SB20260907110 - Ubuntu update for linux
Published: September 7, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 99 vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2026-64085)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in adm1266_nvmem_read_blackbox() when processing device-supplied blackbox records. A local user can provide a device response with more than 64 bytes in a trailing record to cause a denial of service.
The issue occurs because the helper may write up to 255 bytes into a 64-byte record slot before the returned length is validated.
2) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-64034)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass bounds validation.
The vulnerability exists due to a time-of-check time-of-use double-fetch in mana_hwc_rx_event_handler() and mana_hwc_handle_resp() when reading hwc_msg_id from a DMA-coherent buffer. A remote attacker can modify the DMA-visible hwc_msg_id value between reads to bypass bounds validation.
Exploitation requires hardware or a host environment able to alter shared, unencrypted DMA-coherent memory between the check and the subsequent use, such as in confidential VM environments.
3) Out-of-bounds read (CVE-ID: CVE-2026-64039)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in msm_disp_state_print_regs and related snapshot dumping logic when processing unaligned DSI register regions. A local user can trigger snapshotting of a specially positioned unaligned region to cause a denial of service.
The issue occurs because some DSI data regions are shifted by 4 bytes, causing the last registers in the region to be handled incorrectly.
4) Improper input validation (CVE-ID: CVE-2026-64046)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in the net/tls plaintext scatter-gather list handling when processing TLS 1.3 records with a plain text scatter-gather list that wraps and has end = 0. A local user can trigger a chain-after-chain scatterlist layout to cause a denial of service.
The issue affects the case where the wrapping slot is reused for chaining to the content type entry, creating illegal input for the crypto subsystem.
5) Off-by-one (CVE-ID: CVE-2026-64047)
CWE-ID: CWE-193 - Off-by-one Error
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an off-by-one error in tls_push_record() in the net/tls subsystem when chaining a wrapped sk_msg scatterlist ring. A local user can trigger the wrapped ring condition to cause a denial of service.
The issue occurs when the sk_msg scatterlist ring wraps with sg.end less than sg.start.
6) NULL pointer dereference (CVE-ID: CVE-2026-64048)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in smc_v2_determine_accepted_chid and smc_conn_create when processing a crafted SMC-Dv2 accept reply with CHID 0. A remote attacker can send a specially crafted reply to trigger a kernel fault and cause a denial of service.
Exploitation requires a malicious peer to reply to an SMC-Dv2-only proposal.
7) Use-after-free (CVE-ID: CVE-2026-64051)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in qaic_gem_object_mmap when mapping a buffer object into memory with scatter-gather segments that extend beyond the virtual memory area. A local user can trigger the mapping of an oversized buffer object to cause a denial of service.
The issue occurs because memory beyond the requested virtual memory area can remain mapped after munmap() unmaps only the virtual memory area region.
8) Improper Initialization (CVE-ID: CVE-2026-64055)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state management in the gmac_rx() NAPI poll function when assembling packets from a ring buffer. A local user can trigger processing of fragmented packets across poll cycles to cause a denial of service.
The issue occurs when the ring buffer is completely emptied before a packet has been fully assembled.
9) Race condition (CVE-ID: CVE-2026-64056)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in gmac_rx() in the cortina gemini ethernet driver when processing fragmented packets on systems using both ethernet ports. A local user can trigger concurrent packet reception to cause a denial of service.
The issue arises because a packet assembly sk_buff was shared between the two ports.
10) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64064)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state management in netfs_invalidate_folio() when handling a folio that was dirtied by a streaming write and then truncated before being read via mmap(). A local user can truncate the file and trigger a subsequent mmap read to cause a kernel oops and denial of service.
Exploitation requires a local sequence involving streaming writes followed by truncation and mmap-based access.
11) Use-after-free (CVE-ID: CVE-2026-64073)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in irq_work_single() when synchronizing irq_work on PREEMPT_RT systems. A local user can trigger concurrent irq_work activity and free the work structure after BUSY is cleared to cause a denial of service.
The issue affects non-HARD irq_work processed by per-CPU kthreads on PREEMPT_RT.
12) Use of Uninitialized Variable (CVE-ID: CVE-2026-64083)
CWE-ID: CWE-457 - Use of Uninitialized Variable
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an uninitialized stack memory exposure in the adm1266 GPIO accessors when processing short block-read responses from the device. A local user can trigger a short block-read response to disclose sensitive information.
The leaked bits can reach userspace through gpiolib interfaces including sysfs and character-device ioctls.
13) Out-of-bounds write (CVE-ID: CVE-2026-64084)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information and corrupt memory.
The vulnerability exists due to an out-of-bounds read and out-of-bounds write in adm1266_gpio_get_multiple() in the adm1266 PMBus driver when iterating a caller-supplied gpio mask. A local user can trigger access to bits beyond the end of the supplied mask and bits arrays to disclose sensitive information and corrupt memory.
The iteration uses a PMBus command value as the scan bound instead of the number of PDIO pins.
14) Use-after-free (CVE-ID: CVE-2026-64033)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in rtrs_srv_create_path_files() cleanup logic when handling an error path during sysfs path file creation. A local user can trigger a failure in a later cleanup step to cause a denial of service.
The issue occurs before the function returns success, in a failure path where sysfs root folders may already exist and the kobject may already have been initialized.
15) Out-of-bounds write (CVE-ID: CVE-2026-64086)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in adm1266_pmbus_block_xfer() and read_buf in the adm1266 PMBus driver when processing a max-length block read response with a PEC byte. A local user can trigger the driver to process a crafted response to cause a denial of service.
The same condition can also cause an out-of-bounds read during the subsequent PEC comparison.
16) Out-of-bounds write (CVE-ID: CVE-2026-64087)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in adm1266_nvmem_read_blackbox() when processing a malformed BLACKBOX_INFO response. A local user can provide a device response with an implausible blackbox record count to cause a denial of service.
The issue can be triggered by a non-responsive slave returning 0xff, bus corruption, or firmware bugs in the device response.
17) Use of Uninitialized Variable (CVE-ID: CVE-2026-64088)
CWE-ID: CWE-457 - Use of Uninitialized Variable
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to uninitialized memory exposure in batadv_send_other_tt_response() and batadv_tt_prepare_tvlv_global_data() when handling tt changeset response data. A remote attacker can trigger processing of an oversized tt_buff_len value to disclose sensitive information.
The issue is caused by a signed integer field wrapping to a negative value and then being widened with sign extension, resulting in a fully allocated buffer that is only partially initialized.
18) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-64089)
CWE-ID: CWE-195 - Signed to Unsigned Conversion Error
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an integer signedness error in batadv_send_my_tt_response() and batadv_tt_prepare_tvlv_local_data() when processing a translation table changeset length value larger than 32767. A local user can trigger the vulnerable code path to disclose sensitive information.
The issue occurs because a negative sign-extended length can cause a full-sized buffer to be allocated while only a small portion is populated, leaving the remaining bytes uninitialized.
19) Improper resource shutdown or release (CVE-ID: CVE-2026-64092)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown handling in the batman-adv tp_meter receiver shutdown logic when stopping receiver sessions and handling timer expiration. A local user can trigger the affected code path to cause a denial of service.
The issue arises from a reference leak involving tp_vars during coordination between batadv_tp_receiver_shutdown() and batadv_tp_stop_all().
20) Use-after-free (CVE-ID: CVE-2026-64096)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in batadv_mcast_purge_orig() and orig_node RCU release handling when releasing orig_node entries while concurrent RCU readers are still accessing multicast-related references. A local user can trigger concurrent access to freed entries to cause a denial of service.
The issue affects RCU-protected readers accessing references such as orig->mcast_want_all_ipv6_node after the referenced entries have been removed and freed.
21) Out-of-bounds read (CVE-ID: CVE-2026-64097)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() when parsing a malformed VBIOS GPIO pin LUT table. A local attacker can supply a crafted VBIOS image with an invalid structuresize field to disclose sensitive information.
22) Improper locking (CVE-ID: CVE-2026-64098)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper lock handling in virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() when updating planes and flushing framebuffer resources. A local user can trigger error conditions that leave the dma_resv lock unheld and then reach fence-list updates to cause a denial of service.
The issue can race with concurrent readers or writers and corrupt the dma_resv fence list. The reported trigger used fault injection on the DRM_IOCTL_MODE_CURSOR path.
23) Integer underflow (CVE-ID: CVE-2026-64102)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service and disclose kernel memory contents.
The vulnerability exists due to an integer underflow in the Soft-iWARP receive path (siw_get_hdr/siw_tcp_rx_data) when processing a malformed iWARP FPDU with an MPA length smaller than the fixed header length for the opcode. A remote user can send a specially crafted FPDU to cause a denial of service and disclose kernel memory contents.
The issue is triggered by a malicious connected siw peer, and the negative signed length is later promoted to size_t during skb_copy_bits processing.
24) Use-after-free (CVE-ID: CVE-2026-64103)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the isci completion tasklet in the ISCI driver when removing a device or unloading the driver while queued tasklet processing is still possible. A local user can trigger device removal or driver unload to cause a denial of service.
The stale callback may dereference ihost and access ihost->smu_registers after the host lifetime ends.
25) Improper input validation (CVE-ID: CVE-2026-64106)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper input validation in vgic_its_restore_dte() when restoring an ITS Device Table Entry. A remote user can supply a restored DTE with an out-of-range Size field to cause a denial of service.
Exploitation requires the ability to restore crafted KVM ITS device state on arm64 systems.
26) Race condition (CVE-ID: CVE-2026-52918)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in bt_sock_poll() and the Bluetooth accept queue when polling Bluetooth sockets. A local user can trigger concurrent socket teardown and accept queue access to cause a denial of service.
The issue occurs because the accept queue is walked without synchronization while child teardown can unlink a socket and drop its last reference.
27) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2025-71289)
CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper error handling in attr_set_size() during file truncation when truncating files on ntfs3. A local user can truncate a file in a way that triggers an attr_set_size() failure to cause a denial of service.
The inode may be left in an inconsistent state if the error is ignored.
28) Race condition (CVE-ID: CVE-2026-23469)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a race condition in the drm/imagination GPU driver interrupt handling during runtime power management suspend when suspending the GPU while an IRQ handler is still running on another CPU core. A local attacker can trigger GPU activity that races with runtime suspend to cause a denial of service.
This issue can lead to kernel crashes or a kernel panic when the IRQ handler accesses GPU registers while the GPU is suspended.
29) Improper input validation (CVE-ID: CVE-2026-31420)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in br_mrp_start_test(), br_mrp_start_in_test(), and br_mrp_start_in_test_parse() when processing user-supplied netlink attributes. A local user can supply a zero interval value to cause a denial of service.
A zero interval causes delayed work to be rescheduled with no delay, creating a tight loop that allocates and transmits MRP test frames until system memory is exhausted and the kernel panics via OOM deadlock.
30) Race condition (CVE-ID: CVE-2026-31486)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in pmbus regulator operations when accessing PMBus registers and shared data. A local user can trigger concurrent regulator callbacks and voltage operations to cause a denial of service.
31) NULL pointer dereference (CVE-ID: CVE-2026-31560)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in spi-dw-dma error logging when handling an error after a transaction finishes without a current message. A local user can trigger an error condition to cause a denial of service.
32) Improper resource shutdown or release (CVE-ID: CVE-2026-46158)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in the mptcp path manager ADD_ADDR retransmission handling when retransmitting ADD_ADDR messages. A local user can trigger ADD_ADDR retransmissions to cause a denial of service.
33) Improper resource shutdown or release (CVE-ID: CVE-2026-46170)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in the mptcp path manager ADD_ADDR retransmission timer handling when processing ADD_ADDR retransmissions. A local user can trigger ADD_ADDR retransmissions to cause a system hang.
The issue occurs when the last socket reference is released from the timer handler, leading to an indefinite wait on the same timer.
34) Use-after-free (CVE-ID: CVE-2026-46275)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the hci_uart line discipline lifecycle management when closing or initializing a Bluetooth HCI UART device. A local user can trigger a hangup or race the close and initialization paths to cause a denial of service.
The issue involves workqueue handling and teardown ordering in the close and initialization error paths.
35) Use of uninitialized resource (CVE-ID: CVE-2026-46315)
CWE-ID: CWE-908 - Use of Uninitialized Resource
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to uninitialized memory usage in io_uring IORING_OP_WAITID result handling when copying waitid result data to userspace. A local user can trigger a wait operation that completes without reporting a child event to disclose sensitive information.
The issue occurs because stale bytes from reused io_kiocb command storage may be copied to userspace siginfo when no child event information is written.
36) Use-after-free (CVE-ID: CVE-2026-52912)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in nf_queue when reinjecting queued bridge LOCAL_IN packets. A remote attacker can trigger packet queueing and later reinjection to cause a denial of service.
The issue occurs because skb->dev can still reference a freed bridge master device while the packet remains queued.
37) Out-of-bounds read (CVE-ID: CVE-2026-52915)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in hbh_mt6_check() in net/ipv6/netfilter/ip6t_hbh.c when processing user-supplied rule setup data. A local user can supply an oversized option list to cause a denial of service.
The issue is triggered because the fixed-size opts array stores at most 16 option descriptors.
38) Uncontrolled Recursion (CVE-ID: CVE-2026-52916)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in batadv_batman_skb_recv() and fragment reassembly handling in the batman-adv fragmentation component when processing nested BATADV_UNICAST_FRAG packets. A remote attacker can send a specially crafted fragmented packet to cause a denial of service.
The issue occurs when a reassembled payload is itself another BATADV_UNICAST_FRAG packet, leading to unbounded kernel stack growth until exhaustion.
39) Use-after-free (CVE-ID: CVE-2026-64108)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free condition in the cifs deferred file close handling when processing deferred file close work during unmount. A local user can open and close a file and trigger unmount activity to cause a denial of service.
The issue can be triggered because deferred close work may run after the filesystem is being unmounted, leading to a busy dentry warning.
40) Use-after-free (CVE-ID: CVE-2026-52919)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service and trigger a use-after-free.
The vulnerability exists due to a use-after-free in batadv_tp_sender_shutdown() and batadv_tp_send() in the batman-adv tp_meter component when shutting down the throughput meter sender through multiple paths. A local user can trigger timeout, cancellation, or normal completion paths to cause a denial of service and trigger a use-after-free.
The issue occurs because the sending counter can underflow to a negative value, causing the sender kernel thread to continue running after interface removal.
41) Off-by-one (CVE-ID: CVE-2026-52921)
CWE-ID: CWE-193 - Off-by-one Error
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an off-by-one error in the netfilter ipset hash set range iteration logic when processing IPv4 ranges in hash:ip,mark, hash:ip,port, hash:ip,port,ip, and hash:ip,port,net set variants. A local user can supply a crafted range request to cause a denial of service.
A later retry may continue from an unintended position after traversal advances past the end of the requested range.
42) NULL pointer dereference (CVE-ID: CVE-2026-52922)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in batadv_dat_forward_data() when forwarding data to DHT candidates. A local attacker can trigger an allocation failure and reach unconditional dereference of a NULL skb pointer to cause a denial of service.
43) Improper resource shutdown or release (CVE-ID: CVE-2026-52926)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in batman-adv gateway client teardown logic when tearing down and later recreating a mesh. A local user can trigger mesh teardown to cause a denial of service.
The issue leaves stale current gateway state behind across cleanup, which can break a later mesh recreation.
44) NULL pointer dereference (CVE-ID: CVE-2026-52941)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in the smc_msg_event tracepoint when processing sendmsg() or recvmsg() on an SMC-D socket with the tracepoint enabled. A local user can trigger socket activity on an SMC-D socket to cause a denial of service.
Exploitation requires the tracepoint to be enabled, and the crash occurs on the first sendmsg() or recvmsg() on an affected SMC-D socket.
45) Use-after-free (CVE-ID: CVE-2026-53357)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in l2cap_sock_cleanup_listen() and bt_accept_dequeue() in the Bluetooth L2CAP socket handling code when racing listen socket cleanup with a concurrent HCI disconnect. A local user can trigger a listen/close versus HCI-disconnect race to cause a denial of service.
The issue occurs during cleanup of not-yet-accepted child sockets on a listening socket.
46) Race condition (CVE-ID: CVE-2026-64015)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in find_key_to_update in the keyring code when looking up keys for update without holding the RCU read lock. A local user can trigger concurrent key lookup and garbage-collection activity to cause a denial of service.
The issue affects persistent key handling, which uses a different locking model.
47) Out-of-bounds read (CVE-ID: CVE-2026-64018)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in mana_hwc_rx_event_handler() when processing hardware-modifiable WQE contents from DMA-coherent memory. A local attacker can modify the derived rx_req_idx value to cause a denial of service.
In confidential VMs such as SEV-SNP and TDX, the affected DMA-coherent memory is shared unencrypted and hardware can modify WQE contents at any time.
48) Use-after-free (CVE-ID: CVE-2026-64025)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to a use-after-free in sk_psock_verdict_data_ready in the Linux kernel BPF sockmap/skmsg handling when processing socket data with a TLS RX context present. A local user can trigger the race condition to cause a denial of service or execute arbitrary code.
Exploitation requires a socket to be inserted into a sockmap before TLS RX is configured.
49) Use-after-free (CVE-ID: CVE-2026-64029)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in seq_ump_process_event() and snd_rawmidi_kernel_write1() when processing sequencer events during concurrent output teardown. A local user can trigger concurrent event delivery and output close operations to cause a denial of service.
The issue arises from a race condition between the event_input path and the last output unuse path, where the rawmidi substream runtime may be freed while still in use.
50) Use-after-free (CVE-ID: CVE-2026-64032)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the bridge multicast handling in net/bridge/br_multicast.c when removing a bridge port after toggling multicast snooping states. A local user can trigger bridge port state transitions that leave a multicast context enabled on a freed bridge port to cause a denial of service.
The issue occurs when per-VLAN multicast snooping is enabled and global multicast snooping is toggled in a way that leaves both per-port and per-{port, VLAN} multicast contexts enabled on the same port.
51) NULL pointer dereference (CVE-ID: CVE-2026-64183)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in the EFI runtime workqueue handling for ACPI PRM calls when invoking EFI runtime calls during early initialization. A local user can trigger early PRM-related runtime calls to cause a denial of service.
The issue occurs when ACPI PRM accesses happen before the EFI runtime workqueue has been allocated during system initialization.
52) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64163)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state reset in lib/tests/test_kprobes.c when running the kprobes sanity tests multiple times. A local user can trigger repeated test runs to cause a denial of service.
The issue occurs because static kprobe and kretprobe objects retain leftover address and flag data between test runs, which leads to failed re-registration and an eventual kernel crash.
53) NULL pointer dereference (CVE-ID: CVE-2026-64165)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in intcp_init_early when performing early initialization before the memory management subsystem is initialized. A local attacker can trigger the vulnerable initialization path to cause a denial of service.
The issue affects ARM Integrator/CP systems using Device Tree, and the failure may manifest as either a kernel crash or an -ENOMEM condition that prevents sched_clock_register from being called.
54) NULL pointer dereference (CVE-ID: CVE-2026-64166)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in the arm_ffa bus match callback when registering a buggy FF-A driver without an id_table. A local user can register a crafted FF-A driver to cause a denial of service.
55) NULL pointer dereference (CVE-ID: CVE-2026-64168)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an error pointer dereference in the sprd spi driver probe error-handling path when handling DMA setup failure during probe. A local user can trigger a probe path that falls back from DMA to PIO mode and reaches late error handling to cause a denial of service.
The issue occurs because the driver may attempt to release DMA channels after DMA setup has failed.
56) Improper handling of exceptional conditions (CVE-ID: CVE-2026-64170)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of error pointers in the spi-qup DMA initialization logic when handling DMA setup failures during driver probe. A local user can trigger a DMA setup failure and subsequent probe error or driver unbind to cause a denial of service.
The issue can lead to dereferencing an error pointer or attempting to release a DMA channel a second time.
57) Improper resource shutdown or release (CVE-ID: CVE-2026-64173)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in tracing_map_elt_free() in kernel/trace/tracing_map.c when handling allocation failures during tracing map element initialization. A local user can trigger an allocation failure path to cause a denial of service.
58) Infinite loop (CVE-ID: CVE-2026-64174)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper loop state management in cfg80211_merge_profile() when processing a specially crafted malicious beacon containing split Multi-BSSID non-transmitted BSS profile elements. A remote attacker can send a specially crafted beacon to cause a denial of service.
The issue can cause the kernel to spend excessive time in the affected function for each beacon received.
59) Improper locking (CVE-ID: CVE-2026-64177)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper locking in pep_do_rcv() in net/phonet/pep.c when forwarding an skb to a child socket via sk_receive_skb(). A local user can trigger socket backlog processing that acquires the child socket lock with bottom halves enabled to cause a denial of service.
The issue can lead to an inconsistent lock state and a self-deadlock on the same CPU when packets are received for the same child socket.
60) Use-after-free (CVE-ID: CVE-2026-64178)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to disclose sensitive information.
The vulnerability exists due to a use-after-free in the bnep_add_connection function when reading dev->name during connection setup while a concurrent connection deletion tears down the net_device. A local privileged user can trigger concurrent bnep_add_connection and bnep_del_connection operations to disclose sensitive information.
Exploitation requires CAP_NET_ADMIN and a tight race window during net_device teardown.
61) Improper resource shutdown or release (CVE-ID: CVE-2026-64179)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in ipc_imem_init() when handling error paths after ipc_protocol_init(). A local user can trigger initialization failures to cause a denial of service.
62) Improper resource shutdown or release (CVE-ID: CVE-2026-64180)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in remove_memory_blocks_and_altmaps() in mm/memory_hotplug.c when removing memory blocks and their altmaps. A local user can trigger memory block removal operations to cause a denial of service.
63) Improper resource shutdown or release (CVE-ID: CVE-2026-64182)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in memblk_nr_poison_inc() and memblk_nr_poison_sub() in drivers/base/memory.c when updating poison accounting for a memory block. A local user can trigger repeated successful memory block lookups to cause a denial of service.
64) Improper resource shutdown or release (CVE-ID: CVE-2026-64155)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in ath11k WMI WOW command handling in drivers/net/wireless/ath/ath11k/wmi.c when sending WOW host wakeup and WOW enable commands. A local user can trigger error paths to cause a denial of service.
65) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64184)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper release of a resource in damon_sysfs_memcg_path_to_id() in mm/damon/sysfs-schemes.c when iterating memory cgroups and breaking out of the mem_cgroup_iter() loop early. A local user can trigger the affected code path to cause a denial of service.
The issue results from a leaked cgroup reference because mem_cgroup_iter_break() is not called before exiting the iteration.
66) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-64185)
CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state management in sysfs_update_group() and internal_create_group() when handling updates to a named sysfs group after create_files() fails. A local user can trigger an update operation that causes file creation to fail to cause a denial of service.
The issue affects the update path for an already existing named sysfs group, which may be silently removed instead of left intact.
67) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-64214)
CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper access of per-CPU preemption state in arch_irq_work_raise() when handling machine check exceptions in real mode. A local user can trigger a machine check exception that reaches arch_irq_work_raise() to cause a denial of service.
The issue occurs in NMI context on powerpc systems, where accessing preempt_count from real mode can fault and panic the kernel.
68) Out-of-bounds write (CVE-ID: CVE-2026-64217)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in netfs_extract_user_iter() when extracting user-supplied pages from an iov_iter. A local user can trigger an extract_pages overrun to cause memory corruption.
The issue occurs if iov_iter_extract_pages() overfills the pages array, causing excess pages to be included in the constructed iterator.
69) Use-after-free (CVE-ID: CVE-2026-64218)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in batadv_bla_purge_backbone_gw() in the bridge loop avoidance component when purging stale backbone gateway entries. A local user can trigger report_work to access freed memory to cause a denial of service.
The issue occurs when associated report_work is still running or pending during backbone gateway cleanup.
70) Stack-based buffer overflow (CVE-ID: CVE-2026-64219)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a stack-based buffer overflow in dc_process_dmub_aux_transfer_async() when processing an aux transfer payload. A local user can pass a payload length greater than 16 to cause a denial of service.
71) Out-of-bounds read (CVE-ID: CVE-2026-64219)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in dc->links[] access within dc_process_dmub_aux_transfer_async() when handling a link_index value without bounds checking. A local user can supply an invalid link_index to cause a denial of service.
72) Use of Uninitialized Variable (CVE-ID: CVE-2026-64220)
CWE-ID: CWE-457 - Use of Uninitialized Variable
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use of uninitialized memory in fwnode_init() when initializing a firmware node allocated on the stack or with a non-zeroing heap allocation. A local user can trigger code paths that dereference the uninitialized secondary pointer to cause a denial of service.
The issue can occur when a temporary software node is used and its lifetime is controlled by the caller.
73) Use-after-free (CVE-ID: CVE-2026-64221)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the ti-qspi driver when handling DMA setup failure during probe. A local user can trigger a DMA setup failure and subsequent use of a released DMA channel pointer to cause a denial of service.
The issue occurs when the driver falls back to PIO mode after DMA setup failure.
74) Out-of-bounds read (CVE-ID: CVE-2026-64225)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds read in the cgx_speed_mbps array access in link_status_user_format() when processing firmware-reported link status values. A local user can trigger an out-of-range RESP_LINKSTAT_SPEED value to cause a denial of service.
75) Out-of-bounds read (CVE-ID: CVE-2026-64231)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in msm_disp_snapshot_add_block when dumping DSI host registers after the IO base address is adjusted by io_offset. A local user can trigger register dumping to cause a denial of service.
The issue affects DSI 6G platforms.
76) NULL pointer dereference (CVE-ID: CVE-2026-64128)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in iso_recv() in the Bluetooth ISO subsystem when processing an ISO_END frame without a prior ISO_START on a fresh ISO connection. A remote attacker can send a specially crafted Bluetooth ISO frame sequence to cause a denial of service.
For BIS, exploitation does not require pairing and can be triggered by a broadcaster on the air.
77) Use-after-free (CVE-ID: CVE-2026-64109)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in unix_stream_data_wait() in net/unix/af_unix.c when processing racing recv() operations on the same AF_UNIX stream socket. A local user can trigger concurrent peek and normal receive operations to cause a denial of service.
Exploitation requires a race condition between a peeking recv() call and a normal recv() call on the same socket.
78) Improper locking (CVE-ID: CVE-2026-64111)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass security restrictions.
The vulnerability exists due to improper locking in lsm_set_self_attr() when setting a process security attribute. A local user can invoke the syscall while the process is being ptraced to bypass security restrictions.
This affects SELinux and AppArmor checks related to ptrace during security context transitions.
79) Use-after-free (CVE-ID: CVE-2026-64113)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in ixgbevf_clean_rx_irq() when processing received frames that trigger VEPA multicast source pruning. A local user can trigger this code path to cause a denial of service.
The issue occurs in NAPI softirq context when a freed skb is reused on the next loop iteration because the pointer is not cleared before continuing.
80) Out-of-bounds read (CVE-ID: CVE-2026-64114)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds access in the raw_send_hdrinc IPv4 packet handling in the Linux kernel when processing a malformed IP_HDRINCL packet with an IPv4 header length value less than 5. A local user can send a specially crafted packet through a raw socket to cause a denial of service.
Exploitation requires CAP_NET_RAW. Triggering the reproduced crash path also requires a matching xfrm AH policy on the outgoing route, and loopback does not reach the affected path.
81) Use-after-free (CVE-ID: CVE-2026-64115)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in vmci_transport_recv_connecting_server() and vmci_transport_recv_listen() when processing a peer reset during the connection handshake. A remote attacker can send a reset packet during the handshake to cause a denial of service.
The issue is triggered by a race involving pending socket cleanup in the VMCI vsock transport.
82) NULL pointer dereference (CVE-ID: CVE-2026-64116)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in ipv6_hop_ioam() when processing an IPv6 IOAM Hop-by-Hop option during concurrent interface teardown. A remote attacker can send a specially crafted packet to cause a denial of service.
The issue occurs because IPv6 interface state can be cleared concurrently through RCU, allowing __in6_dev_get(skb->dev) to return NULL while the packet is being handled.
83) Double free (CVE-ID: CVE-2026-64118)
CWE-ID: CWE-415 - Double Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to double free in qed_cid_map_free() in the QLogic qed driver context management code when handling failed CID bitmap allocations. A local user can trigger the failing allocation path to cause a denial of service.
Exploitation requires device-specific setup to reach the affected allocation failure path.
84) Out-of-bounds read (CVE-ID: CVE-2026-64121)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in ifb_get_ethtool_stats in the IFB network driver when handling ethtool statistics requests on a device with more RX queues than TX queues. A local user can request ethtool statistics for a crafted asymmetric IFB device to disclose sensitive information.
Exploitation requires an IFB device configuration where the RX queue count exceeds the TX queue count.
85) Improper Initialization (CVE-ID: CVE-2026-64125)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper hardware state management in bcmgenet_eee_enable_set in the Broadcom GENET network driver when enabling energy-efficient ethernet settings. A local user can enable the affected settings to cause a denial of service.
On affected systems, RX traffic can stop flowing while the link remains up, and on some boards the resulting corruption can lead to a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit.
86) Out-of-bounds read (CVE-ID: CVE-2026-64126)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the Bluetooth MGMT add_ext_adv_data() handler when processing a crafted MGMT_OP_ADD_EXT_ADV_DATA command with inconsistent length fields. A local privileged user can send a specially crafted management command to disclose sensitive information.
Exploitation requires CAP_NET_ADMIN in the initial user namespace, and exposed memory may be read back via MGMT_OP_GET_ADV_INSTANCE.
87) Information disclosure (CVE-ID: CVE-2026-64127)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an information leak caused by incorrect size and source-pointer arguments in l2cap_ecred_reconfigure() in the Bluetooth L2CAP subsystem when sending an L2CAP_ECRED_RECONFIGURE_REQ packet to a paired Bluetooth peer. A remote attacker can trigger ecred reconfiguration handling to disclose sensitive information.
The malformed packet copies bytes from kernel stack memory and can expose a kernel stack address to the peer. Exploitation requires Bluetooth connectivity with a paired peer.
88) Out-of-bounds read (CVE-ID: CVE-2026-64518)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in tcp_ao_established_key() when processing TCP_TIME_WAIT sockets from tcp_v[46]_timewait_ack(). A local attacker can trigger the vulnerable code path to cause a denial of service.
The issue occurs because the code may access sock locking state on a timewait socket that does not contain sk_lock.
89) Out-of-bounds read (CVE-ID: CVE-2026-64133)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in the find_control() function in the ALSA asihpi driver when reading cached control information with an out-of-range control index. A local user can provide a crafted control index to cause a denial of service.
90) NULL pointer dereference (CVE-ID: CVE-2026-64134)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in the ALSA PCM interleaved_copy() function when handling silencing operations with NULL data. A local user can trigger a crafted PCM data transfer path to cause a denial of service.
The issue is architecture-dependent and was reported to cause failures on RISC-V systems.
91) Stack-based buffer overflow (CVE-ID: CVE-2026-64135)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a stack-based buffer overflow in adm1266_nvmem_read_blackbox() when processing an SMBus block response from a device. A local user can return a block length larger than the allocated buffer to cause a denial of service.
The issue occurs before the return-length check rejects an unexpected response.
92) Race condition (CVE-ID: CVE-2026-64136)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper synchronization in smb2_find_smb_sess_tcon_unlocked() when handling SMB tree connection lookups. A local user can trigger concurrent access to corrupt tc_count handling and cause a denial of service.
93) Improper access control (CVE-ID: CVE-2026-64137)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper access control in the CIFS SWN generic netlink multicast group when joining the multicast group and receiving registration messages. A local user can join the CIFS_GENL_MCGRP_SWN group to disclose sensitive information.
For NTLM-authenticated mounts, exposed registration messages may include the username, domain, and password attributes copied from the CIFS session.
94) Improper access control (CVE-ID: CVE-2026-64137)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to affect service availability.
The vulnerability exists due to improper access control in the CIFS SWN netlink notify handler when sending witness notification commands. A local user can send crafted RESOURCE_CHANGE or CLIENT_MOVE notifications to affect service availability.
The intended sender is the cifs.witness helper, but any local process could send notifications to the in-kernel witness handler.
95) Out-of-bounds read (CVE-ID: CVE-2026-64138)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in the ksmbd smbacl.c ACL inheritance logic when processing owner and group SIDs from a parent security descriptor. A remote user can provide a specially crafted parent security descriptor to cause a denial of service.
The issue occurs during ACL inheritance in ksmbd.
96) Improper resource shutdown or release (CVE-ID: CVE-2026-64144)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in the btmtk USB Bluetooth driver when handling failed or killed control urbs. A local user can trigger error paths to cause a denial of service.
97) NULL pointer dereference (CVE-ID: CVE-2026-64147)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of error pointers and a missing reference release in pds_core debugfs handling when performing firmware reset recovery or checking for an existing debugfs entry. A local user can trigger the vulnerable code path to cause a denial of service.
The crash condition occurs when CONFIG_DEBUG_FS is disabled.
98) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64148)
CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper error handling in pdsc_devcmd_wait() when handling firmware crash or command timeout conditions. A local user can trigger the vulnerable code path to cause a denial of service.
The issue causes stale success status to be returned instead of propagating an error, which can prevent proper recovery handling.
99) Unchecked Return Value (CVE-ID: CVE-2026-64153)
CWE-ID: CWE-252 - Unchecked Return Value
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of error codes in msm_iommu_map() in the drm/msm iommu mapping logic when mapping scatter-gather tables. A local user can trigger an error condition to cause a denial of service.
Remediation
Install update from vendor's website.