SB20260921179 - SUSE update for the Linux Kernel

Description

This security bulletin contains information about 669 vulnerabilities.

1) Improper error handling (CVE-ID: CVE-2024-44981)

CWE-ID: CWE-388 - Error Handling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the get_work_pool() function in kernel/workqueue.c. A local user can perform a denial of service (DoS) attack.

2) Memory leak (CVE-ID: CVE-2024-57841)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the tcp_conn_request() function in net/ipv4/tcp_input.c. A local user can perform a denial of service (DoS) attack.

3) NULL pointer dereference (CVE-ID: CVE-2025-23137)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the amd_pstate_update() function in drivers/cpufreq/amd-pstate.c. A local user can perform a denial of service (DoS) attack.

4) Resource management error (CVE-ID: CVE-2025-38469)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the kvm_xen_schedop_poll() function in arch/x86/kvm/xen.c. A local user can perform a denial of service (DoS) attack.

5) Out-of-bounds read (CVE-ID: CVE-2025-39939)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the zpci_get_iommu_ctrs() function in drivers/iommu/s390-iommu.c. A local user can perform a denial of service (DoS) attack.

6) Race condition (CVE-ID: CVE-2025-39964) Exploited

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the include/crypto/if_alg.h. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

7) Input validation error (CVE-ID: CVE-2025-40022)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the include/crypto/if_alg.h. A local user can perform a denial of service (DoS) attack.

8) Input validation error (CVE-ID: CVE-2025-40199)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the page_pool_dma_sync_for_device(), page_pool_dma_map(), page_pool_clear_pp_info() and __page_pool_release_page_dma() functions in net/core/page_pool.c. A local user can perform a denial of service (DoS) attack.

9) Buffer overflow (CVE-ID: CVE-2025-68179)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the function in arch/s390/Kconfig. A local user can perform a denial of service (DoS) attack.

10) NULL pointer dereference (CVE-ID: CVE-2025-68214)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __try_to_del_timer_sync() function in kernel/time/timer.c. A local user can perform a denial of service (DoS) attack.

11) Race condition (CVE-ID: CVE-2025-71075)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the asd_pci_remove() function in drivers/scsi/aic94xx/aic94xx_init.c. A local user can escalate privileges on the system.

12) Improper locking (CVE-ID: CVE-2025-71104)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the advance_periodic_target_expiration() function in arch/x86/kvm/lapic.c. A local user can perform a denial of service (DoS) attack.

13) NULL pointer dereference (CVE-ID: CVE-2026-23210)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the drivers/net/ethernet/intel/ice/ice_ptp.h. A local user can perform a denial of service (DoS) attack.

14) Use-after-free (CVE-ID: CVE-2026-23227)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the vidi_store_connection(), vidi_connection_ioctl(), vidi_detect(), vidi_get_modes() and vidi_remove() functions in drivers/gpu/drm/exynos/exynos_drm_vidi.c. A local user can escalate privileges on the system.

15) Input validation error (CVE-ID: CVE-2026-23230)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the fs/smb/client/cached_dir.h. A local user can perform a denial of service (DoS) attack.

16) Use-after-free (CVE-ID: CVE-2026-23454)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in mana_hwc_destroy_channel() when tearing down hardware channels while interrupt handlers are still executing. A local attacker can trigger concurrent channel teardown and interrupt handling to cause a denial of service.

The issue is caused by a race condition where caller_ctx may be freed before the completion queue and event queue are destroyed, which can lead to a use-after-free or NULL pointer dereference in mana_hwc_handle_resp().

17) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-31418)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in mtype_del in the ipset netfilter subsystem when deleting entries from buckets containing only deleted slots below the current position. A local user can trigger bucket deletion handling with crafted set operations to cause a denial of service.

18) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-31531)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory allocation in rtm_get_nexthop() when handling RTM_GETNEXTHOP requests for large nexthop groups. A local user can send a specially crafted netlink request to cause a denial of service.

This issue can be triggered when querying large Equal-Cost Multi-Path nexthop groups such as groups containing hundreds of nexthops.

19) Race condition (CVE-ID: CVE-2026-31557)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in async event work handling on the nvmet workqueue when freeing an NVMe target controller during queue disconnect processing. A local user can trigger queue disconnect and controller cleanup to cause a denial of service.

The issue arises from recursive locking when async event work is flushed from the same worker processing nvmet-wq.

20) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-31658)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in tse_start_xmit() when handling DMA mapping failures. A local user can trigger DMA mapping failures to cause a denial of service.

21) Use-after-free (CVE-ID: CVE-2026-31663)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in xfrm_input_resume and transport_finish when processing packets after asynchronous crypto completion. A local user can trigger a race with device teardown to cause a denial of service.

22) Improper resource shutdown or release (CVE-ID: CVE-2026-43014)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the macb network driver clock registration handling when unregistering fixed rate clocks. A local user can trigger the affected code path to cause a denial of service.

23) Use-after-free (CVE-ID: CVE-2026-43015)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the macb PCI glue driver clock handling during device removal when unregistering the driver and triggering a runtime resume callback. A local user can unload the affected module to trigger a use-after-free and cause a denial of service.

The issue is triggered during driver removal because a runtime resume callback may still access registered clock objects after the platform device has been unregistered.

24) Use-after-free (CVE-ID: CVE-2026-43116)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in netfilter ctnetlink expectation handling when processing expectation add, delete, get, or event operations. A local user can trigger access to an invalid master conntrack object to cause a denial of service.

25) Out-of-bounds write (CVE-ID: CVE-2026-43125)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in dlm_search_rsb_tree() when processing network messages with an excessive resource name length. A remote attacker can send a specially crafted network message to cause a denial of service.

The length value originates from the len parameter in dlm_dump_rsb_name().

26) Use-after-free (CVE-ID: CVE-2026-43163)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race in write_page() when resizing an array while bitmap daemon work is iterating over bitmap->storage.filemap. A local user can trigger concurrent bitmap update and resize operations to cause a denial of service.

The issue occurs because the md thread can continue running during quiesce(), allowing concurrent access to freed pages.

27) Out-of-bounds read (CVE-ID: CVE-2026-43213)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds access in the rtw89_pci TX release report handling when processing an abnormal sequence number in a TX release report. A local attacker can trigger an abnormal TX release report to cause a denial of service.

The issue can lead to a kernel NULL pointer dereference.

28) NULL pointer dereference (CVE-ID: CVE-2026-43271)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in process_metadata_update() when handling a METADATA_UPDATED message from a remote node during MD array startup. A remote attacker can send a crafted metadata update message to cause a denial of service.

The issue can be triggered during a race condition window before the main MD thread is initialized.

29) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-43273)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data inconsistencies in snapshots.

The vulnerability exists due to improper context handling in ceph_zero_partial_object() when performing OSD write operations for partial object zeroing. A local user can modify a file and access its snapshot to cause data inconsistencies in snapshots.

Exploitation requires access to a CephFS mount and interaction with snapshot functionality.

30) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43363)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper hardware state management in lapic_resume() when resuming from s2ram. A local user can trigger a suspend and resume cycle to cause a denial of service.

This occurs when firmware re-enables x2apic mode while the kernel continues using the xapic interface, which can lead to system hangs on bare metal systems.

31) Out-of-bounds read (CVE-ID: CVE-2026-43386)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rtw_restruct_wmm_ie when parsing input. A local user can supply crafted input to disclose sensitive information.

32) NULL pointer dereference (CVE-ID: CVE-2026-43416)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in perf_callchain_user_64 when getting a user callchain while current->mm has already been released. A local user can run a profiling BPF program to cause a denial of service.

The issue can lead to a kernel panic during stack trace collection.

33) Race condition (CVE-ID: CVE-2026-43448)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nvme_poll_irqdisable() when handling concurrent device disable and IRQ polling operations. A local user can trigger the race to cause a denial of service.

The issue can lead to an unbalanced IRQ enable warning in the kernel.

34) Race condition (CVE-ID: CVE-2026-45897)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect counter values to be reported.

The vulnerability exists due to a race condition in nft_counter when performing concurrent dump-and-reset operations. A local user can trigger parallel counter resets to cause incorrect counter values to be reported.

35) Out-of-bounds write (CVE-ID: CVE-2026-45968)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds index in the cpuidle ladder governor when selecting an idle state on systems with only one available idle state. A local attacker can trigger the vulnerable code path to cause a denial of service.

This issue occurs on certain platforms where cpuidle registers only a single polling idle state, which can result in a NULL enter callback being invoked and a system crash.

36) Out-of-bounds read (CVE-ID: CVE-2026-46070)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() when processing corrupted journal metadata blocks. A local user can provide a corrupted journal with payload size fields that extend beyond the metadata block boundary to disclose sensitive information.

37) Out-of-bounds read (CVE-ID: CVE-2026-46078)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the EROFS directory entry handling code when parsing a crafted EROFS image with a trailing directory entry containing an invalid name offset. A local user can provide a specially crafted EROFS image to disclose sensitive information.

The issue occurs because an unchecked name offset can cause an underflow in the length calculation used by strnlen(), leading to a read past the directory block.

38) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46091)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of dma coherency in igorplugusb when processing a usb control request. A local user can trigger a crafted interaction with the usb device to cause a denial of service.

39) Improper update of reference count (CVE-ID: CVE-2026-46107)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in the dm-thin rebalance_children function when rebalancing internal btree nodes with a shared child node. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because grandchild node reference counts are not increased when the shared child node is retained, which can lead to "device mapper: space map common: unable to decrement block" errors.

40) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-46115)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of dev_pagemap boundaries in biovec_phys_mergeable() when coalescing physically contiguous bvec segments. A local user can trigger merging of segments from different dev_pagemaps to cause a denial of service.

The issue occurs when a bio contains bvecs from different dev_pagemaps that are physically contiguous.

41) NULL pointer dereference (CVE-ID: CVE-2026-46127)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ocrdma_copy_pd_uresp() when handling error conditions. A local user can trigger an error path to cause a denial of service.

42) Integer overflow (CVE-ID: CVE-2026-46195)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow in parse_sec_desc(), build_sec_desc(), and id_mode_to_cifs_acl() when processing a server-supplied security descriptor with a crafted dacloffset value. A remote attacker can return a malicious security descriptor to trigger pointer wraparound and cause a denial of service.

The issue affects 32-bit builds and can be reached through the chmod/chown rewrite paths.

43) Improper access control (CVE-ID: CVE-2026-52920)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass inbound IPsec policy matching restrictions.

The vulnerability exists due to improper access control in the xt_policy netfilter matcher when processing strict mode inbound policy matching. A remote attacker can send network traffic that traverses a multi-element inbound rule to bypass inbound IPsec policy matching restrictions.

The issue affects strict matching of multi-element inbound rules.

44) NULL pointer dereference (CVE-ID: CVE-2026-52925)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the VRF port removal logic when removing a port from a VRF while concurrent RCU readers access the master device. A local user can trigger concurrent network operations to cause a denial of service.

The issue occurs because an RCU reader can observe a new non-VRF master device and then dereference missing l3mdev operations.

45) NULL pointer dereference (CVE-ID: CVE-2026-52929)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null-pointer dereference in the SCTP stream scheduler state handling in net/sctp/stream.c when processing a denied ADD_OUT_STREAMS operation and a later stream re-add. A remote attacker can trigger SCTP stream reset operations that leave stale removed stream metadata behind to cause a denial of service.

The issue occurs because removed outgoing stream state is not fully rolled back, leaving scheduler-private stream metadata inconsistent for later reuse.

46) Out-of-bounds read (CVE-ID: CVE-2026-52935)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in espintcp_sendmsg() when handling a new send while a previous partial send is still in progress. A local user can trigger a partial send and initiate another send to disclose sensitive information.

The issue occurs in the send path because a stale offset from a live partial-send state can remain attached to a new sk_msg.

47) NULL pointer dereference (CVE-ID: CVE-2026-52939)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in rds_ib_send_cqe_handler() and rds_ib_send_unmap_op() when processing an atomic cmsg over an active RDS/IB connection. A local user can send a crafted AF_RDS sendmsg() request to cause a denial of service.

On hardware that natively accepts masked atomic operations, no additional setup is required.

48) Improper locking (CVE-ID: CVE-2026-52946)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper locking in fs/fcntl.c when handling TCP urgent data signaling for a process group. A remote attacker can send specially crafted TCP URG packets to cause a denial of service.

The issue occurs when FASYNC is configured for a process group.

49) Race condition (CVE-ID: CVE-2026-52975)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a data race in the bonding 802.3ad port-to-aggregator handling code when processing netlink requests and concurrent bonding state changes. A local user can send crafted netlink messages to trigger the race and cause a denial of service.

The issue was reported by Kernel Concurrency Sanitizer and affects access to the port->aggregator pointer in the bonding subsystem.

50) Race condition (CVE-ID: CVE-2026-52977)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in futex requeue-PI handling in kernel/futex/requeue.c when processing wait-requeue-pi and requeue-PI operations during signal or timeout wakeup. A local user can trigger concurrent futex operations to cause a denial of service.

The issue can result in a live lock where one task blocks on a hash bucket lock while another busy loops, potentially locking up the system.

51) Improper resource shutdown or release (CVE-ID: CVE-2026-52990)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in fsnotify_recalc_mask() when handling concurrent mark attach and detach operations. A local user can trigger the race condition to cause a denial of service.

The issue can manifest as a hung task during unmount operations.

52) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-52994)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass resource limit enforcement.

The vulnerability exists due to improper resource management in virtio_transport_init_zcopy_skb() when processing MSG_ZEROCOPY sends. A local user can send data using MSG_ZEROCOPY to bypass resource limit enforcement.

The issue occurs because pinned-pages accounting can use a consumed iterator count of 0 on the last skb, causing RLIMIT_MEMLOCK accounting to be skipped.

53) Improper access control (CVE-ID: CVE-2026-53001)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended netfilter match restrictions.

The vulnerability exists due to improper access control in the netfilter xtables match extensions xt_mac, xt_owner, xt_physdev, and xt_realm when registering protocol families. A local user can invoke these matches with unsupported protocol families to bypass intended netfilter match restrictions.

The issue stems from these matches being registered for unspecified protocol families even though they are intended only for IPv4 and IPv6, and xt_realm is intended only for IPv4.

54) Use-after-free (CVE-ID: CVE-2026-53033)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in unix_stream_bpf_update_proto() when processing BPF iterator updates to a sockmap during a unix socket state transition. A local user can trigger a race condition to cause a denial of service.

The issue occurs when the peer pointer becomes stale during the transition from TCP_ESTABLISHED to TCP_CLOSE.

55) NULL pointer dereference (CVE-ID: CVE-2026-53034)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in unix_stream_bpf_update_proto() when updating a sockmap for an af_unix stream socket during a concurrent connect operation. A local user can trigger a race condition via a bpf sockmap update to cause a denial of service.

The issue occurs in a race window where the socket state is set to established before the peer pointer is assigned.

56) Out-of-bounds write (CVE-ID: CVE-2026-53059)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in create_log_context() and dm-log bitset handling when processing a crafted device-mapper mirror target configuration with an oversized region count. A local user can create a crafted mirror target to cause a denial of service.

The issue is triggered when region_count overflows 32 bits, causing bitsets to be allocated smaller than required and later accessed with indices derived from the full region space.

57) Out-of-bounds read (CVE-ID: CVE-2026-53076)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in pcpu_init_value in the BPF hashtab implementation when copying an element from a BPF_MAP_TYPE_CGROUP_STORAGE map to another per-cpu map with the same non-8-byte-aligned value_size. A local user can update the destination map with data from the crafted source map to disclose sensitive information.

The issue occurs when the source map value size is not rounded up to 8 bytes, causing a copy operation to read past the claimed source size.

58) Improper access control (CVE-ID: CVE-2026-53077)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper restriction of operations in RDS/IB transport selection and address checking when using RDS/IB from a non-initial network namespace. A local user can select the RDS/IB transport from a non-initial network namespace to cause a denial of service.

The issue is specific to use of RDS/IB outside the initial network namespace.

59) Use-after-free (CVE-ID: CVE-2026-53089)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() when querying info for an offloaded BPF map or program during network namespace destruction. A local user can query crafted offloaded BPF map or program information to cause a denial of service.

The issue occurs because the associated network namespace may be racing with teardown and its reference count may already have reached zero.

60) Improper input validation (CVE-ID: CVE-2026-53091)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of gso packet headers in qdisc_pkt_len_segs_init() when processing malicious gso packets. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue affects the transmit path for gso packets and malformed packets may be dropped during processing.

61) Use-after-free (CVE-ID: CVE-2026-53094)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the BPF offload program pointer handling in kernel/bpf/core.c when destroying a network namespace after JIT compilation with constant blinding enabled for a dev-bound-only BPF program. A local user can trigger cleanup of a crafted dev-bound-only XDP program to cause a denial of service.

Exploitation requires net.core.bpf_jit_harden to be set to 2 or higher and affects dev-bound-only programs created with BPF_F_XDP_DEV_BOUND_ONLY.

62) Race condition (CVE-ID: CVE-2026-53096)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper use of RCU-safe iteration in dev_map_redirect_multi() and dev_map_enqueue_multi() when processing BPF devmap hash buckets under RCU protection. A local user can trigger concurrent updates and lookups to cause a denial of service.

On weakly ordered architectures, readers may observe a partially constructed node.

63) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-53110)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect behavior in kernel BPF processing.

The vulnerability exists due to improper handling of integer extension in the s390 BPF JIT compiler when processing BPF program return values and kfunc arguments. A local user can trigger the JIT compilation of crafted BPF code to cause incorrect behavior in kernel BPF processing.

The issue affects s390 systems because the ABI requires zero extension for unsigned arguments and return values, but only sign extension was implemented.

64) NULL pointer dereference (CVE-ID: CVE-2026-53111)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in bpf_lwt_xmit_push_encap when executing BPF LWT_XMIT programs through bpf_prog_test_run_skb with an uninitialized skb destination reference. A local user can execute a crafted BPF program test run to cause a denial of service.

65) Improper resource shutdown or release (CVE-ID: CVE-2026-53126)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in blkcg_maybe_throttle_current() when handling block cgroup throttling lookups and error paths. A local user can trigger lookup or reference acquisition failures to cause a denial of service.

The issue results from a disk reference leak that can prevent the disk object from being freed.

66) NULL pointer dereference (CVE-ID: CVE-2026-53142)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the xe display initialization and cleanup logic when handling suspend or shutdown on systems without display hardware present. A local user can trigger suspend or shutdown processing to cause a denial of service.

The issue occurs when display support is probed but display hardware is later determined to be unavailable or disabled at runtime initialization.

67) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53154)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in mm/hugetlb.c hugetlb folio copy paths when handling failed hugetlb folio copy operations. A local user can trigger a failed UFFDIO_COPY operation or a fork-time copy-on-write path failure to cause a denial of service.

The issue can leak a reservation from a private hugetlb VMA reserve map, which may cause a later fault at the same address to take the no-reservation path and receive SIGBUS under hugetlb pool pressure.

68) NULL pointer dereference (CVE-ID: CVE-2026-53163)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in remove_waiter() in the rtmutex futex proxy locking path when handling FUTEX_CMP_REQUEUE_PI operations during deadlock detection or proxy lock acquisition. A local user can invoke crafted futex operations to cause a denial of service.

69) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-53180)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of expired timers in tmigr_handle_remote_cpu() in timer migration code when processing remote timer expiry handling. A local user can trigger the affected timer handling path to cause a denial of service.

The issue can cause an indefinite spin in the goto-again loop after an expired timer callback is never invoked and the timer remains reported as expired.

70) Deadlock (CVE-ID: CVE-2026-53207)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a recursive spinlock self-deadlock in get_huge_page_for_hwpoison() when handling concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page while racing with a concurrent unmap. A local user can trigger concurrent madvise(MADV_HWPOISON) operations to cause a denial of service.

The issue occurs when folio_put() drops the folio reference count to zero while hugetlb_lock is still held, leading free_huge_folio() to attempt to re-acquire the same non-recursive lock.

71) Information disclosure (CVE-ID: CVE-2026-53219)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper handling of partially failed copy_to_user operations in x_tables get-entries implementations when copying rule entries to userspace. A local user can provide a userspace buffer that faults during the initial header copy to disclose sensitive information.

On SMP kernels, the leaked value is the internal percpu counter allocation pointer. The issue affects the IPv4, IPv6, and ARP native and compat get-entries paths.

72) NULL pointer dereference (CVE-ID: CVE-2026-53220)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ebt_redirect_tg() in net/bridge/netfilter/ebt_redirect.c when reinjecting an NFQUEUE packet after bridge port state changes. A local user can remove or reassign the bridge port before reinjection to cause a denial of service.

The issue occurs if the bridge port is removed between the original hook invocation and NFQUEUE reinjection, and the device may also be moved to a different virtual device such as macvlan.

73) Out-of-bounds read (CVE-ID: CVE-2026-53223)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the generic timestamp cmsg path in net/socket.c when processing timestamped messages for AF_PACKET sockets. A local user can send or receive crafted packets on an AF_PACKET socket to disclose sensitive information.

Exploitation requires timestamping to be enabled, and information disclosure can occur when SO_RXQ_OVFL is enabled and a non-linear skb is processed.

74) Use-after-free (CVE-ID: CVE-2026-53228)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a use-after-free in the ipip6_tunnel_xmit() function in the SIT IPv6 tunneling implementation when handling GSO packets after offload processing. A local user can trigger transmission of a crafted packet to disclose sensitive information.

The issue occurs because a cached inner IPv6 header pointer may become stale if the skb head is moved during offload handling, and the stale pointer may later be used to read header fields.

75) Out-of-bounds read (CVE-ID: CVE-2026-53238)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in netlbl_unlabel_addrinfo_get() when handling crafted Generic Netlink requests with a shorter unlabeled address mask attribute. A local user can send a specially crafted Generic Netlink request to cause a denial of service.

76) Use-after-free (CVE-ID: CVE-2026-53260)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race condition in reqsk_queue_hash_req() in net/ipv4/inet_connection_sock.c when handling TCP request socket timer setup and reference count initialization on PREEMPT_RT systems. A local user can trigger the race to cause a denial of service.

Exploitation requires a PREEMPT_RT-enabled kernel.

77) Off-by-one (CVE-ID: CVE-2026-53263)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an off-by-one error in lowpan_iphc_mcast_ctx_addr_compress() when compressing multicast context addresses. A remote attacker can send network traffic that triggers the vulnerable compression path to disclose sensitive information.

Uninitialized kernel stack memory may be transmitted over the network via lowpan_push_hc_data().

78) Use-after-free (CVE-ID: CVE-2026-53264)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the net/sched action lifecycle handling in act_api when NEWTFILTER and DELFILTER are run concurrently. A local user can trigger concurrent filter operations to cause a denial of service.

The issue arises from a race between action lookup and action deletion under RCU-protected access.

79) Race condition (CVE-ID: CVE-2026-53269)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the synproxy hook reference counting logic in netfilter when concurrently adding the first iptables target or nftables expression. A local user can trigger concurrent registration or teardown operations to cause a denial of service.

The issue affects on-demand netfilter hook registration performed by the SYNPROXY infrastructure from both iptables and nftables frontends.

80) Use-after-free (CVE-ID: CVE-2026-53273)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the optee supplicant request handling in drivers/tee/optee/supp.c when a client exits before the supplicant finishes processing its request. A local user can trigger a race condition to cause a denial of service.

The issue occurs because the request can be freed by the client while its request ID remains referenced on the supplicant path.

81) Out-of-bounds read (CVE-ID: CVE-2026-53309)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dlm_match_regions() when comparing local and remote regions. A remote attacker can trigger the vulnerable region comparison to disclose sensitive information, modify data, or cause a denial of service.

82) Out-of-bounds read (CVE-ID: CVE-2026-53330)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in dp_get_eq_aux_rd_interval() when processing DisplayPort repeater capability data. A local attacker can provide crafted repeater count information to trigger an out-of-bounds read and disclose sensitive information.

The issue occurs when a sink reports 8 LTTPR repeaters, causing access beyond the declared aux_rd_interval array bounds.

83) Infinite loop (CVE-ID: CVE-2026-53336)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in the onie-tlv nvmem layout driver when parsing EEPROM entries with unknown types. A local attacker can provide a crafted EEPROM image containing a vendor-specific or otherwise unknown TLV entry to cause a denial of service.

84) NULL pointer dereference (CVE-ID: CVE-2026-53337)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in bond_do_ioctl() when handling bonding ioctl requests with a non-existent slave interface name. A local privileged user can send a bonding ioctl request referencing a non-existent slave interface to cause a denial of service.

The issue is reachable from userspace through the bonding ioctl interface.

85) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-53353)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a missing internal state in hsr_addr_is_self() when processing packets during device teardown. A local user can send packets through an HSR device during the teardown window to cause a kernel warning.

The issue occurs in a window where the device remains discoverable after self_node has been cleared.

86) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-53365)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in virtio vsock zerocopy completion handling in net/vmw_vsock/virtio_transport_common.c when processing multi-skb MSG_ZEROCOPY sends. A local user can send a large crafted message that is fragmented into multiple skbs to cause a denial of service.

The issue can leave pinned user pages without completion notification, including when the send loop exits before the final skb is processed.

87) Out-of-bounds write (CVE-ID: CVE-2026-53366)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in __ip_append_data() when processing IPv4 packet data on the paged allocation path. A local user can trigger the faulty length calculations to cause a denial of service.

The issue occurs because fraggap bytes copied from the previous skb are placed into the new skb linear area while the allocation size does not account for those bytes.

88) Use-after-free (CVE-ID: CVE-2026-53381)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fuse_release_end() during virtiofs auto_submount unmount processing when releasing files during submount unmount after the superblock has already been destroyed. A local user can trigger submount unmount activity to cause a denial of service.

The issue affects the virtiofs auto_submounts case, where the wait counter is tracked per connection rather than per superblock.

89) Use-after-free (CVE-ID: CVE-2026-53388)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fuse_try_move_folio() in the FUSE subsystem when moving a page cache folio during FUSE read handling. A local user can trigger a race condition to cause a denial of service.

The issue occurs because the request is not re-locked on the success path, allowing request abortion to free fuse_io_args while subsequent copy logic still accesses it.

90) Use-after-free (CVE-ID: CVE-2026-63801)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in tipc_aead_decrypt_done in the TIPC crypto subsystem when processing crafted encrypted frames during asynchronous decryption. A remote attacker can send crafted encrypted frames to trigger a read from freed memory and cause a denial of service.

Exploitation requires the asynchronous decryption path to be used and can occur while the associated network namespace is being torn down.

91) Use-after-free (CVE-ID: CVE-2026-63808)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in exfat_find_dir_entry() when parsing a crafted exFAT filesystem image. A local user can supply a crafted exFAT image to trigger a kernel fault and cause a denial of service.

The issue occurs on the TYPE_EXTEND path after a directory entry buffer is released and then dereferenced.

92) NULL pointer dereference (CVE-ID: CVE-2026-63810)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the bdev pseudo-filesystem when userspace mounts it and accesses files. A local attacker can mount the pseudo-filesystem and access files to cause a denial of service.

The issue is triggered through move_mount() using inode_operations pointers that are equal to 0 for this pseudo-filesystem.

93) Use-after-free (CVE-ID: CVE-2026-63823)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in request_key_auth handling in the Linux kernel key management subsystem when processing KEYCTL_INSTANTIATE_IOV or related key instantiation and rejection paths concurrently with request_key() completion. A local user can trigger concurrent key operations to cause a denial of service.

The issue occurs because the request_key_auth payload can be freed after helper completion while another path later resumes and accesses rka->target_key.

94) Use-after-free (CVE-ID: CVE-2026-63827)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in aa_replace_profiles() during rawdata_list deduplication when processing policy replacement operations. A local user can trigger AppArmor profile replacement with crafted timing to cause a denial of service.

The issue occurs because entries can remain on the rawdata list after their profile reference count has reached zero and before deferred cleanup runs.

95) Improper access control (CVE-ID: CVE-2026-63828)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass AppArmor connect restrictions.

The vulnerability exists due to improper access control in apparmor_socket_sendmsg() when processing sendmsg()/sendto() calls with MSG_FASTOPEN and a supplied destination address. A local user can send a crafted fast open request to bypass AppArmor connect restrictions.

The issue affects implicit TCP and MPTCP connection establishment performed as part of sendmsg() fast open handling.

96) Improper access control (CVE-ID: CVE-2026-63842)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the amdgpu JPEG v5.0.0 ring when processing command submissions with user fences. A local user can submit a crafted command submission with a user fence to cause a denial of service.

97) Improper input validation (CVE-ID: CVE-2026-63850)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the amdgpu VCN v5.0.0 encoder ring when processing command submissions with user fences. A local user can submit a command stream with a user fence to cause a denial of service.

The issue affects the VCN v5.0.0 encoder ring because it does not support 64-bit user fence writes.

98) Improper input validation (CVE-ID: CVE-2026-63860)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the RDMA/core netlink attribute handling in drivers/infiniband/core/iwpm_msg.c when processing netlink messages containing string attributes evaluated as c-strings without an enforced nul terminator. A local user can send a specially crafted netlink message to cause a denial of service.

99) Race condition (CVE-ID: CVE-2026-63865)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in sleepable bpf lsm hooks in kernel/bpf/bpf_lsm.c when executing the task_to_inode hook from rcu read-side critical sections. A local user can trigger the vulnerable hook to cause a denial of service.

The issue involves sleepable lsm programs being used with a hook that is invoked under rcu_read_lock().

100) Integer underflow (CVE-ID: CVE-2026-63868)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an unsigned integer underflow in garp_pdu_parse_attr in the GARP receive-side attribute parser when parsing crafted GARP attributes. A remote attacker can send crafted Join or Leave events to cause a denial of service.

The issue can cause received GARP events for common attributes, such as GVRP VLAN registration attributes, to be ignored.

101) Race condition (CVE-ID: CVE-2026-63879)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in amdgpu_hmm_range_get_pages in the AMDGPU HMM handling code when reading the notifier sequence across range processing. A local user can trigger memory invalidation during page range handling to cause a denial of service.

The issue can result in operations being performed on invalid pages.

102) Integer overflow (CVE-ID: CVE-2026-63881)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in get_queue_ids() in the amdkfd kfd debugger when processing a user-supplied queue ID array. A local user can supply crafted queue count values to cause a denial of service.

The issue affects 32-bit size_t builds.

103) Heap-based buffer overflow (CVE-ID: CVE-2026-63886)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in chap_server_compute_hash() in the iSCSI target CHAP authentication handling when processing a specially crafted base64-encoded CHAP_R response. A remote user can send a specially crafted CHAP authentication response to cause a denial of service.

The issue affects the BASE64 CHAP_R decoding path; the mutual CHAP CHAP_C decoding path is not affected.

104) Heap-based buffer overflow (CVE-ID: CVE-2026-63887)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in iscsi_encode_text_output() when processing iSCSI login text parameters. A remote attacker can send a specially crafted login request with many minimal key-value pairs to cause a denial of service.

The issue can be triggered by expansion of unknown keys into larger "NotUnderstood" response records during login negotiation.

105) Double free (CVE-ID: CVE-2026-63888)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a double free in iscsit_handle_text_cmd() when handling a Text PDU with a bad DataDigest on connections using ErrorRecoveryLevel greater than 0. A remote user can send a specially crafted text request to cause a denial of service.

On hardened kernels the flaw can trigger a remote kernel BUG(), while on non-hardened kernels it can corrupt the slab freelist. A follow-up Text Request on the same ITT or session teardown can free the same pointer again.

106) Out-of-bounds read (CVE-ID: CVE-2026-63888)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in iscsit_handle_text_cmd() when processing Text PDUs with DataDigest enabled. A remote user can send a specially crafted text request to cause a denial of service.

The issue is triggered when DataDigest is negotiated for the connection.

107) Integer overflow (CVE-ID: CVE-2026-63889)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop caused by an integer truncation error in the FPIN pname walker in scsi_transport_fc when processing a crafted FPIN ELS frame. A remote attacker can send a crafted Fibre Channel fabric frame to cause a denial of service.

Exploitation requires the ability to inject Fibre Channel fabric traffic to an lpfc or qla2xxx Linux initiator, such as from a compromised switch or fabric controller, or from a same-zone N_Port on a fabric that permits source spoofing.

108) Uncontrolled Recursion (CVE-ID: CVE-2026-63891)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in __tb_property_parse_dir() in the thunderbolt property parser when processing a crafted PROPERTIES_REQUEST control-plane exchange containing chained DIRECTORY entries with a back-reference loop. A remote attacker can send crafted XDomain property data to cause a denial of service.

The issue can be triggered by an untrusted XDomain peer such as a cable, dock, in-line inspector, or adjacent host.

109) Out-of-bounds write (CVE-ID: CVE-2026-63898)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the mct_u232 USB serial driver when handling a malicious USB device that reports a smaller endpoint maximum packet size than expected. An attacker with physical access can connect a specially crafted USB device to cause memory corruption.

110) Out-of-bounds read (CVE-ID: CVE-2026-63920)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ip6_datagram_recv_specific_ctl() when processing IPv6 extension headers for recvmsg control messages after the hdrlen field is modified. A local user can use an nftables payload-write expression to corrupt the extension header length and trigger copying beyond the available header data to disclose sensitive information.

Exploitation is reachable from an unprivileged user namespace.

111) Out-of-bounds write (CVE-ID: CVE-2026-63923)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or overwrite out-of-bounds memory.

The vulnerability exists due to an out-of-bounds write in rvu_mbox_handler_rep_event_notify and the representor event handling path when processing a crafted REP_EVENT_NOTIFY mailbox request with a sender-controlled body pcifunc value. A local user can send a specially crafted mailbox request to cause a denial of service or overwrite out-of-bounds memory.

Exploitation requires a VF attached to a PF that has been put into switchdev representor mode. For RVU_EVENT_MAC_ADDR_CHANGE, the invalid body pcifunc is used as a six-byte ether_addr_copy() target in the queued worker.

112) Integer overflow (CVE-ID: CVE-2026-63925)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass replay protection.

The vulnerability exists due to an integer overflow in macsec_post_decrypt() when processing a crafted replayed frame on an XPN association with a packet number of 0xffffffff. A remote attacker can replay a captured legitimate frame to bypass replay protection.

Exploitation requires capturing a legitimate frame carrying the maximum 32-bit packet number on an XPN association.

113) Incorrect calculation (CVE-ID: CVE-2026-63926)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper offset calculation in bpf_msg_push_data() in the sockmap BPF subsystem when inserting data into the middle of a scatterlist entry. A local user can trigger the inconsistent split layout to cause a denial of service.

Exploitation requires access to BPF sockmap functionality.

114) Out-of-bounds write (CVE-ID: CVE-2026-63928)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the omninet USB serial driver bulk-out buffer handling when processing a malicious USB device that reports a smaller endpoint max packet size than expected. An attacker with physical access can connect a crafted USB device to cause memory corruption.

The issue can lead to user-controlled slab corruption.

115) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-63937)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in the KVM SEV Page State Change buffer handling in arch/x86/kvm/svm/sev.c when processing guest-accessible PSC buffer entries and indices. A local user can modify buffer values during processing to cause a denial of service.

The issue involves guest-accessible PSC buffer header fields and entries used for validation and array indexing.

116) Use-after-free (CVE-ID: CVE-2026-63944)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in hci_le_create_cis_sync in the Bluetooth HCI synchronization logic when processing concurrent Bluetooth connection state changes during LE Create CIS handling. A local user can trigger a concurrent disconnect to cause a denial of service.

The stale pointer is dereferenced after both rcu_read_lock() and hci_dev_lock(hdev) are released, and the queued cancellation path does not match the pending work item because it is queued with NULL data but dequeued with the connection pointer.

117) Infinite loop (CVE-ID: CVE-2026-63969)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a stale linked-list state in rt6_fill_node() when walking IPv6 route sibling entries during softirq-side processing. A local user can trigger route state changes to cause a CPU stall.

The issue can result in an infinite loop in the walker.

118) Improper resource shutdown or release (CVE-ID: CVE-2026-63970)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in virtio_transport_alloc_skb() in the vsock/virtio transport when processing fixed-buffer vectored zerocopy input that hits MAX_SKB_FRAGS. A local user can trigger a partial attachment of managed fragments to cause a denial of service.

Exploitation occurs on the rollback path after io_sg_from_iter() returns -EMSGSIZE, causing an skb with managed fragment references but no bound uarg to be freed through the ordinary fragment unref path.

119) NULL pointer dereference (CVE-ID: CVE-2026-63972)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mana_detach() when handling queue reset recovery after a previous detach succeeded but attach failed. A local user can trigger queue reset handling to cause a denial of service.

The issue occurs when the port is already in a detached state and transmit and receive queue resources have already been freed.

120) NULL pointer dereference (CVE-ID: CVE-2026-63973)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mana network driver teardown path when cleaning up after a partial queue allocation failure. A local user can trigger queue allocation failure and subsequent teardown handling to cause a denial of service.

The issue can be reached through multiple teardown paths, including device removal, MTU change recovery, and internal error handling.

121) Improper locking (CVE-ID: CVE-2026-63980)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the net/handshake subsystem when canceling a TLS handshake from softirq context while the same lock is held in process context on the same CPU. A local user can trigger a TLS handshake cancellation race to cause a denial of service.

The issue results in a deadlock.

122) Improper input validation (CVE-ID: CVE-2026-63985)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in fallback_set_params() in the ethtool EEPROM Netlink fallback path when processing module EEPROM read parameters. A local user can supply an offset and length combination that exceeds the EEPROM bounds to cause a denial of service.

The issue affects the Netlink fallback path for reading module EEPROM and may lead to unexpected behavior in drivers or device firmware.

123) NULL pointer dereference (CVE-ID: CVE-2026-63990)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null-pointer dereference in the bonding driver when enslaving a CAN device to a bonding master. A local user can enslave a virtual CAN device to a bonding master to cause a denial of service.

The issue can be triggered with a virtual CAN device such as vxcan, and subsequent socket cleanup operations may access invalid CAN receiver state.

124) Out-of-bounds read (CVE-ID: CVE-2026-63992)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in iptunnel_pmtud_check_icmp() when processing ICMP packets without a valid transport header. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because the function may be called while the skb transport header is not set.

125) Out-of-bounds write (CVE-ID: CVE-2026-63995)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in cmis_fw_update_start_download() when processing a CMIS module firmware management features reply. An attacker with physical access can provide a malicious module response with an oversized start command payload value to cause memory corruption.

A malicious module or a corrupted response can trigger the issue during CMIS firmware update handling.

126) Out-of-bounds write (CVE-ID: CVE-2026-63996)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to out-of-bounds write in cmis_cdb_process_reply() when processing a crafted CDB reply from an SFP module. An attacker with physical access can provide a malicious SFP module that returns an overlong reply to cause a denial of service.

The issue can be triggered by a malicious module, and the advisory notes that buggy hardware or corrupted reads may also reach the vulnerable condition.

127) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-63997)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in module_flash_fw_schedule() in net/ethtool/module.c when handling module firmware flash errors. A local user can trigger an error during a firmware flash operation to cause a denial of service.

128) Improper resource shutdown or release (CVE-ID: CVE-2026-63998)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the ethtool module flash operation handler when handling a module firmware flash request that fails validation. A local user can trigger a validation failure to cause a denial of service.

129) Memory leak (CVE-ID: CVE-2026-63999)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in rss_prepare_get() in net/ethtool/rss.c when handling a get_rxfh operation failure. A local user can trigger an error path to cause a denial of service.

130) Out-of-bounds read (CVE-ID: CVE-2026-64000)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in supervision frame handling in net/hsr/hsr_forward.c when processing truncated supervision frames. A remote attacker can send a specially crafted frame to cause a denial of service.

131) Use-after-free (CVE-ID: CVE-2026-64001)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in snd_pcm_oss_proc_write() and snd_pcm_oss_look_for_setup() when handling proc writes followed by a later OSS device open. A local user can trigger a proc write error that leaves a stale setup_list entry and then open an OSS device to dereference freed memory to cause a denial of service.

The issue arises because a newly allocated setup entry may be linked into setup_list before task name allocation completes.

132) Use-after-free (CVE-ID: CVE-2026-64002)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ipv4_sysctl_exit_net() when unregistering the IPv4 sysctl table while sysctl handlers may still access sysctl_local_reserved_ports. A local user can trigger access to the freed sysctl entry to cause a denial of service.

The issue affects access to /proc/sys/net/ipv4/ip_local_reserved_ports during network namespace sysctl teardown.

133) Race condition (CVE-ID: CVE-2026-64004)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the AF_IUCV getsockopt handler when racing recvmsg() with getsockopt(SO_MSGSIZE). A local user can trigger concurrent socket operations to cause a denial of service.

The issue can lead to a NULL pointer dereference in the kernel.

134) Improper Initialization (CVE-ID: CVE-2026-64005)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the SMC hash tables in net/smc/af_smc.c when initializing the SMC subsystem. A local user can trigger use of corrupted hash list state to cause a denial of service.

The issue can occur when the hash tables are re-initialized after hash entries already exist and are in use, potentially resulting in a corrupted list.

135) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64006)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of overlapping registers in nf_tables bitwise and byteorder operations when processing crafted nf_tables register operations. A local user can create overlapping source and destination register operations to cause incorrect packet filtering behavior and a denial of service.

Exploitation requires the ability to configure nf_tables rules.

136) Use-after-free (CVE-ID: CVE-2026-64007)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption or a denial of service.

The vulnerability exists due to a use-after-free in synproxy_tstamp_adjust() in the netfilter synproxy implementation when processing crafted TCP packets that trigger header rewriting on a cloned or non-linear skb. A remote attacker can send a specially crafted packet to cause memory corruption or a denial of service.

The issue affects checksum updates after the packet buffer is made writable, which can result in a write to freed slab memory or a transmitted packet with a stale checksum.

137) Use-after-free (CVE-ID: CVE-2026-64010)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race condition in nfc_llcp_recv_cc() when processing an NFC LLCP connection acceptance packet concurrently with socket release. A local user can trigger concurrent connection handling and socket release to cause a denial of service.

The issue occurs during a connection state transition when a socket can be moved from the connecting_sockets list to the sockets list after it has already been unlinked and marked for destruction.

138) Use-after-free (CVE-ID: CVE-2026-64011)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in llcp_sock_release() when releasing an LLCP socket in connecting state. A local user can trigger socket release in that state to cause a denial of service.

139) Out-of-bounds read (CVE-ID: CVE-2026-64014)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the nexio_read_data() function in the usbtouchscreen driver when processing a crafted device interrupt packet with falsified length fields. An attacker with physical access can provide a malicious USB device that reports oversized data_len and x_len values to disclose sensitive information and cause a denial of service.

Kernel memory contents may be exposed to userspace through reported ABS_X and ABS_Y input events.

140) Race condition (CVE-ID: CVE-2026-64015)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in find_key_to_update in the keyring code when looking up keys for update without holding the RCU read lock. A local user can trigger concurrent key lookup and garbage-collection activity to cause a denial of service.

The issue affects persistent key handling, which uses a different locking model.

141) Out-of-bounds read (CVE-ID: CVE-2026-64018)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in mana_hwc_rx_event_handler() when processing hardware-modifiable WQE contents from DMA-coherent memory. A local attacker can modify the derived rx_req_idx value to cause a denial of service.

In confidential VMs such as SEV-SNP and TDX, the affected DMA-coherent memory is shared unencrypted and hardware can modify WQE contents at any time.

142) Improper resource shutdown or release (CVE-ID: CVE-2026-64021)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in xe_oa_stream_open_ioctl() when handling an ioctl request with an exec queue whose width is greater than 1. A local user can send a crafted ioctl request to cause a denial of service.

The leaked exec queue reference can keep both the exec queue and the file private state pinned indefinitely.

143) Use-after-free (CVE-ID: CVE-2026-64029)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in seq_ump_process_event() and snd_rawmidi_kernel_write1() when processing sequencer events during concurrent output teardown. A local user can trigger concurrent event delivery and output close operations to cause a denial of service.

The issue arises from a race condition between the event_input path and the last output unuse path, where the rawmidi substream runtime may be freed while still in use.

144) Use-after-free (CVE-ID: CVE-2026-64033)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in rtrs_srv_create_path_files() cleanup logic when handling an error path during sysfs path file creation. A local user can trigger a failure in a later cleanup step to cause a denial of service.

The issue occurs before the function returns success, in a failure path where sysfs root folders may already exist and the kobject may already have been initialized.

145) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-64034)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass bounds validation.

The vulnerability exists due to a time-of-check time-of-use double-fetch in mana_hwc_rx_event_handler() and mana_hwc_handle_resp() when reading hwc_msg_id from a DMA-coherent buffer. A remote attacker can modify the DMA-visible hwc_msg_id value between reads to bypass bounds validation.

Exploitation requires hardware or a host environment able to alter shared, unencrypted DMA-coherent memory between the check and the subsequent use, such as in confidential VM environments.

146) Out-of-bounds read (CVE-ID: CVE-2026-64039)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in msm_disp_state_print_regs and related snapshot dumping logic when processing unaligned DSI register regions. A local user can trigger snapshotting of a specially positioned unaligned region to cause a denial of service.

The issue occurs because some DSI data regions are shifted by 4 bytes, causing the last registers in the region to be handled incorrectly.

147) Off-by-one (CVE-ID: CVE-2026-64047)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in tls_push_record() in the net/tls subsystem when chaining a wrapped sk_msg scatterlist ring. A local user can trigger the wrapped ring condition to cause a denial of service.

The issue occurs when the sk_msg scatterlist ring wraps with sg.end less than sg.start.

148) NULL pointer dereference (CVE-ID: CVE-2026-64048)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in smc_v2_determine_accepted_chid and smc_conn_create when processing a crafted SMC-Dv2 accept reply with CHID 0. A remote attacker can send a specially crafted reply to trigger a kernel fault and cause a denial of service.

Exploitation requires a malicious peer to reply to an SMC-Dv2-only proposal.

149) Use-after-free (CVE-ID: CVE-2026-64051)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in qaic_gem_object_mmap when mapping a buffer object into memory with scatter-gather segments that extend beyond the virtual memory area. A local user can trigger the mapping of an oversized buffer object to cause a denial of service.

The issue occurs because memory beyond the requested virtual memory area can remain mapped after munmap() unmaps only the virtual memory area region.

150) NULL pointer dereference (CVE-ID: CVE-2026-64052)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in bio_integrity_map_user() when mapping user-supplied integrity data with partially pinned pages. A local user can trigger partial page pinning to cause a denial of service.

151) Improper Initialization (CVE-ID: CVE-2026-64055)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the gmac_rx() NAPI poll function when assembling packets from a ring buffer. A local user can trigger processing of fragmented packets across poll cycles to cause a denial of service.

The issue occurs when the ring buffer is completely emptied before a packet has been fully assembled.

152) Race condition (CVE-ID: CVE-2026-64056)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in gmac_rx() in the cortina gemini ethernet driver when processing fragmented packets on systems using both ethernet ports. A local user can trigger concurrent packet reception to cause a denial of service.

The issue arises because a packet assembly sk_buff was shared between the two ports.

153) Use-after-free (CVE-ID: CVE-2026-64073)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in irq_work_single() when synchronizing irq_work on PREEMPT_RT systems. A local user can trigger concurrent irq_work activity and free the work structure after BUSY is cleared to cause a denial of service.

The issue affects non-HARD irq_work processed by per-CPU kthreads on PREEMPT_RT.

154) Use of Uninitialized Variable (CVE-ID: CVE-2026-64083)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an uninitialized stack memory exposure in the adm1266 GPIO accessors when processing short block-read responses from the device. A local user can trigger a short block-read response to disclose sensitive information.

The leaked bits can reach userspace through gpiolib interfaces including sysfs and character-device ioctls.

155) Out-of-bounds write (CVE-ID: CVE-2026-64084)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and corrupt memory.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in adm1266_gpio_get_multiple() in the adm1266 PMBus driver when iterating a caller-supplied gpio mask. A local user can trigger access to bits beyond the end of the supplied mask and bits arrays to disclose sensitive information and corrupt memory.

The iteration uses a PMBus command value as the scan bound instead of the number of PDIO pins.

156) Out-of-bounds write (CVE-ID: CVE-2026-64085)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in adm1266_nvmem_read_blackbox() when processing device-supplied blackbox records. A local user can provide a device response with more than 64 bytes in a trailing record to cause a denial of service.

The issue occurs because the helper may write up to 255 bytes into a 64-byte record slot before the returned length is validated.

157) Out-of-bounds write (CVE-ID: CVE-2026-64086)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in adm1266_pmbus_block_xfer() and read_buf in the adm1266 PMBus driver when processing a max-length block read response with a PEC byte. A local user can trigger the driver to process a crafted response to cause a denial of service.

The same condition can also cause an out-of-bounds read during the subsequent PEC comparison.

158) Out-of-bounds write (CVE-ID: CVE-2026-64087)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in adm1266_nvmem_read_blackbox() when processing a malformed BLACKBOX_INFO response. A local user can provide a device response with an implausible blackbox record count to cause a denial of service.

The issue can be triggered by a non-responsive slave returning 0xff, bus corruption, or firmware bugs in the device response.

159) Use of Uninitialized Variable (CVE-ID: CVE-2026-64088)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in batadv_send_other_tt_response() and batadv_tt_prepare_tvlv_global_data() when handling tt changeset response data. A remote attacker can trigger processing of an oversized tt_buff_len value to disclose sensitive information.

The issue is caused by a signed integer field wrapping to a negative value and then being widened with sign extension, resulting in a fully allocated buffer that is only partially initialized.

160) Out-of-bounds read (CVE-ID: CVE-2026-64097)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() when parsing a malformed VBIOS GPIO pin LUT table. A local attacker can supply a crafted VBIOS image with an invalid structuresize field to disclose sensitive information.

161) Improper locking (CVE-ID: CVE-2026-64098)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() when updating planes and flushing framebuffer resources. A local user can trigger error conditions that leave the dma_resv lock unheld and then reach fence-list updates to cause a denial of service.

The issue can race with concurrent readers or writers and corrupt the dma_resv fence list. The reported trigger used fault injection on the DRM_IOCTL_MODE_CURSOR path.

162) Use-after-free (CVE-ID: CVE-2026-64099)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the v3d CPU job ioctl error path when handling CPU job submission failures. A local user can trigger an error path with crafted CPU job submissions to cause a denial of service.

The same error path can also trigger a NULL dereference and leak one sync object reference per query.

163) Integer underflow (CVE-ID: CVE-2026-64102)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service and disclose kernel memory contents.

The vulnerability exists due to an integer underflow in the Soft-iWARP receive path (siw_get_hdr/siw_tcp_rx_data) when processing a malformed iWARP FPDU with an MPA length smaller than the fixed header length for the opcode. A remote user can send a specially crafted FPDU to cause a denial of service and disclose kernel memory contents.

The issue is triggered by a malicious connected siw peer, and the negative signed length is later promoted to size_t during skb_copy_bits processing.

164) Use-after-free (CVE-ID: CVE-2026-64109)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in unix_stream_data_wait() in net/unix/af_unix.c when processing racing recv() operations on the same AF_UNIX stream socket. A local user can trigger concurrent peek and normal receive operations to cause a denial of service.

Exploitation requires a race condition between a peeking recv() call and a normal recv() call on the same socket.

165) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-64112)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in the rbd lock_dwork handling in drivers/block/rbd.c when unmapping an image while exclusive lock work is being queued. A local user can trigger image unmap operations during concurrent I/O activity to cause a denial of service.

The issue can result in lock acquisition work executing after device and image release operations have freed or reset internal state.

166) Use-after-free (CVE-ID: CVE-2026-64113)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ixgbevf_clean_rx_irq() when processing received frames that trigger VEPA multicast source pruning. A local user can trigger this code path to cause a denial of service.

The issue occurs in NAPI softirq context when a freed skb is reused on the next loop iteration because the pointer is not cleared before continuing.

167) Out-of-bounds read (CVE-ID: CVE-2026-64114)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in the raw_send_hdrinc IPv4 packet handling in the Linux kernel when processing a malformed IP_HDRINCL packet with an IPv4 header length value less than 5. A local user can send a specially crafted packet through a raw socket to cause a denial of service.

Exploitation requires CAP_NET_RAW. Triggering the reproduced crash path also requires a matching xfrm AH policy on the outgoing route, and loopback does not reach the affected path.

168) Use-after-free (CVE-ID: CVE-2026-64115)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in vmci_transport_recv_connecting_server() and vmci_transport_recv_listen() when processing a peer reset during the connection handshake. A remote attacker can send a reset packet during the handshake to cause a denial of service.

The issue is triggered by a race involving pending socket cleanup in the VMCI vsock transport.

169) Double free (CVE-ID: CVE-2026-64118)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in qed_cid_map_free() in the QLogic qed driver context management code when handling failed CID bitmap allocations. A local user can trigger the failing allocation path to cause a denial of service.

Exploitation requires device-specific setup to reach the affected allocation failure path.

170) Out-of-bounds read (CVE-ID: CVE-2026-64121)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ifb_get_ethtool_stats in the IFB network driver when handling ethtool statistics requests on a device with more RX queues than TX queues. A local user can request ethtool statistics for a crafted asymmetric IFB device to disclose sensitive information.

Exploitation requires an IFB device configuration where the RX queue count exceeds the TX queue count.

171) Improper Initialization (CVE-ID: CVE-2026-64125)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper hardware state management in bcmgenet_eee_enable_set in the Broadcom GENET network driver when enabling energy-efficient ethernet settings. A local user can enable the affected settings to cause a denial of service.

On affected systems, RX traffic can stop flowing while the link remains up, and on some boards the resulting corruption can lead to a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit.

172) Out-of-bounds read (CVE-ID: CVE-2026-64126)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the Bluetooth MGMT add_ext_adv_data() handler when processing a crafted MGMT_OP_ADD_EXT_ADV_DATA command with inconsistent length fields. A local privileged user can send a specially crafted management command to disclose sensitive information.

Exploitation requires CAP_NET_ADMIN in the initial user namespace, and exposed memory may be read back via MGMT_OP_GET_ADV_INSTANCE.

173) Information disclosure (CVE-ID: CVE-2026-64127)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an information leak caused by incorrect size and source-pointer arguments in l2cap_ecred_reconfigure() in the Bluetooth L2CAP subsystem when sending an L2CAP_ECRED_RECONFIGURE_REQ packet to a paired Bluetooth peer. A remote attacker can trigger ecred reconfiguration handling to disclose sensitive information.

The malformed packet copies bytes from kernel stack memory and can expose a kernel stack address to the peer. Exploitation requires Bluetooth connectivity with a paired peer.

174) NULL pointer dereference (CVE-ID: CVE-2026-64128)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in iso_recv() in the Bluetooth ISO subsystem when processing an ISO_END frame without a prior ISO_START on a fresh ISO connection. A remote attacker can send a specially crafted Bluetooth ISO frame sequence to cause a denial of service.

For BIS, exploitation does not require pairing and can be triggered by a broadcaster on the air.

175) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-64131)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper check for unusual or exceptional conditions in mm/memory.c unmap path when unmapping device-private or exclusive pages from private file-backed mappings. A local user can trigger memory migration and unmapping operations to cause a denial of service.

The issue can result in a kernel warning during process teardown.

176) Out-of-bounds read (CVE-ID: CVE-2026-64133)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the find_control() function in the ALSA asihpi driver when reading cached control information with an out-of-range control index. A local user can provide a crafted control index to cause a denial of service.

177) NULL pointer dereference (CVE-ID: CVE-2026-64134)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the ALSA PCM interleaved_copy() function when handling silencing operations with NULL data. A local user can trigger a crafted PCM data transfer path to cause a denial of service.

The issue is architecture-dependent and was reported to cause failures on RISC-V systems.

178) Stack-based buffer overflow (CVE-ID: CVE-2026-64135)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in adm1266_nvmem_read_blackbox() when processing an SMBus block response from a device. A local user can return a block length larger than the allocated buffer to cause a denial of service.

The issue occurs before the return-length check rejects an unexpected response.

179) Race condition (CVE-ID: CVE-2026-64136)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in smb2_find_smb_sess_tcon_unlocked() when handling SMB tree connection lookups. A local user can trigger concurrent access to corrupt tc_count handling and cause a denial of service.

180) Improper access control (CVE-ID: CVE-2026-64137)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to affect service availability.

The vulnerability exists due to improper access control in the CIFS SWN netlink notify handler when sending witness notification commands. A local user can send crafted RESOURCE_CHANGE or CLIENT_MOVE notifications to affect service availability.

The intended sender is the cifs.witness helper, but any local process could send notifications to the in-kernel witness handler.

181) Improper access control (CVE-ID: CVE-2026-64137)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the CIFS SWN generic netlink multicast group when joining the multicast group and receiving registration messages. A local user can join the CIFS_GENL_MCGRP_SWN group to disclose sensitive information.

For NTLM-authenticated mounts, exposed registration messages may include the username, domain, and password attributes copied from the CIFS session.

182) Improper resource shutdown or release (CVE-ID: CVE-2026-64144)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the btmtk USB Bluetooth driver when handling failed or killed control urbs. A local user can trigger error paths to cause a denial of service.

183) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64146)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in erofs_init_inode_xattrs() in the EROFS xattr handling code when parsing crafted filesystem metadata. A local user can trigger error paths that leak a folio reference to cause a denial of service.

The issue occurs on certain error paths after a metabuf has been acquired during inode xattr initialization.

184) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64148)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in pdsc_devcmd_wait() when handling firmware crash or command timeout conditions. A local user can trigger the vulnerable code path to cause a denial of service.

The issue causes stale success status to be returned instead of propagating an error, which can prevent proper recovery handling.

185) Improper resource shutdown or release (CVE-ID: CVE-2026-64155)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ath11k WMI WOW command handling in drivers/net/wireless/ath/ath11k/wmi.c when sending WOW host wakeup and WOW enable commands. A local user can trigger error paths to cause a denial of service.

186) Improper resource shutdown or release (CVE-ID: CVE-2026-64164)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the btrfs_sync_file trace event in include/trace/events/btrfs.h when handling file sync operations with the trace event enabled. A local user can trigger the vulnerable trace event to cause a denial of service.

Exploitation requires the btrfs_sync_file trace event to be enabled.

187) NULL pointer dereference (CVE-ID: CVE-2026-64166)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the arm_ffa bus match callback when registering a buggy FF-A driver without an id_table. A local user can register a crafted FF-A driver to cause a denial of service.

188) NULL pointer dereference (CVE-ID: CVE-2026-64168)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an error pointer dereference in the sprd spi driver probe error-handling path when handling DMA setup failure during probe. A local user can trigger a probe path that falls back from DMA to PIO mode and reaches late error handling to cause a denial of service.

The issue occurs because the driver may attempt to release DMA channels after DMA setup has failed.

189) Use-after-free (CVE-ID: CVE-2026-64178)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to a use-after-free in the bnep_add_connection function when reading dev->name during connection setup while a concurrent connection deletion tears down the net_device. A local privileged user can trigger concurrent bnep_add_connection and bnep_del_connection operations to disclose sensitive information.

Exploitation requires CAP_NET_ADMIN and a tight race window during net_device teardown.

190) Improper resource shutdown or release (CVE-ID: CVE-2026-64180)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in remove_memory_blocks_and_altmaps() in mm/memory_hotplug.c when removing memory blocks and their altmaps. A local user can trigger memory block removal operations to cause a denial of service.

191) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-64185)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in sysfs_update_group() and internal_create_group() when handling updates to a named sysfs group after create_files() fails. A local user can trigger an update operation that causes file creation to fail to cause a denial of service.

The issue affects the update path for an already existing named sysfs group, which may be silently removed instead of left intact.

192) Use-after-free (CVE-ID: CVE-2026-64188)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in rmnet_dellink() and the rmnet endpoint handling in the Qualcomm rmnet driver when processing network packets on the receive path while an endpoint is being removed. A local user can trigger concurrent packet processing and endpoint deletion to cause a denial of service.

The stale read occurs when lockless RCU readers dereference the egress_dev pointer after the endpoint memory has been freed.

193) Race condition (CVE-ID: CVE-2026-64190)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a race condition leading to a NULL pointer dereference in team_xmit in the Linux kernel team driver when changing team device mode concurrently with transmit activity. A local privileged user can trigger a mode change while traffic is being transmitted on the team device to cause a denial of service.

Exploitation requires the ability to perform a mode change on the team device and concurrent transmit activity.

194) Out-of-bounds write (CVE-ID: CVE-2026-64192)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in BPF_MAP_TYPE_INODE_STORAGE handling when creating and updating inode storage maps while the BPF LSM is uninitialized. A local privileged user can create and update a BPF_MAP_TYPE_INODE_STORAGE map to cause a denial of service.

This issue occurs when CONFIG_BPF_LSM is enabled but the BPF LSM is not enabled at boot time, causing the inode security blob offset to remain uninitialized and leading to a kernel panic during later RCU callback execution.

195) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-64214)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access of per-CPU preemption state in arch_irq_work_raise() when handling machine check exceptions in real mode. A local user can trigger a machine check exception that reaches arch_irq_work_raise() to cause a denial of service.

The issue occurs in NMI context on powerpc systems, where accessing preempt_count from real mode can fault and panic the kernel.

196) Out-of-bounds write (CVE-ID: CVE-2026-64217)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in netfs_extract_user_iter() when extracting user-supplied pages from an iov_iter. A local user can trigger an extract_pages overrun to cause memory corruption.

The issue occurs if iov_iter_extract_pages() overfills the pages array, causing excess pages to be included in the constructed iterator.

197) Use-after-free (CVE-ID: CVE-2026-64218)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in batadv_bla_purge_backbone_gw() in the bridge loop avoidance component when purging stale backbone gateway entries. A local user can trigger report_work to access freed memory to cause a denial of service.

The issue occurs when associated report_work is still running or pending during backbone gateway cleanup.

198) Out-of-bounds read (CVE-ID: CVE-2026-64219)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dc->links[] access within dc_process_dmub_aux_transfer_async() when handling a link_index value without bounds checking. A local user can supply an invalid link_index to cause a denial of service.

199) Stack-based buffer overflow (CVE-ID: CVE-2026-64219)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in dc_process_dmub_aux_transfer_async() when processing an aux transfer payload. A local user can pass a payload length greater than 16 to cause a denial of service.

200) Double free (CVE-ID: CVE-2026-64222)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in otx2_pool_aq_init() and cn20k_pool_aq_init() when handling allocation or mailbox synchronization failures during pool initialization. A local user can trigger the affected error path to cause a denial of service.

Exploitation requires OcteonTX2 or CN20K hardware.

201) Double free (CVE-ID: CVE-2026-64224)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in rvu_rep_rsrc_init() in the OcteonTX2 representor driver when handling a failure during hardware resource initialization. A local user can trigger initialization failure to cause a denial of service.

Exploitation requires OcteonTX2 representor hardware.

202) Out-of-bounds read (CVE-ID: CVE-2026-64225)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the cgx_speed_mbps array access in link_status_user_format() when processing firmware-reported link status values. A local user can trigger an out-of-range RESP_LINKSTAT_SPEED value to cause a denial of service.

203) Out-of-bounds read (CVE-ID: CVE-2026-64237)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the elan_i2c firmware update handler when processing a crafted firmware file. A local user can provide a specially crafted firmware file to disclose sensitive information.

204) Out-of-bounds read (CVE-ID: CVE-2026-64243)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in simple_mux_control_put() when processing enumerated control values. A local user can supply an invalid enumerated item value to trigger an out-of-bounds read and cause a denial of service.

205) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64244)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper state management in add_memory_block() and memory_block_release() when handling failed memory block registration. A local attacker can trigger a failure during memory block registration to cause a denial of service.

This issue can be triggered when __add_memory_block() fails at xa_store() under memory pressure, leading to a kernel WARN_ON on mem->altmap.

206) Use-after-free (CVE-ID: CVE-2026-64245)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fb_find_mode() in the fbdev modedb component when processing a NULL mode option. A local user can trigger the vulnerable code path to cause a denial of service.

207) Use-after-free (CVE-ID: CVE-2026-64246)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in linkstation_poweroff_init() when initializing the linkstation poweroff driver. A local attacker can trigger the vulnerable initialization path to cause a denial of service.

208) Out-of-bounds read (CVE-ID: CVE-2026-64247)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hv_is_vp_in_sparse_set() when handling a paravirtual TLB flush for an L2 guest with a copied VP ID from the enlightened VMCS. A local user can provide a crafted VP ID value to cause a denial of service.

The issue can also cause KVM to perform an unnecessary TLB flush for an L2 vCPU.

209) Use-after-free (CVE-ID: CVE-2026-64249)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in child_regions_with_firmware() in drivers/fpga/of-fpga-region.c when handling child FPGA region data. A local user can trigger the error path to cause a denial of service.

210) Improper input validation (CVE-ID: CVE-2026-64257)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in __smb2_calc_size() and smb2_check_message() when processing crafted SMB2 responses. A remote attacker can send a specially crafted SMB2 response with overlapping data areas to cause a denial of service.

The issue occurs because an overlapping data area can be misclassified as having no data area, allowing an invalid response to qualify for a length compatibility exception.

211) Use-after-free (CVE-ID: CVE-2026-64266)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fuse_ref_folio() in the FUSE subsystem when handling a subsequent copy chain after unlocking the request. A local user can trigger request abort and asynchronous end callback timing to cause a denial of service.

212) Out-of-bounds write (CVE-ID: CVE-2026-64268)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to write out of bounds.

The vulnerability exists due to an out-of-bounds write in siw_proc_rresp() in drivers/infiniband/sw/siw/siw_qp_rx.c when processing Read Response DDP segments for an outstanding RREAD over an established RDMA connection. A remote user can send Read Response segments with more total payload than requested while keeping the DDP Last flag clear to write out of bounds.

Exploitation requires a connected siw peer on an established RDMA connection over routable TCP.

213) Out-of-bounds read (CVE-ID: CVE-2026-64269)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rdma_write_sg when processing an RTRS READ response with an attacker-controlled descriptor length. A remote attacker can advertise a crafted desc[0].len value larger than max_chunk_size to disclose sensitive information or cause a denial of service.

With no IOMMU or in passthrough mode, adjacent host memory may be returned to the peer; with a translating IOMMU, the out-of-range access is expected to fault and abort the connection.

214) Out-of-bounds write (CVE-ID: CVE-2026-64271)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to overwrite heap memory.

The vulnerability exists due to out-of-bounds write in the tw_interrupt() handler in drivers/input/touchscreen/touchwin.c when processing serial input from a Touchwindow peripheral. An attacker with physical access can send crafted non-zero bytes with mismatched second and third packet bytes to overwrite heap memory.

Exploitation requires a malicious, malfunctioning, or counterfeit Touchwindow peripheral.

215) Out-of-bounds write (CVE-ID: CVE-2026-64273)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in iforce_process_packet() when processing a device-reported force-feedback status packet. An attacker with physical access can supply a crafted device payload with an out-of-range effect index to corrupt kernel memory.

The issue affects both USB interrupt endpoint and serio transports, and the status handling path is not gated on force-feedback support being present.

216) Stack-based buffer overflow (CVE-ID: CVE-2026-64274)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to a stack-based out-of-bounds write in goodix_ts_read_input_report() when processing device-reported touch contact data. A remote attacker can tamper with the I2C bus or use a malicious controller to write beyond an on-stack buffer and cause memory corruption.

The issue occurs because the maximum contact count taken from a 4-bit device configuration field can exceed the number of contacts the buffer is sized to hold.

217) Integer underflow (CVE-ID: CVE-2026-64275)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to integer underflow in the touch reporting logic of the elan_i2c touchpad driver when handling small calculated or fallback width values. A local attacker can cause width values smaller than ETP_FWIDTH_REDUCE to trigger an underflow and report a massive unsigned integer to userspace.

The issue affects touch width reporting to userspace.

218) Division by zero (CVE-ID: CVE-2026-64275)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to division by zero in the elan_i2c touchpad driver when processing invalid device firmware or device tree parameters during device probe. A local attacker can provide zero trace-count values to trigger a kernel panic.

The issue occurs during device probe.

219) Out-of-bounds read (CVE-ID: CVE-2026-64276)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in the rmi_f30_attention handler and EVIOCGKEYCODE/EVIOCSKEYCODE ioctl handling in the synaptics-rmi4 F30 driver when processing a device that reports a gpioled_count greater than 6 with GPIO support enabled. A local user can trigger the attention interrupt or use EVIOCGKEYCODE/EVIOCSKEYCODE ioctls to cause a denial of service or disclose sensitive information.

The issue occurs because the keymap allocation is smaller than the gpioled_count value used for iteration and keycode bounds.

220) Out-of-bounds read (CVE-ID: CVE-2026-64277)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and overwrite adjacent kernel memory.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in the synaptics-rmi4 F3A GPIO keymap handling in drivers/input/rmi4/rmi_f3a.c when processing a device that reports a gpio_count greater than the allocated keymap size. A local user can open the evdev node and invoke keymap ioctls to disclose sensitive information and overwrite adjacent kernel memory.

The information disclosure occurs through EVIOCGKEYCODE leaking adjacent slab memory to user space, while EVIOCSKEYCODE writes a caller-controlled value past the buffer.

221) Use-after-free (CVE-ID: CVE-2026-64286)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a stale pointer in flush_hyp_vcpu() when copying the host vCPU context into the hyp private vCPU. A local user can provide a crafted __hyp_running_vcpu value to cause a denial of service.

The issue occurs on arm64 KVM with pKVM at EL2 during vCPU context handling.

222) Out-of-bounds read (CVE-ID: CVE-2026-64287)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in flush_hyp_vcpu() and the vGIC list register save and restore logic when copying host-controlled vgic_v3 state into the pKVM hyp vCPU. A local privileged user can provide a crafted used_lrs value to trigger out-of-bounds access at EL2 to cause a denial of service.

The issue affects arm64 KVM with pKVM and involves host-to-EL2 state transfer.

223) Improper access control (CVE-ID: CVE-2026-64294)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the mincore() and madvise(MADV_PAGEOUT) ownership checks when handling files on idmapped mounts. A local user can access these interfaces on a crafted idmapped mount to disclose sensitive information.

The issue affects side-channel protection logic and occurs because ownership was checked against an idmap that ignored the file's mount idmap.

224) Out-of-bounds write (CVE-ID: CVE-2026-64296)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read and write.

The vulnerability exists due to an out-of-bounds write in exfat_find_dir_entry() when parsing crafted exfat directory entries containing many short name fragments. A local user can provide a crafted directory structure to cause an out-of-bounds read and write.

The issue occurs because the per-entry output pointer advances by a fixed amount while the tracked accumulated name length can remain smaller when a name fragment contains an early NUL.

225) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64303)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption or trigger a use-after-free.

The vulnerability exists due to improper resource shutdown in the fsl-lpspi dma transfer error path in drivers/spi/spi-fsl-lpspi.c when preparing a tx dma descriptor after the rx dma channel has already been submitted and issued. A local user can trigger a tx prepare failure during a spi dma transfer to cause memory corruption or trigger a use-after-free.

The issue occurs because the spi core unmaps dma buffers after the error is returned while the rx dma engine may continue writing to those buffers.

226) Out-of-bounds write (CVE-ID: CVE-2026-64304)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in qat_rsa_setkey_crt() when processing RSA CRT key components larger than half of the key size. A local user can provide a crafted RSA CRT key to cause memory corruption.

The issue occurs because CRT components are bounded by the modulus size in the generic RSA key parser, while the QAT driver allocates half-size DMA buffers for those components.

227) Use-after-free (CVE-ID: CVE-2026-64305)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the qat service_table list handling in adf_init.c when iterating over registered services during device lifecycle and notification operations. A local user can trigger concurrent service registration or unregistration during list traversal to cause a denial of service.

The issue can also lead to list corruption during concurrent access.

228) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64306)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper handling of error conditions in drbg_ctr_generate() when processing additional input during CTR_DRBG generation. A local user can trigger a failure in drbg_ctr_update() to disclose sensitive information.

The output buffer may remain uninitialized when the function incorrectly reports success.

229) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64312)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper callback handling in the pcrypt aead fallback path in crypto/pcrypt.c when processing non-parallel fallback after padata submission returns -EBUSY. A local user can trigger asynchronous cryptographic operations that use the fallback path to cause a denial of service.

230) Integer overflow (CVE-ID: CVE-2026-64313)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect cryptographic computation.

The vulnerability exists due to an integer overflow in crypto/ecc.c when performing elliptic curve multiplication. A local user can trigger the vulnerable arithmetic path to cause incorrect cryptographic computation.

231) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-64315)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in the caam crypto driver setkey handlers when dumping key material during key setup with dynamic debug enabled. A local user can access debug output containing sensitive key material to disclose sensitive information.

Exposure occurs at runtime when CONFIG_DYNAMIC_DEBUG is enabled.

232) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-64316)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in the caam crypto driver key-dump code when handling key material in *_setkey() and gen_split_key(). A local user can access debug output containing sensitive key material to disclose sensitive information.

Exposure occurs at runtime when CONFIG_DYNAMIC_DEBUG is enabled.

233) Out-of-bounds read (CVE-ID: CVE-2026-64317)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Rock Ridge SL record handling in fs/isofs/rock.c when parsing a crafted ISO 9660 image containing a malformed symbolic link record. A local user can supply a crafted filesystem image to disclose sensitive information.

The issue can copy adjacent kernel memory into the symlink body returned to user space by readlink().

234) Out-of-bounds write (CVE-ID: CVE-2026-64322)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and corrupt memory.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in udf sparing table handling in fs/udf/super.c when parsing a crafted UDF image. A local user can mount or otherwise trigger processing of a specially crafted UDF image to disclose sensitive information and corrupt memory.

The issue is caused by validating reallocationTableLen as a byte count even though it is later used as an entry count for sparingEntry array access.

235) Out-of-bounds read (CVE-ID: CVE-2026-64323)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in udf_load_vat() and udf_get_pblock_virt15() when mounting a crafted UDF image with a virtual (VAT) partition. A local user can provide a crafted UDF image with an oversized VAT header length to disclose sensitive information.

User interaction is required to mount the crafted filesystem image.

236) Use-after-free (CVE-ID: CVE-2026-64329)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the ucsi_ccg_remove() remove path and threaded IRQ handler when handling connector-change events during device removal. A local user can trigger concurrent remove and IRQ activity to cause a denial of service.

The issue arises from a race condition where an in-flight IRQ handler may access a freed ucsi object.

237) NULL pointer dereference (CVE-ID: CVE-2026-64331)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in vep_dequeue() when cancelling FunctionFS AIO requests. A local user can trigger request cancellation on the FunctionFS AIO path to cause a denial of service.

The issue is reachable when stressing FunctionFS endpoints via AIO in usbip's vudc path.

238) Memory leak (CVE-ID: CVE-2026-64332)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in the ULPI device registration logic in drivers/usb/common/ulpi.c when handling early ULPI device registration failures. A local user can trigger a registration failure to cause a denial of service.

239) Out-of-bounds write (CVE-ID: CVE-2026-64333)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to memory corruption in digi_write_inb_command() in the digi_acceleport usb serial driver when handling usb serial write commands while the write urb is in use. A local user can trigger a timeout or no-timeout command path to corrupt the write urb buffer to cause memory corruption.

On 32-bit systems, one corruption path is triggered by a broken jiffies comparison after several minutes of system uptime, while commands such as break control can corrupt the urb immediately when no timeout is used.

240) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64334)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the digi_acceleport USB serial driver when sending out-of-band commands during operations that race with device disconnect. A local user can trigger operations such as open, set_termios, or close while the device is being disconnected to cause a denial of service.

The issue can result in an indefinite loop with interrupts disabled, leading to a hard lockup.

241) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64335)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the digi_acceleport usb serial driver when reopening a port after it was closed while throttled. A local user can close and reopen a throttled port to cause a denial of service.

The issue prevents the port from receiving further data until the device is reconnected or the driver is rebound.

242) Improper resource shutdown or release (CVE-ID: CVE-2026-64337)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mtu3_gadget_queue() function when queuing a USB gadget request and transfer preparation fails. A local user can trigger a queue failure to cause a denial of service.

The issue occurs because a DMA mapping remains active on the failed queue path before the request is linked on the endpoint request list.

243) Improper resource shutdown or release (CVE-ID: CVE-2026-64338)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in uss720_probe() when handling a probe failure after reading the 1284 register. A local attacker can trigger a failed probe with a device that causes get_1284_register() to fail to cause a denial of service.

The issue can leave a registered parport device behind with stale private_data after the common cleanup path releases the associated private data and USB device reference.

244) Use-after-free (CVE-ID: CVE-2026-64340)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the legousbtower USB driver when handling a race between device release and disconnect. A local user can trigger the race condition by opening and releasing the device while it is being disconnected to cause a denial of service.

The issue arises from object lifetime management during concurrent disconnect and release operations.

245) Use-after-free (CVE-ID: CVE-2026-64341)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the iowarrior USB driver when release() races with disconnect(). A local user can trigger device release and disconnection in a racing condition to cause a denial of service or execute arbitrary code.

Exploitation requires access to the affected USB device interface.

246) Use-after-free (CVE-ID: CVE-2026-64342)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the iowarrior USB driver disconnect handling when processing device disconnect events with submitted write URBs still active. A local user can trigger device disconnect while write completion handling is still possible to cause a denial of service or execute arbitrary code.

Exploitation requires local access to the affected USB device interface.

247) Use-after-free (CVE-ID: CVE-2026-64343)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in the ldusb driver when release() races with disconnect(). A local user can trigger a device disconnect while releasing the device to cause a use-after-free.

The issue affects the drivers/usb/misc/ldusb.c code path in the Linux kernel.

248) Use-after-free (CVE-ID: CVE-2026-64344)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the idmouse USB driver when release() races with disconnect(). A local user can trigger a device disconnect while the device file is being released to cause a denial of service or execute arbitrary code.

Exploitation requires a race condition involving device disconnection and file release in the idmouse driver.

249) Use-after-free (CVE-ID: CVE-2026-64346)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in gadget_match_driver() in the usb gadget udc core when handling concurrent gadget removal and configfs access. A local user can trigger a race condition via configfs operations to cause a denial of service.

The issue arises because the udc and gadget lifecycles are decoupled, and concurrent mode-switch work can free the udc structure while it is still being accessed.

250) Memory leak (CVE-ID: CVE-2026-64348)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the EHCI and FOTG210 isochronous submit handling when submitting a URB before it is linked to the endpoint queue. A local user can trigger a failed submit to cause a denial of service.

Exploitation requires access to a system using EHCI or FOTG210 USB isochronous transfers.

251) Memory leak (CVE-ID: CVE-2026-64350)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in cdnsp_alloc_stream_info() when handling stream ring allocation or stream mapping update failures. A local user can trigger allocation failure conditions to cause a denial of service.

252) Out-of-bounds read (CVE-ID: CVE-2026-64351)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in kalmia_rx_fixup() when processing a crafted short bulk-in frame from a USB device. An attacker with physical access can provide malformed frame lengths to disclose sensitive information.

The issue occurs when framing headers are not both present before frame-length subtraction, causing an integer underflow that lets a device-supplied packet length drive buffer access past the end of the rx buffer.

253) Out-of-bounds read (CVE-ID: CVE-2026-64355)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in dev_map_enqueue_clone() and dev_map_redirect_clone() when cloning fragmented native XDP frames or nonlinear generic XDP packets for devmap broadcast redirects. A local user can trigger clone-based broadcast handling with a crafted fragmented frame to cause a denial of service.

The issue occurs because fragment metadata is not present in the linear cloned frame, and later frame return can interpret uninitialized tail data as skb_shared_info.

254) NULL pointer dereference (CVE-ID: CVE-2026-64358)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a null workqueue callback in mtk_jpeg_release() when releasing a JPEG device context on platforms that do not use the workqueue. A local user can trigger release of the affected device context to cause a denial of service.

The issue results in a WARN_ON condition in __flush_work() because cancel_work_sync() is invoked even when no workqueue callback is defined.

255) Use-after-free (CVE-ID: CVE-2026-64362)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to use-after-free in the hid-lg-g15 driver work handling logic when a pending work item is triggered and the device is unplugged. An attacker with physical access can trigger a backlight cycle key event and disconnect the keyboard to cause a denial of service.

The issue is reachable as a race condition on device unplug for G15, G15 v2, and G510 models that initialize the work item.

256) Use-after-free (CVE-ID: CVE-2026-64365)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a use-after-free condition.

The vulnerability exists due to use-after-free in the letsketch HID driver inrange_timer handling when unbinding the device or during the probe error path after raw events arm the timer. An attacker with physical access can trigger device removal or induce the vulnerable cleanup sequence to cause a use-after-free condition.

The issue can be triggered by USB unplug or module removal, and also on the probe error path if I/O has already been enabled and the timer was armed before cleanup.

257) Race condition (CVE-ID: CVE-2026-64375)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a race condition in proc_pid_get_link() and proc_pid_readlink() when handling access to /proc pid link targets. A local user can trigger concurrent task state changes to disclose sensitive information.

The issue affects file descriptor-related proc links and involves ptrace_may_access() checks performed on a different task lookup than the one used for the actual access.

258) Improper update of reference count (CVE-ID: CVE-2026-64376)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count management in firmware_upload_register() in drivers/base/firmware_loader/sysfs_upload.c when handling an error after alloc_lookup_fw_priv() fails. A local user can trigger the vulnerable error path to cause a denial of service.

259) Race condition (CVE-ID: CVE-2026-64378)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb() when unmounting a filesystem while switching inode writeback state. A local user can trigger a container exit or unmount operation during concurrent writeback activity to cause a denial of service.

The issue can lead to busy inodes after unmount and a subsequent use-after-free in writeback cleanup paths.

260) Memory leak (CVE-ID: CVE-2026-64381)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in receive_encrypted_standard() when processing compound SMB PDUs. A remote attacker can send compound SMB messages that exceed MAX_COMPOUND to cause a denial of service.

The issue affects the Linux kernel SMB client.

261) Double free (CVE-ID: CVE-2026-64382)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in SMB2_open() when handling replayable error conditions during SMB2 open request processing. A local user can trigger a replayable error that leads to stale response buffer bookkeeping to cause a denial of service.

The issue affects the Linux kernel SMB client implementation.

262) Double free (CVE-ID: CVE-2026-64383)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to double free in SMB2_flush() when handling replay attempts for flush responses. A remote user can trigger a replayable flush response followed by a failed retry to cause a denial of service.

263) Double free (CVE-ID: CVE-2026-64384)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in SMB change notify handling in fs/smb/client/smb2pdu.c when processing replayable error conditions during change notify requests. A local user can trigger a replayable error and subsequent cleanup to free the same response buffer twice to cause a denial of service.

264) Double free (CVE-ID: CVE-2026-64385)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to double free in SMB2_ioctl() when handling replayable ioctl responses. A remote user can trigger a replayable error condition to cause a denial of service.

265) Double free (CVE-ID: CVE-2026-64386)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a double free in query_info() in the smb client when handling replayable query_info requests. A remote user can trigger a replayable error sequence to cause a denial of service.

266) Double free (CVE-ID: CVE-2026-64387)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in SMB2_query_directory in the SMB client when handling replayed query directory responses and reinitialization failures. A local user can trigger a replayable error and subsequent cleanup conditions to cause a denial of service.

267) Improper access control (CVE-ID: CVE-2026-64388)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass ownership and group changes.

The vulnerability exists due to improper access control in cifs_setattr_nounix() when processing chown and chgrp operations on mounts using SMB3 POSIX Extensions. A local user can change file ownership or group attributes in a way that is ignored to bypass ownership and group changes.

The issue occurs only when SMB3 POSIX Extensions are used without the relevant ACL or SID-based mount options enabled.

268) Use-after-free (CVE-ID: CVE-2026-64401)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the SMB client witness notification handling in fs/smb/client/cifs_swn.c when processing witness notifications for shared registrations. A local user can trigger notification handling involving a freed tcon pointer to cause a denial of service.

Exploitation requires a same-share second mount so that a registration remains live after the first tcon is unregistered and freed.

269) Out-of-bounds read (CVE-ID: CVE-2026-64403)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in l2cap_get_conf_opt() when parsing L2CAP configuration options. A remote attacker can send a specially crafted Bluetooth L2CAP packet to cause a denial of service.

The read occurs before the malformed option is rejected, and up to 4 bytes may be read past the end of the buffer.

270) Use-after-free (CVE-ID: CVE-2026-64406)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bt_accept_dequeue() when handling Bluetooth L2CAP socket cleanup and accept queue processing. A local user can trigger socket state transitions that cause freed memory to be accessed to cause a denial of service.

The issue was observed during listening L2CAP socket cleanup.

271) Out-of-bounds read (CVE-ID: CVE-2026-64407)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in nxp_recv_fw_req_v3() in the btnxpuart Bluetooth driver when processing v3 firmware download requests from the controller. A local user can supply a controller that requests an offset or length beyond the firmware image to disclose sensitive information.

The issue occurs during firmware download over UART.

272) Use-after-free (CVE-ID: CVE-2026-64408)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in bnep_add_connection() during network device registration when handling a concurrent controller teardown. A local user can trigger a race condition to cause a denial of service.

273) Infinite loop (CVE-ID: CVE-2026-64409)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper loop termination in btmtksdio_txrx_work() when processing Bluetooth SDIO transmit and receive work. A local user can trigger repeated pending interrupt handling to cause a denial of service.

The issue can cause the workqueue to loop indefinitely and prevent release of the SDIO host.

274) Out-of-bounds read (CVE-ID: CVE-2026-64411)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in find_table_lock() table name handling when processing a user-supplied ebtables table name through setsockopt calls. A local user can supply a non-null-terminated table name to trigger a read past the end of the name buffer and disclose sensitive information.

The issue occurs on a lookup miss when module autoload formatting uses the supplied table name.

275) Improper input validation (CVE-ID: CVE-2026-64412)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ebtables match handling code in net/bridge/netfilter/ebtables.c when processing a crafted module name. A local user can supply a non-null-terminated module name to cause a denial of service.

276) Use-after-free (CVE-ID: CVE-2026-64420)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the cros_ec device probe handling in drivers/mfd/cros_ec_dev.c when sub-drivers access platform device drvdata after probe failure. A local user can trigger a failed probe and subsequent access to a stale pointer to cause a denial of service.

The issue occurs because the stale drvdata pointer remains accessible to sub-drivers such as cros_ec_typec after the underlying cros_ec_dev structure has already been released.

277) Use-after-free (CVE-ID: CVE-2026-64421)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mxc_isi_remove() and the imx8-isi media cleanup path when removing the imx8_isi module. A local user can trigger module removal to cause a denial of service.

The issue occurs because media links are removed after the media entity pads they reference have already been freed.

278) Use-after-free (CVE-ID: CVE-2026-64423)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the IGMP multicast group handling in net/ipv4/igmp.c when destroying a device while concurrent RCU readers traverse the multicast hash table. A local user can trigger multicast group membership operations and concurrent network processing to cause a denial of service.

The issue occurs because multicast group entries can remain reachable through the device multicast hash table during RCU reclamation.

279) NULL pointer dereference (CVE-ID: CVE-2026-64427)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the logi_dj_probe function in the hid-logitech-dj driver when probing a crafted Logitech DJ short output report descriptor. A local user can emulate a crafted device descriptor to cause a denial of service.

This issue is reproducible through uhid by emulating a Logitech receiver with a padding-only DJ short output report.

280) Improper locking (CVE-ID: CVE-2026-64429)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the Spreadtrum EIC GPIO interrupt controller driver when starting up a requested IRQ on PREEMPT_RT systems. A local user can request a threaded IRQ to trigger a sleeping lock in an invalid context to cause a denial of service.

The issue occurs because the callback can be reached from a non-sleepable irq_startup() path.

281) Use-after-free (CVE-ID: CVE-2026-64433)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in add_device_complete in net/bluetooth/mgmt.c when handling concurrent bluetooth management device add and remove operations. A local user can trigger concurrent MGMT requests to access freed memory and cause a denial of service.

The issue occurs because hci_conn_params_lookup() is used without holding the required device lock while the returned object is later dereferenced.

282) Use-after-free (CVE-ID: CVE-2026-64434)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Bluetooth L2CAP channel timeout handler when processing an asynchronous channel timeout after the associated connection has been torn down. A local user can trigger a channel timeout race to cause a denial of service.

The issue arises because the timeout worker may access chan->conn after the underlying connection object has already been freed.

283) Use of Uninitialized Variable (CVE-ID: CVE-2026-64436)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in pfkey_msg2xfrm_state() when processing a PF_KEY IPComp state and migrating it. A local user can add a crafted IPComp security association via PF_KEY and trigger migration to cause a denial of service.

The issue affects the PF_KEY path for IPComp states; the XFRM netlink path is not affected.

284) Out-of-bounds write (CVE-ID: CVE-2026-64440)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in HT_caps_handler() when parsing a crafted 802.11 association response frame. A remote attacker can send a malicious access point response with an oversized HT Capabilities information element to cause memory corruption.

The issue can write beyond the fixed 26-byte HT_cap array into adjacent fields of struct mlme_ext_info.

285) Out-of-bounds read (CVE-ID: CVE-2026-64442)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in IE parsing loops in issue_assocreq() and join_cmd_hdl() when processing AP beacon and probe-response frames with a truncated final information element. A remote attacker can send a malicious AP beacon or probe-response frame with a truncated final information element to cause a denial of service.

The issue is triggered when the stored IE data ends with an element_id byte without a following length byte.

286) Out-of-bounds read (CVE-ID: CVE-2026-64443)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the update_beacon_info() IE parsing loop in rtl8723bs when parsing a crafted Beacon frame from a malicious access point. A remote attacker can send a specially crafted Beacon frame to disclose sensitive information.

The issue can be triggered when the last information element is truncated or when an information element declares a length that extends past the available frame data.

287) Out-of-bounds read (CVE-ID: CVE-2026-64444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in OnAssocRsp() in the rtl8723bs driver when parsing a crafted association response frame. A remote attacker can send a specially crafted association response frame to disclose sensitive information.

The issue can be triggered by a malicious access point through a truncated information element in the frame.

288) Improper input validation (CVE-ID: CVE-2026-64445)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in OnAuth() when processing seq=3 shared-key authentication responses. A remote attacker can send a specially crafted authentication frame to cause a denial of service.

The issue is triggered when the Challenge Text information element length differs from the required 128 bytes.

289) Out-of-bounds read (CVE-ID: CVE-2026-64445)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in OnAuth() when processing crafted shared-key authentication frames. A remote attacker can send a specially crafted authentication frame to disclose sensitive information.

The issue occurs in the shared-key authentication path when the Privacy bit is set and the frame is too short to contain a valid WEP IV and ICV.

290) Out-of-bounds read (CVE-ID: CVE-2026-64448)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in smb2_check_message() and subsequent SMB client protocol decoders when processing crafted SMB2 responses with a data area. A remote attacker can send a specially crafted SMB server response to disclose sensitive information.

The issue is reachable during NEGOTIATE and SESSION_SETUP before the session is established, including through the SPNEGO/negTokenInit and NTLMSSP challenge decoders when mounting against a non-conforming server.

291) Out-of-bounds read (CVE-ID: CVE-2026-64450)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the TIPC broadcast Gap ACK blocks handling in tipc_bcast_sync_rcv() when processing a crafted broadcast PROTOCOL/STATE_MSG. A remote attacker can send a specially crafted broadcast STATE_MSG with a malformed Gap ACK blocks record to cause a denial of service.

Exploitation requires a TIPC neighbour that has negotiated TIPC_GAP_ACK_BLOCK.

292) Use-after-free (CVE-ID: CVE-2026-64452)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in lowpan_nhc_do_uncompression() when processing a malformed 6LoWPAN packet on an error path. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue is caused by a race condition involving descriptor unregistration and access to nhc->name outside the protection of lowpan_nhc_lock, and it can be reached through the Bluetooth 6LoWPAN L2CAP receive path.

293) Improper locking (CVE-ID: CVE-2026-64454)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the dwc3 gadget disconnect callback path when suspending the gadget. A local user can trigger a gadget disconnect during suspend to cause a denial of service.

The issue occurs because the disconnect callback may run in a non-sleepable context with IRQs disabled, which can trigger kernel lockdep warnings and sleeping-function-in-invalid-context failures.

294) Use-after-free (CVE-ID: CVE-2026-64455)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in chaoskey_release() in the chaoskey USB driver when closing the device file after the USB device has been unplugged. A local user can close the device file after device unplug to cause a denial of service.

The invalid access occurs in a debugging log statement after the usb_interface structure has already been deallocated.

295) Improper resource shutdown or release (CVE-ID: CVE-2026-64463)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the rt1711h_probe() TCPCI port registration handling in drivers/usb/typec/tcpm/tcpci_rt1711h.c when handling device probe failures after registering a TCPCI port. A local user can trigger a device probe failure after port registration to cause a denial of service.

The issue occurs because the TCPCI port is not unregistered when later probe steps fail.

296) Use-after-free (CVE-ID: CVE-2026-64470)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in the btusb probe path in drivers/bluetooth/btusb.c when handling probe failures after Marvell OOB wakeup configuration. A local user can trigger a device probe failure after TX URBs have been submitted to cause a use-after-free.

The issue occurs in the completion callback for submitted TX URBs.

297) Use-after-free (CVE-ID: CVE-2026-64471)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the btusb driver probe error handling in drivers/bluetooth/btusb.c when handling Bluetooth USB controller registration failures and subsequent interface disconnection. A local attacker can trigger controller registration failure to cause a denial of service.

The issue can also result in a double-free when the sibling interfaces are eventually disconnected.

298) Race condition (CVE-ID: CVE-2026-64472)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in vfio/mlx5 page tracker and device state flag handling when concurrently updating runtime bitfields. A local user can trigger concurrent device operations to cause a denial of service.

The issue affects flags that can be updated during runtime, including dirty tracking, reset handling, tracker error handling, and VF attach or detach event processing.

299) Out-of-bounds read (CVE-ID: CVE-2026-64477)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in the resctrl RMID reader and limbo handler when offlining a monitoring domain with SNC enabled. A local user can trigger CPU offlining for a monitoring domain with an empty cpu_mask to cause a denial of service.

The issue occurs when LLC occupancy is tracked and the monitoring domain is going offline, causing a NUMA node lookup to be performed with nr_cpu_ids.

300) NULL pointer dereference (CVE-ID: CVE-2026-64478)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in snd_dualsense_ih_match() when handling repeated device disconnect and reconnect events. A local attacker can trigger a controller disconnect race to cause a denial of service.

The issue can occur when a weak physical connection causes rapid hotplug activity during USB device teardown.

301) Use of Uninitialized Variable (CVE-ID: CVE-2026-64479)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an uninitialized heap leak in snd_seq_event_dup() when delivering a legacy event to a UMP client with SNDRV_SEQ_FILTER_NO_CONVERT set. A local user can send a crafted event through /dev/snd/seq to disclose sensitive information.

The issue can leak 4 bytes of stale kernel heap data to user space, and exploitation requires a UMP-enabled build.

302) NULL pointer dereference (CVE-ID: CVE-2026-64480)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the ALSA ice1712 driver control creation logic when handling failed snd_ctl_new1() allocations. A local user can trigger memory allocation failure and reach code paths that dereference a NULL pointer to cause a denial of service.

303) Use-after-free (CVE-ID: CVE-2026-64481)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the cs35l41_hda firmware load work and ALSA control handling when a firmware load is requested and queued work executes after component unbind or device removal. A local user can trigger a firmware load request and remove the component or device before the queued work runs to cause a denial of service.

Exploitation requires firmware autostart to be disabled and can occur before DSP initialization.

304) NULL pointer dereference (CVE-ID: CVE-2026-64482)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in snd_gf1_pcm_volume_control() when handling a failed snd_ctl_new1() allocation. A local user can trigger a memory allocation failure leading to a NULL dereference to cause a denial of service.

305) Out-of-bounds write (CVE-ID: CVE-2026-64483)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or execute arbitrary code.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in isight_packet() when processing crafted FireWire isochronous packets from a device on the bus during normal capture. An attacker with physical access can provide a malicious device that reports an oversized sample count to cause a denial of service or execute arbitrary code.

Exploitation requires a malicious or faulty Apple iSight device connected on the FireWire bus.

306) NULL pointer dereference (CVE-ID: CVE-2026-64484)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in snd_es1938_mixer() in sound/pci/es1938.c when handling mixer control initialization. A local user can trigger a memory allocation failure and reach the vulnerable code path to cause a denial of service.

307) NULL pointer dereference (CVE-ID: CVE-2026-64486)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in snd_cmipci_mixer_new in sound/pci/cmipci.c when handling control creation failures from snd_ctl_new1(). A local user can trigger a memory allocation failure and reach a NULL pointer dereference to cause a denial of service.

308) Out-of-bounds read (CVE-ID: CVE-2026-64487)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to out-of-bounds read in snd_usb_caiaq_tks4_dispatch() when parsing input from a crafted USB device input stream. An attacker with physical access can provide a malformed short final message block to cause a denial of service.

The issue is triggered because the device-controlled input length is not guaranteed to be a multiple of the 16-byte message block size, leading to an unsigned underflow during iteration.

309) NULL pointer dereference (CVE-ID: CVE-2026-64489)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in snd_ymfpci_create_spdif_controls() when handling control creation after memory allocation failure in snd_ctl_new1(). A local user can trigger memory allocation failure and reach the dereference of a NULL control pointer to cause a denial of service.

310) Improper resource shutdown or release (CVE-ID: CVE-2026-64494)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in gp2ap002_read_raw() when handling read errors from gp2ap002_get_lux(). A local user can trigger a read operation that causes an error to prevent the device from autosuspending and cause a denial of service.

The issue permanently leaks a runtime PM reference on the error path.

311) Out-of-bounds read (CVE-ID: CVE-2026-64495)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in bmg160_get_filter() and bmg160_set_filter() when handling sysfs input for the in_anglvel_filter_low_pass_3db_frequency interface. A local user can supply a value that is not present in bmg160_samp_freq_table to cause a denial of service.

The issue is reachable from userspace through the sysfs interface.

312) Out-of-bounds read (CVE-ID: CVE-2026-64496)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the iio event FIFO handling in drivers/iio/industrialio-event.c when reading from a newly created event file descriptor concurrently with FIFO reset. A local user can read from the file descriptor from another thread to disclose sensitive information.

Exploitation requires shared file descriptor table access between threads, creating a race window before the fd number is returned to userspace.

313) Integer overflow (CVE-ID: CVE-2026-64497)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect sensor data processing.

The vulnerability exists due to an integer sign-extension bug in the scd30_float_to_fp() function in the SCD30 IIO chemical sensor driver when converting floating-point sensor values. A local user can trigger the conversion of a crafted floating-point value to cause incorrect sensor data processing.

The issue affects the Linux kernel SCD30 sensor driver code path that converts device-provided floating-point values into fixed-point representation.

314) Improper Initialization (CVE-ID: CVE-2026-64500)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in lpc32xx_adc_probe() and the lpc32xx ADC interrupt handling path when handling a spurious interrupt during device probe before completion initialization. A local user can trigger a device state that causes an interrupt to arrive before init_completion() to cause a denial of service.

The issue can lead to a kernel panic through a NULL pointer dereference and resulting wild memory access in the interrupt wake-up path.

315) Improper resource shutdown or release (CVE-ID: CVE-2026-64503)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in kxsd9_write_raw() when handling write requests for scale values with a non-zero integer part. A local user can send a crafted write request to cause a denial of service.

The issue leaks a runtime PM usage-counter reference, which can prevent the device from autosuspending.

316) Stack-based buffer overflow (CVE-ID: CVE-2026-64504)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in __bmc150_accel_fifo_flush() when processing a device-reported FIFO frame count. An attacker with physical access can tamper with the I2C/SPI bus or use a malicious device that reports an oversized frame count to execute arbitrary code or cause a denial of service.

The issue can overwrite the stack canary, saved registers, and return address during FIFO data transfer.

317) Out-of-bounds read (CVE-ID: CVE-2026-64505)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rndis_rm_hdr in the RNDIS USB gadget function when parsing a crafted RNDIS header. A local user can provide a truncated header to cause a denial of service.

318) NULL pointer dereference (CVE-ID: CVE-2026-64511)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in acpi_nfit_uc_error_notify() in the ACPI NFIT core when handling an NFIT_NOTIFY_UC_MEMORY_ERROR notification for an NFIT device without initialized driver data. An attacker with physical access can trigger a firmware notification to cause a denial of service.

The issue occurs when the notify handler is installed before the presence of the NFIT table is verified.

319) Improper input validation (CVE-ID: CVE-2026-64512)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the ACPI CPPC register width handling in drivers/acpi/cppc_acpi.c when processing ACPI PCC register definitions. A local attacker can provide a crafted access_width value to trigger a shift-out-of-bounds condition and cause a denial of service.

The issue occurs because the access_width field is reused as a PCC subspace identifier for ACPI_ADR_SPACE_PLATFORM_COMM entries.

320) Improper Initialization (CVE-ID: CVE-2026-64513)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in KVM x86 LAPIC and CR8 intercept handling when updating the guest's PPR and entering a virtual machine. A local user can trigger PPR updates in a guest to cause a VM entry failure with hardware error 0x7.

This is typically exposed on older platforms or under nested virtualization on a hypervisor that does not support virtual-interrupt delivery and enforces the TPR_THRESHOLD check.

321) Out-of-bounds read (CVE-ID: CVE-2026-64515)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the mac80211 MLE defragmentation routine when parsing fragmented reconf or EPCS multi-link elements in a non-transmitted profile. A remote attacker can send a specially crafted wireless management frame to cause a denial of service.

The heap overrun is limited by the buffer layout and parsing stops once the defragmentation buffer is filled.

322) Double free (CVE-ID: CVE-2026-64517)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in xe_gsc_init_post_hwconfig() in the xe_gsc driver component when handling a probe failure error path. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs because a managed buffer object is freed explicitly even though a devm cleanup action is already registered.

323) Out-of-bounds read (CVE-ID: CVE-2026-64524)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Hyper-V DRM protocol resolution response parser when processing a crafted SYNTHVID_RESOLUTION_RESPONSE message. A remote attacker can send a specially crafted resolution response with an oversized resolution_count value to cause a denial of service.

The issue affects the drm/hyperv code path while parsing supported display resolutions from the host.

324) Out-of-bounds read (CVE-ID: CVE-2026-64527)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hyperv_receive() and hyperv_receive_sub() in the Hyper-V DRM protocol handler when handling oversized or malformed VMBus packets. A remote attacker can send a specially crafted VMBus packet to cause a denial of service.

An error path may report a required packet length larger than the 16 KiB receive buffer, leading the code to use that length unsafely if forwarded for copying.

325) Out-of-bounds read (CVE-ID: CVE-2026-64527)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in hyperv_receive_sub() in the Hyper-V DRM protocol handler when processing crafted VMBus packets. A remote attacker can send a specially crafted VMBus packet to disclose sensitive information.

The issue affects completion-driving message handling and can cause residual data from a prior message to be treated as a valid response payload.

326) Out-of-bounds read (CVE-ID: CVE-2026-64536)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in is_ap_in_tkip() in drivers/staging/rtl8723bs/core/rtw_wlan_util.c when parsing information elements from network data. A remote attacker can provide a truncated or crafted information element buffer to cause a denial of service.

327) Improper input validation (CVE-ID: CVE-2026-64537)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the bridge cfm ccm transmission logic when configuring an invalid ccm interval. A local user can set an invalid expiration interval to trigger a tight workqueue loop and exhaust memory to cause a denial of service.

The issue can result in immediate re-arming of delayed work and repeated skb allocations until out-of-memory conditions occur.

328) NULL pointer dereference (CVE-ID: CVE-2026-64538)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fib6_nh_mtu_change() when processing router advertisement-driven MTU changes. A remote attacker can send a specially crafted ICMPv6 router advertisement to cause a denial of service.

The issue can occur during interface teardown when the IPv6 device pointer has been cleared while nexthop-backed routes are still being walked.

329) Stack-based buffer overflow (CVE-ID: CVE-2026-64539)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in eir_create_adv_data() in the Bluetooth EIR advertising data builder when constructing legacy advertising data for an LE-only controller. A local user can supply crafted advertising instance data to trigger a stack out-of-bounds write and cause a denial of service.

Exploitation requires CAP_NET_ADMIN and access to the legacy advertising path on an LE-only controller.

330) Out-of-bounds read (CVE-ID: CVE-2026-64540)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in genelink_rx_fixup() when processing device-supplied aggregated RX frames from a crafted GeneLink (GL620A) USB device. An attacker with physical access can provide a short URB with inconsistent packet length metadata to disclose sensitive information.

The issue can leak adjacent kernel heap contents to the network stack as soon as the USB network interface is up.

331) Use-after-free (CVE-ID: CVE-2026-64541)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in smc_cdc_rx_handler() when handling SMC-R CDC messages for a connection after releasing conns_lock. A local user can trigger a concurrent socket close while the handler continues to dereference the freed socket to cause a denial of service.

Only SMC-R is affected.

332) Use-after-free (CVE-ID: CVE-2026-64543)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tipc_disc_rcv() when processing TIPC discovery messages on a UDP bearer. A local user can trigger network namespace-accessible TIPC bearer operations and send crafted traffic to cause a denial of service.

Exploitation requires CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. The affected functionality is reachable from an unprivileged user namespace because the TIPCv2 generic netlink family is netnsok and its bearer commands do not require GENL_ADMIN_PERM.

333) Out-of-bounds read (CVE-ID: CVE-2026-64544)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in pefile_digest_pe_contents when processing a crafted PE file. A local user can supply a specially crafted PE file to cause a denial of service.

The issue occurs because an unsigned subtraction can underflow after the trailing-data hash length calculation exceeds the PE length, which can lead to a kernel panic on unmapped vmalloc guard pages.

334) NULL pointer dereference (CVE-ID: CVE-2026-64545)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in xdp_master_redirect() when processing XDP_TX on a bond slave during upper-master unlinking. A local user can trigger packet processing in this race window to cause a denial of service.

The issue can lead to a kernel panic when the receiving device no longer has an upper-master adjacency but is still treated as a bond slave.

335) Out-of-bounds read (CVE-ID: CVE-2026-64546)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in drm_parse_tiled_block() when parsing a crafted DisplayID tiled-display block in EDID data. A local user can supply crafted EDID data with a truncated tiled-display block to disclose sensitive information.

The issue is triggered when the tiled-display block declares a small payload length near the end of a DisplayID extension.

336) Out-of-bounds read (CVE-ID: CVE-2026-64547)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in net1080_rx_fixup() when processing a crafted short frame from a malicious NetChip 1080 device. An attacker with physical access can send a frame advertising a large even packet length to cause a denial of service.

337) Integer overflow (CVE-ID: CVE-2026-64548)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow leading to an out-of-bounds write in bpf_msg_push_data() when processing a crafted len value in the copy fallback path. A local user can supply a crafted len value to cause a denial of service.

Exploitation requires access to BPF-driven sockmap message processing and occurs when the scatterlist ring is full or nearly full.

338) Out-of-bounds read (CVE-ID: CVE-2026-64549)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in bpa10x_setup() when processing a crafted device response to the vendor command. An attacker with physical access can return a one-byte or unterminated response to disclose sensitive information.

The out-of-bounds data may be exposed through the kernel log and the firmware-info debugfs file.

339) Out-of-bounds read (CVE-ID: CVE-2026-64551)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized memory.

The vulnerability exists due to an out-of-bounds read in sctp_sf_do_5_2_6_stale() when processing an ERROR chunk with a STALE_COOKIE cause in the COOKIE_ECHOED state. A local user can send a specially crafted SCTP packet to disclose uninitialized memory.

The leaked value is echoed to the peer in the Cookie Preservative of the reply INIT. Exploitation is reachable by a peer that can drive an association into COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket in a user and network namespace.

340) Out-of-bounds write (CVE-ID: CVE-2026-64552)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in receive_big() when processing a device-announced packet length from a virtio backend. A remote attacker can announce a specially crafted length value to cause memory corruption.

The issue can result in a NULL fragment being handed up the receive path.

341) Information disclosure (CVE-ID: CVE-2026-64553)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an information leak caused by improper clearing of padding bytes in PSAMPLE_ATTR_DATA handling in net/psample/psample.c when copying packet data into a netlink attribute. A local user can trigger processing of packet data whose length is not divisible by 4 bytes to disclose sensitive information.

The issue occurs because netlink attributes are padded to 4-byte boundaries.

342) Use-after-free (CVE-ID: CVE-2026-64554)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in br_ip6_fragment() when processing crafted IPv6 packets on a cloned skb. A local user can send a specially crafted packet to cause a denial of service.

The issue results from dereferencing a stale prevhdr pointer after skb_checksum_help() reallocates the skb head, and the resulting write can trigger a kernel panic.

343) Out-of-bounds write (CVE-ID: CVE-2026-64558)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the pkey_pckmo key_to_protkey() handler implementation when processing a target buffer for generated output data. A local user can provide a target buffer with an insufficient length to execute arbitrary code.

344) Improper input validation (CVE-ID: CVE-2026-64559)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to improper input validation in the PKEY_VERIFYPROTK ioctl in drivers/s390/crypto/pkey_api.c when processing a user-supplied request structure from user space. A local user can provide a crafted buffer length value to execute arbitrary code or cause a denial of service.

345) Use-after-free (CVE-ID: CVE-2026-64562)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in KVM nested VMX shadow VMCS handling when freeing nested virtualization state asynchronously with respect to loaded VMCS clearing during vCPU migration. A local user can trigger nested virtualization cleanup and vCPU migration to execute VMCLEAR on a freed shadow VMCS and cause a denial of service.

The issue occurs because vmcs01 may still reference the shadow VMCS until explicit VMCLEAR completes.

346) Use-after-free (CVE-ID: CVE-2026-64563)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in rhashtable_walk_next in the rhashtable iterator logic when resuming multi-fragment rhashtable walks across walk_stop and walk_start boundaries after a table restart. A local user can trigger a stale iterator pointer dereference to cause a denial of service.

Concrete affected call paths include netlink_diag and TIPC.

347) Heap-based buffer overflow (CVE-ID: CVE-2026-64565)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in ims_pcu_handle_response() when processing oversized packets from a malicious USB device. An attacker with physical access can send a specially crafted oversized USB packet to execute arbitrary code.

The issue arises because ims_pcu_process_data() does not properly bound-check read_pos, allowing it to be overwritten and later used as a controlled index during response handling.

348) Out-of-bounds read (CVE-ID: CVE-2026-64567)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in io_ctl_check_crc() in the btrfs free space cache loader when loading a corrupted v1 free space cache. A local user can modify free space cache header counts to exceed the number of allocated pages to cause a denial of service.

The invalid out-of-bounds slot is treated as a struct page and can lead to a general protection fault during crc32c() processing.

349) Double free (CVE-ID: CVE-2026-64568)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in ieee80211_set_unsol_bcast_probe_resp() when handling updates to unsolicited broadcast probe response templates after an allocation failure. A local user can trigger a later update or AP teardown to cause a denial of service.

The issue occurs because the pointer can still reference an object already queued for RCU freeing after kzalloc() fails.

350) NULL pointer dereference (CVE-ID: CVE-2026-64569)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mpls_valid_fib_dump_req() when handling an RTM_GETROUTE dump request for AF_MPLS with strict checking and no RTA_OIF attribute. A local user can send a specially crafted netlink request to cause a denial of service.

The issue affects CONFIG_INET=n builds.

351) Double free (CVE-ID: CVE-2026-64570)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in ieee80211_set_fils_discovery() when handling FILS discovery template updates after an allocation failure. A local user can trigger an allocation failure and cause the same object to be queued for freeing multiple times to cause a denial of service.

The issue is triggered when a later update or AP teardown re-queues an object that still points to memory already scheduled for RCU freeing.

352) Out-of-bounds read (CVE-ID: CVE-2026-64571)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in p54_rx_eeprom_readback() when processing a device-supplied EEPROM readback frame. An attacker with physical access can send a truncated frame with a matching advertised length to disclose sensitive information.

The issue can be triggered by a malicious USB device.

353) Use-after-free (CVE-ID: CVE-2026-64572)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib_table_lookup() and the IPv4 FIB alias list handling in fib_trie.c when processing concurrent route insertion failure and lookup operations. A local privileged user can trigger a route insertion error path and perform a concurrent lookup to cause a denial of service.

Exploitation requires CAP_NET_ADMIN and a registered FIB notifier that can reject a route, such as when an IPv4 FIB resource is exhausted on a netdevsim device.

354) Integer underflow (CVE-ID: CVE-2026-64573)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in the qca_tlv_check_data() TLV parser when parsing a crafted firmware TLV with an undersized NVM tag length. A local user can supply a specially crafted firmware image to trigger out-of-bounds access and cause a denial of service.

The issue is caused by an integer underflow in the loop bound calculation for TLV_TYPE_NVM records.

355) Use-after-free (CVE-ID: CVE-2026-64574)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ieee80211_if_read_link and related mac80211 link handling when reading debugfs link files after a vif link update error path leaves stale debugfs entries for newly added links. A local user can open and read a debugfs link file referencing freed memory to cause a denial of service.

The issue is triggered when drv_change_vif_links() fails after new links have been allocated and initialized.

356) Use of Uninitialized Variable (CVE-ID: CVE-2026-64576)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in nh_res_bucket_migrate() when handling rtnetlink nexthop operations. A local user can send a specially crafted netlink message to cause a denial of service.

The issue can lead to a general protection fault and kernel panic when an error path dereferences an uninitialized extack message pointer.

357) Unchecked Return Value (CVE-ID: CVE-2026-64577)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of a failed buffer pull in gtp1u_send_echo_resp() in the Linux kernel GTP implementation when processing a crafted short echo request packet. A remote attacker can send a specially crafted packet to cause a kernel panic.

The issue is triggered by a 16 to 19 byte echo request that causes skb_pull_data() to fail while execution continues and skb data is moved below the buffer head.

358) Double free (CVE-ID: CVE-2026-64581)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in xfrm_user_policy() when racing a per-socket policy change with packet transmission on a connected UDP socket. A local user can trigger concurrent socket operations to cause a denial of service.

The issue is reachable by an unprivileged user via a user and network namespace.

359) Use-after-free (CVE-ID: CVE-2026-64582)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in rxe_mmap in the RDMA/rxe subsystem when processing a memory mapping request concurrently with a DESTROY_CQ ioctl. A local user can trigger a race condition to cause a denial of service or execute arbitrary code.

Exploitation requires winning a narrow race window between the mmap path and concurrent object destruction.

360) Use-after-free (CVE-ID: CVE-2026-64583)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Broadcom BDC USB gadget UDC driver IRQ handler and delayed work processing when tearing down the driver during device removal. A local user can trigger a shared interrupt or delayed work execution during teardown to cause a denial of service.

The issue occurs in the window after teardown of endpoint and DMA-related structures begins while the IRQ handler remains deliverable, and delayed work may also execute after removal.

361) Use-after-free (CVE-ID: CVE-2026-64584)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the f_midi driver work handler when handling concurrent userspace writes to an open rawmidi substream during device teardown. A local user can write to a rawmidi substream to trigger pending work on a freed midi object and cause a denial of service.

The issue occurs because the rawmidi device can remain usable by an open substream after USB endpoints have been disabled and before the final midi object reference is released.

362) Use-after-free (CVE-ID: CVE-2026-64585)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in esd_usb_disconnect() and unlink_all_urbs() when handling USB device disconnect events. A local user can trigger a device disconnect condition to cause a denial of service.

The issue occurs because per-netdev private data embedded in the net_device allocation is dereferenced after free during teardown.

363) NULL pointer dereference (CVE-ID: CVE-2026-64593)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in btrfs_trim_free_extents in the Btrfs filesystem when processing a FITRIM ioctl on a rescanned device that is not writeable. A local user can issue a trim request to trigger a kernel crash and cause a denial of service.

The issue occurs when a previously missing device is rescanned, clearing the missing-device state while the block device pointer remains NULL.

364) Double free (CVE-ID: CVE-2026-64597)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to double free in SMB2_close() in the SMB client close request handling when processing a response-bearing attempt that returns a replayable error. A remote user can trigger a replay sequence that causes the same response buffer to be freed twice to cause a denial of service.

365) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64598)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an error pointer in smb2_aead_req_alloc() when processing SMB client requests. A local user can trigger the bug to cause a denial of service.

366) Double free (CVE-ID: CVE-2026-64599)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in meson_crypto_probe() when handling a failure after partial channel list allocation during device probe. A local user can trigger the vulnerable probe path to cause a denial of service.

The issue was reproduced by forcing the second dma_alloc_attrs() call in the gxl-crypto probe path to fail after partial initialization.

367) Access of Uninitialized Pointer (CVE-ID: CVE-2026-64602)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an uninitialized pointer dereference in the spear_adc_probe() initialization path and interrupt handler in drivers/iio/adc/spear_adc.c when handling a device interrupt before completion initialization. A local user can trigger a spurious interrupt during device probe to cause a denial of service.

The issue can lead to a kernel panic and was observed as a KASAN wild-memory-access caused by complete() operating on an uninitialized completion object.

368) Race condition (CVE-ID: CVE-2026-64603)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the intel-hid ACPI notify_handler() when handling concurrent tablet-mode events on multiple CPU cores. A local user can trigger concurrent notify events to cause a denial of service.

The issue affects convertible and detachable systems matched by DMI chassis types 31 and 32 where the SW_TABLET_MODE input device is registered lazily on the first tablet-mode event.

369) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64604)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state handling in vmx_update_cr8_intercept when creating a vCPU outside guest mode. A local user can issue crafted KVM vCPU creation operations to cause a denial of service.

The issue can trigger a kernel warning due to calling get_vmcs12() when the vCPU is not in guest mode.

370) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68081)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the KVM nVMX nested VM-Enter handling in arch/x86/kvm/vmx/nested.c when emulating VMLAUNCH or VMRESUME with invalid guest state. A local user can repeatedly trigger failed nested VM-Enter operations to cause a denial of service.

The issue occurs when KVM synthesizes a nested VM-Exit on invalid guest state, allowing pinned vmcs12 pages or mappings to be leaked if the operation is retried.

371) Out-of-bounds read (CVE-ID: CVE-2026-68082)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in decode_lockers() in net/ceph/cls_lock_client.c when parsing OSD-supplied lock information. A remote user can send a specially crafted OSD reply to disclose sensitive information.

Exploitation requires control of a malicious or compromised OSD and can be triggered against kernel clients that issue the lock.get_info class method, such as during RBD exclusive lock acquisition in a multi-tenant Ceph deployment.

372) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68085)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the hci_uart Bluetooth line discipline write_work handling when closing and reopening the device. A local user can repeatedly reopen the device to cause a denial of service.

The issue can block future writes after the device is reopened if write_work was pending.

373) Race condition (CVE-ID: CVE-2026-68086)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data loss.

The vulnerability exists due to improper synchronization in mm/khugepaged collapse_file() when collapsing file-backed transparent huge pages in the presence of previously dirtied folios. A local user can write to a file, close it, and trigger a collapse operation to cause data loss.

The issue occurs in an edge case where dirty folios from previous writers can be discarded during page cache truncation after a later writable open.

374) Out-of-bounds read (CVE-ID: CVE-2026-68088)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rndis_query_response() in the RNDIS USB gadget function when processing a crafted RNDIS query message. A remote attacker can send a specially crafted RNDIS query message to cause a denial of service.

375) Improper resource shutdown or release (CVE-ID: CVE-2026-68091)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in wacom_parse_and_register() in the Wacom HID driver when handling post-start probe failures. A local user can trigger a device initialization failure after HID hardware has been started to cause a denial of service.

376) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68093)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource lifecycle management in KVM SVM ASID handling when resuming a vCPU after a CPU hotplug cycle. A local user can trigger CPU hotplug conditions and resume execution of a affected vCPU to cause a denial of service.

The issue can result in ASID collisions between vCPUs from different VMs, causing stale TLB translations and KVM internal emulation failures.

377) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68102)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in the amdgpu aperture mapping handling in amdgpu_ttm_fini() and amdgpu_device_unmap_mmio() when unloading and reloading the driver on connected_to_cpu hardware. A local user can trigger driver unload and reload to cause a denial of service.

The issue can leave an orphaned x86 PAT interval tree entry, and a subsequent write-combining versus write-back mapping conflict can cause GPU discovery to fail.

378) Use-after-free (CVE-ID: CVE-2026-68104)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the amdgpu ACP power management domain cleanup logic when removing the ACP power domain. A local user can trigger the affected cleanup path to cause a denial of service.

379) NULL pointer dereference (CVE-ID: CVE-2026-68105)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the amdgpu driver KIQ ring handling when loading the driver after MES initialization fails. A local user can trigger driver loading to cause a denial of service.

The issue occurs on ASICs that use MES, where the KIQ ring is owned by MES and may be incorrectly left marked as ready after initialization failure.

380) Division by zero (CVE-ID: CVE-2026-68106)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in the amdgpu UVD H264 and H264 Perf decode paths when processing crafted frame dimensions with a width or height less than 16. A local user can submit crafted decoding parameters to cause a denial of service.

381) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-68107)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in the amdgpu vcn_v4_0 command submission handling in drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c when processing an indirect buffer. A local user can modify the indirect buffer between reads to cause a denial of service.

The issue affects the VCN4 encoding parameter parsing path.

382) Integer overflow (CVE-ID: CVE-2026-68108)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds memory access.

The vulnerability exists due to integer overflow in amdgpu_vce_ring_parse_cs() in the VCE command stream parser when processing crafted VCE command streams with oversized image dimensions. A local user can submit a specially crafted command stream to cause out-of-bounds memory access.

The issue occurs when image dimensions wrap the calculated buffer size and bypass validation before reaching the GPU firmware.

383) Reachable assertion (CVE-ID: CVE-2026-68110)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable assertion in sdma_v4_4_2_ring_emit_fence() in the amdgpu SDMA 4.4.2 driver when emitting fence commands. A local user can trigger the assertion condition to cause a denial of service.

384) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68111)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in the amdgpu gfx_v9_0 driver when processing misaligned GPU buffer or address values. A local user can trigger BUG_ON() assertions with crafted alignment-related values to cause a denial of service.

The issue results in a kernel crash instead of a warning when alignment checks fail.

385) Reachable assertion (CVE-ID: CVE-2026-68112)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of assertion checks in gfx_v9_4_3.c when processing misaligned GPU addresses in amdgpu ring operations. A local user can trigger a BUG_ON condition to cause a denial of service.

386) Reachable assertion (CVE-ID: CVE-2026-68113)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of assertion checks in drm/amdgpu gfx12 ring command emission routines when processing misaligned gpu or memory addresses. A local user can trigger code paths with improperly aligned addresses to cause a denial of service.

The issue can crash the kernel via reachable BUG_ON() conditions in multiple gfx12 amdgpu paths.

387) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68115)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in the amdgpu gfx_v10 code when processing misaligned GPU addresses. A local user can trigger a BUG_ON condition to cause a denial of service.

388) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68116)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended traffic filtering.

The vulnerability exists due to improper state management in vxlan multicast database remote source list handling when replacing the source list of an existing (*, G) remote entry. A local user can trigger a failed source list replacement to bypass intended traffic filtering.

An EXCLUDE filter may start forwarding traffic that should be blocked, while an INCLUDE filter may drop traffic that should be forwarded.

389) Use-after-free (CVE-ID: CVE-2026-68117)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tipc_sk_create() and tipc_release() in the TIPC socket handling code when handling a failed accept() path after socket insertion failure. A local user can trigger creation of a large number of TIPC sockets and invoke accept() to cause a denial of service.

The issue is reached when the per-netns TIPC socket rhashtable hits its maximum size, leaving a pre-allocated child socket with a dangling sock->sk pointer during release.

390) Use-after-free (CVE-ID: CVE-2026-68121)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in pppoe_sendmsg() when handling a blocked send while a non-Ethernet port is added to an empty team device. A local user can trigger skb head reallocation and subsequent writes through a stale PPPoE header pointer to cause memory corruption.

The issue occurs because device header callbacks may reallocate the skb head and invalidate saved pointers into it.

391) Integer underflow (CVE-ID: CVE-2026-68123)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow in queue_userspace_packet() in the openvswitch subsystem when processing userspace actions on segmented gso packets after truncation. A local user can send a specially crafted packet that triggers truncation and segmentation handling to cause a denial of service.

The issue occurs because truncation state is reused across smaller gso segments, allowing the preserved length value to exceed the current packet length.

392) Out-of-bounds write (CVE-ID: CVE-2026-68124)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to perform out-of-bounds heap writes.

The vulnerability exists due to an out-of-bounds write in the MCTP serial receive state machine in drivers/net/mctp/mctp-serial.c when processing a zero-length MCTP serial frame. A local privileged user can send a specially crafted zero-length frame followed by data bytes to perform out-of-bounds heap writes.

Exploitation requires attaching the N_MCTP line discipline and bringing the resulting mctpserial network device up before sending bytes through the tty receive path.

393) Out-of-bounds read (CVE-ID: CVE-2026-68125)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in llsec_do_decrypt_auth() when processing crafted IEEE 802.15.4 secured frames with payloads shorter than the authentication tag. A remote attacker can send a specially crafted frame to cause a denial of service.

The crafted frame can reach the vulnerable path from an IEEE 802.15.4 peer in radio range.

394) Use-after-free (CVE-ID: CVE-2026-68126)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mac802154_scan_worker() when racing scan requests against interface deletion or PHY removal. A local user can trigger a scan while concurrently deleting the interface to cause a denial of service.

The issue is reachable by racing TRIGGER_SCAN against DEL_INTERFACE.

395) Use-after-free (CVE-ID: CVE-2026-68127)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to use-after-free in ila_update_ipv6_locator() and ila_csum_adjust_transport() when processing a crafted IPv6 packet routed through a configured ILA checksum-adjust-transport route or receive-side mapping. A remote attacker can send a specially crafted IPv6 packet to trigger a use-after-free.

Exploitation requires a configured ILA checksum-adjust-transport route or receive-side mapping.

396) Resource exhaustion (CVE-ID: CVE-2026-68129)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource handling in the gve Rx queue handling logic when processing received packets under extreme memory pressure. A local user can trigger page allocation failures that leave too few descriptors posted to hardware to cause a denial of service.

The issue can result in a permanent Rx queue stall because no receive completions are generated, preventing NAPI from being scheduled again.

397) Deadlock (CVE-ID: CVE-2026-68132)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in the emergency thaw worker in fs/super.c when thawing frozen block devices. A local user can trigger emergency thaw handling to cause a denial of service.

The issue can deadlock against itself while reacquiring s_umount and can block subsequent unmount, freeze, or thaw operations for the affected filesystem and block device.

398) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68133)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the ice_ptp_rebuild() function in the Intel ice PTP driver when handling a PF reset while PTP is uninitialized. A local user can trigger this condition to cause a denial of service.

This was observed during driver unload after passing PF1 through to a virtual machine.

399) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68135)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in the hip04_rx_poll() receive path when handling a build_skb() failure. A local user can trigger build_skb() failures to cause a denial of service.

The issue leaks an RX buffer and its DMA mapping when slot references are overwritten, and also involves a newly allocated RX fragment if dma_map_single() fails.

400) Improper input validation (CVE-ID: CVE-2026-68136)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state validation in skb_gro_receive_list() in the GRO subsystem when processing flush-marked aggregated packets. A remote attacker can send specially crafted network traffic to cause a denial of service.

The issue can corrupt the frag_list chain and later trigger a kernel panic when skb_segment() processes the malformed packet state.

401) Use-after-free (CVE-ID: CVE-2026-68137)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in x25_kill_by_neigh() when handling termination of an X.25 neighbour while walking the global X.25 socket list. A local user can trigger concurrent socket release and neighbour teardown operations to cause a denial of service.

The issue is triggered by a race condition after the list lock is dropped and before the socket lifetime is pinned.

402) Race condition (CVE-ID: CVE-2026-68138)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to use-after-free and double-free in qdisc_get_rtab() and qdisc_put_rtab() when processing concurrent RTM_NEWTFILTER requests that add flower filters with a police action carrying the same rate. A local user can send concurrent netlink filter configuration requests to cause a denial of service.

The corrupted qdisc_rate_table object is shared system-wide because the affected rate-table list is process-global rather than per-network-namespace.

403) NULL pointer dereference (CVE-ID: CVE-2026-68139)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mlx5e_devcom_event_mpv in the Linux kernel mlx5 mlx5e multiport devcom handling when replaying affiliation events during PCI error recovery. A local user can trigger a crafted device recovery sequence to cause a denial of service.

The issue occurs because peer private data can become visible before the corresponding devcom backpointer is initialized, allowing a master-up event to reach a peer with a NULL devcom pointer.

404) Improper access control (CVE-ID: CVE-2026-68142)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify Geneve tunnel device configuration in another network namespace.

The vulnerability exists due to improper access control in geneve_changelink() when handling rtnetlink changelink requests for a Geneve device whose underlay network namespace differs from the device network namespace. A local privileged user can send a specially crafted changelink request to modify Geneve tunnel settings in the underlay network namespace.

The issue arises when the Geneve device has been created in or moved to a different network namespace than the one associated with its underlay sockets.

405) Race condition (CVE-ID: CVE-2026-68143)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to an out-of-bounds write and use-after-free in slip_receive_buf() and sl_realloc_bufs() when processing received SLIP data during a concurrent MTU change. A local user can trigger receive processing while racing an MTU change to cause a denial of service or execute arbitrary code.

406) Out-of-bounds write (CVE-ID: CVE-2026-68145)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in ifs_set_range_dirty() when processing a zero-length range. A local user can trigger a user buffer fault that results in copied == 0 during a write operation to cause a denial of service.

The issue is reachable from __iomap_write_end() when copy_folio_from_iter_atomic() returns 0 and the folio is already uptodate.

407) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68149)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended ACL handling and retain stale access control list data.

The vulnerability exists due to improper cache state handling in posix ACL caching for fuse inodes in the Linux kernel when invalidating cached ACL entries. A local user can trigger ACL updates and cache invalidation conditions to bypass intended ACL handling and retain stale access control list data.

The issue affects fuse filesystems that opt out of POSIX ACL caching when the fuse server does not negotiate POSIX ACL support.

408) Use-after-free (CVE-ID: CVE-2026-68152)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the AMT delayed work handling in drivers/net/amt.c when processing queued delayed work during device removal. A local user can trigger a race condition involving AMT device shutdown to cause a denial of service or execute arbitrary code.

The issue occurs because delayed work items can be re-queued from event_wq after cancellation and then access a freed amt_dev structure after the netdev has been released.

409) Use-after-free (CVE-ID: CVE-2026-68153)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the monmap debugfs file handler when processing a concurrent read during client teardown. A local user can read the monmap debugfs file during teardown to cause a denial of service.

The issue is triggered by a race condition between debugfs access and ceph client teardown.

410) Out-of-bounds read (CVE-ID: CVE-2026-68154)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in crush_decode and the CRUSH mapper when parsing a malformed CRUSH map. A local user can supply a crafted CRUSH map with a zero bucket type to cause a denial of service.

The issue arises because bucket type 0 is reserved for devices, and an invalid map can make the mapper treat a negative bucket ID as a device and index the OSD weight array with a negative value.

411) Improper input validation (CVE-ID: CVE-2026-68155)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ceph_monmap_decode() when processing a CEPH_MSG_MON_MAP monmap message. A remote attacker can send a specially crafted monmap advertising zero monitors to cause a denial of service.

The issue is triggered when the client later attempts to open a session with a monitor, causing an assertion in pick_new_mon() to fire.

412) Use-after-free (CVE-ID: CVE-2026-68156)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Ceph authorizer handling code when processing a rebuilt authorizer during a messenger reconnect. A local user can trigger an authorizer update that reallocates the buffer and then cause a reconnect to use a stale pointer to cause a denial of service.

The issue is triggered when a newer service ticket causes the authorizer to be rebuilt and the rebuilt authorizer no longer fits in the existing buffer.

413) NULL pointer dereference (CVE-ID: CVE-2026-68157)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in get_immediate_parent() in net/ceph/osdmap.c when processing malformed CRUSH hierarchy metadata during localized read selection. A local user can trigger lookup of a parent bucket whose type has no matching entry in type_names to cause a denial of service.

The issue occurs when a parent bucket name exists in the CRUSH map but its type name metadata is missing, causing an invalid pointer to be passed to strcmp().

414) Integer overflow (CVE-ID: CVE-2026-68158)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer overflow in decode_new_up_state_weight() when processing a corrupted CEPH_MSG_OSD_MAP message containing a crafted osdmap. A remote attacker can send a specially crafted message to disclose sensitive information.

The issue can lead to out-of-bounds reads while decoding the new_state portion of the osdmap.

415) Out-of-bounds write (CVE-ID: CVE-2026-68159)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack out-of-bounds write in __decode_pg_temp(), __decode_pg_upmap_items(), and OSDMap handling in net/ceph/osdmap.c when processing a crafted OSDMap containing an oversized pg_temp, pg_upmap, or pg_upmap_items entry. A remote attacker can send a specially crafted OSDMap entry to cause a denial of service.

The issue is triggered when the decoded list is later copied into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE].

416) Out-of-bounds read (CVE-ID: CVE-2026-68160)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ceph_handle_caps() and ceph_update_snap_trace() when processing a crafted Ceph MDS caps message with a malicious snap_trace_len value. A remote attacker can send a specially crafted message to disclose sensitive information.

Exploitation requires a malicious or compromised MDS to send a version 1 message so the IMPORT path is reached without prior version-gated validation of snap_trace_len.

417) Improper resource shutdown or release (CVE-ID: CVE-2026-68161)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in SCTP UDP tunnel sockets during net namespace teardown when tearing down a network namespace with SCTP UDP tunneling enabled. A local user can trigger namespace teardown while the sockets remain installed to cause a denial of service.

Only systems using per-network-namespace SCTP UDP tunneling are affected.

418) Use-after-free (CVE-ID: CVE-2026-68162)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the SCTP auth_enable sysctl handler when handling writes to an already opened sysctl file during network namespace teardown. A local user can write to the auth_enable sysctl entry to cause a denial of service.

The issue is exposed during initialization before the SCTP control socket exists and during teardown after the control socket has been released.

419) Improper access control (CVE-ID: CVE-2026-68166)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to inject chosen return addresses.

The vulnerability exists due to improper access control in userfaultfd registration for virtual memory areas when registering shadow stack or special VMAs. A local user can register a shadow stack VMA with userfaultfd and inject a page with chosen return addresses via UFFDIO_COPY to inject chosen return addresses.

The issue involves shadow stack VMAs, and special VMAs are also affected in cases where a driver implements vm_uffd_ops.

420) Improper resource shutdown or release (CVE-ID: CVE-2026-68180)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the intel_th MSC output release path when opening and closing MSC output files. A local user can repeatedly open MSC output files to cause a denial of service.

Each successful MSC output open leaks one device reference because the release callback used for MSC outputs does not drop the reference acquired during open.

421) Use-after-free (CVE-ID: CVE-2026-68181)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mei_cl_bus_dev_release() in the MEI bus driver when cleaning up a MEI client bus device. A local user can trigger concurrent cleanup access to cause a denial of service.

The issue involves queue cleanup running without the device lock and traversal of file_list after releasing the final bus reference.

422) Improper Initialization (CVE-ID: CVE-2026-68182)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the comedi_parport interrupt handler and attach logic when handling interrupts during device attachment. A local user can supply a crafted I/O port base address or trigger a premature interrupt to cause a denial of service.

The issue can occur if the interrupt handler runs before the comedi device is fully attached, including when a user-supplied I/O port base address is not backed by real parallel port hardware.

423) Out-of-bounds read (CVE-ID: CVE-2026-68184)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a stack out-of-bounds read in mmc_ioctl_cdrom_volume() when processing the CDROMVOLCTRL ioctl on drives that return a non-zero block descriptor length. A local user can invoke the CDROMVOLCTRL ioctl to disclose sensitive information.

The issue is not triggered by CDROMVOLREAD and only occurs on drives that report a non-zero block descriptor length.

424) Use-after-free (CVE-ID: CVE-2026-68188)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in rfcomm_tty_set_termios() and rfcomm_send_rpn() when handling TTY ioctl requests on an RFCOMM device during a concurrent session teardown. A local user can trigger a race condition to cause a denial of service or execute arbitrary code.

The issue is caused by concurrent access to dlc->session without proper locking while krfcommd can unlink the DLC and free the associated session.

425) Use-after-free (CVE-ID: CVE-2026-68189)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in UUID list traversal in hci_sync.c when generating EIR data or class-of-device data during asynchronous command sync work. A local user can add and remove Bluetooth UUID entries through the management socket to cause a denial of service.

The issue is triggered by a race condition between command sync work and management socket operations.

426) Double free (CVE-ID: CVE-2026-68192)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in brcmf_pcie_release_scratchbuffers() when releasing scratch and ring update DMA buffers during reset and device removal. A local user can trigger repeated sequential release to cause a denial of service.

The issue occurs when reset teardown runs before device removal, causing the same DMA allocation to be freed a second time.

427) NULL pointer dereference (CVE-ID: CVE-2026-68193)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7925_rx_check() and mt7925_queue_rx_skb() when handling PKT_TYPE_TXRX_NOTIFY on non-mmio buses. A local attacker can trigger the affected code path to cause a denial of service.

The issue occurs on USB devices because the tx_cleanup callback is NULL for non-mmio queue operations.

428) NULL pointer dereference (CVE-ID: CVE-2026-68194)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7921_rx_check() and mt7921_queue_rx_skb() when handling PKT_TYPE_TXRX_NOTIFY events on non-mmio buses. A local user can trigger the vulnerable code path to cause a denial of service.

The issue affects USB and SDIO bus configurations because the tx_cleanup callback is NULL on those non-mmio buses.

429) NULL pointer dereference (CVE-ID: CVE-2026-68195)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mt7615_rx_check() and mt7615_queue_rx_skb() when processing PKT_TYPE_TXRX_NOTIFY on non-mmio buses. A local user can trigger the RX worker to handle a crafted TXRX_NOTIFY event to cause a denial of service.

The issue affects mt7663 USB and SDIO buses where the tx_cleanup callback is NULL.

430) Out-of-bounds read (CVE-ID: CVE-2026-68196)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in wilc_parse_assoc_resp_info() in the wilc1000 driver when parsing a received association response. A remote attacker can send a specially crafted short association response frame to disclose sensitive information.

A response shorter than the 6-byte fixed header can trigger the issue, and a response shorter than four bytes may cause an out-of-bounds read of status_code at offsets 2 and 3.

431) NULL pointer dereference (CVE-ID: CVE-2026-68197)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mwifiex_tdls_add_ht_oper() when setting up a TDLS link to a peer while associated with an access point that advertises HT Capabilities but omits the HT Operation element. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the driver checks bcn_ht_cap but dereferences bcn_ht_oper, which may remain NULL after beacon parsing.

432) Out-of-bounds read (CVE-ID: CVE-2026-68199)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in aggr_recv_addba_req_evt() in the ath6kl wireless driver when processing a firmware-supplied ADDBA window size. A remote attacker can supply a crafted window size value to cause a denial of service.

The issue arises because an out-of-range window size can lead to a zero-size or overflowed allocation before subsequent memory access.

433) Use-after-free (CVE-ID: CVE-2026-68202)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ALSA sequencer queue timer handling in snd_seq_timer_delete() and related queue destruction logic when accessing /dev/snd/seq and re-opening a queue timer during queue teardown. A local user can issue crafted sequencer operations to leave a timer instance live and trigger a dereference of freed queue memory to cause a denial of service.

No queue ownership is required.

434) Race condition (CVE-ID: CVE-2026-68204)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unexpected results.

The vulnerability exists due to improper state management in vivid_update_format_cap() and vivid_update_format_out() when changing CROP, COMPOSE, or SCALE capability controls after REQBUFS and before STREAMON while the queue state is not properly enforced. A local user can change these controls to cause unexpected results.

The issue affects the vivid media test driver during the window between buffer request setup and the start of streaming.

435) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68205)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper ownership handling in v4l2_async_register_subdev_sensor() when registering a V4L2 subdevice sensor asynchronously. A local user can trigger registration of a crafted or removable sensor driver module to cause a denial of service.

The issue can leave the sensor driver's module owner unset, allowing the module to be removed while the subdevice is still in use by a notifier such as a CSI-2 receiver bridge driver.

436) Improper input validation (CVE-ID: CVE-2026-68206)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the V4L2 HEVC slice control validation path when processing HEVC slice parameters. A local user can supply crafted active L0/L1 reference counts to cause a denial of service.

The issue affects stateless HEVC drivers, and validation was missing before driver-specific code consumed the shared control data.

437) Improper resource shutdown or release (CVE-ID: CVE-2026-68207)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the v4l2 device registration handling in vpe_probe() when probing the TI VPE driver with missing vpe_top resources. A local user can trigger device probing in this state to cause a denial of service.

The issue occurs on an error path after v4l2_device_register() succeeds, leaving the v4l2 device registered when probe initialization fails.

438) Improper resource shutdown or release (CVE-ID: CVE-2026-68209)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the sun4i_csi_start_streaming() path of the sun4i-csi driver when handling streaming startup with an unsupported CSI format. A local user can trigger streaming initialization with a format that has no matching CSI format to cause a denial of service.

The issue occurs because queued video buffers are not returned on the error path after they have already been handed to the driver by the vb2 framework.

439) Improper resource shutdown or release (CVE-ID: CVE-2026-68210)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the stm32 dcmi driver async notifier handling when probing the device and reset operations fail. A local user can trigger a probe failure to cause a denial of service.

The issue occurs because the notifier remains registered on the error path when probe exits before the normal remove path is reached.

440) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68212)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in saa7134_video_init1 in the saa7134 video driver when probing a device and initializing video and VBI queues. A local user can trigger initialization failures that leave allocated resources unreleased and may result in use of uninitialized DMA resources to cause a denial of service.

The issue occurs during device probing before the device is fully registered, so the normal cleanup path is not executed.

441) Improper resource shutdown or release (CVE-ID: CVE-2026-68213)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in rtl2832_sdr_start_streaming() and queued buffer handling when handling start_streaming() failures. A local user can trigger a streaming start failure to cause a denial of service.

The issue occurs because buffers queued before streaming are not returned to the videobuf2 framework on error paths, which can trigger a WARN_ON and leak queued buffers.

442) Use-after-free (CVE-ID: CVE-2026-68214)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in rtl2832_remove() when removing a device while concurrent I2C transfers are still in flight through the mux adapter. A local user can trigger device removal during concurrent I2C activity to cause a denial of service.

The issue arises because delayed work may be rescheduled after cancellation by a concurrent thread during device teardown.

443) Improper resource shutdown or release (CVE-ID: CVE-2026-68215)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the si476x radio driver probe error path when handling device initialization failures. A local user can trigger a probe failure to cause a denial of service.

444) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68216)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in start_streaming() in the pwc USB camera driver when handling queued video buffers during streaming startup failure conditions. A local user can trigger a streaming startup failure to cause a denial of service.

The issue can be triggered when the USB device is already disconnected or when locking is interrupted by a signal.

445) Improper resource shutdown or release (CVE-ID: CVE-2026-68217)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in start_streaming() in the pwc USB media driver when handling a start_streaming() failure after isochronous URB submission. A local user can trigger a streaming start failure to cause a denial of service.

The issue occurs because a buffer moved from queued_bufs into fill_buf is not drained on the error path, which leads to a WARN_ON(owned_by_drv_count).

446) Improper resource shutdown or release (CVE-ID: CVE-2026-68218)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the dm1105 driver remove() callback when removing the device. A local user can trigger device removal to cause a denial of service.

447) Improper input validation (CVE-ID: CVE-2026-68219)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the imx8-isi scaling configuration logic when processing crafted image scaling parameters. A local user can supply specially crafted width or height values to cause a denial of service.

The issue can cause the affected process to stop responding even when interrupted with Ctrl+C.

448) Memory leak (CVE-ID: CVE-2026-68220)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the imx8-isi crossbar and pipe cleanup paths when repeatedly loading and unloading the affected kernel module. A local user can trigger module initialization and cleanup cycles to cause a denial of service.

The issue occurs because subdevice active state allocated by v4l2_subdev_init_finalize() is not released during cleanup.

449) Improper resource shutdown or release (CVE-ID: CVE-2026-68222)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in msi2500_start_streaming() and queued buffer cleanup handling when starting streaming after buffers have been queued by the vb2 framework. A local user can trigger start_streaming() error paths to cause a denial of service.

The issue occurs on multiple start_streaming() failure paths, including device disconnect, interrupted locking, USB ADC setup failure, isochronous initialization failure, and streaming command failure. In some cases, queued buffers are not returned as expected and submitted isochronous URBs may remain active without being consumable by the driver.

450) Improper resource shutdown or release (CVE-ID: CVE-2026-68223)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the vdec_open() function when opening the video decoder device and initialization of controls fails. A local user can open the device to cause a denial of service.

The issue occurs in the error path after m2m context allocation, resulting in a kernel memory leak.

451) NULL pointer dereference (CVE-ID: CVE-2026-68226)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in cx23885_dev_setup() in the cx23885 driver when handling a memory mapping failure for PCI BAR0. A local attacker can trigger the vulnerable code path to cause a denial of service.

452) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68227)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource lifetime management in the cx231xx USB media driver when the driver is unbound from a USB interface without physical device disconnection. A local user can trigger driver unbind or reconfiguration conditions to cause a denial of service.

The issue can be triggered during probe deferral or configuration changes.

453) Out-of-bounds read (CVE-ID: CVE-2026-68229)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in _cedrus_write_ref_list() when processing malformed or unsupported H.264 reference list entries. A local user can provide crafted stateless slice control reference list entries to disclose sensitive information.

454) Improper resource shutdown or release (CVE-ID: CVE-2026-68231)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in airspy_start_streaming() in the airspy USB media driver when starting streaming after the USB device has been disconnected. A local user can trigger streaming with queued buffers present to cause a denial of service.

The issue occurs because buffers accepted before start_streaming() are not returned on the error path.

455) Improper resource shutdown or release (CVE-ID: CVE-2026-68234)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in amdgpu_bo_create_reserved() when handling repeated calls with a non-NULL BO pointer. A local user can trigger repeated resume or firmware buffer reload operations to cause a denial of service.

The issue occurs because repeated calls increase the BO pin count, while teardown only removes a single pin reference, preventing the buffer object from being moved, swapped, or evicted.

456) NULL pointer dereference (CVE-ID: CVE-2026-68235)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in dce100_find_first_free_match_stream_enc_for_link() and link_set_dpms_on() when handling DisplayPort MST stream encoder assignment. A local user can trigger DisplayPort MST multi-monitor handling to cause a denial of service.

The issue affects DCE8-class ASICs in a DisplayPort MST daisy-chain setup, such as when a second monitor is hot-plugged or already connected at boot.

457) Double free (CVE-ID: CVE-2026-68236)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in dm_update_crtc_state() in the AMD display manager when handling error paths after releasing new_stream on the skip_modeset path. A local user can trigger a later error condition after the initial release to cause a denial of service.

The issue occurs because a dangling pointer may be released again after a color management failure reaches the fail label.

458) Improper resource shutdown or release (CVE-ID: CVE-2026-68238)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in amdgpu_acpi_vfct_bios() when fetching and processing the ACPI VFCT table. A local user can trigger repeated calls to the vulnerable function to cause a denial of service.

The issue leaks an ACPI table mapping because the reference obtained with acpi_get_table() is not released on exit paths after the table is acquired.

459) NULL pointer dereference (CVE-ID: CVE-2026-68243)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the i915 GEM context SSEU parameter handling in set_proto_ctx_sseu() when applying I915_CONTEXT_PARAM_SSEU to a context engine slot previously set to I915_ENGINE_CLASS_INVALID or I915_ENGINE_CLASS_INVALID_NONE. A local user can configure the same slot and trigger the affected operation to cause a denial of service.

460) Memory leak (CVE-ID: CVE-2026-68244)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the i915 GEM proto context creation extension handling when processing user extensions after a successful BALANCE/PARALLEL_SUBMIT extension. A local user can submit crafted context creation extensions to cause a denial of service.

The issue occurs when an error is triggered while processing a subsequent user extension after BALANCE/PARALLEL_SUBMIT has already succeeded.

461) Use-after-free (CVE-ID: CVE-2026-68245)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in amdgpu_vm_get_task_info_pasid() when looking up task information by PASID. A local user can trigger the flawed lookup path to cause a denial of service.

462) Reachable assertion (CVE-ID: CVE-2026-68246)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of invalid alignment conditions in gfx_v11_0.c when processing misaligned GPU addresses and fence addresses. A local user can trigger a kernel BUG_ON condition to cause a denial of service.

463) Improper input validation (CVE-ID: CVE-2026-68247)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the panel type selection logic in drivers/gpu/drm/i915/display/intel_bios.c when parsing LFP Data Block panel_type2 values from VBT data. A local user can provide a specially crafted panel_type2 value to cause a denial of service.

The issue affects the handling of LFP2 device panel selection.

464) NULL pointer dereference (CVE-ID: CVE-2026-68248)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in active_instance in the i915 DRM driver when handling memory allocation failure during GFP_ATOMIC allocation. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when kmem_cache_alloc returns NULL and the function returns node->base derived from a NULL node.

465) Reachable assertion (CVE-ID: CVE-2026-68249)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable assertion in the sdma_v5_0 fence emission logic when processing a crafted fence address. A local user can trigger the BUG_ON() condition to cause a denial of service.

The issue results in a kernel crash rather than continued execution.

466) Reachable assertion (CVE-ID: CVE-2026-68250)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a BUG_ON assertion in sdma_v5_2_ring_emit_fence() in the amdgpu sdma_v5_2 component when processing a crafted fence address. A local user can trigger the BUG_ON condition to cause a denial of service.

467) Reachable assertion (CVE-ID: CVE-2026-68251)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable kernel assertion in sdma_v6_0_ring_emit_fence() in the amdgpu sdma v6.0 driver when processing a fence address with the low two bits set. A local user can trigger the vulnerable code path to cause a denial of service.

468) Reachable assertion (CVE-ID: CVE-2026-68252)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of invalid address alignment checks in sdma_v7_0_ring_emit_fence() in the amdgpu SDMA v7.0 driver when processing fence addresses. A local user can trigger a misaligned fence address condition to cause a denial of service.

The issue results in a kernel crash because a BUG_ON() assertion is reachable in this code path.

469) Out-of-bounds write (CVE-ID: CVE-2026-68253)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the intel_hdcp_required_content_stream function when processing HDCP content stream data. A local user can trigger a stream count overflow to cause a denial of service.

470) Improper input validation (CVE-ID: CVE-2026-68254)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the intel_vrr.c VRR capability handling when processing EDID monitor range data. A local user can provide crafted min/max vertical frequency values to trigger a division by zero and cause a denial of service.

471) Out-of-bounds read (CVE-ID: CVE-2026-68255)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in virtio_get_edid_block() when parsing device-supplied EDID responses. A remote privileged user can supply a crafted virtio-gpu EDID response with a large reported size and high extension count to disclose sensitive information.

Exploitation requires control of a malicious virtio-gpu backend.

472) Memory leak (CVE-ID: CVE-2026-68256)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in detect_link_and_local_sink in the AMD display link detection code when handling a DisplayPort alt mode timeout. A local user can trigger the timeout path to cause a denial of service.

473) Integer overflow (CVE-ID: CVE-2026-68257)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in drm/amdkfd queue buffer handling in kfd_queue_acquire_buffers() and kfd_queue_release_buffers() when calculating the CWSR save area size. A local user can provide crafted queue properties with large ctx_save_restore_area_size values to cause a denial of service.

The issue can result in an undersized CWSR save area that firmware later overruns.

474) Improper input validation (CVE-ID: CVE-2026-68259)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in allocate_event_notification_slot in the amdkfd event handling code when processing a user-supplied restore event id. A local user can provide an out-of-bounds event id to cause a denial of service.

The issue is related to the restore_id option used by CRIU.

475) Race condition (CVE-ID: CVE-2026-68260)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to a NULL pointer dereference in the PowerVR GPU virtual memory mapping logic when performing map or unmap operations while a find operation is in progress. A local user can issue crafted ioctl requests to trigger the NULL pointer dereference and cause a denial of service.

476) NULL pointer dereference (CVE-ID: CVE-2026-68261)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in pvr_context_create and pvr_vm_context_lookup handling when processing a DRM_IOCTL_PVR_CREATE_CONTEXT ioctl request with an invalid VM context handle. A local user can send a specially crafted ioctl request to cause a denial of service.

477) Incorrect calculation (CVE-ID: CVE-2026-68262)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information or corrupt memory in userspace.

The vulnerability exists due to improper pointer arithmetic in pvr_set_uobj_array() when copying an array of kernel objects to a userspace array with a differing element stride. A local user can supply crafted stride values to cause later copies to read from incorrect kernel addresses or write to incorrect userspace offsets to disclose sensitive information or corrupt memory in userspace.

The issue occurs in the slow path when the userspace element size differs from the kernel object size, and padding is not cleared for each element.

478) Double free (CVE-ID: CVE-2026-68263)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in drm_sched_entity_fini() in the PowerVR DRM queue cleanup path when destroying queues after queue kill handling. A local user can trigger queue teardown in a crafted context lifecycle to cause a denial of service.

The issue is associated with a refcount underflow and use-after-free warning in the drm/imagination PowerVR driver.

479) Improper access control (CVE-ID: CVE-2026-68267)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass register access restrictions.

The vulnerability exists due to improper access control in the OA register whitelist handling in the xe DRM driver when initializing or resetting whitelist entries. A local user can access OA registers through non-privileged slots to bypass register access restrictions.

The issue can occur after probe, GT reset, resume, and engine reset.

480) Observable discrepancy (CVE-ID: CVE-2026-68269)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper restriction of speculative execution in the parallel submission slot handling in set_proto_ctx_engines_parallel_submit() when processing a userspace-controlled parallel submission slot. A local user can supply a crafted slot value to disclose sensitive information.

481) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68271)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() when handling failed u_memcpya() allocations during user copy operations. A local user can trigger an allocation failure to cause a denial of service.

The issue can lead to a kernel oops from dereferencing an ERR_PTR value, and a different failure path can also result in a memory leak.

482) NULL pointer dereference (CVE-ID: CVE-2026-68272)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper input validation leading to a NULL-pointer dereference in amdgpu_cs_pass1() and amdgpu_cs_p2_shadow() when processing an undersized AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk. A local user can submit a specially crafted chunk with zero length to cause a denial of service.

This is reachable by an unprivileged process in the render group.

483) Out-of-bounds read (CVE-ID: CVE-2026-68277)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the sideband reply parsers in drm_dp_mst_topology.c when parsing crafted sideband reply messages. A local user can provide a crafted message with a truncated 2-byte field to disclose sensitive information.

The out-of-bounds read can access data from adjacent struct fields including curchunk_len, curchunk_idx, and curlen.

484) Out-of-bounds write (CVE-ID: CVE-2026-68278)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to out-of-bounds write in drm_dp_sideband_append_payload() when processing forged DP MST sideband reply messages from a connected device. An attacker with physical access can send crafted sideband reply data to cause memory corruption.

The issue is reachable from a DP MST device over a physical connection.

485) Out-of-bounds read (CVE-ID: CVE-2026-68279)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in drm_dp_sideband_parse_remote_dpcd_read() and drm_dp_sideband_parse_remote_i2c_read_ack() when parsing remote DPCD and I2C sideband reply messages from an MST hub. A remote attacker can send a specially crafted sideband reply with an oversized num_bytes value to disclose sensitive information.

The issue can be triggered by a malicious or misbehaving MST hub.

486) Improper resource shutdown or release (CVE-ID: CVE-2026-68280)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in cdns_dsi power management operations when handling runtime suspend and system suspend transitions. A local user can trigger suspend operations to cause a denial of service.

The issue results in a kernel warning when clocks are disabled twice.

487) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68281)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of dependencies in prepare_job() in the PowerVR DRM scheduler queue handling code when submitting paired geometry and fragment jobs to the fragment CCCB. A local user can submit specially crafted paired jobs to cause a denial of service.

The issue can lead to kernel warnings and potentially job timeouts when the fragment command queue is almost full.

488) Use-after-free (CVE-ID: CVE-2026-68284)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tcp_bpf_sendmsg() when two threads send on the same socket and an error occurs after waiting for socket memory. A local user can trigger concurrent send operations to cause a denial of service.

The issue occurs in the sockmap BPF path and involves stale cork state being mistaken for a stack-local temporary message.

489) Race condition (CVE-ID: CVE-2026-68286)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe() in net/core/drop_monitor.c when updating 64-bit per-CPU statistics after releasing drop_queue.lock with interrupts re-enabled. A local attacker can trigger reentrant execution during the stats update to cause a denial of service.

On 32-bit architectures, a nested interrupt on the same CPU during the seqcount-based update can corrupt the seqcount state or statistics value.

490) Use of uninitialized resource (CVE-ID: CVE-2026-68288)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in NET_DM_ATTR_PAYLOAD handling in net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() when constructing netlink messages containing packet payload data. A local user can receive a specially crafted netlink message to disclose sensitive information.

The issue occurs when the packet payload length is not 4-byte aligned, causing 1 to 3 padding bytes to remain uninitialized and be leaked to user space.

491) Integer overflow (CVE-ID: CVE-2026-68289)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in tipc_recvmsg() and tipc_recvstream() when processing oversized user-supplied buffer lengths. A local user can supply an excessively large buffer length via io_uring provided buffers to cause a denial of service.

The issue can trigger a WARN_ON that may lead to a kernel panic on systems configured with panic_on_warn.

492) Out-of-bounds read (CVE-ID: CVE-2026-68293)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the MCIA register handling in the mlx5 driver when processing module EEPROM reads via ethtool. A local user can trigger a read of module EEPROM data to cause a denial of service.

The issue is detected on kernels built with FORTIFY_SOURCE, where it results in a kernel BUG.

493) Improper input validation (CVE-ID: CVE-2026-68297)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in TIPC netlink MTU property handling when processing user-supplied MTU values through TIPC media or bearer configuration requests. A local user can supply an MTU value greater than 65535 to trigger a division by zero and cause a denial of service.

Exploitation is possible by an unprivileged user via a user namespace.

494) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68299)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of encapsulated packet headers in vmxnet3_get_hdr_len() when processing Geneve-encapsulated packets. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue is triggered when descriptor fields describe the inner header instead of the outer header, including cases where the outer protocol is UDP or the outer and inner IP versions differ.

495) Improper Authentication (CVE-ID: CVE-2026-68300)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass authentication.

The vulnerability exists due to improper authentication in sctp_auth_chunk_verify() when processing SCTP chunks with a NULL auth_chunk. A remote user can send a specially crafted SCTP chunk to bypass authentication.

This can occur for new connections or when no AUTH chunk precedes a COOKIE-ECHO chunk.

496) Use-after-free (CVE-ID: CVE-2026-68302)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the AMT packet handling logic in drivers/net/amt.c when processing crafted network packets that trigger skb header pulls and head reallocation. A remote attacker can send specially crafted packets to cause a denial of service or potentially execute arbitrary code.

The issue affects multiple AMT receive and transmit paths that cache skb header pointers and later dereference them after helpers such as pskb_may_pull(), ip_mc_may_pull(), ipv6_mc_may_pull(), iptunnel_pull_header(), ip_mc_check_igmp(), or ipv6_mc_check_mld() move the skb head.

497) NULL pointer dereference (CVE-ID: CVE-2026-68303)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the vc4_hvs_unbind and vc4_v3d_unbind functions when unbinding dependent vc4 drivers after vc4-drm removal. A local user can trigger driver unbind operations to cause a denial of service.

The issue occurs because the dependent drivers access master driver data after the vc4-drm device has already been removed.

498) Improper Initialization (CVE-ID: CVE-2026-68304)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the brcmfmac cfg80211 key management handling when processing 802.1X-SHA256 PMK configuration requests. A local user can send a crafted netlink request to trigger a kernel warning and cause a denial of service.

The issue occurs when 802.1X-SHA256 mode is used without the required firmware supplicant configuration.

499) NULL pointer dereference (CVE-ID: CVE-2026-68306)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7996_mcu_sta_bfer_eht() when handling EHT PHY capability data. A local attacker can trigger the vulnerable code path to cause a denial of service.

500) NULL pointer dereference (CVE-ID: CVE-2026-68308)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the mt7996 MCU handling code when processing HE PHY capability data. A local user can trigger code paths that use a NULL capability pointer to cause a denial of service.

501) NULL pointer dereference (CVE-ID: CVE-2026-68309)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt76_connac_mcu_uni_bss_he_tlv() when processing HE BSS TLV data. A local user can trigger the vulnerable code path to cause a denial of service.

502) NULL pointer dereference (CVE-ID: CVE-2026-68310)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in HE capability handling in mt7915_mcu_bss_he_tlv() and mt7915_mcu_sta_bfer_tlv() when processing HE-specific setup for a vif type with no matching capability entry. A local user can trigger HE-specific processing to cause a denial of service.

503) Improper resource shutdown or release (CVE-ID: CVE-2026-68312)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in cifs_close_deferred_file(), cifs_close_all_deferred_files(), and cifs_close_deferred_file_under_dentry() when handling deferred close cancellation and allocation failure under memory pressure. A local user can trigger deferred close processing in low-memory conditions to cause a denial of service.

The issue occurs when cancel_delayed_work() succeeds and the subsequent allocation for local processing fails, causing a cifsFileInfo reference and an open server handle to leak.

504) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68313)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in __tipc_nl_compat_dumpit in the TIPC netlink compatibility handler when processing dumpit callback results. A local user can trigger a negative return value path to cause a denial of service.

The issue can lead to an infinite loop that prevents genl_mutex from being released, causing tasks waiting on the mutex to starve in D state.

505) Integer overflow (CVE-ID: CVE-2026-68315)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow in sctp_process_strreset_inreq() when processing a crafted SCTP RESET_IN_REQUEST from a peer. A remote attacker can send a specially crafted SCTP stream reset request to cause a denial of service.

Exploitation is only possible on interfaces with MTU greater than 65535, such as loopback with IPv6 jumbograms.

506) Heap-based buffer overflow (CVE-ID: CVE-2026-68320)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in sctp_association_init and SCTP authentication chunk handling when processing endpoint authentication chunk lists containing more than 16 entries. A local user can add excessive chunk identifiers to trigger memory corruption and cause a denial of service.

507) NULL pointer dereference (CVE-ID: CVE-2026-68322)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the RDS IPv6 address check logic when binding an RDS socket to an IPv6 address while IPv6 is disabled. A local user can bind an RDS socket to an IPv6 address to cause a denial of service.

The issue occurs on systems booted with the ipv6.disable=1 parameter.

508) Out-of-bounds write (CVE-ID: CVE-2026-68324)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in dmar_latency_disable() when disabling latency statistics for a type value greater than 0. A local user can trigger the vulnerable code path to cause a denial of service.

When the type value is greater than 0, the operation writes beyond the end of the allocated array and corrupts adjacent memory.

509) Stack-based buffer overflow (CVE-ID: CVE-2026-68325)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in the ivrs_acpihid command-line parser when parsing the ivrs_acpihid kernel command-line parameter. A local attacker can supply a specially crafted parameter with more than four entries to cause a denial of service.

510) Out-of-bounds read (CVE-ID: CVE-2026-68326)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in mwifiex_process_uap_event() and the assoc_req_ies parsing path when processing a firmware-reported uAP association event with a crafted event length. A local attacker can supply a malicious or malformed event from a mwifiex device to disclose sensitive information.

The issue can be triggered by a malicious or malfunctioning mwifiex USB, SDIO, or PCIe device while the interface is operating in AP/uAP mode. An underflow in the calculated length may also cause stale event buffer bytes to be exposed through an NL80211_CMD_NEW_STATION notification.

511) NULL pointer dereference (CVE-ID: CVE-2026-68327)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in wanxl_reset in the wanxl PCI device removal path when handling early probe failures before BAR mapping. A local user can trigger device initialization failure conditions to cause a denial of service.

The issue occurs on an error path where the PLX MMIO BAR has not yet been mapped, leaving card->plx NULL when cleanup invokes the reset routine.

512) NULL pointer dereference (CVE-ID: CVE-2026-68328)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in nfp_cpp_resource_find() and nfp_resource_try_acquire() when opening a resource with a matching resource-table entry after mutex allocation fails. A local user can trigger resource acquisition to cause a denial of service.

This issue was identified through static analysis and confirmed by manual source review.

513) Race condition (CVE-ID: CVE-2026-68329)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a race condition in iommu_completion_wait() in the AMD IOMMU subsystem when handling concurrent command completion waits across multiple CPUs. A local user can trigger concurrent IOMMU command activity to cause a use-after-free condition.

The issue occurs because the code may return without waiting for previously queued commands to complete in hardware, which can leave stale translations in use while related page-table pages are freed.

514) Improper resource shutdown or release (CVE-ID: CVE-2026-68331)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the dpaa2 Ethernet MAC disconnect path when disconnecting a MAC endpoint device. A local user can repeatedly trigger connect and disconnect operations to cause a denial of service.

The issue leaks a device reference stored in mac->mc_dev on each successful connect that is later disconnected.

515) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68333)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper release of a resource in dpaa2_switch_port_disconnect_mac in the dpaa2-switch driver when disconnecting a MAC endpoint device. A local user can repeatedly connect and disconnect the MAC endpoint to cause a denial of service.

516) Use-after-free (CVE-ID: CVE-2026-68335)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the RDS receive path when delivering an incoming message across network namespace boundaries. A local user can create network namespaces and send a crafted message to trigger a dangling connection reference and potentially execute arbitrary code.

The issue is reachable from unprivileged user namespaces using CLONE_NEWUSER and CLONE_NEWNET.

517) NULL pointer dereference (CVE-ID: CVE-2026-68336)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in bond_send_validate() in the bonding driver when processing ARP monitor validation with IPv6 disabled. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when the system is booted with the 'ipv6.disable=1' parameter.

518) Out-of-bounds read (CVE-ID: CVE-2026-68339)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in btusb_recv_event_realtek() when processing short Realtek vendor events. A local attacker can send a specially crafted Bluetooth HCI vendor event to cause a denial of service.

Short vendor events may be misclassified as coredump events because the code inspects a missing third byte.

519) Out-of-bounds read (CVE-ID: CVE-2026-68340)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the OCC poll response parser in drivers/hwmon/occ/common.c when parsing a truncated transport response. A local user can supply a malformed poll response to cause a denial of service.

The issue occurs because the parser used the backing-array capacity instead of the current response data length as the parse boundary, and malformed-response errors were not propagated before the OCC was published as active.

520) Out-of-bounds read (CVE-ID: CVE-2026-68343)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in parse_dfs_referrals() in the SMB client DFS referral parser when processing a malformed DFS referral response with an oversized PathConsumed value. A remote attacker can send a specially crafted DFS referral response to cause an out-of-bounds read.

The issue occurs when PathConsumed is larger than the search name length used for later DFS path parsing.

521) Memory leak (CVE-ID: CVE-2026-68346)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in cs35l41_get_acpi_mute_state() when repeatedly querying the ACPI _DSM mute state. A local user can trigger repeated successful queries to cause a denial of service.

Each successful query leaks the returned _DSM result object because it is owned by the caller and is not freed after use.

522) Out-of-bounds read (CVE-ID: CVE-2026-68346)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in cs35l41_get_acpi_mute_state() when processing a malformed ACPI _DSM firmware response. A local user can provide a crafted firmware response to cause a denial of service.

The issue occurs because the code assumes the returned ACPI object is a buffer with at least one byte and directly dereferences the returned buffer pointer.

523) Out-of-bounds read (CVE-ID: CVE-2026-68348)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the TAS2781 firmware parser when parsing malformed firmware description strings. A local user can supply a crafted firmware image without a NUL terminator to cause a denial of service.

The issue occurs because variable-length description strings are processed with strlen() before verifying that the terminator is present within the firmware buffer.

524) Heap-based buffer overflow (CVE-ID: CVE-2026-68349)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in carl9170_rx_stream() when processing USB transfer data in the rx stream failover path. A local attacker can provide specially crafted transfer data to cause a denial of service.

The issue is triggered when two transfers are near the maximum size and their combined copied length exceeds the 65535-byte failover SKB, resulting in skb_over_panic.

525) Out-of-bounds read (CVE-ID: CVE-2026-68350)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in carl9170_tx_process_status() when processing firmware-controlled TX status entries. A local attacker can provide a crafted firmware response with an oversized hdr.ext value to disclose sensitive information.

The issue is caused by an off-by-two bounds check error that allows two extra iterations past valid _tx_status entries.

526) Out-of-bounds read (CVE-ID: CVE-2026-68351)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in carl9170_cmd_callback() when processing a firmware command response with a length mismatch. A remote attacker can send a specially crafted firmware response to disclose sensitive information.

527) Out-of-bounds read (CVE-ID: CVE-2026-68352)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in ath6kl_wmi_connect_event_rx() when parsing firmware-controlled connect event information elements. A local attacker can supply crafted length fields to trigger out-of-bounds reads and disclose sensitive information.

The issue can also corrupt the wmi->is_wmm_enabled state during parsing.

528) Out-of-bounds read (CVE-ID: CVE-2026-68353)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ath6kl_wmi_tx_complete_event_rx() when processing a crafted WMI TX complete event from firmware. A local user can supply an inflated num_msg field to disclose sensitive information.

The num_msg field is firmware-controlled and can cause reads of up to 1020 bytes past the WMI event buffer.

529) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68354)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of fragment list boundaries in the firewire networking fragmented datagram reassembly logic when processing fragmented datagrams. A remote attacker can send specially crafted fragmented datagrams to cause a denial of service.

The issue can prevent complete datagrams from being correctly recognized during reassembly.

530) Out-of-bounds read (CVE-ID: CVE-2026-68355)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in ath11k_hal_rx_msdu_list_get() when processing msdu descriptor entries. A local attacker can trigger a zero buffer address in the first msdu_details entry to cause a denial of service.

531) Use-after-free (CVE-ID: CVE-2026-68357)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in watchdog_unregister_governor() and the watchdog pretimeout governor handling logic when unregistering a watchdog governor that is still referenced as default_gov. A local user can trigger governor unregistration and subsequent watchdog device registration or reassignment to cause a denial of service.

The issue occurs when the unregistered governor remains referenced through a dangling default_gov pointer, affecting both newly registered watchdog devices and existing devices whose governor is reassigned.

532) Use-after-free (CVE-ID: CVE-2026-68359)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the nzxt-smart2 driver probe function when stopping a device after device I/O has been started and probe subsequently fails. A local user can trigger device initialization failure to execute arbitrary code.

The issue is caused by a race condition between hid_input_report() and execution immediately following hid_device_io_start() during probe error handling.

533) Use-after-free (CVE-ID: CVE-2026-68360)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the corsair-cpro driver probe function when handling device I/O during probe failure after I/O start. A local user can trigger the vulnerable code path to execute arbitrary code.

The issue is caused by a race condition between hid_input_report() and execution immediately following hid_device_io_start() during probing.

534) Use-after-free (CVE-ID: CVE-2026-68361)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in corsairpsu_probe() and HID input report handling when stopping a device after probe failure while input reports are still being processed. A local user can trigger the race condition during device initialization failure to execute arbitrary code.

The issue is triggered by a race condition between hid_input_report() and the code path immediately following hid_device_io_start() during probe failure.

535) NULL pointer dereference (CVE-ID: CVE-2026-68362)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ath11k_hal_srng_access_begin and the ath11k driver restart path when handling firmware ready events after a failed initialization. A local user can trigger a subsystem restart after firmware ready handling fails to cause a denial of service.

The issue occurs because the driver can enter recovery with an inconsistent registered state after firmware ready processing does not complete successfully.

536) Use-after-free (CVE-ID: CVE-2026-68363)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in ath9k_hif_request_firmware() in drivers/net/wireless/ath/ath9k/hif_usb.c when handling a failed asynchronous firmware request during concurrent USB device disconnect. A local user can trigger a firmware download failure and a concurrent disconnect to cause a denial of service.

The issue is triggered by a race condition between the firmware callback running on the events workqueue and device disconnect, leading to a read from freed memory.

537) Out-of-bounds write (CVE-ID: CVE-2026-68365)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the io_edgeport USB serial driver ring buffer when processing interrupt-status packets that report transmit credits. A local user can provide a malicious or non-conforming USB device that returns excessive transmit credits to cause a denial of service.

Exploitation requires the system to interact with a USB serial device using the affected driver.

538) Out-of-bounds read (CVE-ID: CVE-2026-68366)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in uvc_send_response() when processing a UVCIOC_SEND_RESPONSE ioctl with a crafted response length. A local user can supply a crafted struct uvc_request_data to cause an out-of-bounds read and disclose sensitive information.

539) Out-of-bounds read (CVE-ID: CVE-2026-68368)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ncm_unwrap_ntb() in the USB gadget NCM function when parsing host-supplied NTBs. A remote attacker can supply a crafted NTB with invalid block lengths, datagram offsets, or datagram lengths to disclose sensitive information.

Exploitation requires a malicious USB host interacting with a system using the affected USB gadget functionality.

540) Infinite loop (CVE-ID: CVE-2026-68369)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of copy_to_user() results in printer_read() in the USB gadget printer function when processing read requests with an unwritable user buffer. A local user can trigger a read operation with an unwritable user buffer to cause a denial of service.

The issue can result in an infinite loop if RX data is available and an iteration makes no progress.

541) Race condition (CVE-ID: CVE-2026-68370)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dummy_hcd shared fifo_req handling when processing small IN transfers through the emulated single-request FIFO fast-path. A local user can trigger concurrent request queueing and completion handling to cause a denial of service.

The issue can overwrite the request completion function pointer while a completion callback is still running, leading to a general protection fault or page fault in dummy_timer.

542) Use-after-free (CVE-ID: CVE-2026-68372)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the USB Type-C connector handling in drivers/usb/core/port.c when processing Thunderbolt dock unplug and concurrent partner-disconnect events. A local user can trigger a crafted hot-unplug race to cause a denial of service.

Exploitation requires a race between component unbind, USB disconnect, and UCSI partner-disconnect handling during dock hot-plug events.

543) Out-of-bounds read (CVE-ID: CVE-2026-68373)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in at76_guess_freq() when processing truncated beacon or probe response frames during scanning. A remote attacker can send a specially crafted wireless management frame to disclose sensitive information.

The issue is reachable from at76_rx_tasklet() while scanning.

544) Improper Initialization (CVE-ID: CVE-2026-68375)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in bnxt_aux_devices_init() and the bnxt_aux_dev_release() release callback when unwinding errors after auxiliary_device_init(). A local user can trigger an allocation failure during auxiliary device initialization to cause a denial of service.

The issue arises because the release callback may dereference or clear partially initialized state.

545) Use-after-free (CVE-ID: CVE-2026-68377)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tunnel_key_release_params() in net/sched/act_tunnel_key.c when handling concurrent tunnel key action processing on the datapath. A local user can trigger a race condition to cause a denial of service.

The issue arises because a reader may still access the old params structure under RCU while the associated metadata_dst is released synchronously.

546) Improper input validation (CVE-ID: CVE-2026-68386)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state validation in sockmap update handling in net/core/sock_map.c when processing updates for unhashed UDP sockets. A local user can use a BPF program to look up an unbound UDP socket and then bind the socket to trigger a refcount imbalance and cause a denial of service.

The issue is triggered by a transition of a UDP socket from an unbound state to a bound state, which causes the reference decrement to be skipped and results in a memory leak.

547) Use-after-free (CVE-ID: CVE-2026-68389)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in qca_controller_memdump() in the Qualcomm Bluetooth hci_qca driver when processing a controller-reported memdump with an invalid zero dump size. A local user can trigger a crafted invalid memdump condition to cause a denial of service.

The issue can leave memdump collection state stale and IBS disabled after the aborted dump, which may block waiters or later transmit handling.

548) Use-after-free (CVE-ID: CVE-2026-68391)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth management subsystem in net/bluetooth/mgmt.c when handling Bluetooth management operations involving pending command callbacks and connection lookups. A local user can trigger connection state changes during these operations to cause a denial of service.

The issue involves dereferencing RCU-protected hci_conn pointers outside critical sections and accessing connection state without the required device lock, which can also lead to a data race.

549) Use-after-free (CVE-ID: CVE-2026-68392)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth management subsystem net/bluetooth/mgmt.c when handling unpair and disconnect operations. A local user can trigger these operations to cause a denial of service.

The issue arises from dereferencing RCU-protected connection pointers outside the required critical section.

550) Use-after-free (CVE-ID: CVE-2026-68394)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth management subsystem when processing crafted MGMT_OP_LOAD_CONN_PARAM requests that queue a connection parameter update. A local user can send crafted requests that free a queued connection-parameter entry before the queued callback runs to cause a denial of service.

The issue occurs in queued connection update handling for an existing LE central connection.

551) Use-after-free (CVE-ID: CVE-2026-68397)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in afiucv_hs_rcv() and the afiucv_hs_callback_* handlers when processing AF_IUCV socket traffic. A local user can trigger a concurrent socket close to cause a denial of service.

The issue arises because the destination socket is looked up under a lock and then used after the lock is released without holding a reference.

552) Use-after-free (CVE-ID: CVE-2026-68398)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in pppol2tp_recv() and PPP channel handling when processing pppol2tp receive traffic concurrently with channel teardown. A local user can trigger concurrent receive and close operations to cause a denial of service or execute arbitrary code.

The issue is reachable by an unprivileged user and affects a channel that is bound but not attached to a PPP unit and not bridged.

553) Use-after-free (CVE-ID: CVE-2026-68399)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sk_clone() and BPF socket local storage handling when cloning sockets and an early bailout occurs before BPF storage cloning. A local user can trigger socket cloning that fails before storage initialization completes to cause a denial of service.

Only systems with BPF syscall support enabled are vulnerable.

554) Out-of-bounds read (CVE-ID: CVE-2026-68402)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in cfg80211_is_element_inherited() when parsing a crafted wireless frame containing a zero-length extension element. A remote attacker can send a specially crafted frame to disclose sensitive information.

The issue is triggered during element parsing when a non-inheritance context exists, such as while parsing a per-STA profile of a Multi-Link element in a (re)association response or a non-transmitted BSS profile.

555) Improper Initialization (CVE-ID: CVE-2026-68403)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in brcmf_sdio_probe() and brcmf_sdio_remove() when handling an early probe failure during SDIO device initialization. A local attacker can trigger a workqueue allocation failure to cause a denial of service.

The issue occurs because the cleanup path cancels bus->datawork before the work item has been initialized.

556) Improper locking (CVE-ID: CVE-2026-68405)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in ieee80211_do_stop() for AP_VLAN packet cleanup when freeing queued SKBs associated with ps->bc_buf while IRQs are disabled. A local user can trigger AP_VLAN stop processing with buffered packets to cause a denial of service.

The issue occurs because ieee80211_free_txskb() may invoke reporting paths beyond passive SKB release while the IRQ-disabled lock is still held.

557) Improper input validation (CVE-ID: CVE-2026-68406)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in PMSR FTM request parsing in cfg80211/nl80211 when processing user-supplied PMSR FTM request attributes. A remote attacker can send a specially crafted request with an out-of-range preamble value to cause a denial of service.

558) Memory leak (CVE-ID: CVE-2026-68407)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in nl80211_parse_beacon() when processing beacon data with fewer RNR entries than MBSSID entries. A local user can supply crafted beacon data to cause a denial of service.

559) Deadlock (CVE-ID: CVE-2026-68408)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in cfg80211 PMSR work handling when closing a netlink socket that owns a PMSR session concurrently with interface teardown. A local user can close the socket and trigger concurrent interface shutdown processing to cause a denial of service.

The deadlock is also reachable from cfg80211_leave_locked() when interface cleanup is performed under wiphy_lock.

560) Memory leak (CVE-ID: CVE-2026-68410)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in helper_firmware_cb() in the libertas USB firmware-download path when handling an asynchronous firmware load. A local user can trigger the firmware-download path to cause a denial of service.

No runtime testing was performed because compatible Libertas USB hardware was unavailable.

561) Improper resource shutdown or release (CVE-ID: CVE-2026-68413)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ipw2100_pci_init_one() when handling error paths during device initialization. A local attacker can trigger initialization failures to cause a denial of service.

562) Use-after-free (CVE-ID: CVE-2026-68414)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in cfg80211_sched_scan_results_wk when processing scheduled scan result work during device unregister. A local user can trigger scheduled scan result handling during interface teardown to cause a denial of service.

The issue is caused by a race condition between the scheduled-scan result path and the unregister/free path.

563) Race condition (CVE-ID: CVE-2026-68417)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in siw_create_qp() and QP lookup handling when creating and looking up queue pairs. A local user can trigger a QPN lookup for a queue pair that is still being constructed to cause a denial of service.

The issue occurs because the queue pair can be published before its queues, completion queue pointers, state, completion object, and device list entry are fully initialized.

564) NULL pointer dereference (CVE-ID: CVE-2026-68418)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the irdma queue pair creation path when creating a queue pair with a zero user_wqe_bufs value. A local user can submit a crafted queue pair creation request to cause a denial of service.

565) Improper access control (CVE-ID: CVE-2026-68419)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in irdma_rereg_user_mr when re-registering non-memory regions. A local user can invoke rereg_mr on a specially registered QP, CQ, or SRQ region to cause a denial of service.

The issue affects special RDMA registrations created through a two-step userspace allocation and registration process where the region does not have a valid mkey.

566) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68422)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing release of a reference in merge_reloc_roots() in the btrfs relocation code when handling an unexpected reloc_root for a root. A local user can trigger this condition to cause a denial of service.

The issue results in a root reference leak.

567) Improper input validation (CVE-ID: CVE-2026-68425)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state validation in the kernel-handled RMPP receive processing in IB MAD handling when processing unsolicited active RMPP DATA responses. A remote attacker can send a specially crafted unmatched RMPP response to cause a denial of service.

The issue occurs because receive-side reassembly could begin before the full TID and source address were verified against an outstanding send.

568) Use-after-free (CVE-ID: CVE-2026-68426)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in validate_xmit_xfrm() in net/xfrm/xfrm_device.c when processing GSO segment lists with asynchronous crypto handling. A local user can trigger asynchronous processing that steals a segment and leaves a stale skb->prev pointer to cause a denial of service.

The issue occurs when a stolen segment remains referenced as the list tail and is later dereferenced by validate_xmit_skb_list().

569) Use-after-free (CVE-ID: CVE-2026-68427)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in host1x_bo_clear_cached_mappings() when clearing cached mappings. A local user can trigger the vulnerable code path to cause a denial of service.

570) Use-after-free (CVE-ID: CVE-2026-68428)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the KVM x86 MMU cache cleanup logic when reloading a vendor module after a prior unload. A local user can trigger a vendor module reload sequence with a failed cache initialization to cause a denial of service.

The issue occurs when kvm.ko remains loaded while a vendor module is unloaded and then reloaded, leaving a stale cache pointer that is later passed to kmem_cache_destroy().

571) Race condition (CVE-ID: CVE-2026-68429)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in drm_dp_mst_topology_queue_probe() when handling hotplug or link-loss events during MST topology teardown. A local user can trigger concurrent monitor connect or disconnect activity to cause a denial of service.

The issue can lead to spurious kernel warnings and compositor crashes when connecting or disconnecting DP MST monitors.

572) Reachable assertion (CVE-ID: CVE-2026-68430)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable assertion in the amdgpu gfx8 fence emission logic when processing GPU fence operations. A local user can trigger the affected code path to cause a denial of service.

The issue results in a kernel crash.

573) Improper access control (CVE-ID: CVE-2026-68432)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify VXLAN device configuration across network namespaces.

The vulnerability exists due to improper access control in vxlan_changelink() when handling changelink requests for a VXLAN device whose underlay network namespace differs from the device network namespace. A local privileged user can send a crafted changelink request to modify VXLAN device configuration across network namespaces.

The issue occurs when the caller has CAP_NET_ADMIN in the device network namespace but not in the VXLAN underlay network namespace.

574) Out-of-bounds read (CVE-ID: CVE-2026-68433)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in handle_get_version_reply() in libceph when processing a truncated MON_GET_VERSION_REPLY message. A remote attacker can send a specially crafted reply to disclose sensitive information.

The issue occurs because decoding is bounded by the reused reply buffer size rather than the number of bytes actually received, allowing stale tail bytes from an earlier message to be read.

575) NULL pointer dereference (CVE-ID: CVE-2026-68434)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mid8250_probe() and mid8250_remove() in the 8250_mid serial driver when handling setup and exit callbacks for affected platforms. A local user can trigger the vulnerable code path to cause a denial of service.

The issue affects Denverton, Ice Lake Xeon D, and Snowridge platforms.

576) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68437)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the pvr_queue_prepare_job() and paired fragment job handling in the drm/imagination PowerVR queue logic when processing paired geometry and fragment jobs. A local user can submit crafted paired jobs to cause a denial of service.

The issue can lead to kernel warnings and job timeouts because the code may check CCCB space in the geometry queue instead of the fragment queue and then fail to write the full command sequence.

577) NULL pointer dereference (CVE-ID: CVE-2026-68444)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ffa_partition_info_get() when processing a NULL partition UUID argument. A local attacker can trigger the vulnerable function with a NULL argument to cause a denial of service.

The issue results in a kernel panic.

578) Improper access control (CVE-ID: CVE-2026-68445)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass shader validation and execute untrusted GPU shader code.

The vulnerability exists due to improper access control in vc4_gem_object_mmap() when handling mappings of validated shader buffer objects. A local user can map a validated shader buffer object read-only and then use mprotect() to make it writable to bypass shader validation and execute untrusted GPU shader code.

The issue affects validated shader buffer objects that are initially mapped read-only but can later be upgraded to writable mappings.

579) Improper input validation (CVE-ID: CVE-2026-68446)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in vmw_gb_surface_define_internal when handling a userspace surface creation request with a crafted array_size value. A local user can submit a specially crafted request to cause a denial of service.

The array_size limit depends on which Shader Model is available.

580) Memory leak (CVE-ID: CVE-2026-68450)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in __add_reloc_root() in fs/btrfs/relocation.c when inserting a relocation root into reloc_root_tree and encountering an unexpected duplicate entry. A local user can trigger the duplicate insert path to cause a denial of service.

This issue occurs because a newly allocated mapping node is left unfreed if insertion finds an existing entry and returns -EEXIST.

581) Out-of-bounds read (CVE-ID: CVE-2026-68470)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the mac80211 RX path when processing unsupported extension frames and S1G beacon extension frames. A remote attacker can send a specially crafted wireless frame to cause a denial of service.

The issue affects extension-frame handling before unsupported extension subtypes are dropped, and S1G beacon processing requires the target system to receive crafted 802.11 frames.

582) Insufficient Control Flow Management (CVE-ID: CVE-2026-68480)

CWE-ID: CWE-691 - Insufficient Control Flow Management

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper control flow handling in the x86 Safe-RET sequence when interrupts are injected during execution of the sequence on SRSO-affected systems. A local user can inject interrupts during the Safe-RET sequence to disclose sensitive information.

Only systems affected by SRSO are vulnerable.

583) Use of Uninitialized Variable (CVE-ID: CVE-2026-72020)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information and corrupt forwarded TCP traffic.

The vulnerability exists due to use of uninitialized memory in ip_vs_conn_new and TCP sequence handling in IPVS when processing a malformed sync message that omits sequence data. A remote user can send a specially crafted sync message to disclose sensitive information and corrupt forwarded TCP traffic.

The issue affects connections learned from a sync message when sequence flags are preserved without valid sequence data, causing stale slab bytes to be used in TCP sequence and acknowledgment number rewriting by an IPVS application helper.

584) Memory leak (CVE-ID: CVE-2026-72032)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in hws_bwc_matcher_move() in the mlx5 HWS matcher handling code when setting a resize target after allocating a replacement matcher. A local user can trigger a resize-target setup failure to cause a denial of service.

Exploitation requires access to an environment using mlx5 HWS-capable functionality.

585) NULL pointer dereference (CVE-ID: CVE-2026-72035)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the sch_taprio scheduler when processing ordinary egress through a non-work-conserving child qdisc after a peeked packet is orphaned and queue state is desynchronized. A local attacker can trigger network egress through a qfq child to cause a denial of service.

The issue can panic the kernel from softirq, and the qfq child can be re-entered on an emptied list.

586) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-72036)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in multiq_dequeue in the sch_multiq scheduler when handling queued packets after a peek operation on a non-work-conserving child qdisc. A local user can trigger network traffic through the affected queuing path to cause a denial of service.

The issue can desynchronize the child queue length and backlog accounting and lead to a NULL pointer dereference in softirq context on egress.

587) Out-of-bounds write (CVE-ID: CVE-2026-72046)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the gve DQO RX header buffer handling when processing out-of-order RX completions with header-split and HW-GRO enabled. A local user can trigger packet flows that cause header buffer reuse while still owned by the device to cause a denial of service.

Exploitation requires header-split and HW-GRO to be enabled, and completion reordering can occur with multiple interleaved flows.

588) Use-after-free (CVE-ID: CVE-2026-72069)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in rt_spin_unlock(), rt_read_unlock(), and rt_write_unlock() when releasing RCU protection before completing unlock operations. A local user can trigger concurrent lock and RCU operations to execute arbitrary code.

The issue affects the RT spinlock and rwlock substitutions where unlock handling does not preserve the expected non-RT RCU protection semantics.

589) Use-after-free (CVE-ID: CVE-2026-72072)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mlx5e MACsec RX offload handling when deleting and processing offloaded MACsec RX SC entries concurrently. A local user can trigger concurrent RX SC deletion and RX datapath processing to cause a denial of service.

The issue affects the RX datapath under RCU lookup and reference handling of metadata_dst objects.

590) Use-after-free (CVE-ID: CVE-2026-72083)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in core_scsi3_emulate_pro_register_and_move() when processing a crafted iSCSI TransportID in a PERSISTENT RESERVE OUT REGISTER AND MOVE parameter list. A remote user can send a specially crafted request to cause a denial of service.

The issue is triggered when the parameter list spans more than one page, causing the ISID pointer to reference an unmapped region after the buffer is torn down.

591) Out-of-bounds read (CVE-ID: CVE-2026-72084)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in iSCSI PR-OUT TransportID parsing in the Linux kernel SCSI target subsystem when processing a crafted PERSISTENT RESERVE OUT TransportID buffer. A remote attacker can send a specially crafted PR OUT request to cause a denial of service.

The issue is reachable through any fabric that delivers a PR OUT to a device exported through an iSCSI target portal group, including a guest via vhost-scsi.

592) Use-after-free (CVE-ID: CVE-2026-72123)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the can bcm rx operation handling in net/can/bcm.c when tearing down bcm rx operations concurrently with packet reception and timer activity. A local user can trigger a race condition to cause a denial of service.

The issue involves a thrtimer callback dereferencing a deallocated bcm_op object after an RCU grace period elapses.

593) Resource exhaustion (CVE-ID: CVE-2026-72132)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect resource accounting in NFS commit-list writeback accounting when handling unstable writes split into multiple sub-folio requests. A local user can trigger writes that are split into many small requests to cause a denial of service.

Exploitation requires NFS client write activity where a folio is split into multiple requests, such as with pNFS flexfiles striping or wsize-limited splitting.

594) Race condition (CVE-ID: CVE-2026-72221)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in svc_tcp_handshake() in the sunrpc server socket handling code when processing a TLS handshake callback during handshake cancellation. A remote attacker can trigger a TLS handshake timeout or interruption and cause concurrent handshake completion to corrupt the embedded swait_queue or tear down the connection to cause a denial of service.

The issue occurs when cancellation loses the race to handshake completion and the callback is still in flight.

595) Use-after-free (CVE-ID: CVE-2026-72222)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to a use-after-free in the sunrpc TLS handshake callback handling in svc_tcp_handshake() and svc_tcp_handshake_done() when a connection close overlaps an asynchronous TLS handshake. A remote attacker can trigger a connection close during the TLS handshake to cause memory corruption.

The issue is reachable on TLS-enabled NFS servers, and signal delivery during the interruptible wait can trigger the affected race window.

596) Use-after-free (CVE-ID: CVE-2026-72251)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in nf_nat_sip in net/netfilter/nf_nat_sip.c when handling cloned socket buffers during SIP NAT processing. A local user can trigger packet processing with a cloned skb to cause a denial of service.

The issue occurs in the reply-direction destination port mangling path for SIP traffic.

597) NULL pointer dereference (CVE-ID: CVE-2026-72254)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the nft_fib netdev egress hook handling when evaluating a fib expression in a netdev egress base chain. A local user can create a crafted nftables rule using a fib expression on the netdev egress hook to cause a denial of service.

The issue occurs because netdev hook numbers alias NF_INET_* values, allowing an egress chain to pass validation and then fault on the transmit path when nft_in(pkt) is NULL.

598) Heap-based buffer overflow (CVE-ID: CVE-2026-72262)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to a heap-based buffer overflow and out-of-bounds read in the SOF IPC3 bytes control handling in sound/soc/sof/ipc3-control.c when processing data through the ALSA TLV kcontrol interface. A local user can send specially crafted control data to cause a denial of service or disclose sensitive information.

The issue affects the bytes_ext put and get paths, including an error-path restore operation that can write past the end of the allocated buffer.

599) Use-after-free (CVE-ID: CVE-2026-72288)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the KVM arm64 virtual generic interrupt controller (vgic) AP list handling when racing interrupt affinity changes with LPI disabling. A local user can trigger concurrent interrupt state changes to cause a denial of service.

The issue occurs during LPI handling involving multiple vCPUs.

600) Race condition (CVE-ID: CVE-2026-72289)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in vgic_prune_ap_list() in the KVM arm64 virtual generic interrupt controller when migrating an interrupt to another vCPU while locks are temporarily dropped. A local user can trigger interrupt migration during this race to cause a denial of service.

The issue can result in list_del() being performed on an interrupt entry that has already been removed from the ap_list.

601) Improper input validation (CVE-ID: CVE-2026-72296)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ife_decode() when processing malformed IFE frames. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue can crash the kernel when the inner Ethernet header is not sufficiently accessible from the linear data area before the packet is passed to eth_type_trans().

602) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72307)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect reference count management in mlxsw_sp_vrs_lpm_tree_replace() when rolling back failed LPM tree replacements for virtual routers. A local user can trigger an error during LPM tree replacement to cause a denial of service.

603) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72308)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in mlxsw_sp_port_lag_join() when handling an error from mlxsw_sp_port_lag_index_get(). A local user can trigger the error path to cause a denial of service.

604) Use-after-free (CVE-ID: CVE-2026-72317)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the SUNRPC TLS connect_worker when handling a failed TLS handshake on a TLS-secured transport. A local user can trigger a failed TLS handshake that causes the upper rpc_clnt to be freed before the queued worker dereferences it to cause a denial of service.

The issue affects the TLS transport path; the non-TLS connect worker does not use the saved client pointer.

605) Race condition (CVE-ID: CVE-2026-72341)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mlx5 driver channel statistics handling when reading netdevice statistics concurrently with channel initialization. A local user can trigger concurrent statistics queries to cause a denial of service.

The issue can lead to a NULL pointer dereference on weakly ordered architectures such as ARM, PowerPC, and RISC-V during NIC bringup.

606) Race condition (CVE-ID: CVE-2026-72342)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mlx5 hv vhca stats agent registration and workqueue handling when processing asynchronous control invalidation callbacks during agent creation. A local user can trigger the vulnerable control path to cause a denial of service.

The issue can lead to a NULL function pointer invocation, timer list corruption, or a NULL pointer dereference.

607) Out-of-bounds write (CVE-ID: CVE-2026-72343)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in mlx5e_hv_vhca_stats_work() and mlx5e_hv_vhca_stats_create() when handling hypervisor VHCA statistics after channel initialization. A local user can trigger stats handling with an incorrectly sized buffer to cause a denial of service.

The issue can result from a zero-sized allocation that leaves the buffer pointer set to ZERO_SIZE_PTR, and may also occur across a detach and resume cycle when buffer sizing becomes smaller than the persisted channel count.

608) Use-after-free (CVE-ID: CVE-2026-72389)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the STP timer handling in the Linux kernel bridge subsystem when deleting a bridge while the topology change timer is armed on an administratively down bridge. A local user can trigger bridge topology change detection and delete the bridge to cause a denial of service.

The issue occurs because the IFF_UP check was missing in br_topology_change_detection().

609) Use-after-free (CVE-ID: CVE-2026-72463)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the xfrm async resumption handling in net/xfrm/xfrm_input.c when processing xfrm packets and resuming transport processing asynchronously. A remote attacker can send crafted traffic that triggers xfrm_rcv_cb to modify skb->dev and cause a denial of service.

The issue involves a race condition with tunnel device teardown and affects handling of both IPv4 and IPv6 transport finish paths.

610) Resource exhaustion (CVE-ID: CVE-2026-72464)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in rpcrdma_reply_handler() when processing malformed RPC/RDMA replies. A remote attacker can send a sustained stream of short replies or replies with an unrecognized RPC/RDMA version to cause a denial of service.

The issue can drain the client's posted Receive queue and stall the transport until reconnect.

611) Out-of-bounds read (CVE-ID: CVE-2026-72466)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read and improper resource management in rpcrdma_is_bcall() when processing a short or malformed reply. A remote attacker can send a specially crafted reply to cause a denial of service.

The issue can misclassify a reply as a backchannel call and orphan a persistently DMA-mapped receive buffer, which can drain the Receive queue and lead to RNR NAKs in the peer.

612) NULL pointer dereference (CVE-ID: CVE-2026-72467)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rpcrdma_encode_write_list() when processing an NFS/RDMA read with a non-4-byte-aligned receive page length after a connection succeeds with a NULL write-pad memory region. A local user can trigger a connection or reconnection that hits a local memory region allocation, DMA-map, memory region map, or post-send failure to cause a denial of service.

A remote peer alone cannot force the local memory region setup failure required for exploitation.

613) Use-after-free (CVE-ID: CVE-2026-72469)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in rpcrdma_cm_event_handler() and RDMA connection teardown handling in the xprtrdma component when processing an RDMA_CM_EVENT_ADDR_CHANGE event before RDMA_CM_EVENT_ESTABLISHED. A local user can trigger crafted RDMA connection state changes to cause a denial of service.

The issue occurs because an unmatched reference decrement can underflow the kref and leave disconnect handling operating on a freed endpoint.

614) Use-after-free (CVE-ID: CVE-2026-72473)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the xprtrdma request handling logic when processing RPC-over-RDMA send and reply completion. A local user can trigger request reuse while the HCA is still DMA-reading from its send buffer to cause a denial of service.

The issue occurs for Sends carrying only pre-registered buffers, where the request could be returned to the free pool before Send-side completion.

615) Race condition (CVE-ID: CVE-2026-72494)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the irdma cqp request completion handling when waiting for cqp request completion. A local user can trigger a race condition to cause a denial of service.

The issue arises from missing memory barriers around the request_done flag.

616) Race condition (CVE-ID: CVE-2026-72495)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the bnxt_re RDMA ucontext WC page allocation handler when processing repeated concurrent requests to allocate WC pages for the same ucontext. A local user can send repeated allocation requests to cause a denial of service.

Only one WC page per ucontext is supported.

617) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72496)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in bnxt_qplib_alloc_dpi when mapping device memory with ioremap. A local user can trigger an ioremap failure to cause a denial of service.

618) Improper input validation (CVE-ID: CVE-2026-72497)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the bnxt_re queue pair initialization logic when processing a user-supplied sq_slots value for variable WQE mode. A local user can supply an invalid sq_slots value to cause a denial of service.

The issue occurs when variable WQE mode is used, and the supplied sq_slots value is zero or exceeds the hardware-supported maximum of 64K.

619) Information disclosure (CVE-ID: CVE-2026-72498)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in the RDMA bnxt_re MR info dump functionality when dumping MR information using the rdma tool. A local user can query MR information to disclose sensitive information.

The exposed value is a kernel pointer for mr_hwq.

620) Use-after-free (CVE-ID: CVE-2026-72499)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the bnxt_re CQ destruction logic when handling an NQ interrupt during completion queue teardown. A local user can trigger completion queue destruction while an interrupt arrives to cause a denial of service.

The issue occurs because the toggle page may be written after it has already been freed during firmware teardown.

621) Use-after-free (CVE-ID: CVE-2026-72500)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the bnxt_re SRQ teardown logic when handling an NQ interrupt during SRQ destruction. A local user can trigger SRQ destruction while an interrupt arrives to cause a denial of service.

The issue occurs because toggle values may be written to an already-freed page before firmware teardown completes.

622) Use of Uninitialized Variable (CVE-ID: CVE-2026-72501)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the BNXT_RE_METHOD_ALLOC_PAGE handler in drivers/infiniband/hw/bnxt_re/uapi.c when processing page allocation requests. A local user can trigger the handler so that an uninitialized dpi value is copied to user space to disclose sensitive information.

623) NULL pointer dereference (CVE-ID: CVE-2026-72502)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in skb_segment() when processing a local TCP packet with gso_size set to 0xFFFF. A local attacker can trigger a large MTU condition that causes the MSS clamp to reach 65535 to cause a denial of service.

The issue occurs because the 0xFFFF MSS value collides with the GSO_BY_FRAGS magic value, and local TCP packets do not use frag_list.

624) Double free (CVE-ID: CVE-2026-74269)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in the bnxt driver receive path in bnxt_rx_multi_page_skb when processing XDP head-grow adjustments. A local user can trigger crafted XDP head adjustment behavior to cause a denial of service.

The issue occurs because a head underflow can corrupt page pool fragment reference counts, causing a page to be prematurely recycled while still in use.

625) Improper resource shutdown or release (CVE-ID: CVE-2026-74296)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the RDMA/mlx5 UAR deallocation logic when releasing a user access region index. A local user can trigger UAR allocation and release operations to cause a denial of service.

626) Integer overflow (CVE-ID: CVE-2026-74297)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in set_rq_size() in the RDMA/mlx5 queue pair handling code when processing a user-provided rq_wqe_shift value. A local user can supply a crafted shift value to trigger undefined behavior and cause a denial of service.

627) Deadlock (CVE-ID: CVE-2026-74318)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in the btrfs reflink inline extent cloning logic when cloning an inline extent to a destination offset greater than zero while the filesystem is mounted with flushoncommit. A local user can trigger crafted reflink and write activity to cause a denial of service.

The issue occurs when inline extent data is copied into a destination file beyond its current end of file, leading transaction commit and folio invalidation paths to wait on the same extent lock.

628) NULL pointer dereference (CVE-ID: CVE-2026-74321)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an invalid pointer dereference in __btrfs_run_delayed_refs() when processing delayed references. A local user can trigger the vulnerable code path to cause a denial of service.

629) Race condition (CVE-ID: CVE-2026-74334)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the RDMA nldev resource tracking code when accessing memory region protection domain data during memory region re-registration. A local user can trigger concurrent memory region re-registration and netlink resource access to cause a denial of service.

The issue involves user memory regions whose protection domain pointer can change during in-place re-registration.

630) Use-after-free (CVE-ID: CVE-2026-74345)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the RDMA/siw connection management endpoint handling code when processing a malformed MPA request during connection establishment. A remote attacker can send a malformed MPA request to cause a denial of service.

The issue is triggered when the new endpoint is closed during connection establishment.

631) Integer overflow (CVE-ID: CVE-2026-74394)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the immediate data length check in the RDMA/srpt subsystem when processing user-supplied immediate data received over the network. A remote attacker can send a specially crafted network request with an oversized length value to cause a denial of service.

The length field is user-controlled and may wrap the computed request size, bypassing the bounds check before a very large length is passed to sg_init_one().

632) NULL pointer dereference (CVE-ID: CVE-2026-74395)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT in drivers/infiniband/hw/mlx5/devx.c when handling devx subscribe-event requests and unwinding an error after eventfd acquisition fails. A local user can trigger the error path with a crafted subscribe-event request to cause a denial of service.

The issue occurs because the subscription object is linked into the pending list before fields needed by cleanup are initialized.

633) Out-of-bounds write (CVE-ID: CVE-2026-74454)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory and cause a denial of service.

The vulnerability exists due to an out-of-bounds write in vc4_overflow_mem_work() when handling a binner out-of-memory event. A local user can trigger a GPU job overflow to corrupt memory and cause a denial of service.

The issue arises because the GPU is authorized to DMA beyond the intended 512KB overflow slot, potentially overwriting in-flight job data and unrelated CMA memory.

634) Out-of-bounds read (CVE-ID: CVE-2026-74474)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the vxlan transmit path header handling in vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get() when processing crafted socket buffers. A local user can provide a specially crafted skb layout to cause a denial of service.

The issue occurs because network-layer header availability is checked without accounting for the MAC header offset during transmit processing.

635) Use-after-free (CVE-ID: CVE-2026-74481)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in page_reporting_process and virtballoon_free_page_report when page reporting work continues during power management freeze while virtqueues are being deleted. A local user can trigger suspend or hibernation activity while freed pages are being reported to access deleted virtqueues and cause a denial of service.

The issue can be reached during S3 suspend or S4 hibernation, including cases where memory reclamation returns pages to the buddy allocator during image saving.

636) Use-after-free (CVE-ID: CVE-2026-74482)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __folio_split() in mm/huge_memory.c when handling a split of a shmem transparent huge page during memory failure processing and truncation. A local user can trigger the vulnerable split path to cause a denial of service.

The issue can occur when a poisoned tail beyond EOF is split while truncation and a concurrent final iput() allow the inode to be evicted and RCU-freed before i_mmap_unlock_read() is reached.

637) Use-after-free (CVE-ID: CVE-2026-74488)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use-after-free in mwifiex_11n_dispatch_amsdu_pkt() when parsing A-MSDU TDLS frames. A remote attacker can send a specially crafted A-MSDU frame with shorter earlier subframes to disclose sensitive information.

Reaching the vulnerable path requires TDLS support in firmware and the TDLS ethertype on the subframe.

638) Off-by-one (CVE-ID: CVE-2026-74495)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in the igbvf TX DMA error cleanup logic when handling TX buffer mapping errors. A local user can trigger a DMA mapping failure after one or more successful mappings to cause a denial of service.

The issue can leak exactly one DMA mapping for the packet head when a fragment mapping fails after earlier mappings succeed.

639) Use-after-free (CVE-ID: CVE-2026-74496)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fou_create() and fou_from_sock() when handling concurrent socket activity after a failed FOU port creation. A local user can request local port 0 and trigger concurrent receive processing to cause a denial of service.

The issue is reachable when local port 0 is requested and the creation path fails after the object remains reachable through sk_user_data.

640) Use-after-free (CVE-ID: CVE-2026-74509)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth HCI advertising command-sync paths in net/bluetooth/hci_sync.c when processing advertising termination events during extended advertising, scan response, or periodic advertising data handling. A local attacker can trigger a race condition to cause a denial of service.

The issue occurs because an adv_info pointer can be retained across an HCI command wait after the associated advertising instance is removed.

641) Use-after-free (CVE-ID: CVE-2026-74510)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the Bluetooth management subsystem pair command handling in net/bluetooth/mgmt.c when racing pairing completion or authentication failure callbacks with a cancel pair device request. A local user can trigger concurrent pair and cancel operations to cause a denial of service or execute arbitrary code.

The issue arises from unsafe access to shared pending pairing commands on the hdev->mgmt_pending list during command cancellation and callback processing, and the race can also lead to a second list removal.

642) Use-after-free (CVE-ID: CVE-2026-74512)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in audit_del_rule() when deleting audit rules while concurrent readers access RCU-visible filter lists. A local user can trigger rule deletion during concurrent access to cause a denial of service.

643) Improper access control (CVE-ID: CVE-2026-74516)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in x2APIC MSR interception handling in KVM SVM/AVIC when AVIC is inhibited while an L2 guest is active. A local user can run a nested guest that triggers this state to cause a denial of service.

The issue can allow an L1 guest to read much of the host APIC state, send arbitrary interrupts, and change task priority before host disruption occurs.

644) Use-after-free (CVE-ID: CVE-2026-74518)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in allocate_file_region_entries() when handling concurrent region cache operations on a shared resv_map. A local user can trigger concurrent region_chg()/region_add()/region_del() activity on the same shared mapping to cause a denial of service.

The issue occurs in shared hugetlbfs mappings and was observed when multiple mappers accessed the same hugetlbfs inode concurrently.

645) Improper access control (CVE-ID: CVE-2026-74527)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify shared packet kind configuration and disrupt network parsing behavior.

The vulnerability exists due to improper access control in the octeontx2-af CGX/NIX PKIND configuration logic when allocating or configuring a VF NIX logical function that shares a CGX LMAC with a PF using HiGig2 or EDSA parsing. A local user can allocate or configure a crafted VF NIX logical function to modify shared packet kind configuration and disrupt network parsing behavior.

Only CGX-mapped virtual functions sharing a LMAC with a physical function using special parse kinds are affected.

646) Use-after-free (CVE-ID: CVE-2026-74537)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in iso_conn_ready in the Bluetooth ISO subsystem when handling connection ready events during a concurrent socket close. A local user can trigger a race condition to cause a denial of service.

647) Use-after-free (CVE-ID: CVE-2026-74548)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the forcedeth driver txrx_stats handling in nv_remove() when unregistering a network device. A local user can trigger device removal while code paths such as ndo_get_stats64, the NAPI/xmit data path, or nv_close()/drain still access freed memory to cause a denial of service.

The issue occurs because accesses to the per-CPU statistics structure may continue until network device unregistration completes.

648) Improper resource shutdown or release (CVE-ID: CVE-2026-74550)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown in ICMP/NDISC redirect handling when peer allocation fails under memory pressure or peer tree size caps. A remote attacker can trigger packet forwarding conditions that cause un-rate-limited ICMP/NDISC Redirect messages to be sent to cause a denial of service.

The issue affects both IPv4 and IPv6 redirect paths.

649) Heap-based buffer overflow (CVE-ID: CVE-2026-74556)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in iscsi_tcp_hdr_dissect() in libiscsi_tcp when processing a crafted iSCSI SCSI Command Response pdu. A remote attacker can send a specially crafted response with an oversized data segment to cause a denial of service.

The issue occurs because sense or response data for ISCSI_OP_SCSI_CMD_RSP can exceed the fixed 8192-byte connection buffer while remaining within the negotiated maximum receive data segment length.

650) Use-after-free (CVE-ID: CVE-2026-74563)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use-after-free in rds_tcp_laddr_check() and ipv6 address checking when processing a bind request with a scoped IPv6 interface. A local user can trigger a concurrent device removal condition and issue a bind operation to disclose sensitive information.

The issue is caused by dereferencing a stale net_device pointer after the RCU read-side lock is released.

651) Improper input validation (CVE-ID: CVE-2026-74566)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the keyring subsystem when processing crafted key descriptions. A local user can add keys with specially crafted descriptions to cause a denial of service.

The issue affects in-memory ordering used to place keys within a keyring, allowing crafted descriptions to collide into one node.

652) Out-of-bounds read (CVE-ID: CVE-2026-74567)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in keyring_get_key_chunk() when processing crafted colliding key descriptions through add_key(2). A local user can add a crafted pair of same-type keys whose index hashes collide to disclose sensitive information.

The issue is triggered when the lookup reaches a description-level chunk after collisions through the hash, x, type, and domain_tag chunks.

653) NULL pointer dereference (CVE-ID: CVE-2026-74571)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in btrfs_update_global_block_rsv() when mounting a btrfs filesystem with rescue=ibadroots and corrupted tree roots. A local user can mount a crafted corrupted filesystem image to cause a denial of service.

The issue occurs on fully read-only rescue mounts when the block group tree root or raid stripe tree root cannot be read, leaving the corresponding root pointer NULL while the on-disk feature bit remains set.

654) Improper Initialization (CVE-ID: CVE-2026-74577)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in mpls_getroute() when handling RTM_GETROUTE requests. A local user can send a crafted netlink route request to disclose sensitive information.

The issue leaks one byte of uninitialized heap memory to user space in the RTM_NEWROUTE reply.

655) Use-after-free (CVE-ID: CVE-2026-74581)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib6_rule_lookup() and fib6_rule_suppress() in the IPv6 routing rules handler when processing suppressed IPv6 route lookups. A local user can trigger route lookups involving a suppressing rule to cause a denial of service.

The issue occurs because a stale dst entry can be returned after the released route remains referenced in the lookup result.

656) Out-of-bounds write (CVE-ID: CVE-2026-74582)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in packet_snd() and packet_sendmsg_spkt() in the Linux kernel AF_PACKET implementation when handling non-ring send paths during concurrent device reconfiguration. A local user can send crafted packets while triggering a change in hard_header_len to cause an out-of-bounds write.

The issue affects SOCK_RAW send handling, and packet_sendmsg_spkt() is affected by the same inconsistent header length usage across allocation and packet construction.

657) Use of uninitialized resource (CVE-ID: CVE-2026-74584)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the bnxt_re shared userspace page allocation in bnxt_re_alloc_ucontext() when mapping the shared page to userspace through BNXT_RE_MMAP_SH_PAGE after IB_USER_VERBS_CMD_GET_CONTEXT. A local user can perform a single mmap() on the exposed page to disclose sensitive information.

Exploitation requires access to /dev/infiniband/uverbsX on a host with a bnxt_re device.

658) Out-of-bounds write (CVE-ID: CVE-2026-74610)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in tls_sw_sendmsg_locked() and the plaintext sk_msg ring handling in net/tls/tls_sw.c when processing sendmsg and later splice operations on a loopback TCP socket with the "tls" ULP attached. A local user can trigger the ring to appear empty after wrapping and overwrite live entries to cause a denial of service.

The issue can lead to a kernel NULL pointer dereference when a full plaintext sk_msg ring is left unpushed.

659) Stack-based buffer overflow (CVE-ID: CVE-2026-74669)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack out-of-bounds write in ip_vs_in_icmp() when rebasing tunnel ICMP errors and processing IPv4 options. A remote attacker can send a specially crafted ICMP packet with IPv4 timestamp options to cause a denial of service.

The issue is triggered because stale IPv4 option metadata from the outer header is retained after the packet is rebased to the quoted original request.

660) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74692)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in smc_listen_out() in net/smc/af_smc.c when handling TCP connection attempts while a listener is being closed. A remote attacker can open TCP connections during the race window to cause a denial of service.

The issue can leak child smc_sock objects, their clcsock objects, and references, which can exhaust kernel memory.

661) Out-of-bounds read (CVE-ID: CVE-2026-74694)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ncsi_send_cmd_nl() and ncsi_cmd_handler_oem() when processing a netlink request containing an NCSI packet header with a forged payload length. A local user can send a specially crafted netlink request to disclose sensitive information.

Exploitation requires a registered NCSI device.

662) Improper resource shutdown or release (CVE-ID: CVE-2026-74695)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in netfilter nf_flow_table offload hooks and the XFRM offload path when processing incoming sk_buffs that already carry a ref-counted dst_entry. A local user can trigger packet handling that overwrites the existing destination reference to cause a denial of service.

The issue leaks a previous dst_entry reference count and triggers a DEBUG_NET_WARN_ON_ONCE assertion in skb_dst_check_unset().

663) Out-of-bounds read (CVE-ID: CVE-2026-74712)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in create_direct_keys() when calculating command input buffer lengths for mlx5 vDPA direct key creation. A local user can trigger the vulnerable code path to cause a denial of service.

The issue is caused by a mismatch between the input buffer pointer and the calculated input size, which can lead to a read beyond the allocated slab buffer.

664) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74717)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error conditions in the mlx5 firmware tracer core dump logic when processing a tracer creation failure. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can lead to an ERR_PTR dereference and kernel panic during core dump handling.

665) Improper resource shutdown or release (CVE-ID: CVE-2026-74722)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in btrfs_do_encoded_write() when handling crafted Btrfs encoded write ioctl requests. A local user can invoke the encoded write ioctl to cause a denial of service.

666) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80529)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause filesystem corruption.

The vulnerability exists due to improper handling of error conditions in xlog_recover_dquot_commit_pass2() when recovering quota log items. A local user can trigger quota recovery involving a corrupted dquot to cause filesystem corruption.

The issue occurs because a recovered dquot verification failure is discarded, allowing log recovery to proceed as if the dquot were valid and enabling a corrupt quota buffer to be written back to disk.

667) Improper locking (CVE-ID: CVE-2026-80534)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock release in xfs_dq_get_next_id when handling an error from xfs_iread_extents. A local user can trigger the error condition during quota operations to cause a denial of service.

The issue can leave the quota inode locked, causing subsequent quota operations to hang.

668) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-80590)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of gso metadata in inet fragment reassembly when processing crafted IP fragments with attached GSO state. A local user can write specially crafted packets to a tap device to cause a denial of service.

The issue can be triggered by an unprivileged user in its own user namespace, and it may also be reachable in environments where virtio_net_hdr metadata is forwarded to a tap device or where CAP_NET_RAW is available in a network namespace.

669) Use-after-free (CVE-ID: CVE-2026-80654)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to use-after-free in the rx mailbox channel handling in drivers/soc/xilinx/zynqmp_power.c when processing mailbox messages after device removal. A local user can trigger message delivery to the stale channel to execute arbitrary code.

The issue occurs because the receive mailbox channel may remain active after the device is removed.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2026/suse-su-20264254-1/