVE-ID: CVE-2026-53122)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in the btrfs reflink operation when processing reflink operations with the flushoncommit mount option enabled. A local user can trigger a reflink of an inline extent to an offset beyond the destination inode size to cause a denial of service.

Exploitation requires the flushoncommit mount option and a reflink operation that copies an inline extent beyond the current i_size of the destination inode.

420) Memory leak (CVE-ID: CVE-2026-53121)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in amd_pstate_epp_cpu_init() when initializing CPU EPP settings. A local user can trigger an error path to cause a denial of service.

421) Use-after-free (CVE-ID: CVE-2026-53120)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the pci driver matching logic when probing a driver through __driver_attach__(). A local user can trigger concurrent access to the driver_override field to cause a denial of service.

The issue occurs because the bus match callback accesses driver_override without the device lock held.

422) Use-after-free (CVE-ID: CVE-2026-53119)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the wmi driver_override handling in the WMI bus match callback when probing a driver through __driver_attach(). A local user can trigger driver matching to cause a denial of service.

423) Use-after-free (CVE-ID: CVE-2026-53118)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the vdpa driver_override handling in the vDPA bus match callback when probing a driver through __driver_attach(). A local user can trigger driver matching while the driver_override field is accessed without the device lock to cause a denial of service.

The issue occurs because the bus match callback is invoked without the device lock held during this code path.

424) Use-after-free (CVE-ID: CVE-2026-53117)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the s390 cio driver_override handling when probing a driver through __driver_attach__(). A local user can trigger driver matching on a device with a stale driver_override reference to cause a denial of service.

The issue occurs because the bus match callback may access driver_override without the device lock held.

425) Use-after-free (CVE-ID: CVE-2026-53116)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the AP bus driver_override handling in drivers/s390/crypto/ap_bus.c and drivers/s390/crypto/ap_queue.c when updating AP masks concurrently with driver_override sysfs operations. A local user can trigger concurrent driver_override changes and AP mask updates to cause a denial of service.

Exploitation requires access to local sysfs interfaces that modify AP mask or driver override settings.

426) Use-after-free (CVE-ID: CVE-2026-53115)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the fsl-mc bus driver_override handling when matching drivers during device probing. A local user can trigger driver matching on a device with a stale driver_override reference to cause a denial of service.

The issue occurs because the match callback may access driver_override without the device lock held during __driver_attach().

427) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-53114)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a function call in the amd ibs nmi handler when processing perf events. A local user can create a perf event that triggers the unsafe call from nmi context to cause a denial of service.

The issue occurs when raw sampling is used for IBS perf events.

428) Improper resource shutdown or release (CVE-ID: CVE-2026-53113)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ath11k beacon template setup functions when handling error paths during beacon template setup. A local user can trigger error conditions in beacon template setup to cause a denial of service.

The issue affects the ath11k driver code paths in ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid().

429) Use-after-free (CVE-ID: CVE-2026-53112)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in irq_prepare_bcn_tasklet in the rtlwifi PCI driver when handling beacon interrupts during device probe failure or device detachment. A local user can trigger the affected code path to cause a denial of service.

The issue occurs because a pending or running tasklet may access a freed ieee80211_hw object.

430) NULL pointer dereference (CVE-ID: CVE-2026-53111)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in bpf_lwt_xmit_push_encap when executing BPF LWT_XMIT programs through bpf_prog_test_run_skb with an uninitialized skb destination reference. A local user can execute a crafted BPF program test run to cause a denial of service.

431) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-53110)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause incorrect behavior in kernel BPF processing.

The vulnerability exists due to improper handling of integer extension in the s390 BPF JIT compiler when processing BPF program return values and kfunc arguments. A local user can trigger the JIT compilation of crafted BPF code to cause incorrect behavior in kernel BPF processing.

The issue affects s390 systems because the ABI requires zero extension for unsigned arguments and return values, but only sign extension was implemented.

432) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53109)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in pte_frag_destroy when freeing cached page table fragments during process exit. A local user can trigger process exit with a crafted memory state to cause a denial of service.

The issue affects the powerpc page table fragment handling path for hash with 64K page size and can occur in a corner case involving deferred PTE table freeing in parallel with do_exit().

433) Race condition (CVE-ID: CVE-2026-53108)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in powerpc PMD huge page handling when unmapping memory during PMD page migration or device-private THP entry handling. A local user can trigger concurrent move_pages() and munmap() operations to cause a denial of service.

The issue can lead to a kernel BUG in pmdp_huge_get_and_clear_full() on powerpc/64s systems.

434) Improper locking (CVE-ID: CVE-2026-53107)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of urb cancellation in drivers/net/wireless/marvell/libertas/if_usb.c when processing usb transmit requests in interrupt context. A local user can trigger transmission while a previous urb is still pending to cause a denial of service.

The issue occurs because the transmit path may be reached from interrupt context, where sleeping is not allowed.

435) Improper locking (CVE-ID: CVE-2026-53106)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of local storage deletion in bpf local storage helpers when deleting local storage from an nmi context. A local user can trigger bpf_xxx_storage_delete() helpers to cause a denial of service.

The issue affects helper and syscall paths that reach bpf_selem_unlink().

436) NULL pointer dereference (CVE-ID: CVE-2026-53105)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7925_mac_write_txwi when handling transmission metadata with an uninitialized vif pointer. A local user can trigger the vulnerable code path to cause a denial of service.

The issue may lead to a kernel panic.

437) Memory leak (CVE-ID: CVE-2026-53104)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the mt76 dma rx queue cleanup logic when destroying the device during module unload. A local user can trigger device cleanup to cause a denial of service.

The issue affects MT76 rx queues, including WED RRO queues that have an associated page_pool even when not associated to a NAPI.

438) Deadlock (CVE-ID: CVE-2026-53103)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in mt7925_roc_abort_sync when canceling roc_work during station removal while the work item is still running and holding dev->mt76.mutex. A local user can trigger station removal to cause a denial of service.

439) Memory leak (CVE-ID: CVE-2026-53102)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the mt76 wireless driver MCU request handling code when processing error paths after allocating an skb. A local user can trigger an intermediate failure to cause a denial of service.

440) Deadlock (CVE-ID: CVE-2026-53101)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in mt7921_roc_abort_sync when canceling roc_work during station removal. A local user can trigger station removal while roc_work is running to cause a denial of service.

441) Deadlock (CVE-ID: CVE-2026-53100)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in the mt76 remain-on-channel handling in drivers/net/wireless/mediatek/mt76/channel.c when invoking remain-on-channel operations while dev->mutex is already held. A local user can trigger remain-on-channel processing to cause a denial of service.

442) Insufficient Control Flow Management (CVE-ID: CVE-2026-53099)

CWE-ID: CWE-691 - Insufficient Control Flow Management

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper control flow management in btf_check_dtor_kfuncs in kernel/bpf/btf.c when processing BPF type information for destructor kfuncs. A local user can trigger a CFI failure to cause a denial of service.

443) Use-after-free (CVE-ID: CVE-2026-53098)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mt7915_mac_dump_work() when processing queued dump work during device detachment. A local user can trigger device recovery while the device removal path is freeing crash_data to cause a denial of service.

The issue is caused by a race condition between the removal path and a workqueue handler.

444) Use-after-free (CVE-ID: CVE-2026-53097)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mt7996_mac_dump_work() when processing queued dump work during device detachment. A local user can trigger the race condition to cause a denial of service.

The issue occurs when the work item is still running or pending while crash_data has already been released.

445) Race condition (CVE-ID: CVE-2026-53096)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper use of RCU-safe iteration in dev_map_redirect_multi() and dev_map_enqueue_multi() when processing BPF devmap hash buckets under RCU protection. A local user can trigger concurrent updates and lookups to cause a denial of service.

On weakly ordered architectures, readers may observe a partially constructed node.

446) Improper access control (CVE-ID: CVE-2026-53095)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to modify kernel function arguments.

The vulnerability exists due to improper access control in the BPF kprobe and freplace program attachment logic when attaching a freplace program to a kprobe program with mismatched kprobe_write_ctx values. A local user can attach a crafted freplace program to a kprobe program to modify struct pt_regs and modify kernel function arguments.

This issue arises because uprobe programs use the KPROBE program type, enabling abuse of kprobe_write_ctx through the kprobe+freplace combination.

447) Use-after-free (CVE-ID: CVE-2026-53094)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the BPF offload program pointer handling in kernel/bpf/core.c when destroying a network namespace after JIT compilation with constant blinding enabled for a dev-bound-only BPF program. A local user can trigger cleanup of a crafted dev-bound-only XDP program to cause a denial of service.

Exploitation requires net.core.bpf_jit_harden to be set to 2 or higher and affects dev-bound-only programs created with BPF_F_XDP_DEV_BOUND_ONLY.

448) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-53093)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper check for exceptional conditions in brcmf_chip_recognition() in the brcmfmac driver when processing error returns from brcmf_chip_add_core(). A local user can trigger the vulnerable code path to cause a denial of service.

449) Improper input validation (CVE-ID: CVE-2026-53092)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass the BPF verifier's safety checks.

The vulnerability exists due to improper input validation in the BPF verifier when processing BPF add or subtract operations where the source and destination register are the same. A local user can load a crafted BPF program to bypass the BPF verifier's safety checks.

The issue stems from incorrect delta tracking for linked registers, which can create a verifier-versus-runtime mismatch.

450) Improper input validation (CVE-ID: CVE-2026-53091)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of gso packet headers in qdisc_pkt_len_segs_init() when processing malicious gso packets. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue affects the transmit path for gso packets and malformed packets may be dropped during processing.

451) Improper access control (CVE-ID: CVE-2026-53090)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass BPF verifier checks.

The vulnerability exists due to improper access control in the Linux kernel BPF verifier when analyzing ld_{abs,ind} instructions in subprograms. A local user can load a crafted BPF program to bypass BPF verifier checks.

The issue affects subprograms where ld_{abs,ind} instructions are permitted, including cases involving BTF-annotated subprograms with scalar return types.

452) Use-after-free (CVE-ID: CVE-2026-53089)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() when querying info for an offloaded BPF map or program during network namespace destruction. A local user can query crafted offloaded BPF map or program information to cause a denial of service.

The issue occurs because the associated network namespace may be racing with teardown and its reference count may already have reached zero.

453) Off-by-one (CVE-ID: CVE-2026-53088)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in bcmgenet_put_txcb in the bcmgenet network driver when handling transmit control block pointer rewinding. A local user can trigger the flawed pointer handling to cause a denial of service.

454) Improper resource shutdown or release (CVE-ID: CVE-2026-53087)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the bcmgenet transmit queue reclaim logic when reclaiming the tx queue and dropping data in flight. A local user can trigger transmission drops to cause a denial of service.

455) Race condition (CVE-ID: CVE-2026-53086)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the bcmgenet_timeout handler when handling a transmit queue timeout. A local user can trigger a transmit queue timeout to cause a denial of service.

456) Use-after-free (CVE-ID: CVE-2026-53085)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the open-coded task_vma iterator in kernel/bpf/task_iter.c when iterating a task's virtual memory areas while the target task exits concurrently. A local user can trigger the iterator on a task whose mm_struct is freed concurrently to cause a denial of service.

The issue occurs because task->mm is read locklessly and no mm reference is acquired before mmap_read_trylock().

457) Improper locking (CVE-ID: CVE-2026-53084)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the bpf task_vma iterator when executing a BPF program that iterates task VMAs. A local user can trigger lock ordering conditions to cause a denial of service.

The issue arises because the iterator held a per-VMA lock across the BPF program body, creating a lock ordering problem involving vm_lock, i_rwsem, and mmap_lock.

458) Resource exhaustion (CVE-ID: CVE-2026-53083)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper control of resource consumption in bpf_fd_array_map_clear() in the BPF array map implementation when clearing PROG_ARRAY maps with many entries. A local user can trigger map clearing operations to cause a denial of service.

The issue can lead to RCU stalls under load.

459) Use of Uninitialized Variable (CVE-ID: CVE-2026-53082)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an uninitialized value read in sixpack_receive_buf() and sixpack_decode() in the 6pack hamradio driver when processing TTY input with error-flagged bytes. A local user can supply crafted input containing TTY error conditions to cause a denial of service.

The issue occurs because bytes marked with TTY error flags are not skipped correctly before decoding.

460) Improper access control (CVE-ID: CVE-2026-53081)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass BPF verifier state pruning checks.

The vulnerability exists due to improper access control in the BPF verifier when comparing scalar registers carrying BPF_ADD_CONST state. A local user can load a specially crafted BPF program to bypass BPF verifier state pruning checks.

The issue occurs because compound scalar IDs are checked without ensuring consistent mapping of their underlying base IDs.

461) NULL pointer dereference (CVE-ID: CVE-2026-53080)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the cls_fw classifier when classifying packets with an invalid old-style filter on a shared block. A local user can send crafted traffic while creating such a filter to cause a denial of service.

Exploitation requires the ability to configure traffic control filters and trigger packet classification.

462) Memory leak (CVE-ID: CVE-2026-53079)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in qdisc_dequeue_drop() and deferred qdisc drop handling when cleaning up deferred packet drops. A local user can trigger packet drops through a child qdisc whose root qdisc does not implement the TCQ_F_DEQUEUE_DROPS flag to cause a denial of service.

The issue occurs because packets can remain stranded on a child qdisc's local to_free list instead of being freed.

463) Out-of-bounds read (CVE-ID: CVE-2026-53078)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in BPF sock_ops context field access handling when accessing ctx fields with the same destination and source register. A local user can trigger the flawed register handling to cause a denial of service.

The issue occurs when the fullsock or locked_tcp_sock check is false, causing a stale ctx pointer to be retained and used as a bogus socket pointer.

464) Out-of-bounds read (CVE-ID: CVE-2026-53078)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in BPF sock_ops context field access handling when accessing ctx fields with the same destination and source register. A local user can trigger the flawed register handling to disclose sensitive information.

The issue occurs when the fullsock or locked_tcp_sock check is false, causing a stale ctx pointer to be retained.

465) Improper access control (CVE-ID: CVE-2026-53077)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper restriction of operations in RDS/IB transport selection and address checking when using RDS/IB from a non-initial network namespace. A local user can select the RDS/IB transport from a non-initial network namespace to cause a denial of service.

The issue is specific to use of RDS/IB outside the initial network namespace.

466) Out-of-bounds read (CVE-ID: CVE-2026-53076)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in pcpu_init_value in the BPF hashtab implementation when copying an element from a BPF_MAP_TYPE_CGROUP_STORAGE map to another per-cpu map with the same non-8-byte-aligned value_size. A local user can update the destination map with data from the crafted source map to disclose sensitive information.

The issue occurs when the source map value size is not rounded up to 8 bytes, causing a copy operation to read past the claimed source size.

467) Improper access control (CVE-ID: CVE-2026-53075)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform unauthorized PPP administrative operations in an inherited network namespace.

The vulnerability exists due to improper access control in unattached PPP administrative ioctl handling in drivers/net/ppp/ppp_generic.c when processing PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN requests. A local user can create a new user namespace and issue crafted ioctl requests to perform unauthorized PPP administrative operations in an inherited network namespace.

Exploitation requires the ability to create a new user namespace with CLONE_NEWUSER.

468) Out-of-bounds read (CVE-ID: CVE-2026-53074)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in bpf_prog_test_run_skb() when processing crafted IPv4 or IPv6 test inputs with an insufficient L3 header. A local user can supply a specially crafted Ethernet frame to cause a denial of service.

469) Race condition (CVE-ID: CVE-2026-53073)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to a null pointer dereference in the Bluetooth hci_ldisc subsystem when processing incoming UART data after device registration fails. A local user can trigger device registration failure and subsequent UART data handling to cause a denial of service.

The issue occurs because protocol-specific receive handlers may be reached after resources have been freed.

470) Use-after-free (CVE-ID: CVE-2026-53072)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in hci_conn_request_evt() when handling deferred Bluetooth connection requests. A local user can trigger concurrent connection handling to cause a denial of service.

Only SCO deferred setup listen code paths are affected.

471) Race condition (CVE-ID: CVE-2026-53071)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to corrupt kernel memory.

The vulnerability exists due to a race condition in l2cap_ecred_reconf_rsp in the L2CAP subsystem when processing a crafted L2CAP ECRED reconfiguration response from a remote BLE device. A remote attacker can send a specially crafted L2CAP ECRED reconfiguration response to corrupt kernel memory.

Exploitation requires concurrent channel list iteration by another thread.

472) Race condition (CVE-ID: CVE-2026-53070)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in SCTP over UDP transmission handling in net/sctp/ipv6.c and net/sctp/protocol.c when transmitting SCTP packets over UDP. A local user can trigger SCTP over UDP traffic to cause a denial of service.

Exploitation requires SCTP over UDP to be enabled.

473) NULL pointer dereference (CVE-ID: CVE-2026-53069)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in xdp_master_redirect() when processing XDP redirect operations for a master device that is not up. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can be reached through the bonding round-robin transmit slave selection path when XDP redirection is enabled system-wide and the bond device was never opened.

474) Integer overflow (CVE-ID: CVE-2026-53068)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to integer overflow in the AFBC framebuffer size check in komeda_framebuffer.c when validating a userspace-supplied AFBC framebuffer object. A local user can provide an undersized drm_gem_object with crafted size-related values to cause an out-of-bounds memory access.

475) Double free (CVE-ID: CVE-2026-53067)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in pci_epf_alloc_doorbell() in the pci endpoint MSI component when handling doorbell allocation after MSI allocation failure or repeated allocation attempts. A local user can trigger doorbell allocation in a way that leaves stale state or reuses an existing allocation to cause a denial of service.

476) NULL pointer dereference (CVE-ID: CVE-2026-53066)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error pointers in sun4i_backend_atomic_check() in drivers/gpu/drm/sun4i/sun4i_backend.c when processing atomic plane state checks. A local user can trigger an error pointer dereference to cause a denial of service.

477) Improper resource shutdown or release (CVE-ID: CVE-2026-53065)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the sti uniperif player driver when removing the driver after player initialization. A local user can trigger driver initialization and removal to cause a denial of service.

478) NULL pointer dereference (CVE-ID: CVE-2026-53064)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the dm-cache target when handling concurrent writes in passthrough mode during cache entry invalidation. A local user can trigger concurrent writes to the same cached block to cause a denial of service.

Only the passthrough mode code path is affected.

479) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-53063)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper control flow management in invalidate_remove() in the dm-cache target when handling write hit bios after cache invalidation in passthrough mode. A local user can trigger write operations in this state to cause a denial of service.

The issue causes write operations to hang because a remapped overwrite bio is dropped without being submitted.

480) Use-after-free (CVE-ID: CVE-2026-53062)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the dm-cache smq policy invalidate_mapping operation when handling concurrent writes in passthrough mode. A local user can trigger concurrent cache block invalidations to cause a denial of service.

The issue occurs when the cache is operating in passthrough mode and multiple workers invalidate cache blocks simultaneously.

481) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-53061)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause data loss.

The vulnerability exists due to improper state validation in the dm-cache target when resuming a preloaded table in passthrough mode while dirty mappings are present. A local user can preload and resume a crafted dm-cache table configuration to cause data loss.

Exploitation requires local access to device-mapper management and occurs when metadata updates are still ongoing during table preloading.

482) Memory leak (CVE-ID: CVE-2026-53060)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in dm_cache_metadata_abort in the device-mapper cache metadata component when reloading a new table while metadata is read-only. A local user can trigger repeated metadata abort operations to cause a denial of service.

The issue can also occur through concurrent metadata_operation_failed calls due to races in cache mode updates.

483) Out-of-bounds write (CVE-ID: CVE-2026-53059)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in create_log_context() and dm-log bitset handling when processing a crafted device-mapper mirror target configuration with an oversized region count. A local user can create a crafted mirror target to cause a denial of service.

The issue is triggered when region_count overflows 32 bits, causing bitsets to be allocated smaller than required and later accessed with indices derived from the full region space.

484) NULL pointer dereference (CVE-ID: CVE-2026-53058)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the Cadence MHDP8546 DRM bridge driver when handling atomic enable error recovery paths. A local user can trigger link-up or register-read errors that reach modeset retry handling to cause a denial of service.

The issue occurs with the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag set.

485) Improper access control (CVE-ID: CVE-2026-53057)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass IOMMU memory translation updates.

The vulnerability exists due to improper access control in the RISC-V IOMMU IODIR update handling when updating DDT or PDT entries without performing required IOTINVAL invalidations. A local user can trigger device context updates to bypass IOMMU memory translation updates.

The issue affects the RISC-V IOMMU implementation and arises because required TLB and context cache invalidations were not performed after directory entry updates.

486) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53056)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper power state management in the drm/msm/dpu runtime suspend logic when handling runtime suspend and resume operations. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when the MMCX rail is dropped to MIN_SVS while the core clock remains at its highest rate, which can lead to instability or a system crash when the clock is re-enabled.

487) Use-after-free (CVE-ID: CVE-2026-53055)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the hisilicon sec2 crypto driver when processing packet transmission completions under heavy load. A local user can trigger concurrent packet transmission activity to cause a denial of service.

The issue occurs when hardware completes packet processing and the request memory is freed before the transmission function finishes using it.

488) Improper locking (CVE-ID: CVE-2026-53054)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in drm/msm vm_bind unmap handling when processing VM_BIND UNMAP operations for non-_NO_SHARE buffer objects. A local user can trigger a VM_BIND UNMAP operation to cause a denial of service.

The issue only manifests with non-_NO_SHARE buffer objects, because _NO_SHARE objects share a common reservation object with the VM that is always locked.

489) Improper access control (CVE-ID: CVE-2026-53053)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access of device identifier data in clone_alias() in the AMD IOMMU subsystem when processing PCI DMA aliases. A local user can trigger alias cloning for a device to cause a denial of service.

Incorrect source device identifiers can cause wrong or stale device table entries to be propagated to an alias device.

490) Memory corruption (CVE-ID: CVE-2026-53052)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect memory access in the qdsp6 topology widget unload handler when processing a virtual widget without checking its type before accessing private data. A local user can trigger the vulnerable code path to cause a denial of service.

491) Improper Initialization (CVE-ID: CVE-2026-53051)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the tegra194 PCIe endpoint reset handling code when processing a double PERST# deassert sequence. A local user can trigger repeated reset transitions to cause a denial of service.

The issue occurs because DBI registers are accessed before the controller core is powered on, leading to a CBB timeout.

492) Race condition (CVE-ID: CVE-2026-53050)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dquot_scan_active() and quota deactivation handling in the quota subsystem when scanning active dquots during quota deactivation. A local user can trigger the race to cause a denial of service.

Under memory pressure, the caller of dquot_scan_active() can end up working on a freed dquot.

493) Improper locking (CVE-ID: CVE-2026-53049)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in gfs2_logd() and log flushing functions in the gfs2 log subsystem when handling concurrent transactions. A local user can trigger concurrent log flush activity to cause a denial of service.

494) NULL pointer dereference (CVE-ID: CVE-2026-53048)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in gfs2_log_release() when flushing outstanding glock work during an unmount. A local user can trigger an unmount condition to cause a denial of service.

495) Heap-based buffer overflow (CVE-ID: CVE-2026-53047)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the efi capsule loader when reallocating the phys array. A local user can trigger the vulnerable code path to cause a denial of service.

The issue affects 32-bit systems with PAE where phys_addr_t is 64-bit but pointers are 32-bit.

496) Use-after-free (CVE-ID: CVE-2026-53046)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in ksmbd_crypt_message() when handling SMB encryption requests with an asynchronous hardware crypto engine. A remote user can send a crafted SMB request to cause a denial of service.

Exploitation requires the ksmbd server to use an asynchronous crypto engine such as the Qualcomm Crypto Engine.

497) Improper input validation (CVE-ID: CVE-2026-53045)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the tegra124 emc timing change logic when processing memory timing settings. A local user can provide a timing configuration with an incorrect DLL state check to cause a denial of service.

498) Out-of-bounds read (CVE-ID: CVE-2026-53044)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the tegra cbb fabric lookup tables when performing target timeout lookup. A local user can trigger the lookup with a crafted fabric configuration state to cause a denial of service.

499) Out-of-bounds read (CVE-ID: CVE-2026-53043)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in dlm_match_regions() when processing a crafted DLM_QUERY_REGION network message. A remote attacker can send a specially crafted network message to disclose sensitive information.

500) NULL pointer dereference (CVE-ID: CVE-2026-53042)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the fwctl device registration and removal handling in the Linux kernel when removing a device after registration occurs before fwctl class initialization. A local user can trigger device removal in this state to cause a denial of service.

501) Improper input validation (CVE-ID: CVE-2026-53041)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ocfs2 xattr list handling logic when processing listxattr requests for inodes with both inline and block-based extended attributes. A local user can invoke listxattr on a crafted OCFS2 inode state to cause a denial of service.

The issue occurs when inline extended attribute names exactly consume the caller buffer and additional block-based extended attribute names are present.

502) Out-of-bounds read (CVE-ID: CVE-2026-53040)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the ocfs2 freefrag scan logic in fs/ocfs2/ioctl.c when processing a crafted filesystem through OCFS2_IOC_INFO with OCFS2_INFO_FL_NON_COHERENT. A local user can supply a crafted filesystem and issue the ioctl request to cause a denial of service.

The issue occurs in the non-coherent scan path, which reads raw group descriptor blocks without the validation performed by the coherent path.

503) Improper input validation (CVE-ID: CVE-2026-53039)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ocfs2_group_add when handling the OCFS2_IOC_GROUP_ADD ioctl with a user-controlled group block before validation. A local user can supply crafted group add input to cause a denial of service.

The issue can trigger a kernel BUG in ocfs2_set_new_buffer_uptodate().

504) Out-of-bounds read (CVE-ID: CVE-2026-53038)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in create_securityfs_measurement_lists in the IMA securityfs measurement list creation logic when processing TPM banks with unsupported hash algorithms. A local user can trigger initialization on a system with a TPM that reports an unsupported bank algorithm to cause a denial of service.

The issue is triggered during IMA initialization when a TPM bank algorithm is left as HASH_ALGO__LAST and then used as an index into hash_algo_name[].

505) Improper locking (CVE-ID: CVE-2026-53037)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper resource management in hid_post_reset() when processing a reset of a crafted USB device that includes both HID and storage or UAS components. An attacker with physical access can connect a crafted USB device to trigger a deadlock and cause a denial of service.

The issue occurs because the components can be reset only together, placing the affected code in block I/O error handling.

506) Off-by-one (CVE-ID: CVE-2026-53036)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in the arm64 BPF JIT immediate range check in check_imm() when validating branch displacement values for encoded BPF branch instructions. A local user can supply a crafted branch displacement value to cause a denial of service.

The issue can flip a forward branch into a backward one because the raw value is masked into the signed immediate field.

507) Improper locking (CVE-ID: CVE-2026-53035)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in bpf_iter_unix_seq_show() when processing BPF iterator output for AF_UNIX sockets. A local user can trigger a sockmap update from an iterator program to cause a denial of service.

Exploitation requires the ability to run a BPF iterator program that updates a sockmap.

508) NULL pointer dereference (CVE-ID: CVE-2026-53034)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in unix_stream_bpf_update_proto() when updating a sockmap for an af_unix stream socket during a concurrent connect operation. A local user can trigger a race condition via a bpf sockmap update to cause a denial of service.

The issue occurs in a race window where the socket state is set to established before the peer pointer is assigned.

509) Use-after-free (CVE-ID: CVE-2026-53033)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in unix_stream_bpf_update_proto() when processing BPF iterator updates to a sockmap during a unix socket state transition. A local user can trigger a race condition to cause a denial of service.

The issue occurs when the peer pointer becomes stale during the transition from TCP_ESTABLISHED to TCP_CLOSE.

510) NULL pointer dereference (CVE-ID: CVE-2026-53032)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in map_kptr_match_type() in the BPF verifier when processing a scalar register stored into a kptr slot. A local user can trigger the verifier to access a NULL btf pointer to cause a denial of service.

511) Improper input validation (CVE-ID: CVE-2026-53031)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in arena_alloc_pages() when processing a node_id value for page allocation. A local user can supply an invalid node_id to cause a denial of service.

The issue is in the Linux kernel BPF arena implementation.

512) Memory leak (CVE-ID: CVE-2026-53030)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in renesas_i3c_i3c_xfers() when processing I3C transfer requests. A local user can trigger repeated transfer operations to cause a denial of service.

513) Use of Uninitialized Variable (CVE-ID: CVE-2026-53029)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized variable in ntfs_iomap_begin in fs/ntfs3/inode.c when processing crafted NTFS filesystem metadata. A local user can mount or access a specially crafted NTFS filesystem to cause a denial of service.

514) NULL pointer dereference (CVE-ID: CVE-2026-53028)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an error pointer dereference in the cd321x_update_work() function in drivers/usb/typec/tipd/core.c when handling partner registration. A local user can trigger the vulnerable code path to cause a denial of service.

515) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-53027)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of attribute segment run loading in attr_data_get_block_locked() when processing compressed or sparse attributes with frame-aligned clusters. A local user can trigger the affected code path to cause a denial of service.

The issue is triggered when vcn is rounded down to the frame start and vcn and vcn0 reside in different attribute segments.

516) Improper update of reference count (CVE-ID: CVE-2026-53026)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper reference count management in nfsd4_add_rdaccess_to_wrdeleg when handling concurrent NFS file access state updates. A remote user can trigger concurrent access patterns to cause a denial of service.

The issue can leave nfsd_file objects unreleased and trigger a BUG in kmem_cache_destroy() when the nfs-server service is stopped.

517) Use-after-free (CVE-ID: CVE-2026-53025)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the greybus raw character device handling in drivers/staging/greybus/raw.c when closing an opened character device after the associated raw bundle has been disconnected. A local user can keep the character device open and then close it after disconnect to cause a denial of service.

Exploitation requires that the character device remain opened by an application while the associated raw bundle is disconnected.

518) Use-after-free (CVE-ID: CVE-2026-53024)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the greybus raw character device write handler when writing to the device after disconnect. A local user can write to the chardev after disconnect to cause a denial of service.

The issue can lead to a kernel panic.

519) Out-of-bounds read (CVE-ID: CVE-2026-53023)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ntfs3_label_show() when exposing a cached NTFS volume label after UTF-8 conversion. A local user can mount a crafted NTFS filesystem image to disclose sensitive information.

520) Stack-based buffer overflow (CVE-ID: CVE-2026-53022)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in populate_enum_data() in the dell-wmi-sysman enumeration attribute handler when aggregating firmware-provided enumeration strings. A local user can provide crafted enumeration data to overflow fixed-size destination buffers and cause a denial of service.

The issue affects aggregation of value-modifier and possible-value strings into fixed 512-byte structure members.

521) Integer overflow (CVE-ID: CVE-2026-53021)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in sbc_execute_unmap() when processing UNMAP requests. A local user can send a crafted UNMAP request to cause a denial of service.

522) Race condition (CVE-ID: CVE-2026-53020)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in um_tlb_sync in arch/um/kernel/tlb.c when synchronizing the TLB and traversing page tables. A local user can trigger concurrent memory-management operations to cause a denial of service.

The issue affects User-Mode Linux.

523) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-53019)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an incorrect conditional check in ccu_mix_trigger_fc() in the spacemit ccu_mix clock driver when handling cpufreq scaling. A local user can trigger cpu frequency scaling to cause a denial of service.

The issue can lead to kernel panics during cpu frequency scaling.

524) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53018)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the f2fs garbage collection logic when processing already updated pages during garbage collection. A local user can trigger garbage collection on crafted filesystem state to cause a denial of service.

The issue was identified during fuzz testing and results in a kernel BUG triggered by reading a page that had already been marked uptodate.

525) Race condition (CVE-ID: CVE-2026-53017)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause data loss.

The vulnerability exists due to a race condition in f2fs_need_inode_block_update() and nat_entry flag handling when performing fsync on a newly created file concurrently with a checkpoint operation. A local user can trigger concurrent file and checkpoint activity to cause data loss.

The issue occurs before any checkpoint has been written for the newly created file.

526) Out-of-bounds write (CVE-ID: CVE-2026-53016)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in ccp_aes_complete() when processing AF_ALG rfc3686-ctr-aes-ccp requests. A local user can supply a request with an 8-byte IV to cause a denial of service.

527) Integer overflow (CVE-ID: CVE-2026-53015)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer truncation in the EROFS zmap logic when processing crafted EROFS filesystem metadata on 32-bit platforms. A local user can provide a specially crafted filesystem image to cause a denial of service.

Only 32-bit platforms are affected.

528) Out-of-bounds write (CVE-ID: CVE-2026-53014)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to memory corruption in tcf_blockcast_redir in net/sched/act_mirred.c when redirecting packets to multiple devices in a block with mixed device types. A local user can trigger packet redirection through such a block to cause a denial of service.

In the worst case, an incorrect mac_len can exhaust skb headroom and panic the kernel.

529) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-53013)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper calculation of buffer size in macvlan_get_size() when dumping macvlan interface information over netlink. A local user can configure the bc_cutoff attribute and request detailed link information to cause a denial of service.

The issue is triggered when the broadcast cutoff value is not equal to 1, causing the netlink message buffer to run out of space and the interface dump to fail with -EMSGSIZE.

530) NULL pointer dereference (CVE-ID: CVE-2026-53012)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in IPv6 route handling in the nexthop subsystem when replacing an IPv6 nexthop with an IPv4 nexthop and then performing route lookups. A local user can replace a nexthop with one of a different address family and add an IPv6 route referencing the affected group to cause a denial of service.

531) Use-after-free (CVE-ID: CVE-2026-53011)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in advance_sched() in the taprio scheduler when switching schedules. A local user can trigger a schedule switch to cause a denial of service.

532) Use-after-free (CVE-ID: CVE-2026-53010)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in smb2_open during durable reconnect handling when processing a durable reconnect request. A remote user can trigger an error condition during durable reconnect to cause a denial of service.

The issue can occur if a subsequent error happens after the durable file descriptor reference is dropped early, or if a scavenger accesses the file before smb2_open returns.

533) Double free (CVE-ID: CVE-2026-53009)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in ice_xmit_frame_ring() and tx ring buffer cleanup when handling transmit error paths and interface shutdown. A local user can trigger transmit checksum or tso failure conditions and then bring the interface down to cause a denial of service.

The issue occurs because a tx_buf entry can remain marked as valid and continue to reference an skb that was already freed in the error path.

534) Race condition (CVE-ID: CVE-2026-53008)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to a NULL pointer dereference in the ice TX timestamp ring handling when processing transmit operations concurrently with TX timestamp ring cleanup. A local user can trigger concurrent ring cleanup and transmit mapping operations to cause a denial of service.

The issue occurs because one CPU can observe the TXTIME flag as set after the timestamp ring pointer has already been cleared on another CPU.

535) NULL pointer dereference (CVE-ID: CVE-2026-53007)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ice_set_ringparam() error handling when unwinding a failed ice_setup_tx_ring() call with the TXTIME flag still set. A local user can trigger this error path to cause a denial of service.

The issue occurs in the Intel ice network driver.

536) Use-after-free (CVE-ID: CVE-2026-53006)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in icmpv6_rcv() in the IPv6 ICMP handling code when processing ICMPv6 packets. A remote attacker can send a specially crafted ICMPv6 packet to cause a denial of service.

537) Use-after-free (CVE-ID: CVE-2026-53005)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the AF_UNIX SOCKMAP handling and garbage collection logic when processing socket buffers carrying SCM file descriptor attributes through SOCKMAP. A local user can send crafted AF_UNIX messages with SCM file descriptor attributes through SOCKMAP to cause a denial of service.

The issue arises because redirected socket buffers are not visible to AF_UNIX garbage collection, and user interaction is not required.

538) Out-of-bounds write (CVE-ID: CVE-2026-53004)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to corrupt adjacent userspace data.

The vulnerability exists due to an out-of-bounds write in sctp_getsockopt_peer_auth_chunks when processing a getsockopt request for peer AUTH chunks with an undersized optval buffer. A local user can supply a crafted buffer length to corrupt adjacent userspace data.

Exploitation requires an SCTP association with AUTH enabled, and the overwritten bytes land in the caller's own userspace buffer rather than in kernel memory.

539) Improper input validation (CVE-ID: CVE-2026-53003)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the PPPoE frame handling in the Linux kernel when processing PPPoE frames with a compressed protocol field. A remote attacker can send a specially crafted PPPoE frame to cause a denial of service.

The issue can trigger unaligned access exceptions on some architectures because the PPP payload becomes shifted by one byte and the network header becomes 4-byte misaligned.

540) Stack-based buffer overflow (CVE-ID: CVE-2026-53002)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in the nf_nat_sip netfilter helper when processing crafted SIP/SDP messages. A remote attacker can send specially crafted network traffic to cause a denial of service.

The issue is triggered in mangle_content_len() during SIP message handling.

541) Improper access control (CVE-ID: CVE-2026-53001)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass intended netfilter match restrictions.

The vulnerability exists due to improper access control in the netfilter xtables match extensions xt_mac, xt_owner, xt_physdev, and xt_realm when registering protocol families. A local user can invoke these matches with unsupported protocol families to bypass intended netfilter match restrictions.

The issue stems from these matches being registered for unspecified protocol families even though they are intended only for IPv4 and IPv6, and xt_realm is intended only for IPv4.

542) Use-after-free (CVE-ID: CVE-2026-53000)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in netfilter nat hook operations when dumping active netfilter hooks from userspace or handling partial hook exposure on error paths. A local user can trigger hook inspection while freed hook operation structures are still referenced to cause a denial of service.

The issue affects nat hook registration and unregistration paths, including interaction with the nfnetlink hook dump subsystem.

543) Out-of-bounds read (CVE-ID: CVE-2026-52999)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause incorrect logging behavior.

The vulnerability exists due to an out-of-bounds read in nf_osf_match_one() in nfnetlink_osf when processing TCP option matching across multiple fingerprints. A remote attacker can send specially crafted network traffic to cause incorrect logging behavior.

The issue is triggered when NF_OSF_LOGLEVEL_ALL is configured and matching continues after an earlier fingerprint match.

544) NULL pointer dereference (CVE-ID: CVE-2026-52998)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in nf_osf_ttl() when processing packets for TTL checks. A remote attacker can send a specially crafted packet to cause a denial of service.

545) NULL pointer dereference (CVE-ID: CVE-2026-52997)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dualpi2_change() in the sch_dualpi2 qdisc when enforcing updated limit or memlimit values after a configuration change. A local user can trigger traffic classification that leaves packets queued in the L-queue while the C-queue is empty to cause a denial of service.

546) Improper resource shutdown or release (CVE-ID: CVE-2026-52996)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in parse_durable_handle_context() in the ksmbd SMB server durable handle processing when handling durable v2 open requests with a matching CreateGuid but mismatched ClientGUID. A remote user can send specially crafted durable reconnect requests to cause a denial of service.

Repeated mismatch requests can pin global file table entries and prevent file cleanup for the corresponding files.

547) Improper Initialization (CVE-ID: CVE-2026-52995)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in net/rds connection information handling when processing getsockopt requests for RDS connection information. A local user can query RDS IB connection information to disclose sensitive information.

Exploitation requires access to AF_RDS and an RDMA-capable network device, and occurs when connection state causes only part of the output structure to be populated.

548) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-52994)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass resource limit enforcement.

The vulnerability exists due to improper resource management in virtio_transport_init_zcopy_skb() when processing MSG_ZEROCOPY sends. A local user can send data using MSG_ZEROCOPY to bypass resource limit enforcement.

The issue occurs because pinned-pages accounting can use a consumed iterator count of 0 on the last skb, causing RLIMIT_MEMLOCK accounting to be skipped.

549) Double free (CVE-ID: CVE-2026-52993)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in tipc_buf_append() when validating a reassembled skb after tipc_msg_validate() reallocates it. A local user can trigger the error-handling path with a crafted TIPC message to cause a denial of service.

550) Out-of-bounds write (CVE-ID: CVE-2026-52992)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in adfs_map_layout() when parsing a crafted ADFS image during filesystem probe. A local user can provide a crafted image with a zero zone count to cause a denial of service.

The issue affects new-format ADFS images and is triggered before the disc record is used.

551) Use-after-free (CVE-ID: CVE-2026-52991)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in pressure_write() in kernel/cgroup/cgroup.c when handling a write to a pressure cgroup file during concurrent cgroup file release. A local user can write crafted pressure data while racing cgroup file release to cause a denial of service.

The issue occurs because the of->priv pointer may be freed concurrently and later dereferenced.

552) Improper resource shutdown or release (CVE-ID: CVE-2026-52990)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in fsnotify_recalc_mask() when handling concurrent mark attach and detach operations. A local user can trigger the race condition to cause a denial of service.

The issue can manifest as a hung task during unmount operations.

553) Out-of-bounds read (CVE-ID: CVE-2026-52989)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds condition in nvmet_tcp_build_pdu_iovec() and the NVMe target TCP receive path when processing crafted PDU length or offset values. A remote attacker can send a specially crafted network PDU to cause a denial of service.

The issue occurs because a fatal error is not propagated to callers, leaving cmd->recv_msg.msg_iter uninitialized before subsequent receive handling uses it.

554) Race condition (CVE-ID: CVE-2026-52988)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nf_tables commit phase hook list handling in netfilter when publishing new hooks while concurrent netlink dump list traversal via rcu is in progress. A local user can trigger concurrent ruleset updates to cause a denial of service.

555) Double free (CVE-ID: CVE-2026-52987)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in amdgpu_userq_vm_validate() when handling failures from amdgpu_ttm_tt_get_user_pages() during user queue validation. A local user can trigger an error path that calls drm_exec_fini() twice on the same exec object to cause a denial of service.

The issue occurs when the new_addition path has already finalized the exec object before processing collected HMM ranges.

556) Out-of-bounds read (CVE-ID: CVE-2026-52986)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the nf_conntrack_sip SIP message parser when parsing non-NUL-terminated SIP packet data containing crafted port values. A remote attacker can send a specially crafted SIP packet to cause a denial of service.

The issue involves port parsing in epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request(), where parsing could reach the buffer limit without a trailing character.

557) Use of Uninitialized Variable (CVE-ID: CVE-2026-52985)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in nsim_dev_trap_skb_build when building a dummy sk_buff IP header. A local user can trigger the vulnerable code path to disclose sensitive information.

558) Resource exhaustion (CVE-ID: CVE-2026-52984)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in netem_enqueue() in the netem scheduler when handling reordered packets. A local user can trigger packet reordering to cause a denial of service.

559) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-52983)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the airoha network driver transmit queue handling when processing transmitted packets and completion accounting. A local user can trigger inconsistent BQL accounting to cause a denial of service.

560) Use-after-free (CVE-ID: CVE-2026-52982)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in rtl8150_start_xmit() when submitting a USB transmit URB and updating transmit statistics. A local user can trigger concurrent URB completion to cause a denial of service.

The issue is caused by reading skb->len after usb_submit_urb() returns, while the skb may already have been freed by the completion path on another CPU in softirq context.

561) Improper resource shutdown or release (CVE-ID: CVE-2026-52981)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in neigh_xmit in the neighbour networking subsystem when handling packet transmission with an uninitialized neighbor table. A local user can trigger packet transmission in this state to cause a denial of service.

This can occur, for example, when the IPv6 neighbor table is uninitialized because IPv6 is disabled.

562) Improper Initialization (CVE-ID: CVE-2026-52980)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the fair scheduler sched_entity state in __sched_fork() when handling a newly forked task that later calls sched_yield(). A local user can fork a task and trigger sched_yield() to cause a denial of service.

The issue can corrupt cfs_rq->sum_w_vruntime, break EEVDF eligibility calculation, and lead to a later NULL dereference.

563) Race condition (CVE-ID: CVE-2026-52979)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in psp_assoc_device_get_locked() when handling netlink requests for association creation. A local user can send a specially crafted netlink request to cause a denial of service.

The issue is caused by a race condition involving device unregistration.

564) Improper access control (CVE-ID: CVE-2026-52978)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to modify shared device state.

The vulnerability exists due to improper access control in the psp netlink dev-set and key-rotate operations when handling netlink requests. A remote user can send crafted netlink requests to modify shared device state.

The only access check verifies network namespace membership.

565) Race condition (CVE-ID: CVE-2026-52977)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in futex requeue-PI handling in kernel/futex/requeue.c when processing wait-requeue-pi and requeue-PI operations during signal or timeout wakeup. A local user can trigger concurrent futex operations to cause a denial of service.

The issue can result in a live lock where one task blocks on a hash bucket lock while another busy loops, potentially locking up the system.

566) Use-after-free (CVE-ID: CVE-2026-52976)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in xe_exec_queue_create_ioctl() when handling crafted ioctl requests that trigger error cleanup paths. A local user can trigger queue creation failures to cause a denial of service.

One affected path leaves a freed queue linked in the VM compute exec queue list in preempt fence mode, and another leaves a freed queue linked in the hardware engine group list.

567) Race condition (CVE-ID: CVE-2026-52975)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a data race in the bonding 802.3ad port-to-aggregator handling code when processing netlink requests and concurrent bonding state changes. A local user can send crafted netlink messages to trigger the race and cause a denial of service.

The issue was reported by Kernel Concurrency Sanitizer and affects access to the port->aggregator pointer in the bonding subsystem.

568) Memory leak (CVE-ID: CVE-2026-52974)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the TLS RX offload setup error path when handling a failure in device offload initialization. A local user can trigger offload RX setup failure to cause a denial of service.

The issue occurs when tls_set_device_offload_rx() fails at tls_dev_add() after the strparser has been initialized and an anchor skb has been allocated.

569) Use-after-free (CVE-ID: CVE-2026-52973)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in futex hash allocation logic when creating a CLONE_VM clone that shares the memory map outside strict CLONE_THREAD semantics. A local user can create a crafted clone scenario to cause a denial of service.

The issue arises when the memory map is shared in ways other than pthread-style threading, which can leave a biased per-cpu futex reference pointing to freed memory.

570) Use-after-free (CVE-ID: CVE-2026-52971)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ena PHC get_timestamp function when accessing PHC timestamp data during concurrent PHC destruction. A local user can trigger concurrent operations to cause a denial of service.

571) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-52970)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing reference release in nft_ct_expect_obj_eval() in the netfilter nft_ct component when processing conntrack expectation objects. A local user can trigger the vulnerable code path to cause a denial of service.

572) Out-of-bounds write (CVE-ID: CVE-2026-52969)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in kvm_reset_dirty_gfn() and the KVM dirty ring handling logic when processing rewritten dirty ring entries from a vcpu file descriptor. A local user can modify slot and offset fields in crafted dirty ring entries to cause memory corruption.

The issue is reachable from a process holding /dev/kvm and affects the legacy MMU path with shadow paging, allocated shadow roots, or a write-tracked slot.

573) Out-of-bounds write (CVE-ID: CVE-2026-52968)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds access in the KVM s390 PCI GAIT handling code when processing AIF and host alert forwarding operations. A local user can trigger crafted GAIT index usage to cause a denial of service.

The issue is caused by double-scaling pointer arithmetic that accesses element aisb*16 instead of aisb, and out-of-bounds accesses occur when aisb is 32 or greater.

574) Out-of-bounds read (CVE-ID: CVE-2026-52967)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to cause a denial of service or disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in symlink_data() in fs/smb/client/smb2file.c when parsing SMB error context data for symlink responses. A remote attacker can send a specially crafted SMB response to cause a denial of service or disclose sensitive information.

On 32-bit architectures, malformed ErrorDataLength values can also trigger an infinite loop.

575) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-52965)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in ttm_bo_swapout() LRU list handling when processing swapout failures. A local user can trigger a swapout failure to cause a denial of service.

The issue can cause an infinite LRU walk because the same resource is encountered repeatedly after being moved relative to the walk cursor's hitch node.

576) Out-of-bounds read (CVE-ID: CVE-2026-52964)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the USB MIDI 2.0 endpoint descriptor parser when parsing a malformed USB device descriptor. An attacker with physical access can connect a specially crafted USB device to cause a denial of service.

577) Out-of-bounds read (CVE-ID: CVE-2026-52963)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in snd_usbmidi_get_ms_info() / USB MIDI endpoint descriptor scanning when parsing crafted MIDIStreaming endpoint descriptors. A local user can provide a crafted USB device descriptor to disclose sensitive information.

578) Memory leak (CVE-ID: CVE-2026-52962)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in __ceph_setxattr() when retrying extended attribute updates. A local user can trigger repeated setxattr operations to cause a denial of service.

579) Race condition (CVE-ID: CVE-2026-52961)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in __ceph_build_xattrs_blob() and ceph xattr handling when processing concurrent xattr updates and capability grant handling. A local user can trigger stale blob size state to cause a denial of service.

The issue can lead to a kernel BUG in fs/ceph/xattr.c during Ceph xattr processing.

580) Improper update of reference count (CVE-ID: CVE-2026-52960)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count management in ceph_process_folio_batch in fs/ceph/addr.c when processing folios for writeback. A local user can trigger handling of folios not suitable for writeback to cause a denial of service.

581) Out-of-bounds write (CVE-ID: CVE-2026-52959)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to improper handling of a host-controlled allocation size in get_ext_report() in the sev-guest driver when processing an extended guest request. A local user can provide a crafted length value through the host response to cause memory corruption.

The issue occurs in the cleanup path after the host reports an invalid buffer length and returns an expected certificate buffer size.

582) Out-of-bounds read (CVE-ID: CVE-2026-52958)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in osdmap_decode() when decoding a corrupted incoming osdmap message. A remote attacker can send a specially crafted osdmap message to cause a denial of service.

The issue can occur when the max_osd value in the message exceeds the actual content of the osdmap.

583) NULL pointer dereference (CVE-ID: CVE-2026-52957)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in decode_choose_args() when processing a crafted CEPH_MSG_OSD_MAP message containing a crush_choose_arg_map with a bucket index that refers to a NULL bucket. A remote attacker can send a specially crafted message to cause a denial of service.

584) Out-of-bounds read (CVE-ID: CVE-2026-52956)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in __ceph_x_decrypt() when processing a crafted Ceph authentication reply message. A remote attacker can send a specially crafted message frame to cause a denial of service.

The issue can be triggered when the ciphertext is too short to contain a ceph_x_encrypt_header, such as in a FRAME_TAG_AUTH_REPLY_MORE message.

585) Out-of-bounds read (CVE-ID: CVE-2026-52955)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in crush_decode() when processing a CEPH_MSG_OSD_MAP message containing a crush map with mismatched bucket algorithm fields. A remote attacker can send a specially crafted CEPH_MSG_OSD_MAP message to cause a denial of service.

586) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-52954)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of duplicate rbtree keys in decode_choose_args() when processing a crafted CEPH_MSG_OSD_MAP message containing duplicate choose_args_index values. A remote attacker can send a specially crafted message to cause a denial of service.

587) Out-of-bounds read (CVE-ID: CVE-2026-52953)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in domain_remove_dev_pasid() when closing a VFIO device and removing a device PASID for a blocked domain. A local user can trigger the affected code path to cause a denial of service.

The issue can be triggered when a QEMU process is terminated.

588) Use-after-free (CVE-ID: CVE-2026-52952)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __iommu_group_set_domain_internal() when handling concurrent domain attachment and device recovery operations. A local user can trigger device reset and re-attachment sequences to cause a denial of service.

The issue arises when a device in the IOMMU group is recovering while group->domain still points to a domain that may be freed.

589) Use-after-free (CVE-ID: CVE-2026-52951)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race condition in the xe dma-buf import handling in drivers/gpu/drm/xe/xe_dma_buf.c when triggering the invalidate_mappings hook during buffer object initialization or error handling. A local user can trigger dma-buf import and race the invalidate_mappings callback to cause a denial of service.

The issue can occur when importing a dma-buf from another driver such as amdgpu, and reported outcomes include NULL pointer dereference and crashes during eviction flow.

590) Use-after-free (CVE-ID: CVE-2026-52950)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the drm/xe dma-buf import handling in xe_gem_prime_import() when processing a dma-buf attachment with the retry loop. A local user can trigger an error path that frees the backing object and then causes it to be reused to cause a denial of service.

591) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-52949)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in ttm_bo_shrink() when handling backup failures during buffer object shrinking. A local user can trigger a backup failure to cause a denial of service.

592) Improper access control (CVE-ID: CVE-2026-52944)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to bypass permission checks and modify file sparse attributes.

The vulnerability exists due to improper access control in fsctl_set_sparse() when handling FSCTL_SET_SPARSE requests. A remote user can send a crafted FSCTL_SET_SPARSE request on an opened file to bypass permission checks and modify file sparse attributes.

The issue affects both clients on read-only shares and clients on writable shares that lack FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES access.

593) Use-after-free (CVE-ID: CVE-2026-52943)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a use-after-free in pskb_carve_inside_header() and pskb_carve_inside_nonlinear() when copying skb_shared_info for MSG_ZEROCOPY skbs. A local user can trigger repeated zerocopy skb operations to escalate privileges.

The issue is caused by copying the destructor_arg pointer into a new skb_shared_info without incrementing the associated zerocopy reference count, which can prematurely free ubuf_info_msgzc while transmit skbs still hold live references.

594) NULL pointer dereference (CVE-ID: CVE-2026-52941)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the smc_msg_event tracepoint when processing sendmsg() or recvmsg() on an SMC-D socket with the tracepoint enabled. A local user can trigger socket activity on an SMC-D socket to cause a denial of service.

Exploitation requires the tracepoint to be enabled, and the crash occurs on the first sendmsg() or recvmsg() on an affected SMC-D socket.

595) Use of Uninitialized Variable (CVE-ID: CVE-2026-52937)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an information leak from uninitialized stack memory in tap_ioctl() when handling the SIOCGIFHWADDR ioctl request. A local user can issue a crafted ioctl request to disclose sensitive information.

The leaked data may include kernel .text and direct-map pointers, which can defeat KASLR.

596) Improper locking (CVE-ID: CVE-2026-52936)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock management in jent_kcapi_random() when generating entropy for parallel readers. A local user can trigger concurrent requests to cause a denial of service.

The issue arises because a shared lock is held across expensive entropy collection and SHA3 conditioning operations, causing contending readers to spin and stall.

597) Integer overflow (CVE-ID: CVE-2026-52934)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to an integer overflow leading to an out-of-bounds write in batadv_tvlv_container_ogm_append() and batadv_tvlv_container_list_size() when processing registered TVLV containers. A local user can cause the accumulated TVLV size to exceed U16_MAX and trigger an undersized allocation to corrupt kernel memory.

598) Improper resource shutdown or release (CVE-ID: CVE-2026-52932)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the xfrm ipcomp processing in net/xfrm/xfrm_ipcomp.c when handling acomp error conditions. A local user can trigger an error during IPComp processing to cause a denial of service.

599) Use of Uninitialized Variable (CVE-ID: CVE-2026-52931)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause undefined behavior.

The vulnerability exists due to use of uninitialized memory in batadv_tp_recv_ack() and batadv_tp_stop() in the tp_meter component when processing a malicious ACK packet for a tp_meter session while the node is acting as a receiver. A remote attacker can send a malicious ACK packet to cause undefined behavior.

The issue occurs when sender-only members are accessed for tp_vars in the BATADV_TP_RECEIVER role during an ongoing tp_meter session.

600) Improper access control (CVE-ID: CVE-2026-52928)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the AF_UNIX SIOCATMARK ioctl handler when processing SIOCATMARK requests on non-stream sockets. A local user can invoke the ioctl on a SOCK_DGRAM or SOCK_SEQPACKET socket to cause a denial of service.

601) Out-of-bounds read (CVE-ID: CVE-2026-52927)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in compat_mtw_from_user in the ebtables netfilter subsystem when converting 32-bit user-supplied extension structures to native kernel structures. A local user can provide a crafted match or target size smaller than the extension requires to disclose sensitive information.

The issue affects extensions that rely on compat_from_user callbacks, which assume they can read the required compat size.

602) Improper resource shutdown or release (CVE-ID: CVE-2026-52926)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in batman-adv gateway client teardown logic when tearing down and later recreating a mesh. A local user can trigger mesh teardown to cause a denial of service.

The issue leaves stale current gateway state behind across cleanup, which can break a later mesh recreation.

603) NULL pointer dereference (CVE-ID: CVE-2026-52925)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the VRF port removal logic when removing a port from a VRF while concurrent RCU readers access the master device. A local user can trigger concurrent network operations to cause a denial of service.

The issue occurs because an RCU reader can observe a new non-VRF master device and then dereference missing l3mdev operations.

604) Use-after-free (CVE-ID: CVE-2026-52923)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ipc_idr_alloc() in the checkpoint/restore SysV IPC allocation path when processing a request for the next SysV IPC id. A local user can request allocation beyond the valid IPC id range to cause a denial of service.

A subsequent walk of /proc/sysvipc/shm can dereference freed memory through a stale IDR entry.

605) NULL pointer dereference (CVE-ID: CVE-2026-52922)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in batadv_dat_forward_data() when forwarding data to DHT candidates. A local attacker can trigger an allocation failure and reach unconditional dereference of a NULL skb pointer to cause a denial of service.

606) Off-by-one (CVE-ID: CVE-2026-52921)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in the netfilter ipset hash set range iteration logic when processing IPv4 ranges in hash:ip,mark, hash:ip,port, hash:ip,port,ip, and hash:ip,port,net set variants. A local user can supply a crafted range request to cause a denial of service.

A later retry may continue from an unintended position after traversal advances past the end of the requested range.

607) Improper access control (CVE-ID: CVE-2026-52920)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass inbound IPsec policy matching restrictions.

The vulnerability exists due to improper access control in the xt_policy netfilter matcher when processing strict mode inbound policy matching. A remote attacker can send network traffic that traverses a multi-element inbound rule to bypass inbound IPsec policy matching restrictions.

The issue affects strict matching of multi-element inbound rules.

608) Use-after-free (CVE-ID: CVE-2026-52919)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service and trigger a use-after-free.

The vulnerability exists due to a use-after-free in batadv_tp_sender_shutdown() and batadv_tp_send() in the batman-adv tp_meter component when shutting down the throughput meter sender through multiple paths. A local user can trigger timeout, cancellation, or normal completion paths to cause a denial of service and trigger a use-after-free.

The issue occurs because the sending counter can underflow to a negative value, causing the sender kernel thread to continue running after interface removal.

609) Race condition (CVE-ID: CVE-2026-52918)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in bt_sock_poll() and the Bluetooth accept queue when polling Bluetooth sockets. A local user can trigger concurrent socket teardown and accept queue access to cause a denial of service.

The issue occurs because the accept queue is walked without synchronization while child teardown can unlink a socket and drop its last reference.

610) Uncontrolled Recursion (CVE-ID: CVE-2026-52916)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in batadv_batman_skb_recv() and fragment reassembly handling in the batman-adv fragmentation component when processing nested BATADV_UNICAST_FRAG packets. A remote attacker can send a specially crafted fragmented packet to cause a denial of service.

The issue occurs when a reassembled payload is itself another BATADV_UNICAST_FRAG packet, leading to unbounded kernel stack growth until exhaustion.

611) Out-of-bounds read (CVE-ID: CVE-2026-52915)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hbh_mt6_check() in net/ipv6/netfilter/ip6t_hbh.c when processing user-supplied rule setup data. A local user can supply an oversized option list to cause a denial of service.

The issue is triggered because the fixed-size opts array stores at most 16 option descriptors.

612) Integer overflow (CVE-ID: CVE-2026-52914)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in the batman-adv fragment reassembly logic when processing malformed fragment chains. A local user can send malformed fragments to cause a denial of service.

613) NULL pointer dereference (CVE-ID: CVE-2026-52913)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the batman-adv OGMv2 handling code when processing OGM dispatch on an interface that has been disabled and lost its mesh interface association. A local user can trigger OGM processing on such an interface to cause a denial of service.

The issue occurs because an interface may be disabled after OGM processing begins, leaving its mesh interface pointer set to NULL while the code still attempts to use it.

614) Use-after-free (CVE-ID: CVE-2026-52912)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in nf_queue when reinjecting queued bridge LOCAL_IN packets. A remote attacker can trigger packet queueing and later reinjection to cause a denial of service.

The issue occurs because skb->dev can still reference a freed bridge master device while the packet remains queued.

615) Improper access control (CVE-ID: CVE-2026-52911)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to access another user's session.

The vulnerability exists due to improper access control in ksmbd_session_lookup_all() when processing a binding SESSION_SETUP request. A remote user can send a crafted session lookup request to access another user's session.

The issue occurs because a connection-wide binding flag can remain set after a binding SESSION_SETUP, allowing the global session lookup path to resolve sessions not bound to that connection.

616) Race condition (CVE-ID: CVE-2026-46324)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in netfilter nf_tables netlink hooks when concurrent dumpers walk hook lists during hook unregistration. A local user can trigger concurrent netlink operations to cause a denial of service.

617) Memory leak (CVE-ID: CVE-2026-46322)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in tun_xdp_one() when handling a build_skb() allocation failure. A local user can trigger this error path to cause a denial of service.

The issue occurs because a page allocated for the frame is not freed on the failure path, and the per-buffer error may be discarded during batch processing.

618) Memory leak (CVE-ID: CVE-2026-46321)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in tun_xdp_one() in the tun driver when processing short frames through the tun and vhost-net transmit path. A local user can submit TX descriptors whose payload length is shorter than ETH_HLEN to exhaust host memory and trigger an OOM panic.

Exploitation requires the ability to open /dev/net/tun and /dev/vhost-net and to attach a tun/tap device as the vhost-net backend.

619) Improper resource shutdown or release (CVE-ID: CVE-2026-46320)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in tap_get_user_xdp() when processing XDP frames. A local user can send a crafted short frame or trigger skb allocation failure to cause a denial of service.

Each rejected frame in a batch leaks one page-frag chunk.

620) Use-after-free (CVE-ID: CVE-2026-46319)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a use-after-free race condition in tcf_ct_flow_table_get() in net/sched/act_ct.c when looking up a flow table and incrementing its reference count. A local user can trigger the race during act_ct initialization to escalate privileges.

The race window is very short and occurs after the flow table object is returned from the hash table lookup but before its reference count is successfully incremented.

621) Memory leak (CVE-ID: CVE-2026-46318)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in hugetlbfs mmap handling when processing a hugetlb mapping request. A local user can trigger a failed allocation after mmap preparation to cause a denial of service.

The issue occurs because hugetlb VMA lock allocation may leak if allocation fails after mmap preparation is invoked.

622) Use-after-free (CVE-ID: CVE-2026-46317)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the nested_mmus array in arm64 KVM nested virtualization when reallocating nested MMU structures while the array is being walked under mmu_lock. A local user can trigger nested vcpu initialization and concurrent MMU notifier activity to cause a denial of service.

The issue arises from a race condition between nested vcpu initialization and the MMU notifier path.

623) Use of uninitialized resource (CVE-ID: CVE-2026-46315)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory usage in io_uring IORING_OP_WAITID result handling when copying waitid result data to userspace. A local user can trigger a wait operation that completes without reporting a child event to disclose sensitive information.

The issue occurs because stale bytes from reused io_kiocb command storage may be copied to userspace siginfo when no child event information is written.

624) Improper input validation (CVE-ID: CVE-2026-46314)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in v3d_get_extensions() and multisync extension handling in the v3d driver when processing a userspace-provided ioctl extension list. A local user can submit a self-referential extension with zero in_sync_count and out_sync_count to cause a denial of service.

The issue can result in an infinite loop in kernel context that blocks the calling thread and pegs a CPU core indefinitely.

625) NULL pointer dereference (CVE-ID: CVE-2026-46313)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper handling of an error pointer in ipu6_pci_probe() in drivers/media/pci/intel/ipu6/ipu6.c when handling a device probe error path. A local attacker can trigger the vulnerable error path to cause a denial of service.

626) Improper Initialization (CVE-ID: CVE-2026-46312)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization of vma flags in vb2_dma_sg_mmap() in the videobuf2 dma-sg memory-mapping path when mmap() is performed on an imported dma-buf. A local user can trigger the affected mmap operation to cause a denial of service.

The issue manifests as a kernel warning in drm_gem_mmap_obj() during mmap() of an imported dma-buf.

627) Race condition (CVE-ID: CVE-2026-46311)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in drm/amdgpu user queue handling in drivers/gpu/drm/amd/amdgpu/mes_userqueue.c when creating a user queue and accessing the wptr mapping. A local user can trigger queue creation while unmapping the wptr object and reusing another buffer object at the same address to cause a denial of service.

The issue involves stale wptr mapping access during queue creation.

628) NULL pointer dereference (CVE-ID: CVE-2026-46310)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the vsp1 module cleanup logic when unloading the module on gen 4 systems. A local user can trigger module unload to cause a denial of service.

The issue occurs because the cleanup path calls the wrong cleanup function for gen 4 hardware.

629) Improper input validation (CVE-ID: CVE-2026-46309)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper input validation in xe_vm_madvise_ioctl() when applying a PAT index with XE_COH_NONE to CPU cached memory. A local user can submit a crafted madvise request to disclose sensitive information.

This issue is limited to iGPU configurations, where the GPU can bypass CPU caches and read stale data directly from DRAM from previously freed pages of other processes.

630) Use-after-free (CVE-ID: CVE-2026-46308)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in scpsys_get_bus_protection_legacy() when handling an error from syscon_regmap_lookup_by_phandle(). A local user can trigger the error path to cause a denial of service.

631) Out-of-bounds write (CVE-ID: CVE-2026-46307)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the ath5k driver transmit completion handling in drivers/net/wireless/ath/ath5k/base.c when processing transmit status data. A local attacker can trigger the vulnerable code path to cause a denial of service.

The out-of-bounds write overwrites the adjacent ack_signal member, and the reported effect is negligible.

632) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-46306)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of compressed protocol fields in the PPPoE flow dissector in net/core/flow_dissector.c when processing PPPoE PFC frames. A remote attacker can send a specially crafted PPPoE PFC frame to cause a denial of service.

The issue can trigger an unaligned access exception on some architectures, and it was reproduced on MIPS systems with RPS enabled even when no PPPoE session was active on the interface.

633) NULL pointer dereference (CVE-ID: CVE-2026-46305)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in rtw_cbuf_alloc when handling a failed memory allocation. A local user can trigger memory allocation failure conditions to cause a denial of service.

634) Improper locking (CVE-ID: CVE-2026-46304)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in nvmet_ctrl_free when freeing a controller while processing nvmet-wq work items. A local user can trigger controller teardown to cause a denial of service.

The issue can lead to a possible recursive locking condition on the nvmet-wq workqueue during NVMe target controller teardown.

635) Out-of-bounds read (CVE-ID: CVE-2026-46303)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rock_continue() in the isofs Rock Ridge continuation entry parser when parsing a crafted ISO image during mount. A remote attacker can supply a crafted ISO image with a malformed CE continuation extent to disclose sensitive information.

User interaction may be required through desktop optical auto-mount, or exploitation may require mounting the crafted ISO with administrative mount capability.

636) Improper access control (CVE-ID: CVE-2026-46302)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in /sys/fs/selinux/policy when handling concurrent opens of the policy file. A local user can open the policy file and keep it open to cause a denial of service.

The issue can prevent other processes from reading the kernel policy.

637) Use-after-free (CVE-ID: CVE-2026-46301)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the spi-topcliff-pch driver when handling driver unbind operations with pending queued work. A local user can trigger driver unbind while queued operations are still being flushed to cause a denial of service.

The issue occurs because DMA buffers may be released before the driver queue is fully flushed during device removal.

638) Improper locking (CVE-ID: CVE-2026-46299)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock management in hfsplus_fill_super() when mounting a crafted HFS+ filesystem image. A local user can trigger the error path during filesystem mount to cause a denial of service.

The issue occurs when hfsplus_cat_build_key() fails after hfs_find_init() has acquired tree->tree_lock, leading to cleanup of the tree structure while the lock is still held.

639) Race condition (CVE-ID: CVE-2026-46298)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in papr-hvpipe ioctl and release handlers when handling ioctl or release operations concurrently with an interrupt on the same cpu. A local user can trigger these operations to cause a denial of service.

640) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-46297)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource or shutdown handling in the VF misc interrupt registration logic in libwx when registering the VF misc interrupt handler. A local user can trigger the vulnerable interrupt registration path to cause a denial of service.

The issue results in a kernel WARNING when the interrupt is registered with IRQF_ONESHOT and no threaded handler.

641) NULL pointer dereference (CVE-ID: CVE-2026-46296)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL-pointer dereference in the s3c64xx spi driver remove() path when unbinding the driver. A local user can trigger driver unbind to cause a denial of service.

642) Race condition (CVE-ID: CVE-2026-46295)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in __kvm_apic_update_irr and KVM x86 LAPIC interrupt handling when synchronizing posted interrupts to the IRR in nested virtualization. A local user can trigger the race during nested VM interrupt delivery to cause a denial of service.

The issue causes a spurious kernel WARNING and a wasted L2 VM-Enter/VM-Exit cycle, while the pending interrupt is not lost.

643) Out-of-bounds write (CVE-ID: CVE-2026-46294)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to cause a buffer overflow.

The vulnerability exists due to a buffer overflow in dm-ioctl retrieve_status when processing device mapper ioctl output buffers. A local privileged user can supply a crafted buffer layout to cause a buffer overflow.

Exploitation requires issuing device mapper ioctls, and the issue does not occur accidentally with commonly used libraries because they use 8-byte-aligned buffer sizes.

644) Out-of-bounds write (CVE-ID: CVE-2026-46293)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in mpfs_ccc_register_outputs() in the Microchip PolarFire SoC clock driver when registering clock outputs. A local user can trigger registration of affected outputs to cause a denial of service.

The issue occurs during registration of the last two outputs because sparse clock IDs are packed into the hws array.

645) Improper resource shutdown or release (CVE-ID: CVE-2026-46292)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in genpd_dev_pm_detach() for virtual devices in the generic PM domain core when detaching a device from a PM domain after attachment through genpd_dev_pm_attach_by_id(). A local user can trigger device detach handling to cause a denial of service.

In worst cases, the issue may result in a NULL pointer dereference in genpd_runtime_suspend().

646) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-46291)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in hash_digest_key in the caam hash implementation when debug hex dumps are generated with CONFIG_DYNAMIC_DEBUG enabled. A local user can read exposed HMAC key bytes from debug output to disclose sensitive information.

The issue affects HMAC key material handled by the CAAM crypto driver.

647) Improper handling of exceptional conditions (CVE-ID: CVE-2026-46290)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exceptional-condition handling in efi_crash_gracefully_on_page_fault() when processing EFI runtime service calls that trigger page faults. A local user can trigger a page fault during an EFI runtime service call to cause a denial of service.

Only systems with buggy firmware that triggers page faults during EFI runtime calls are affected.

648) Use-after-free (CVE-ID: CVE-2026-46275)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the hci_uart line discipline lifecycle management when closing or initializing a Bluetooth HCI UART device. A local user can trigger a hangup or race the close and initialization paths to cause a denial of service.

The issue involves workqueue handling and teardown ordering in the close and initialization error paths.

649) Use-after-free (CVE-ID: CVE-2026-46274)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in io_wq_remove_pending() and hash_tail handling in io_uring when cancelling hashed bucket-0 work with a non-hashed predecessor in the work list. A local user can trigger cancellation and subsequent hashed work insertion to execute arbitrary code.

The dangling pointer can persist for the lifetime of the task because the io_wq is per-task and survives ring open and close operations.

650) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-46273)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of segmentation offload constraints in ibmveth when processing gso packets with a small mss. A local user can send specially crafted packets to cause a denial of service.

The issue is triggered when the hardware performs segmentation with more than one segment and an MSS smaller than 224 bytes; single-segment GSO packets do not trigger the affected code path.

651) Use-after-free (CVE-ID: CVE-2026-46242)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in ep_remove() in fs/eventpoll.c when removing epoll file references during a race with file release handling. A local user can trigger a race condition to cause memory corruption.

The issue involves the epoll-watches-epoll case and a concurrent __fput() path that can lead to operations on freed structures.

652) Use-after-free (CVE-ID: CVE-2026-46241)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the mpc52xx spi controller driver when controller registration fails. A local user can trigger a controller registration failure to cause a denial of service.

The issue may also result in a resource leak.

653) Use-after-free (CVE-ID: CVE-2026-46240)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in iris_release_internal_buffers() when releasing internal buffers. A local user can trigger the vulnerable buffer release path to cause a denial of service.

654) Improper resource shutdown or release (CVE-ID: CVE-2026-46239)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the s_ctrl handler of the ov5647 media i2c driver when processing AUTOGAIN, EXPOSURE_AUTO, or ANALOGUE_GAIN control operations. A local user can trigger the affected control paths to cause a denial of service.

655) Use-after-free (CVE-ID: CVE-2026-46238)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the BAT IV neighbor state when handling purge operations on cached originator data. A local user can trigger network state changes that cause a stale originator pointer to be dereferenced to cause a denial of service.

656) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46236)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of dma coherency restrictions in xbox_remote when performing device i/o. A local user can trigger device i/o involving the improperly placed buffer to cause a denial of service.

657) NULL pointer dereference (CVE-ID: CVE-2026-46235)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in saa7164_dev_setup() when mapping PCI BAR memory regions. A local attacker can trigger memory mapping failures to cause a denial of service.

658) Improper input validation (CVE-ID: CVE-2026-46234)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to consume more socket memory than intended.

The vulnerability exists due to improper input validation in vsock_update_buffer_size() when processing user-controlled buffer size settings. A local user can set a minimum buffer size larger than the maximum to consume more socket memory than intended.

659) NULL pointer dereference (CVE-ID: CVE-2026-46233)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in batadv_bla_purge_claims() when traversing the list of claims during concurrent claim release. A local user can trigger concurrent claim handling to cause a denial of service.

The issue occurs because a claim being released may have its backbone_gw pointer set to NULL before delayed RCU freeing completes.

660) Out-of-bounds read (CVE-ID: CVE-2026-46232)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in dualshock4_parse_report when processing a crafted HID report from a malicious device. An attacker with physical access can provide a device that misreports the number of touch reports to disclose sensitive information.

Data is exposed via evdev when the DS4_TOUCH_POINT_INACTIVE bit is set.

661) Memory leak (CVE-ID: CVE-2026-46231)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in batadv_bla_add_claim() when handling a failed claim hash insert. A local user can trigger an error path that leaks a reference to a backbone_gw object to cause a denial of service.

662) Out-of-bounds read (CVE-ID: CVE-2026-46230)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the amdgpu vcn3 decoder message parser when parsing decoder messages from a buffer object. A local user can supply a specially crafted decoder message to disclose sensitive information.

663) Improper Initialization (CVE-ID: CVE-2026-46229)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in the KFD VRAM allocation path when allocating VRAM buffers for compute kernels. A local user can allocate VRAM buffers and observe stale data from prior use to disclose sensitive information.

Stale page table remnants may be exposed in user buffers.

664) Improper resource shutdown or release (CVE-ID: CVE-2026-46228)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the ch341 spi usb driver when the driver is unbound without the device being physically disconnected. A local user can trigger driver unbind conditions to cause a denial of service.

This can occur during probe deferral or configuration changes.

665) Use-after-free (CVE-ID: CVE-2026-46227)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free and type confusion in sctp_sendmsg() SCTP_SENDALL path when iterating associations after sctp_sendmsg_to_asoc() drops and reacquires the socket lock. A local user can trigger concurrent association migration or freeing to execute arbitrary code.

The issue is reachable with no effective capabilities, and the type-confusion path can lead to a controlled indirect call via the outqueue.sched->init_sid pointer.

666) Improper resource shutdown or release (CVE-ID: CVE-2026-46226)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the fsl spi controller driver when the driver is unbound. A local user can trigger driver unbind while the controller is still registered to cause a denial of service.

667) Improper resource shutdown or release (CVE-ID: CVE-2026-46225)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the rspi driver controller deregistration logic when the driver is unbound. A local user can trigger driver unbind while the controller is still registered to cause a denial of service.

668) Improper resource shutdown or release (CVE-ID: CVE-2026-46224)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in xe_dma_buf_init_obj() when handling allocation failures. A local user can trigger an allocation failure during dma-buf object initialization to cause a denial of service.

669) Race condition (CVE-ID: CVE-2026-46223)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in cgroup rmdir handling when removing a cgroup while zombie reaping and pid namespace teardown are in progress. A local user can trigger cgroup removal in this state to cause a denial of service.

The issue can lead to an A-A deadlock because the reaper can block in an uninterruptible wait while the resources it is waiting on cannot be released.

670) NULL pointer dereference (CVE-ID: CVE-2026-46222)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the rkcif media driver pads when enabling the stream with pads not connected to devices. A local user can issue a stream-on ioctl to trigger a kernel crash to cause a denial of service.

671) Memory leak (CVE-ID: CVE-2026-46221)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in init_one_mc() when registering and removing devices. A local user can trigger the affected code path to cause a denial of service.

672) Reachable assertion (CVE-ID: CVE-2026-46220)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to reachable assertion use in sdma_v4_0_ring_emit_fence() when processing crafted DRM_IOCTL_AMDGPU_CS submissions. A local user can submit a specially crafted command submission request to cause a denial of service.

The issue can trigger a fatal kernel panic in a scheduler worker thread when a misaligned fence writeback address reaches the fence emission path.

673) Use-after-free (CVE-ID: CVE-2026-46219)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in the mpc52xx SPI driver state machine work handling when processing an unbind operation after an interrupt schedules work. A local attacker can trigger device unbinding while scheduled work remains pending to execute arbitrary code.

674) Out-of-bounds read (CVE-ID: CVE-2026-46218)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ib_get_value and ib_set_value when processing indirect buffer data at predefined offsets. A local user can supply a specially crafted indirect buffer to cause a denial of service.

The issue affects the uvd, vce, and vcn code paths.

675) NULL pointer dereference (CVE-ID: CVE-2026-46216)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in intel_hdcp_gsc_check_status() when handling a system state where media_gt is disabled via configfs. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when media GT is disabled and media_gt remains NULL.

676) Use-after-free (CVE-ID: CVE-2026-46215)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to use-after-free in drm change_handle when handling concurrent gem_close operations during a prime handle swap. A local user can trigger concurrent handle operations to cause a denial of service.

677) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46214)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in virtio_transport_recv_listen() when handling connection attempts with a transport mismatch. A remote attacker can trigger repeated transport mismatch failures to cause a denial of service.

After enough such failures, the listener rejects all new connections because the accept queue backlog count remains permanently incremented.

678) Use-after-free (CVE-ID: CVE-2026-46213)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the appletb-kbd inactivity timer cleanup path when handling driver tear-down and timer re-arming through HID event callbacks. A local user can trigger driver removal or error-handling conditions to cause a denial of service.

The issue can be reached through two race windows during cleanup, including concurrent backlight device unbind activity and late HID event callbacks that re-arm the timer.

679) Use-after-free (CVE-ID: CVE-2026-46212)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in batadv_bla_del_backbone_claims() when deleting backbone claims. A local user can trigger claim deletion to cause a denial of service.

680) NULL pointer dereference (CVE-ID: CVE-2026-46211)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in msm_ioctl_gem_info_get_metadata() when handling a metadata retrieval ioctl request after memory allocation failure. A local user can trigger allocation failure and invoke the ioctl to cause a denial of service.

681) Use-after-free (CVE-ID: CVE-2026-46210)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the MBPF checker when processing concurrent instance teardown and core list iteration. A local user can trigger concurrent operations that free fmt_src while it is still referenced from the core list to cause a denial of service.

The issue occurs because instance-specific locking and core list locking protect different scopes, allowing a dangling pointer to be dereferenced during parallel instance handling.

682) Integer overflow (CVE-ID: CVE-2026-46209)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform out-of-bounds read or write operations.

The vulnerability exists due to an integer overflow in drm_gem_fb_init_with_funcs() when initializing framebuffer plane dimensions for sub-sampled pixel formats. A local user can create a specially crafted framebuffer configuration to perform out-of-bounds read or write operations.

The issue can occur for certain pixel format and dimension combinations where plane height calculation truncates instead of rounding up, causing the GEM object size check to accept an undersized object.

683) Use-after-free (CVE-ID: CVE-2026-46208)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tp_meter session handling during mesh teardown when processing tp_meter sessions as a mesh interface is being removed. A local user can trigger tp_meter activity during interface teardown to cause a denial of service.

684) Use of uninitialized resource (CVE-ID: CVE-2026-46207)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in virtio_transport_build_skb() when processing non-linear skbs for delivery to the vsockmon tap device. A local attacker can trigger handling of a specially crafted non-linear skb to disclose sensitive information.

The issue affects payload copying to the monitor interface, where no payload is copied and data remains uninitialized.

685) Race condition (CVE-ID: CVE-2026-46206)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in tp_meter when starting new sender or receiver sessions after mesh_state has left BATADV_MESH_ACTIVE. A local user can start a new tp_meter sender or receiver session during teardown to cause a denial of service.

686) Improper access control (CVE-ID: CVE-2026-46205)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to perform unauthorized ioctl operations.

The vulnerability exists due to improper access control in private ioctl handlers when handling ioctl commands. A local user can invoke a non-zero private ioctl command to perform unauthorized ioctl operations.

687) Out-of-bounds read (CVE-ID: CVE-2026-46204)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the amdgpu vcn4 IB parser when parsing IB data. A local user can provide a specially crafted IB to disclose sensitive information.

688) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-46203)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access to hardware registers in cadence-quadspi driver unbind handling when unbinding the driver while the controller is runtime suspended. A local user can trigger driver unbind to cause a denial of service.

689) Improper locking (CVE-ID: CVE-2026-46202)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper execution of a blocking operation in atomic context in the hid-appletb-kbd driver when handling keyboard and input events or inactivity timeouts. A local user can trigger crafted input activity to cause a denial of service.

690) Improper resource shutdown or release (CVE-ID: CVE-2026-46201)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in xe_gem_prime_import() when handling dma-buf imports after xe_dma_buf_init_obj() fails. A local user can trigger an error during dma-buf import to cause a denial of service.

691) Improper resource shutdown or release (CVE-ID: CVE-2026-46200)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mpc52xx spi controller driver when the driver is being unbound. A local user can trigger driver unbind operations to cause a denial of service.

692) Out-of-bounds read (CVE-ID: CVE-2026-46199)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the drm/amdgpu vcn4 decoder message parser when parsing a decoder message from a buffer object. A local user can provide a specially crafted decoder message to disclose sensitive information.

693) Integer overflow (CVE-ID: CVE-2026-46198)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an integer overflow in batadv_iv_ogm_send_to_if when processing aggregated OGM packets. A local user can trigger the flawed size calculation to disclose sensitive information.

694) Out-of-bounds read (CVE-ID: CVE-2026-46197)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the SVM ioctl handler when processing a user-controlled attribute count. A local user can supply a crafted ioctl request to cause a denial of service.

695) Improper resource shutdown or release (CVE-ID: CVE-2026-46196)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in tracepoint_add_func() when handling tracepoint registration failures after invoking ext->regfunc(). A local user can trigger a func_add() failure during probe installation to cause a denial of service.

For syscall tracepoints, the issue can leave syscall tracing state enabled and impose persistent syscall entry and exit overhead until reboot.

696) Race condition (CVE-ID: CVE-2026-46194)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the f2fs extent tree handling in __destroy_extent_node() and __update_extent_tree_range() when concurrent inode drop and writeback operations occur. A local user can trigger concurrent writeback during extent node destruction to cause a denial of service.

The issue can trigger f2fs_bug_on() because new extent nodes may be inserted into the same extent tree while extent nodes are being destroyed, and EX_BLOCK_AGE updates were left unprotected.

697) Incorrect calculation (CVE-ID: CVE-2026-46193)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of ESN high bits in async callbacks in the AH implementation when processing AH packets with ESN enabled using an asynchronous AH implementation. A local user can send specially crafted AH traffic to cause a denial of service.

The issue affects both IPv4 and IPv6 AH paths, and exploitation requires ESN to be enabled with an asynchronous AH implementation selected.

698) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-46192)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in microchip-core-qspi when handling emulated read-only dual/quad operations. A local user can trigger a crafted QSPI read operation to cause a denial of service.

The issue can brick the transfer because the driver attempts to transmit garbage data during read handling.

699) Out-of-bounds write (CVE-ID: CVE-2026-46191)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in fbcon_rotate_font() and the rotated font buffer handling in fbcon when printing to a rotated console after console rotation reallocation fails. A local user can print a high-enough character code to overflow the font buffer to cause a denial of service.

Exploitation requires a console to be using rotation and the font reallocation during rotation to fail.

700) Out-of-bounds read (CVE-ID: CVE-2026-46190)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in spi_nor_params_show() when displaying SPI NOR parameters through debugfs. A local attacker can trigger access to debugfs output to disclose sensitive information.

The issue is caused by passing the byte size of an array of pointers instead of the actual element count, which can permit reads past the end of the names array on 64-bit systems when certain flag bits are set.

701) Double free (CVE-ID: CVE-2026-46189)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in pvrdma_alloc_ucontext() error path when handling ucontext allocation failures. A local user can trigger the error path to cause a denial of service.

702) NULL pointer dereference (CVE-ID: CVE-2026-46188)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in __octep_vf_oq_process_rx() when processing received packets after napi_build_skb() allocation failure. A local user can trigger allocation failure conditions to cause a denial of service.

703) Use-after-free (CVE-ID: CVE-2026-46187)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the rsi wifi driver kthread handling logic when stopping a kernel thread after it has already self-exited. A local user can trigger the race condition to cause a denial of service.

The issue occurs in the rare case where self-exit via kthread_complete_and_exit() happens before an external stop via kthread_stop().

704) Out-of-bounds read (CVE-ID: CVE-2026-46186)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in virtbt_rx_handle() and Bluetooth HCI packet classification when processing a backend-supplied RX packet with an insufficient header length. A local user can provide a specially crafted RX completion with a truncated packet to disclose sensitive information.

The issue can be triggered when the virtio Bluetooth device has an active CIS_LINK, BIS_LINK, or PA_LINK connection.

705) Improper input validation (CVE-ID: CVE-2026-46184)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in detect_usb_format() when processing class-specific USB descriptor fields from a connected device. An attacker with physical access can provide a crafted USB device with bNrChannels set to 0 to cause a denial of service.

The issue can lead to a kernel crash in playback_urb_complete() and capture_urb_complete() because a zero frame_bytes value is later used as a divisor.

706) Use-after-free (CVE-ID: CVE-2026-46183)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use-after-free in damon_sysfs_quot_goal->path handling in the DAMON sysfs 'path' file when performing concurrent reads and writes through separate open files. A local user can trigger concurrent access to read freed memory and disclose sensitive information.

The issue does not race when the same open file is used for both operations due to kernfs open file locking.

707) Use of Uninitialized Variable (CVE-ID: CVE-2026-46182)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized stack memory in papr_hvpipe when copying a header structure to userspace. A local user can trigger the affected operation to disclose sensitive information.

The issue is caused by uninitialized padding bytes in the structure being exposed through copy_to_user().

708) Race condition (CVE-ID: CVE-2026-46181)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in mlx4_srq_event() when handling RDMA SRQ events. A local user can trigger an event for a partially initialized srq object to cause a denial of service.

The issue can occur if an event is delivered before the srq object has finished initializing.

709) Use-after-free (CVE-ID: CVE-2026-46180)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the brcmfmac watchdog task handling when stopping the watchdog task. A local user can trigger the watchdog task shutdown to cause a denial of service.

710) Division by zero (CVE-ID: CVE-2026-46179)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to divide by zero in compressed stream pointer reporting when reporting the pointer for an unconfigured stream. A local user can trigger pointer operations on an unconfigured compressed stream to cause a denial of service.

711) Improper resource shutdown or release (CVE-ID: CVE-2026-46178)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in mlx4_ib_create_srq() when handling error conditions during SRQ creation. A local user can trigger an error during SRQ creation to cause a denial of service.

712) Excessive Iteration (CVE-ID: CVE-2026-46177)

CWE-ID: CWE-834 - Excessive Iteration

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper restriction of excessive iteration in the ipmi driver when processing event and receive message fetches from a BMC that continues reporting available data. A local user can trigger interaction with a malfunctioning or malicious BMC to cause a denial of service.

The issue can also be triggered when the si interface attention state remains stuck and repeatedly causes flag fetch handling.

713) Use-after-free (CVE-ID: CVE-2026-46176)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free and double free in mlx5_ib_dev_res_srq_init() when handling an error during SRQ initialization after ib_create_srq() fails for the second SRQ. A local user can trigger the faulty initialization path to cause a denial of service.

The issue occurs because freed and error-pointer SRQ values are stored and later dereferenced during queue pair creation and cleanup.

714) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46175)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause file system inconsistency.

The vulnerability exists due to improper state management in f2fs node block migration when performing foreground garbage collection of node blocks. A local user can trigger node block migration and subsequent file system checking to cause file system inconsistency.

The issue occurs because dentry and fsync marks are not cleared during foreground garbage collection, which can cause fsck to misinterpret migrated node blocks as fsync-written data.

715) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-46174)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause instruction corruption.

The vulnerability exists due to improper isolation of shared resources in Zen2 op cache when executing code on the system. A local user can run code locally to cause instruction corruption.

716) Use-after-free (CVE-ID: CVE-2026-46173)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to use-after-free in make_task_dead()/do_task_dead() task exit handling when an already-exiting task oopses during task exit. A local user can trigger an oops in a file_operations::release handler to cause memory corruption.

This can result in two tasks running on the same stack.

717) Memory leak (CVE-ID: CVE-2026-46172)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in xfrm6_rcv_encap() when processing IPv6 packets that trigger an error route lookup. A remote attacker can send specially crafted packets to cause a denial of service.

Repeated packets hitting this path leak dst entries.

718) Memory leak (CVE-ID: CVE-2026-46171)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in kvm_riscv_vcpu_alloc_vector_context when allocating vector context buffers. A local user can trigger the allocation failure path to cause a denial of service.

719) Improper resource shutdown or release (CVE-ID: CVE-2026-46170)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mptcp path manager ADD_ADDR retransmission timer handling when processing ADD_ADDR retransmissions. A local user can trigger ADD_ADDR retransmissions to cause a system hang.

The issue occurs when the last socket reference is released from the timer handler, leading to an indefinite wait on the same timer.

720) Use of Uninitialized Variable (CVE-ID: CVE-2026-46169)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uninitialized memory use in hfs_brec_read() and catalog record handling in the hfsplus filesystem code when mounting a corrupted filesystem. A local user can mount a specially crafted filesystem image to cause a denial of service.

721) Improper locking (CVE-ID: CVE-2026-46168)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in timestamp socket option handling when setting timestamp-related socket options. A local user can invoke timestamp socket option operations to cause a denial of service.

722) Heap Inspection (CVE-ID: CVE-2026-46167)

CWE-ID: CWE-244 - Improper Clearing of Heap Memory Before Release ('Heap Inspection')

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to uninitialized heap memory exposure in the usblp driver LPGETSTATUS ioctl path when processing a status response from a connected USB printer. An attacker with physical access can cause a malicious printer to return zero bytes in response to a status request to disclose sensitive information.

The issue occurs because the status buffer may contain stale heap data before the first LPGETSTATUS ioctl call.

723) Use-after-free (CVE-ID: CVE-2026-46166)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in radar detect work in mac80211 when cancelling dfs cac during list iteration. A local user can trigger the affected workflow to cause a denial of service.

724) Improper locking (CVE-ID: CVE-2026-46165)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in the openvswitch vport release logic when removing tunnel ports. A local user can trigger device removal to cause a denial of service.

The issue results in a self-deadlock during device removal because the RCU callback that releases the reference is not reached.

725) Double free (CVE-ID: CVE-2026-46164)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in create_space_info_sub_group() when handling an error from kobject_init_and_add(). A local user can trigger the error path to cause a denial of service.

726) Out-of-bounds read (CVE-ID: CVE-2026-46163)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in b43legacy_rx() when processing received frames with a firmware-controlled key index. A remote attacker can supply a crafted key index value to disclose sensitive information.

727) Double free (CVE-ID: CVE-2026-46162)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in ice_sf_eth_activate() when handling an auxiliary_device_add() failure. A local user can trigger the error path to cause a denial of service.

728) Division by zero (CVE-ID: CVE-2026-46161)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to divide-by-zero in setup_geo() when processing a user-provided layout parameter with zero far_copies and the improved far set layout selected. A local user can supply a crafted layout value to cause a denial of service.

The issue is triggered when far_copies is zero under the improved far set layout.

729) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46160)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause filesystem corruption and a denial of service.

The vulnerability exists due to improper state update in the btrfs directory unlink handling when removing a directory and later fsyncing it through an open file descriptor. A local user can remove a directory, retain a file descriptor to it, and trigger fsync to cause filesystem corruption and a denial of service.

The issue can cause log replay to fail with an -EIO error when the filesystem is mounted.

730) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-46159)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a time-of-check time-of-use race in btrfs_ioctl_space_info() when processing a space information ioctl request while block groups are concurrently removed. A local user can trigger the ioctl and race concurrent block group removal to disclose sensitive information.

The issue can result in copying uninitialized kmalloc heap bytes to userspace.

731) Improper resource shutdown or release (CVE-ID: CVE-2026-46158)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mptcp path manager ADD_ADDR retransmission handling when retransmitting ADD_ADDR messages. A local user can trigger ADD_ADDR retransmissions to cause a denial of service.

732) Race condition (CVE-ID: CVE-2026-46157)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a data race in the ALSA pcm oss subsystem when accessing the runtime.oss.trigger field concurrently. A local user can trigger concurrent access to confuse operation and cause a denial of service.

The issue involves a bit field, so concurrent writes may overwrite other bit fields as well.

733) Improper input validation (CVE-ID: CVE-2026-46156)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in loongson_gpu_fixup_dma_hang() when scanning PCI devices during system initialization. A local user can attach a discrete GPU in a configuration that causes an invalid register address to be used to trigger a kernel panic.

The issue occurs on LoongArch systems when a discrete GPU is present and the switch logic does not match the expected device cases.

734) Use-after-free (CVE-ID: CVE-2026-46154)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in scx_group_set_{weight,idle,bandwidth}() and sched_ext cgroup setters when racing scheduler disable and enable operations while handling cgroup setting changes. A local user can trigger concurrent cgroup setter activity to dereference a freed scheduler pointer and cause a denial of service.

The issue occurs because a cached scx_root pointer can become stale before scx_cgroup_ops_rwsem is acquired.

735) Improper resource shutdown or release (CVE-ID: CVE-2026-46153)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in vlan_dev_set_egress_priority() when repeatedly setting and clearing egress priority mappings with distinct skb priorities. A local user can trigger repeated set and clear operations to cause a denial of service.

The issue results in mapping nodes being retained until device teardown, leading to memory consumption over time.

736) Race condition (CVE-ID: CVE-2026-46152)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause incorrect packet processing.

The vulnerability exists due to a race condition in ieee80211_invoke_fast_rx() when processing packets in parallel RX paths. A local user can trigger concurrent packet processing to cause incorrect packet processing.

This issue arises because concurrent callers share a single rx_result instance, which can be overwritten between ieee80211_rx_mesh_data() and the subsequent switch on the result.

737) Use of uninitialized resource (CVE-ID: CVE-2026-46151)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in the usblp driver when processing a short IEEE 1284 GET_DEVICE_ID control response from a connected USB printer. An attacker with physical access can connect a specially crafted device that returns a truncated response with a forged length field to disclose sensitive information.

The leaked data may be exposed through the ieee1284_id sysfs attribute and the IOCNR_GET_DEVICE_ID ioctl.

738) Improper access control (CVE-ID: CVE-2026-46150)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass permission checks.

The vulnerability exists due to improper access control in fsnotify_get_mark_safe() when processing fanotify permission events. A local user can trigger permission events in the presence of an unrelated detached mark to bypass permission checks.

739) Out-of-bounds read (CVE-ID: CVE-2026-46149)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tg_pt_gp_members_show() when formatting and copying LUN paths to a sysfs reader. A local user can read the affected sysfs entry with a long fabric WWN value to disclose sensitive information.

When CONFIG_FORTIFY_SOURCE is enabled, exploitation triggers fortify_panic() instead of leaking adjacent stack contents.

740) Improper access control (CVE-ID: CVE-2026-46148)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to interfere with SPI communications.

The vulnerability exists due to improper access control in the microchip-core-qspi driver when handling chip select lines for transfers involving multiple SPI devices. A local user can trigger access to a device attached via GPIO chip select while the built-in chip select is incorrectly asserted to interfere with SPI communications.

The issue occurs when multiple devices are attached to the QSPI controller and the built-in chip select is used alongside GPIO-based chip selects.

741) Race condition (CVE-ID: CVE-2026-46147)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in register_hyp_vcpu() and pkvm_load_hyp_vcpu() when publishing and loading vCPU pointers during vCPU initialization. A local user can trigger concurrent access to cause a denial of service.

A concurrent reader may observe a partially initialized hyp_vcpu object.

742) Improper resource shutdown or release (CVE-ID: CVE-2026-46147)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in __pkvm_init_vcpu() when initializing a vCPU after shared memory has been pinned and a subsequent check fails. A local user can trigger the error path to cause a denial of service.

The issue can permanently leak pin references on the host vCPU and SVE state pages.

743) Improper input validation (CVE-ID: CVE-2026-46146)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in convert_chmap_v3() when parsing a malformed USB audio descriptor. A local user can connect or present a specially crafted USB audio device to trigger an endless loop and cause a denial of service.

744) Out-of-bounds write (CVE-ID: CVE-2026-46145)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to overwrite kernel memory.

The vulnerability exists due to an out-of-bounds write in the RDMA/mana rx hash key handling when processing a user-supplied uAPI structure. A local user can supply a crafted rx_hash_key_len value to overwrite kernel memory.

745) Improper resource shutdown or release (CVE-ID: CVE-2026-46144)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in mana_ib_create_qp_rss() when handling queue pair creation errors. A local user can trigger an error during queue pair creation to cause a denial of service.

746) Improper resource shutdown or release (CVE-ID: CVE-2026-46143)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in q6apm-lpass-dai when prepare is called multiple times for the playback path. A local user can repeatedly trigger prepare to cause a denial of service.

747) Improper access control (CVE-ID: CVE-2026-46142)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access to a restricted register in net: libwx when initializing a virtual function device. A local user can initialize a virtual function to cause a denial of service.

The issue is triggered when a virtual function attempts to read the PF-restricted register WX_CFG_PORT_ST, leading to a system hang.

748) Improper resource shutdown or release (CVE-ID: CVE-2026-46141)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in xive_irq_free_data() in the powerpc XIVE interrupt handling code when freeing MSI-X irqdomain data for an NVMe device. A local user can trigger allocation and release of MSI-X vectors to cause a denial of service.

749) Out-of-bounds read (CVE-ID: CVE-2026-46140)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in btmtk_usb_hci_wmt_sync() when processing a short firmware response in a WMT event SKB. A local attacker can provide a specially crafted short firmware response to disclose sensitive information.

750) Use of uninitialized resource (CVE-ID: CVE-2026-46139)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uninitialized memory in build_sec_desc() when building an ACL descriptor. A local user can trigger construction of a security descriptor with a non-zero reserved field to cause a denial of service.

The issue can cause chmod to fail with EINVAL when the malformed security descriptor is rejected.

751) Out-of-bounds read (CVE-ID: CVE-2026-46138)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hci_le_create_big_complete_evt when processing a crafted LE_Create_BIG_Complete event. A remote attacker can send a specially crafted Bluetooth controller event to cause a denial of service.

The issue can also result in an infinite loop while hci_dev_lock is held when the event contains fewer bis_handle entries than expected or num_bis is zero.

752) Integer underflow (CVE-ID: CVE-2026-46136)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer underflow in the clc buffer length handling in the mt7921 driver when retrieving the country power setting. A local user can trigger the vulnerable code path to cause a denial of service.

The issue may result in an almost infinite loop or an invalid power setting that causes driver initialization failure.

753) NULL pointer dereference (CVE-ID: CVE-2026-46134)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in cros_typec_register_thunderbolt() and cros_typec_altmode_work() when handling Thunderbolt registration and later altmode work processing. A local user can trigger the vulnerable code path to cause a denial of service.

754) Out-of-bounds read (CVE-ID: CVE-2026-46133)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rxe_icrc_hdr() and opcode handling in the Soft RoCE receive path when processing a specially crafted UDP packet with an unknown RDMA opcode. A remote attacker can send a specially crafted UDP packet to trigger an out-of-bounds read and cause a denial of service.

The issue can be triggered without authentication after the RDMA RXE interface is enabled, and no queue pair or connection setup is required.

755) Use of Uninitialized Variable (CVE-ID: CVE-2026-46132)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to uninitialized stack memory in rtnl_fill_vfinfo when handling RTM_GETLINK requests with an IFLA_EXT_MASK attribute carrying RTEXT_FILTER_VF. A local attacker can send a crafted netlink request to disclose sensitive information.

The issue can leak up to 26 bytes of uninitialized kernel stack per virtual function per request to userspace.

756) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-46131)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper check of nested EPT/NPT state in KVM x86 slow flush hypercalls when handling hypercalls from a nested guest. A local user can trigger the affected hypercall path to cause a denial of service.

Exploitation requires a nested virtualization scenario in which an L2 guest is running.

757) Out-of-bounds read (CVE-ID: CVE-2026-46130)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in fec_decode_bufs() in dm-verity-fec when decoding parity bytes split across parity blocks. A local user can trigger the vulnerable code path to disclose sensitive information.

The issue occurs only for certain non-default fec_roots values and when the maximum number of buffers cannot be allocated due to low-memory conditions.

758) Double free (CVE-ID: CVE-2026-46129)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in create_space_info() when handling an error after a failed kobject_init_and_add() call. A local user can trigger the vulnerable error path to cause a denial of service.

759) Improper input validation (CVE-ID: CVE-2026-46128)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ipmi event message buffer response handling when processing event message buffer responses from a BMC. A local user can trigger processing of a malformed or empty response to cause a denial of service.

Some BMCs may return an empty message instead of an error when events are fetched.

760) NULL pointer dereference (CVE-ID: CVE-2026-46127)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ocrdma_copy_pd_uresp() when handling error conditions. A local user can trigger an error path to cause a denial of service.

761) Double free (CVE-ID: CVE-2026-46126)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() when unwinding error paths during queue pair creation. A local user can trigger a failure during queue pair creation to cause a denial of service.

762) Use-after-free (CVE-ID: CVE-2026-46125)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in debugfs when handling failed connection preparation for mlo connections. A local user can trigger connection preparation failure and access the affected debugfs state to cause a denial of service.

The issue occurs when debugfs is enabled and an interface is reset from mld to non-mld, which recreates its debugfs entries.

763) Improper input validation (CVE-ID: CVE-2026-46124)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper input validation in isofs_export_iget when processing block numbers from NFS file handles. A remote user can send a crafted NFS file handle to disclose sensitive information.

Exploitation requires an authenticated NFS peer and affects isofs exported over NFS from loop-mounted images.

764) Out-of-bounds read (CVE-ID: CVE-2026-46123)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in virtbt_rx_work() and virtbt_rx_handle() when processing device-reported receive lengths from the virtio Bluetooth backend. A local attacker can provide a crafted length value to cause the kernel to read uninitialized memory and disclose sensitive information.

The issue can be triggered when the backend reports a receive length larger than the 1000-byte buffer exposed to the device, or when it reports an empty completion with a zero length.

765) Out-of-bounds read (CVE-ID: CVE-2026-46122)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in b43_rx() when processing firmware-provided key index values. A local attacker can supply an invalid key index to disclose sensitive information.

The issue occurs because the firmware-controlled key index can exceed the dev->key[] array size of 58 entries.

766) Use-after-free (CVE-ID: CVE-2026-46121)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in DAMON sysfs memcg_path file handling when performing concurrent reads and writes through separate open files. A local user can trigger concurrent access to a freed buffer to cause a denial of service.

The issue affects user-driven direct reads and writes, while reads performed during parameter committing are separately synchronized.

767) Use-after-free (CVE-ID: CVE-2026-46120)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ip6erspan_changelink() when changing link configuration after network namespace migration. A local user can trigger tunnel reinsertion into the wrong per-netns hash to cause a denial of service.

The issue is reachable from an unprivileged user namespace.

768) NULL pointer dereference (CVE-ID: CVE-2026-46118)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in papr_hvpipe_dev_create_handle() when handling an ioctl request. A local user can send a crafted ioctl request to cause a denial of service.

The issue can trigger a kernel panic.

769) Improper input validation (CVE-ID: CVE-2026-46117)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to improper input validation in mana_ib_create_qp_rss() when processing user-supplied work queue configurations through the RDMA uAPI. A local user can specify work queues sharing the same completion queue to corrupt kernel memory.

770) Use-after-free (CVE-ID: CVE-2026-46116)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __xfrm_state_delete when deleting xfrm_state list entries during xfrm_state lifecycle handling. A local user can trigger repeated deletion of the same xfrm_state object to cause a denial of service.

The issue was reproduced under syzkaller load during network namespace cleanup in the xfrm subsystem.

771) Out-of-bounds read (CVE-ID: CVE-2026-46114)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in atomic_write_reply() in the RDMA rxe responder when processing a crafted ATOMIC_WRITE request with a zero-length logical payload. A remote attacker can send a specially crafted ATOMIC_WRITE request to disclose sensitive information.

The issue can leak kernel tailroom bytes into the attacker's memory region, including recognizable kernel strings and partial pointer words.

772) Use-after-free (CVE-ID: CVE-2026-46113)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in KVM shadow paging when handling guest page table changes between VM entries. A local user can modify guest page tables to create a stale reverse-mapping entry and trigger a stale rmap walk to cause a denial of service.

This can be triggered during operations such as dirty logging or MMU notifier invalidations.

773) Improper locking (CVE-ID: CVE-2026-46112)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to corrupt memory.

The vulnerability exists due to improper locking in hns_roce_create_qp_common() and hns_roce_qp_remove() when handling error unwind during queue pair creation. A local user can trigger the error path to corrupt memory.

774) Use-after-free (CVE-ID: CVE-2026-46111)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in create_big_sync/create_big_complete in the Bluetooth hci_conn handling code when processing BIG creation completion after an asynchronous operation on a stale connection. A local attacker can trigger BIG creation and cause the kernel to dereference a freed connection pointer to cause a denial of service.

775) NULL pointer dereference (CVE-ID: CVE-2026-46110)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in stmmac_rx() and stmmac_rx_zc() in the stmmac driver when processing receive descriptors after RX memory exhaustion. A local attacker can trigger memory starvation and network receive processing to cause a denial of service.

The issue occurs when dirty descriptors with OWN=0 and NULL buffers are mistaken for completed descriptors.

776) Memory leak (CVE-ID: CVE-2026-46109)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in ulpi_register() when handling error paths before device registration. A local user can trigger failures in ulpi_of_register() or ulpi_read_id() to cause a denial of service.

777) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-46108)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the ipmi:si driver when handling message allocation failures. A local user can trigger a message allocation failure to cause a denial of service.

778) Improper update of reference count (CVE-ID: CVE-2026-46107)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in the dm-thin rebalance_children function when rebalancing internal btree nodes with a shared child node. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because grandchild node reference counts are not increased when the shared child node is retained, which can lead to "device mapper: space map common: unable to decrement block" errors.

779) Race condition (CVE-ID: CVE-2026-46106)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in eventfs remount handling when walking events during remount operations. A local user can trigger concurrent remount and event creation or removal operations to cause a denial of service.

The issue occurs because the walk over eventfs children is performed without the required eventfs mutex and SRCU protection, which can lead to dereference of reclaimed or poisoned list entries.

780) Improper input validation (CVE-ID: CVE-2026-46105)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the mpt3sas NVMe I/O handling logic when processing oversized NVMe I/O requests. A local user can trigger oversized I/O operations to cause a denial of service.

The issue can lead to a kernel oops because the driver uses a fixed 4K PRP list buffer that supports at most 512 entries, limiting transfers to 2 MiB.

781) Improper access control (CVE-ID: CVE-2026-46104)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass SELinux socket permission checks.

The vulnerability exists due to improper access control in sock_has_perm() and nlmsg_sock_has_extended_perms() when handling socket permission checks in stacked LSM configurations. A local user can trigger access checks on a socket with an incorrectly interpreted security blob to bypass SELinux socket permission checks.

The issue occurs when another LSM allocates socket blob storage before SELinux, causing invalid SID and class values to be used in AVC checks.

782) NULL pointer dereference (CVE-ID: CVE-2026-45846)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in bareudp_fill_metadata_dst() when processing Open vSwitch packet execution on a bareudp device that is down. A local user can send a crafted netlink request to trigger a kernel crash and cause a denial of service.

The issue occurs on the IPv6 path when the code uses bareudp->sock after it has been cleared during device shutdown.

783) NULL pointer dereference (CVE-ID: CVE-2026-45845)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in taprio class dump handling when deleting a TAPRIO child qdisc and requesting a class dump. A local user can delete an explicit child qdisc and trigger a class dump to cause a denial of service.

Exploitation is reachable in a network namespace with CAP_NET_ADMIN, and on systems with unprivileged user namespaces enabled, user interaction is not required.

784) Out-of-bounds read (CVE-ID: CVE-2026-45844)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause incorrect packet filtering decisions.

The vulnerability exists due to an out-of-bounds read in arp_packet_match() when parsing ARP payloads on IEEE1394 interfaces. A local user can send a specially crafted ARP packet to cause incorrect packet filtering decisions.

The issue occurs because IPv4-over-IEEE1394 ARP omits the target hardware address field, causing rule evaluation to use incorrect bytes for target address comparisons.

785) Out-of-bounds read (CVE-ID: CVE-2026-45843)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in slhc_uncompress() when parsing a short VJ-compressed TCP header with optional fields requested in the change byte. A remote attacker can send a specially crafted compressed packet to disclose sensitive information.

The over-read bytes are incorporated into cached connection state and may be reflected into subsequent reconstructed packets.

786) NULL pointer dereference (CVE-ID: CVE-2026-45842)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the SLIP/PPP VJ receive handling code when processing inbound VJ-compressed or VJ-uncompressed frames after installing a malformed VJ state with zero receive slots. A local user can configure PPP compression state through /dev/ppp and trigger processing of a frame selecting slot 0 to cause a denial of service.

The issue is reachable through PPPIOCSMAXCID from an unprivileged user namespace.

787) Division by zero (CVE-ID: CVE-2026-45841)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to divide-by-zero in nf_osf_match_one() in nfnetlink_osf when processing a subsequent matching TCP SYN after a crafted fingerprint is added via nfnetlink. A local user can add a fingerprint with a zero wss value to trigger a kernel panic.

Exploitation requires CAP_NET_ADMIN privileges.

788) Improper input validation (CVE-ID: CVE-2026-45840)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the openvswitch vport netlink reply helpers when handling a crafted upcall PID array in vport mutation operations. A local user can supply an oversized PID array to trigger a kernel BUG and cause a denial of service.

On systems with unprivileged user namespaces enabled, the issue is reachable via unshare -Urn.

789) Out-of-bounds read (CVE-ID: CVE-2026-45839)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in bpf_core_parse_spec() when processing a crafted BPF program containing negative CO-RE accessor indices. A local privileged user can load a specially crafted BPF program to cause a denial of service.

The issue is reachable during BPF_PROG_LOAD on systems with CONFIG_DEBUG_INFO_BTF enabled.

790) Out-of-bounds read (CVE-ID: CVE-2026-45838)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in cgroup_storage_get_next_key() when processing end-of-list conditions for cgroup storage map keys. A local user can trigger the function on the last list element to disclose sensitive information.

The issue occurs because the code reads a key from a bogus pointer that aliases internal map fields and copies the result to userspace.

791) Use-after-free (CVE-ID: CVE-2026-45837)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in arena_vm_close and bpf_arena_free_pages when handling inherited arena VMAs after a fork. A local user can trigger a stale VMA reference by calling bpf_arena_free_pages() in a child process after the parent unmaps the arena to cause a denial of service.

The issue occurs when an arena VMA is inherited across fork and the child retains a pointer to the parent VMA.

792) NULL pointer dereference (CVE-ID: CVE-2026-45836)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in l2cap_sock_get_sndtimeo_cb() when handling Bluetooth L2CAP socket operations. A local user can trigger the vulnerable code path to cause a denial of service.

793) NULL pointer dereference (CVE-ID: CVE-2026-45835)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in l2cap_sock_new_connection_cb() when handling a new Bluetooth L2CAP connection. A remote attacker can trigger a crafted connection attempt to cause a denial of service.

794) NULL pointer dereference (CVE-ID: CVE-2026-45834)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in l2cap_sock_state_change_cb() when handling Bluetooth L2CAP socket state changes. A local user can trigger the vulnerable callback to cause a denial of service.

795) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43502)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in rds_message_purge() in the net/rds subsystem when cleaning up a failed zerocopy send before the message is queued. A local user can trigger an early zerocopy send failure to cause a denial of service.

The issue occurs after user pages have been pinned but before the message is attached to the sending socket.

796) Improper access control (CVE-ID: CVE-2026-43498)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause data corruption.

The vulnerability exists due to improper access control in GEM buffer export handling when re-exporting imported GEM objects. A local user can re-export an imported GEM buffer to cause data corruption.

The issue can also lead to incorrect device access because buffer flag settings are lost during re-export.

797) Use-after-free (CVE-ID: CVE-2026-43497)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to read and write freed kernel memory.

The vulnerability exists due to a use-after-free in the udlfb framebuffer mmap handling when replacing the framebuffer while a userspace mapping remains active and the device is later disconnected. A local user can trigger framebuffer reallocation through FBIOPUT_VSCREENINFO and then access stale mapped pages to read and write freed kernel memory.

Exploitation requires an existing userspace mmap of the framebuffer, and the stale mapping remains usable after USB disconnect.

798) NULL pointer dereference (CVE-ID: CVE-2026-43496)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the sch_red qdisc dequeue logic when processing queued packets through child qdiscs whose peek() callback is qdisc_peek_dequeued(). A local user can trigger network traffic through a crafted qdisc hierarchy to cause a kernel panic.

The issue occurs when red qdisc has child qdiscs such as qfq and a parent qdisc retrieves an skb using a peek operation followed by dequeue.

799) Out-of-bounds read (CVE-ID: CVE-2026-43495)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in t7xx_port_enum_msg_handler and t7xx_parse_host_rt_data when parsing modem-supplied messages. A remote attacker can send a specially crafted modem message to disclose sensitive information.

The issue can be triggered by a malformed message with an invalid port_count field or inconsistent feature data length.

800) Integer underflow (CVE-ID: CVE-2026-43492)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer underflow in mpi_read_raw_from_sgl() when processing a crafted scatterlist during a KEYCTL_PKEY_ENCRYPT system call. A local user can supply an input buffer of zeroes with a larger out_len than in_len to cause a denial of service.

The issue can cause the kernel to spin forever, resulting in soft lockup splats.

801) Out-of-bounds read (CVE-ID: CVE-2026-43490)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in smb_inherit_dacl() when processing a parent directory DACL from the security descriptor xattr during ACE inheritance. A remote user can provide a malformed inheritable ACE with an invalid SID length to cause a denial of service.

The issue occurs because the ACE can advertise more SID subauthorities than are actually present, which can lead to reads past the ACE and incorrect inherited ACE size accounting.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-8593-1