SB2026093050 - SUSE update for the Linux Kernel

Description

This security bulletin contains information about 235 vulnerabilities.

1) Use of uninitialized resource (CVE-ID: CVE-2024-35973)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the geneve_xmit_skb() and geneve6_xmit_skb() functions in drivers/net/geneve.c. A local user can perform a denial of service (DoS) attack.

2) Race condition (CVE-ID: CVE-2025-39964) Exploited

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the include/crypto/if_alg.h. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

3) Input validation error (CVE-ID: CVE-2025-40022)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the include/crypto/if_alg.h. A local user can perform a denial of service (DoS) attack.

4) Out-of-bounds read (CVE-ID: CVE-2025-40277)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the vmw_cmd_check() function in drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c. A local user can perform a denial of service (DoS) attack.

5) NULL pointer dereference (CVE-ID: CVE-2025-68214)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __try_to_del_timer_sync() function in kernel/time/timer.c. A local user can perform a denial of service (DoS) attack.

6) Use of uninitialized resource (CVE-ID: CVE-2026-23003)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the __ip6_tnl_rcv() function in net/ipv6/ip6_tunnel.c. A local user can perform a denial of service (DoS) attack.

7) Use-after-free (CVE-ID: CVE-2026-23443)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in acpi_processor_errata_piix4() when handling device objects. A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue occurs because device pointers may be dereferenced after references to the corresponding device objects have been dropped.

8) Observable discrepancy (CVE-ID: CVE-2026-31483)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper restriction of speculative execution in syscall dispatch table handling when processing a user-controlled syscall number. A local user can supply a crafted syscall number to disclose sensitive information.

9) Use-after-free (CVE-ID: CVE-2026-43116)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in netfilter ctnetlink expectation handling when processing expectation add, delete, get, or event operations. A local user can trigger access to an invalid master conntrack object to cause a denial of service.

10) Out-of-bounds write (CVE-ID: CVE-2026-43125)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in dlm_search_rsb_tree() when processing network messages with an excessive resource name length. A remote attacker can send a specially crafted network message to cause a denial of service.

The length value originates from the len parameter in dlm_dump_rsb_name().

11) Improper input validation (CVE-ID: CVE-2026-43134)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass an encryption key size check.

The vulnerability exists due to improper input validation in the L2CAP LE connection request handling when processing L2CAP_LE_CONN_REQ packets. A remote attacker can send a specially crafted L2CAP_LE_CONN_REQ packet to bypass an encryption key size check.

12) Improper resource shutdown or release (CVE-ID: CVE-2026-43257)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in snd_cx88_hw_params() when handling hardware parameter setup error paths. A local user can trigger an error condition to cause a denial of service.

13) Out-of-bounds read (CVE-ID: CVE-2026-43277)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ghes_new() and CPER error record handling when processing firmware-supplied CPER data. An attacker with physical access can provide a malformed CPER record with a length larger than the allocated buffer to cause a denial of service.

The issue can be triggered by bad firmware supplying inconsistent CPER record size information.

14) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43363)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper hardware state management in lapic_resume() when resuming from s2ram. A local user can trigger a suspend and resume cycle to cause a denial of service.

This occurs when firmware re-enables x2apic mode while the kernel continues using the xapic interface, which can lead to system hangs on bare metal systems.

15) NULL pointer dereference (CVE-ID: CVE-2026-43416)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in perf_callchain_user_64 when getting a user callchain while current->mm has already been released. A local user can run a profiling BPF program to cause a denial of service.

The issue can lead to a kernel panic during stack trace collection.

16) Improper resource shutdown or release (CVE-ID: CVE-2026-45941)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in tpm_tis_i2c_send() when handling a get_burstcount() timeout failure. A local user can trigger a timeout condition to cause a denial of service.

The issue occurs because locality is not released if get_burstcount() returns -EBUSY.

17) Out-of-bounds read (CVE-ID: CVE-2026-46070)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() when processing corrupted journal metadata blocks. A local user can provide a corrupted journal with payload size fields that extend beyond the metadata block boundary to disclose sensitive information.

18) Improper update of reference count (CVE-ID: CVE-2026-46107)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in the dm-thin rebalance_children function when rebalancing internal btree nodes with a shared child node. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because grandchild node reference counts are not increased when the shared child node is retained, which can lead to "device mapper: space map common: unable to decrement block" errors.

19) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-46108)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the ipmi:si driver when handling message allocation failures. A local user can trigger a message allocation failure to cause a denial of service.

20) Improper input validation (CVE-ID: CVE-2026-46128)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ipmi event message buffer response handling when processing event message buffer responses from a BMC. A local user can trigger processing of a malformed or empty response to cause a denial of service.

Some BMCs may return an empty message instead of an error when events are fetched.

21) Use-after-free (CVE-ID: CVE-2026-52912)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in nf_queue when reinjecting queued bridge LOCAL_IN packets. A remote attacker can trigger packet queueing and later reinjection to cause a denial of service.

The issue occurs because skb->dev can still reference a freed bridge master device while the packet remains queued.

22) Improper access control (CVE-ID: CVE-2026-52920)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass inbound IPsec policy matching restrictions.

The vulnerability exists due to improper access control in the xt_policy netfilter matcher when processing strict mode inbound policy matching. A remote attacker can send network traffic that traverses a multi-element inbound rule to bypass inbound IPsec policy matching restrictions.

The issue affects strict matching of multi-element inbound rules.

23) NULL pointer dereference (CVE-ID: CVE-2026-52925)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the VRF port removal logic when removing a port from a VRF while concurrent RCU readers access the master device. A local user can trigger concurrent network operations to cause a denial of service.

The issue occurs because an RCU reader can observe a new non-VRF master device and then dereference missing l3mdev operations.

24) NULL pointer dereference (CVE-ID: CVE-2026-52939)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in rds_ib_send_cqe_handler() and rds_ib_send_unmap_op() when processing an atomic cmsg over an active RDS/IB connection. A local user can send a crafted AF_RDS sendmsg() request to cause a denial of service.

On hardware that natively accepts masked atomic operations, no additional setup is required.

25) Improper locking (CVE-ID: CVE-2026-52946)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper locking in fs/fcntl.c when handling TCP urgent data signaling for a process group. A remote attacker can send specially crafted TCP URG packets to cause a denial of service.

The issue occurs when FASYNC is configured for a process group.

26) Improper access control (CVE-ID: CVE-2026-53001)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended netfilter match restrictions.

The vulnerability exists due to improper access control in the netfilter xtables match extensions xt_mac, xt_owner, xt_physdev, and xt_realm when registering protocol families. A local user can invoke these matches with unsupported protocol families to bypass intended netfilter match restrictions.

The issue stems from these matches being registered for unspecified protocol families even though they are intended only for IPv4 and IPv6, and xt_realm is intended only for IPv4.

27) Out-of-bounds write (CVE-ID: CVE-2026-53059)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in create_log_context() and dm-log bitset handling when processing a crafted device-mapper mirror target configuration with an oversized region count. A local user can create a crafted mirror target to cause a denial of service.

The issue is triggered when region_count overflows 32 bits, causing bitsets to be allocated smaller than required and later accessed with indices derived from the full region space.

28) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-53061)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data loss.

The vulnerability exists due to improper state validation in the dm-cache target when resuming a preloaded table in passthrough mode while dirty mappings are present. A local user can preload and resume a crafted dm-cache table configuration to cause data loss.

Exploitation requires local access to device-mapper management and occurs when metadata updates are still ongoing during table preloading.

29) Improper access control (CVE-ID: CVE-2026-53077)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper restriction of operations in RDS/IB transport selection and address checking when using RDS/IB from a non-initial network namespace. A local user can select the RDS/IB transport from a non-initial network namespace to cause a denial of service.

The issue is specific to use of RDS/IB outside the initial network namespace.

30) Use-after-free (CVE-ID: CVE-2026-53089)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() when querying info for an offloaded BPF map or program during network namespace destruction. A local user can query crafted offloaded BPF map or program information to cause a denial of service.

The issue occurs because the associated network namespace may be racing with teardown and its reference count may already have reached zero.

31) Improper input validation (CVE-ID: CVE-2026-53091)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of gso packet headers in qdisc_pkt_len_segs_init() when processing malicious gso packets. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue affects the transmit path for gso packets and malformed packets may be dropped during processing.

32) Out-of-bounds read (CVE-ID: CVE-2026-53149)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in __tb_property_parse_dir() in the thunderbolt property parser when parsing a crafted root directory property block. A local user can supply a crafted property block to cause a denial of service.

33) NULL pointer dereference (CVE-ID: CVE-2026-53163)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in remove_waiter() in the rtmutex futex proxy locking path when handling FUTEX_CMP_REQUEUE_PI operations during deadlock detection or proxy lock acquisition. A local user can invoke crafted futex operations to cause a denial of service.

34) Information disclosure (CVE-ID: CVE-2026-53219)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper handling of partially failed copy_to_user operations in x_tables get-entries implementations when copying rule entries to userspace. A local user can provide a userspace buffer that faults during the initial header copy to disclose sensitive information.

On SMP kernels, the leaked value is the internal percpu counter allocation pointer. The issue affects the IPv4, IPv6, and ARP native and compat get-entries paths.

35) NULL pointer dereference (CVE-ID: CVE-2026-53220)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ebt_redirect_tg() in net/bridge/netfilter/ebt_redirect.c when reinjecting an NFQUEUE packet after bridge port state changes. A local user can remove or reassign the bridge port before reinjection to cause a denial of service.

The issue occurs if the bridge port is removed between the original hook invocation and NFQUEUE reinjection, and the device may also be moved to a different virtual device such as macvlan.

36) Out-of-bounds read (CVE-ID: CVE-2026-53223)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the generic timestamp cmsg path in net/socket.c when processing timestamped messages for AF_PACKET sockets. A local user can send or receive crafted packets on an AF_PACKET socket to disclose sensitive information.

Exploitation requires timestamping to be enabled, and information disclosure can occur when SO_RXQ_OVFL is enabled and a non-linear skb is processed.

37) Use-after-free (CVE-ID: CVE-2026-53228)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a use-after-free in the ipip6_tunnel_xmit() function in the SIT IPv6 tunneling implementation when handling GSO packets after offload processing. A local user can trigger transmission of a crafted packet to disclose sensitive information.

The issue occurs because a cached inner IPv6 header pointer may become stale if the skb head is moved during offload handling, and the stale pointer may later be used to read header fields.

38) Out-of-bounds read (CVE-ID: CVE-2026-53238)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in netlbl_unlabel_addrinfo_get() when handling crafted Generic Netlink requests with a shorter unlabeled address mask attribute. A local user can send a specially crafted Generic Netlink request to cause a denial of service.

39) Use-after-free (CVE-ID: CVE-2026-53264)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the net/sched action lifecycle handling in act_api when NEWTFILTER and DELFILTER are run concurrently. A local user can trigger concurrent filter operations to cause a denial of service.

The issue arises from a race between action lookup and action deletion under RCU-protected access.

40) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-53265)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a check-then-act race condition in smq_invalidate_mapping() in the dm-cache-policy-smq component when invalidating cache blocks concurrently. A local user can trigger concurrent invalidation operations to cause a denial of service.

The issue can corrupt the SMQ queues or hash table and may result in a double free condition.

41) Out-of-bounds read (CVE-ID: CVE-2026-53309)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dlm_match_regions() when comparing local and remote regions. A remote attacker can trigger the vulnerable region comparison to disclose sensitive information, modify data, or cause a denial of service.

42) Improper Initialization (CVE-ID: CVE-2026-53374)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption in GPU address translation.

The vulnerability exists due to improper initialization in the AMDGPU GART table when allocating and populating page table entries in VRAM. A local user can trigger GART mappings so that stale uninitialized entries are used to cause memory corruption in GPU address translation.

The issue arises because speculative TLB loads may consume other uninitialized entries from the same cacheline, and stale garbage page table entries may later be used by the GPU.

43) Use-after-free (CVE-ID: CVE-2026-53388)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fuse_try_move_folio() in the FUSE subsystem when moving a page cache folio during FUSE read handling. A local user can trigger a race condition to cause a denial of service.

The issue occurs because the request is not re-locked on the success path, allowing request abortion to free fuse_io_args while subsequent copy logic still accesses it.

44) NULL pointer dereference (CVE-ID: CVE-2026-53403)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fb_videomode_to_var in the fbdev subsystem when processing a userspace-supplied modelist that does not contain the current framebuffer mode. A local user can supply a crafted mode list to trigger a kernel crash and cause a denial of service.

Exploitation requires fbcon to be unbound so that the current mode is left without a matching entry before a later console takeover occurs.

45) NULL pointer dereference (CVE-ID: CVE-2026-63810)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the bdev pseudo-filesystem when userspace mounts it and accesses files. A local attacker can mount the pseudo-filesystem and access files to cause a denial of service.

The issue is triggered through move_mount() using inode_operations pointers that are equal to 0 for this pseudo-filesystem.

46) Use-after-free (CVE-ID: CVE-2026-63823)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in request_key_auth handling in the Linux kernel key management subsystem when processing KEYCTL_INSTANTIATE_IOV or related key instantiation and rejection paths concurrently with request_key() completion. A local user can trigger concurrent key operations to cause a denial of service.

The issue occurs because the request_key_auth payload can be freed after helper completion while another path later resumes and accesses rka->target_key.

47) Improper input validation (CVE-ID: CVE-2026-63860)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the RDMA/core netlink attribute handling in drivers/infiniband/core/iwpm_msg.c when processing netlink messages containing string attributes evaluated as c-strings without an enforced nul terminator. A local user can send a specially crafted netlink message to cause a denial of service.

48) Integer underflow (CVE-ID: CVE-2026-63868)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an unsigned integer underflow in garp_pdu_parse_attr in the GARP receive-side attribute parser when parsing crafted GARP attributes. A remote attacker can send crafted Join or Leave events to cause a denial of service.

The issue can cause received GARP events for common attributes, such as GVRP VLAN registration attributes, to be ignored.

49) Heap-based buffer overflow (CVE-ID: CVE-2026-63887)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in iscsi_encode_text_output() when processing iSCSI login text parameters. A remote attacker can send a specially crafted login request with many minimal key-value pairs to cause a denial of service.

The issue can be triggered by expansion of unknown keys into larger "NotUnderstood" response records during login negotiation.

50) Double free (CVE-ID: CVE-2026-63888)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a double free in iscsit_handle_text_cmd() when handling a Text PDU with a bad DataDigest on connections using ErrorRecoveryLevel greater than 0. A remote user can send a specially crafted text request to cause a denial of service.

On hardened kernels the flaw can trigger a remote kernel BUG(), while on non-hardened kernels it can corrupt the slab freelist. A follow-up Text Request on the same ITT or session teardown can free the same pointer again.

51) Out-of-bounds read (CVE-ID: CVE-2026-63888)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in iscsit_handle_text_cmd() when processing Text PDUs with DataDigest enabled. A remote user can send a specially crafted text request to cause a denial of service.

The issue is triggered when DataDigest is negotiated for the connection.

52) Improper input validation (CVE-ID: CVE-2026-63890)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in fcoe_ctlr_recv_clr_vlink() in drivers/scsi/fcoe/fcoe_ctlr.c when processing FIP CVL frames. A remote attacker can send a crafted FIP CVL frame with a zero-length non-critical descriptor to cause a denial of service.

Exploitation is limited to an unauthenticated layer 2 peer on the FCoE control VLAN and can block subsequent FIP frames on the affected controller.

53) Uncontrolled Recursion (CVE-ID: CVE-2026-63891)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in __tb_property_parse_dir() in the thunderbolt property parser when processing a crafted PROPERTIES_REQUEST control-plane exchange containing chained DIRECTORY entries with a back-reference loop. A remote attacker can send crafted XDomain property data to cause a denial of service.

The issue can be triggered by an untrusted XDomain peer such as a cable, dock, in-line inspector, or adjacent host.

54) Out-of-bounds read (CVE-ID: CVE-2026-63892)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read and integer underflow in __tb_property_parse_dir() in the thunderbolt property parser when parsing a crafted non-root property directory with dir_len less than 4. A local user can provide crafted property data to trigger out-of-bounds memory access and cause a denial of service.

The issue affects the non-root parsing path, where a short directory length can cause a UUID copy to read past the end of the property block and can also cause entry walking to continue out of bounds until the kernel oopses.

55) Out-of-bounds write (CVE-ID: CVE-2026-63898)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the mct_u232 USB serial driver when handling a malicious USB device that reports a smaller endpoint maximum packet size than expected. An attacker with physical access can connect a specially crafted USB device to cause memory corruption.

56) Out-of-bounds read (CVE-ID: CVE-2026-63920)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ip6_datagram_recv_specific_ctl() when processing IPv6 extension headers for recvmsg control messages after the hdrlen field is modified. A local user can use an nftables payload-write expression to corrupt the extension header length and trigger copying beyond the available header data to disclose sensitive information.

Exploitation is reachable from an unprivileged user namespace.

57) Out-of-bounds write (CVE-ID: CVE-2026-63928)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the omninet USB serial driver bulk-out buffer handling when processing a malicious USB device that reports a smaller endpoint max packet size than expected. An attacker with physical access can connect a crafted USB device to cause memory corruption.

The issue can lead to user-controlled slab corruption.

58) Out-of-bounds write (CVE-ID: CVE-2026-63962)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to overwrite adjacent memory.

The vulnerability exists due to an out-of-bounds write in svdm_consume_modes() when processing an unsolicited Discover Modes ACK containing crafted VDOs from a connected port partner. A remote attacker can send a crafted Discover Modes ACK to overwrite adjacent memory.

Exploitation is possible after the port partner is set because incoming Discover Modes ACK messages are consumed without being correlated to a request sent by the port.

59) NULL pointer dereference (CVE-ID: CVE-2026-63990)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null-pointer dereference in the bonding driver when enslaving a CAN device to a bonding master. A local user can enslave a virtual CAN device to a bonding master to cause a denial of service.

The issue can be triggered with a virtual CAN device such as vxcan, and subsequent socket cleanup operations may access invalid CAN receiver state.

60) Use-after-free (CVE-ID: CVE-2026-64001)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in snd_pcm_oss_proc_write() and snd_pcm_oss_look_for_setup() when handling proc writes followed by a later OSS device open. A local user can trigger a proc write error that leaves a stale setup_list entry and then open an OSS device to dereference freed memory to cause a denial of service.

The issue arises because a newly allocated setup entry may be linked into setup_list before task name allocation completes.

61) Use-after-free (CVE-ID: CVE-2026-64002)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ipv4_sysctl_exit_net() when unregistering the IPv4 sysctl table while sysctl handlers may still access sysctl_local_reserved_ports. A local user can trigger access to the freed sysctl entry to cause a denial of service.

The issue affects access to /proc/sys/net/ipv4/ip_local_reserved_ports during network namespace sysctl teardown.

62) Improper Initialization (CVE-ID: CVE-2026-64005)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the SMC hash tables in net/smc/af_smc.c when initializing the SMC subsystem. A local user can trigger use of corrupted hash list state to cause a denial of service.

The issue can occur when the hash tables are re-initialized after hash entries already exist and are in use, potentially resulting in a corrupted list.

63) Use-after-free (CVE-ID: CVE-2026-64007)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption or a denial of service.

The vulnerability exists due to a use-after-free in synproxy_tstamp_adjust() in the netfilter synproxy implementation when processing crafted TCP packets that trigger header rewriting on a cloned or non-linear skb. A remote attacker can send a specially crafted packet to cause memory corruption or a denial of service.

The issue affects checksum updates after the packet buffer is made writable, which can result in a write to freed slab memory or a transmitted packet with a stale checksum.

64) Use-after-free (CVE-ID: CVE-2026-64010)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race condition in nfc_llcp_recv_cc() when processing an NFC LLCP connection acceptance packet concurrently with socket release. A local user can trigger concurrent connection handling and socket release to cause a denial of service.

The issue occurs during a connection state transition when a socket can be moved from the connecting_sockets list to the sockets list after it has already been unlinked and marked for destruction.

65) Use-after-free (CVE-ID: CVE-2026-64011)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in llcp_sock_release() when releasing an LLCP socket in connecting state. A local user can trigger socket release in that state to cause a denial of service.

66) Race condition (CVE-ID: CVE-2026-64015)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in find_key_to_update in the keyring code when looking up keys for update without holding the RCU read lock. A local user can trigger concurrent key lookup and garbage-collection activity to cause a denial of service.

The issue affects persistent key handling, which uses a different locking model.

67) Use of Uninitialized Variable (CVE-ID: CVE-2026-64088)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in batadv_send_other_tt_response() and batadv_tt_prepare_tvlv_global_data() when handling tt changeset response data. A remote attacker can trigger processing of an oversized tt_buff_len value to disclose sensitive information.

The issue is caused by a signed integer field wrapping to a negative value and then being widened with sign extension, resulting in a fully allocated buffer that is only partially initialized.

68) Use-after-free (CVE-ID: CVE-2026-64103)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the isci completion tasklet in the ISCI driver when removing a device or unloading the driver while queued tasklet processing is still possible. A local user can trigger device removal or driver unload to cause a denial of service.

The stale callback may dereference ihost and access ihost->smu_registers after the host lifetime ends.

69) Use-after-free (CVE-ID: CVE-2026-64109)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in unix_stream_data_wait() in net/unix/af_unix.c when processing racing recv() operations on the same AF_UNIX stream socket. A local user can trigger concurrent peek and normal receive operations to cause a denial of service.

Exploitation requires a race condition between a peeking recv() call and a normal recv() call on the same socket.

70) Use-after-free (CVE-ID: CVE-2026-64113)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ixgbevf_clean_rx_irq() when processing received frames that trigger VEPA multicast source pruning. A local user can trigger this code path to cause a denial of service.

The issue occurs in NAPI softirq context when a freed skb is reused on the next loop iteration because the pointer is not cleared before continuing.

71) Out-of-bounds read (CVE-ID: CVE-2026-64114)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in the raw_send_hdrinc IPv4 packet handling in the Linux kernel when processing a malformed IP_HDRINCL packet with an IPv4 header length value less than 5. A local user can send a specially crafted packet through a raw socket to cause a denial of service.

Exploitation requires CAP_NET_RAW. Triggering the reproduced crash path also requires a matching xfrm AH policy on the outgoing route, and loopback does not reach the affected path.

72) Use-after-free (CVE-ID: CVE-2026-64115)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in vmci_transport_recv_connecting_server() and vmci_transport_recv_listen() when processing a peer reset during the connection handshake. A remote attacker can send a reset packet during the handshake to cause a denial of service.

The issue is triggered by a race involving pending socket cleanup in the VMCI vsock transport.

73) Double free (CVE-ID: CVE-2026-64118)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in qed_cid_map_free() in the QLogic qed driver context management code when handling failed CID bitmap allocations. A local user can trigger the failing allocation path to cause a denial of service.

Exploitation requires device-specific setup to reach the affected allocation failure path.

74) Improper resource shutdown or release (CVE-ID: CVE-2026-64164)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the btrfs_sync_file trace event in include/trace/events/btrfs.h when handling file sync operations with the trace event enabled. A local user can trigger the vulnerable trace event to cause a denial of service.

Exploitation requires the btrfs_sync_file trace event to be enabled.

75) Use-after-free (CVE-ID: CVE-2026-64178)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to a use-after-free in the bnep_add_connection function when reading dev->name during connection setup while a concurrent connection deletion tears down the net_device. A local privileged user can trigger concurrent bnep_add_connection and bnep_del_connection operations to disclose sensitive information.

Exploitation requires CAP_NET_ADMIN and a tight race window during net_device teardown.

76) Race condition (CVE-ID: CVE-2026-64190)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a race condition leading to a NULL pointer dereference in team_xmit in the Linux kernel team driver when changing team device mode concurrently with transmit activity. A local privileged user can trigger a mode change while traffic is being transmitted on the team device to cause a denial of service.

Exploitation requires the ability to perform a mode change on the team device and concurrent transmit activity.

77) Use-after-free (CVE-ID: CVE-2026-64266)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fuse_ref_folio() in the FUSE subsystem when handling a subsequent copy chain after unlocking the request. A local user can trigger request abort and asynchronous end callback timing to cause a denial of service.

78) Out-of-bounds write (CVE-ID: CVE-2026-64304)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in qat_rsa_setkey_crt() when processing RSA CRT key components larger than half of the key size. A local user can provide a crafted RSA CRT key to cause memory corruption.

The issue occurs because CRT components are bounded by the modulus size in the generic RSA key parser, while the QAT driver allocates half-size DMA buffers for those components.

79) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64306)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper handling of error conditions in drbg_ctr_generate() when processing additional input during CTR_DRBG generation. A local user can trigger a failure in drbg_ctr_update() to disclose sensitive information.

The output buffer may remain uninitialized when the function incorrectly reports success.

80) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64312)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper callback handling in the pcrypt aead fallback path in crypto/pcrypt.c when processing non-parallel fallback after padata submission returns -EBUSY. A local user can trigger asynchronous cryptographic operations that use the fallback path to cause a denial of service.

81) Integer overflow (CVE-ID: CVE-2026-64313)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect cryptographic computation.

The vulnerability exists due to an integer overflow in crypto/ecc.c when performing elliptic curve multiplication. A local user can trigger the vulnerable arithmetic path to cause incorrect cryptographic computation.

82) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-64315)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in the caam crypto driver setkey handlers when dumping key material during key setup with dynamic debug enabled. A local user can access debug output containing sensitive key material to disclose sensitive information.

Exposure occurs at runtime when CONFIG_DYNAMIC_DEBUG is enabled.

83) Out-of-bounds read (CVE-ID: CVE-2026-64317)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Rock Ridge SL record handling in fs/isofs/rock.c when parsing a crafted ISO 9660 image containing a malformed symbolic link record. A local user can supply a crafted filesystem image to disclose sensitive information.

The issue can copy adjacent kernel memory into the symlink body returned to user space by readlink().

84) Out-of-bounds write (CVE-ID: CVE-2026-64322)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and corrupt memory.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in udf sparing table handling in fs/udf/super.c when parsing a crafted UDF image. A local user can mount or otherwise trigger processing of a specially crafted UDF image to disclose sensitive information and corrupt memory.

The issue is caused by validating reallocationTableLen as a byte count even though it is later used as an entry count for sparingEntry array access.

85) Out-of-bounds read (CVE-ID: CVE-2026-64323)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in udf_load_vat() and udf_get_pblock_virt15() when mounting a crafted UDF image with a virtual (VAT) partition. A local user can provide a crafted UDF image with an oversized VAT header length to disclose sensitive information.

User interaction is required to mount the crafted filesystem image.

86) Memory leak (CVE-ID: CVE-2026-64332)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in the ULPI device registration logic in drivers/usb/common/ulpi.c when handling early ULPI device registration failures. A local user can trigger a registration failure to cause a denial of service.

87) Out-of-bounds write (CVE-ID: CVE-2026-64333)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to memory corruption in digi_write_inb_command() in the digi_acceleport usb serial driver when handling usb serial write commands while the write urb is in use. A local user can trigger a timeout or no-timeout command path to corrupt the write urb buffer to cause memory corruption.

On 32-bit systems, one corruption path is triggered by a broken jiffies comparison after several minutes of system uptime, while commands such as break control can corrupt the urb immediately when no timeout is used.

88) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64334)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the digi_acceleport USB serial driver when sending out-of-band commands during operations that race with device disconnect. A local user can trigger operations such as open, set_termios, or close while the device is being disconnected to cause a denial of service.

The issue can result in an indefinite loop with interrupts disabled, leading to a hard lockup.

89) Use-after-free (CVE-ID: CVE-2026-64340)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the legousbtower USB driver when handling a race between device release and disconnect. A local user can trigger the race condition by opening and releasing the device while it is being disconnected to cause a denial of service.

The issue arises from object lifetime management during concurrent disconnect and release operations.

90) Use-after-free (CVE-ID: CVE-2026-64341)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the iowarrior USB driver when release() races with disconnect(). A local user can trigger device release and disconnection in a racing condition to cause a denial of service or execute arbitrary code.

Exploitation requires access to the affected USB device interface.

91) Use-after-free (CVE-ID: CVE-2026-64343)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in the ldusb driver when release() races with disconnect(). A local user can trigger a device disconnect while releasing the device to cause a use-after-free.

The issue affects the drivers/usb/misc/ldusb.c code path in the Linux kernel.

92) Use-after-free (CVE-ID: CVE-2026-64344)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the idmouse USB driver when release() races with disconnect(). A local user can trigger a device disconnect while the device file is being released to cause a denial of service or execute arbitrary code.

Exploitation requires a race condition involving device disconnection and file release in the idmouse driver.

93) Out-of-bounds read (CVE-ID: CVE-2026-64380)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in posix_info_sid_size() in the SMB client when parsing truncated POSIX SIDs. A remote attacker can send a specially crafted SMB response to cause a denial of service.

94) Memory leak (CVE-ID: CVE-2026-64381)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in receive_encrypted_standard() when processing compound SMB PDUs. A remote attacker can send compound SMB messages that exceed MAX_COMPOUND to cause a denial of service.

The issue affects the Linux kernel SMB client.

95) Use-after-free (CVE-ID: CVE-2026-64408)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in bnep_add_connection() during network device registration when handling a concurrent controller teardown. A local user can trigger a race condition to cause a denial of service.

96) Out-of-bounds read (CVE-ID: CVE-2026-64411)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in find_table_lock() table name handling when processing a user-supplied ebtables table name through setsockopt calls. A local user can supply a non-null-terminated table name to trigger a read past the end of the name buffer and disclose sensitive information.

The issue occurs on a lookup miss when module autoload formatting uses the supplied table name.

97) Improper input validation (CVE-ID: CVE-2026-64412)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ebtables match handling code in net/bridge/netfilter/ebtables.c when processing a crafted module name. A local user can supply a non-null-terminated module name to cause a denial of service.

98) Use-after-free (CVE-ID: CVE-2026-64423)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the IGMP multicast group handling in net/ipv4/igmp.c when destroying a device while concurrent RCU readers traverse the multicast hash table. A local user can trigger multicast group membership operations and concurrent network processing to cause a denial of service.

The issue occurs because multicast group entries can remain reachable through the device multicast hash table during RCU reclamation.

99) Use of Uninitialized Variable (CVE-ID: CVE-2026-64436)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in pfkey_msg2xfrm_state() when processing a PF_KEY IPComp state and migrating it. A local user can add a crafted IPComp security association via PF_KEY and trigger migration to cause a denial of service.

The issue affects the PF_KEY path for IPComp states; the XFRM netlink path is not affected.

100) Use-after-free (CVE-ID: CVE-2026-64470)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in the btusb probe path in drivers/bluetooth/btusb.c when handling probe failures after Marvell OOB wakeup configuration. A local user can trigger a device probe failure after TX URBs have been submitted to cause a use-after-free.

The issue occurs in the completion callback for submitted TX URBs.

101) Use-after-free (CVE-ID: CVE-2026-64471)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the btusb driver probe error handling in drivers/bluetooth/btusb.c when handling Bluetooth USB controller registration failures and subsequent interface disconnection. A local attacker can trigger controller registration failure to cause a denial of service.

The issue can also result in a double-free when the sibling interfaces are eventually disconnected.

102) Improper input validation (CVE-ID: CVE-2026-64512)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the ACPI CPPC register width handling in drivers/acpi/cppc_acpi.c when processing ACPI PCC register definitions. A local attacker can provide a crafted access_width value to trigger a shift-out-of-bounds condition and cause a denial of service.

The issue occurs because the access_width field is reused as a PCC subspace identifier for ACPI_ADR_SPACE_PLATFORM_COMM entries.

103) Improper Initialization (CVE-ID: CVE-2026-64513)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in KVM x86 LAPIC and CR8 intercept handling when updating the guest's PPR and entering a virtual machine. A local user can trigger PPR updates in a guest to cause a VM entry failure with hardware error 0x7.

This is typically exposed on older platforms or under nested virtualization on a hypervisor that does not support virtual-interrupt delivery and enforces the TPR_THRESHOLD check.

104) Use-after-free (CVE-ID: CVE-2026-64541)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in smc_cdc_rx_handler() when handling SMC-R CDC messages for a connection after releasing conns_lock. A local user can trigger a concurrent socket close while the handler continues to dereference the freed socket to cause a denial of service.

Only SMC-R is affected.

105) Out-of-bounds read (CVE-ID: CVE-2026-64544)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in pefile_digest_pe_contents when processing a crafted PE file. A local user can supply a specially crafted PE file to cause a denial of service.

The issue occurs because an unsigned subtraction can underflow after the trailing-data hash length calculation exceeds the PE length, which can lead to a kernel panic on unmapped vmalloc guard pages.

106) Out-of-bounds read (CVE-ID: CVE-2026-64547)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in net1080_rx_fixup() when processing a crafted short frame from a malicious NetChip 1080 device. An attacker with physical access can send a frame advertising a large even packet length to cause a denial of service.

107) Out-of-bounds read (CVE-ID: CVE-2026-64551)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized memory.

The vulnerability exists due to an out-of-bounds read in sctp_sf_do_5_2_6_stale() when processing an ERROR chunk with a STALE_COOKIE cause in the COOKIE_ECHOED state. A local user can send a specially crafted SCTP packet to disclose uninitialized memory.

The leaked value is echoed to the peer in the Cookie Preservative of the reply INIT. Exploitation is reachable by a peer that can drive an association into COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket in a user and network namespace.

108) Information disclosure (CVE-ID: CVE-2026-64553)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an information leak caused by improper clearing of padding bytes in PSAMPLE_ATTR_DATA handling in net/psample/psample.c when copying packet data into a netlink attribute. A local user can trigger processing of packet data whose length is not divisible by 4 bytes to disclose sensitive information.

The issue occurs because netlink attributes are padded to 4-byte boundaries.

109) Use-after-free (CVE-ID: CVE-2026-64562)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in KVM nested VMX shadow VMCS handling when freeing nested virtualization state asynchronously with respect to loaded VMCS clearing during vCPU migration. A local user can trigger nested virtualization cleanup and vCPU migration to execute VMCLEAR on a freed shadow VMCS and cause a denial of service.

The issue occurs because vmcs01 may still reference the shadow VMCS until explicit VMCLEAR completes.

110) Out-of-bounds read (CVE-ID: CVE-2026-64567)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in io_ctl_check_crc() in the btrfs free space cache loader when loading a corrupted v1 free space cache. A local user can modify free space cache header counts to exceed the number of allocated pages to cause a denial of service.

The invalid out-of-bounds slot is treated as a struct page and can lead to a general protection fault during crc32c() processing.

111) Double free (CVE-ID: CVE-2026-64581)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in xfrm_user_policy() when racing a per-socket policy change with packet transmission on a connected UDP socket. A local user can trigger concurrent socket operations to cause a denial of service.

The issue is reachable by an unprivileged user via a user and network namespace.

112) Use-after-free (CVE-ID: CVE-2026-64582)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in rxe_mmap in the RDMA/rxe subsystem when processing a memory mapping request concurrently with a DESTROY_CQ ioctl. A local user can trigger a race condition to cause a denial of service or execute arbitrary code.

Exploitation requires winning a narrow race window between the mmap path and concurrent object destruction.

113) Out-of-bounds read (CVE-ID: CVE-2026-68082)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in decode_lockers() in net/ceph/cls_lock_client.c when parsing OSD-supplied lock information. A remote user can send a specially crafted OSD reply to disclose sensitive information.

Exploitation requires control of a malicious or compromised OSD and can be triggered against kernel clients that issue the lock.get_info class method, such as during RBD exclusive lock acquisition in a multi-tenant Ceph deployment.

114) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68093)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource lifecycle management in KVM SVM ASID handling when resuming a vCPU after a CPU hotplug cycle. A local user can trigger CPU hotplug conditions and resume execution of a affected vCPU to cause a denial of service.

The issue can result in ASID collisions between vCPUs from different VMs, causing stale TLB translations and KVM internal emulation failures.

115) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68111)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in the amdgpu gfx_v9_0 driver when processing misaligned GPU buffer or address values. A local user can trigger BUG_ON() assertions with crafted alignment-related values to cause a denial of service.

The issue results in a kernel crash instead of a warning when alignment checks fail.

116) Use-after-free (CVE-ID: CVE-2026-68117)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tipc_sk_create() and tipc_release() in the TIPC socket handling code when handling a failed accept() path after socket insertion failure. A local user can trigger creation of a large number of TIPC sockets and invoke accept() to cause a denial of service.

The issue is reached when the per-netns TIPC socket rhashtable hits its maximum size, leaving a pre-allocated child socket with a dangling sock->sk pointer during release.

117) Use-after-free (CVE-ID: CVE-2026-68121)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in pppoe_sendmsg() when handling a blocked send while a non-Ethernet port is added to an empty team device. A local user can trigger skb head reallocation and subsequent writes through a stale PPPoE header pointer to cause memory corruption.

The issue occurs because device header callbacks may reallocate the skb head and invalidate saved pointers into it.

118) Integer underflow (CVE-ID: CVE-2026-68123)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow in queue_userspace_packet() in the openvswitch subsystem when processing userspace actions on segmented gso packets after truncation. A local user can send a specially crafted packet that triggers truncation and segmentation handling to cause a denial of service.

The issue occurs because truncation state is reused across smaller gso segments, allowing the preserved length value to exceed the current packet length.

119) Resource exhaustion (CVE-ID: CVE-2026-68129)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource handling in the gve Rx queue handling logic when processing received packets under extreme memory pressure. A local user can trigger page allocation failures that leave too few descriptors posted to hardware to cause a denial of service.

The issue can result in a permanent Rx queue stall because no receive completions are generated, preventing NAPI from being scheduled again.

120) NULL pointer dereference (CVE-ID: CVE-2026-68141)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in afiucv_hs_callback_syn() when handling connection requests that enter the connection-refused path after child socket allocation fails. A local user can trigger this condition to cause a denial of service.

The issue occurs because the code calls iucv_sock_kill() with a NULL child socket pointer.

121) Race condition (CVE-ID: CVE-2026-68143)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to an out-of-bounds write and use-after-free in slip_receive_buf() and sl_realloc_bufs() when processing received SLIP data during a concurrent MTU change. A local user can trigger receive processing while racing an MTU change to cause a denial of service or execute arbitrary code.

122) Use-after-free (CVE-ID: CVE-2026-68153)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the monmap debugfs file handler when processing a concurrent read during client teardown. A local user can read the monmap debugfs file during teardown to cause a denial of service.

The issue is triggered by a race condition between debugfs access and ceph client teardown.

123) Out-of-bounds read (CVE-ID: CVE-2026-68154)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in crush_decode and the CRUSH mapper when parsing a malformed CRUSH map. A local user can supply a crafted CRUSH map with a zero bucket type to cause a denial of service.

The issue arises because bucket type 0 is reserved for devices, and an invalid map can make the mapper treat a negative bucket ID as a device and index the OSD weight array with a negative value.

124) Improper input validation (CVE-ID: CVE-2026-68155)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ceph_monmap_decode() when processing a CEPH_MSG_MON_MAP monmap message. A remote attacker can send a specially crafted monmap advertising zero monitors to cause a denial of service.

The issue is triggered when the client later attempts to open a session with a monitor, causing an assertion in pick_new_mon() to fire.

125) Use-after-free (CVE-ID: CVE-2026-68156)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Ceph authorizer handling code when processing a rebuilt authorizer during a messenger reconnect. A local user can trigger an authorizer update that reallocates the buffer and then cause a reconnect to use a stale pointer to cause a denial of service.

The issue is triggered when a newer service ticket causes the authorizer to be rebuilt and the rebuilt authorizer no longer fits in the existing buffer.

126) Integer overflow (CVE-ID: CVE-2026-68158)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer overflow in decode_new_up_state_weight() when processing a corrupted CEPH_MSG_OSD_MAP message containing a crafted osdmap. A remote attacker can send a specially crafted message to disclose sensitive information.

The issue can lead to out-of-bounds reads while decoding the new_state portion of the osdmap.

127) Out-of-bounds write (CVE-ID: CVE-2026-68159)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack out-of-bounds write in __decode_pg_temp(), __decode_pg_upmap_items(), and OSDMap handling in net/ceph/osdmap.c when processing a crafted OSDMap containing an oversized pg_temp, pg_upmap, or pg_upmap_items entry. A remote attacker can send a specially crafted OSDMap entry to cause a denial of service.

The issue is triggered when the decoded list is later copied into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE].

128) Use-after-free (CVE-ID: CVE-2026-68188)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in rfcomm_tty_set_termios() and rfcomm_send_rpn() when handling TTY ioctl requests on an RFCOMM device during a concurrent session teardown. A local user can trigger a race condition to cause a denial of service or execute arbitrary code.

The issue is caused by concurrent access to dlc->session without proper locking while krfcommd can unlink the DLC and free the associated session.

129) NULL pointer dereference (CVE-ID: CVE-2026-68197)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mwifiex_tdls_add_ht_oper() when setting up a TDLS link to a peer while associated with an access point that advertises HT Capabilities but omits the HT Operation element. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the driver checks bcn_ht_cap but dereferences bcn_ht_oper, which may remain NULL after beacon parsing.

130) Use-after-free (CVE-ID: CVE-2026-68198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in aggr_reset_state() in the ath6kl wireless driver when handling a race between timer callback execution and TID state teardown. A local user can trigger the race condition to cause a denial of service.

The timer callback may continue accessing rx_tid[] and stat[] fields after the associated aggr_conn structure is freed, and it can re-arm itself while the reset routine is running.

131) Use-after-free (CVE-ID: CVE-2026-68202)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ALSA sequencer queue timer handling in snd_seq_timer_delete() and related queue destruction logic when accessing /dev/snd/seq and re-opening a queue timer during queue teardown. A local user can issue crafted sequencer operations to leave a timer instance live and trigger a dereference of freed queue memory to cause a denial of service.

No queue ownership is required.

132) Improper resource shutdown or release (CVE-ID: CVE-2026-68234)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in amdgpu_bo_create_reserved() when handling repeated calls with a non-NULL BO pointer. A local user can trigger repeated resume or firmware buffer reload operations to cause a denial of service.

The issue occurs because repeated calls increase the BO pin count, while teardown only removes a single pin reference, preventing the buffer object from being moved, swapped, or evicted.

133) Improper resource shutdown or release (CVE-ID: CVE-2026-68238)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in amdgpu_acpi_vfct_bios() when fetching and processing the ACPI VFCT table. A local user can trigger repeated calls to the vulnerable function to cause a denial of service.

The issue leaks an ACPI table mapping because the reference obtained with acpi_get_table() is not released on exit paths after the table is acquired.

134) Out-of-bounds read (CVE-ID: CVE-2026-68277)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the sideband reply parsers in drm_dp_mst_topology.c when parsing crafted sideband reply messages. A local user can provide a crafted message with a truncated 2-byte field to disclose sensitive information.

The out-of-bounds read can access data from adjacent struct fields including curchunk_len, curchunk_idx, and curlen.

135) Out-of-bounds write (CVE-ID: CVE-2026-68278)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to out-of-bounds write in drm_dp_sideband_append_payload() when processing forged DP MST sideband reply messages from a connected device. An attacker with physical access can send crafted sideband reply data to cause memory corruption.

The issue is reachable from a DP MST device over a physical connection.

136) Out-of-bounds read (CVE-ID: CVE-2026-68279)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in drm_dp_sideband_parse_remote_dpcd_read() and drm_dp_sideband_parse_remote_i2c_read_ack() when parsing remote DPCD and I2C sideband reply messages from an MST hub. A remote attacker can send a specially crafted sideband reply with an oversized num_bytes value to disclose sensitive information.

The issue can be triggered by a malicious or misbehaving MST hub.

137) Use-after-free (CVE-ID: CVE-2026-68284)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tcp_bpf_sendmsg() when two threads send on the same socket and an error occurs after waiting for socket memory. A local user can trigger concurrent send operations to cause a denial of service.

The issue occurs in the sockmap BPF path and involves stale cork state being mistaken for a stack-local temporary message.

138) Integer overflow (CVE-ID: CVE-2026-68289)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in tipc_recvmsg() and tipc_recvstream() when processing oversized user-supplied buffer lengths. A local user can supply an excessively large buffer length via io_uring provided buffers to cause a denial of service.

The issue can trigger a WARN_ON that may lead to a kernel panic on systems configured with panic_on_warn.

139) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68299)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of encapsulated packet headers in vmxnet3_get_hdr_len() when processing Geneve-encapsulated packets. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue is triggered when descriptor fields describe the inner header instead of the outer header, including cases where the outer protocol is UDP or the outer and inner IP versions differ.

140) Improper Authentication (CVE-ID: CVE-2026-68300)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass authentication.

The vulnerability exists due to improper authentication in sctp_auth_chunk_verify() when processing SCTP chunks with a NULL auth_chunk. A remote user can send a specially crafted SCTP chunk to bypass authentication.

This can occur for new connections or when no AUTH chunk precedes a COOKIE-ECHO chunk.

141) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68313)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in __tipc_nl_compat_dumpit in the TIPC netlink compatibility handler when processing dumpit callback results. A local user can trigger a negative return value path to cause a denial of service.

The issue can lead to an infinite loop that prevents genl_mutex from being released, causing tasks waiting on the mutex to starve in D state.

142) Integer overflow (CVE-ID: CVE-2026-68315)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow in sctp_process_strreset_inreq() when processing a crafted SCTP RESET_IN_REQUEST from a peer. A remote attacker can send a specially crafted SCTP stream reset request to cause a denial of service.

Exploitation is only possible on interfaces with MTU greater than 65535, such as loopback with IPv6 jumbograms.

143) Heap-based buffer overflow (CVE-ID: CVE-2026-68320)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in sctp_association_init and SCTP authentication chunk handling when processing endpoint authentication chunk lists containing more than 16 entries. A local user can add excessive chunk identifiers to trigger memory corruption and cause a denial of service.

144) Stack-based buffer overflow (CVE-ID: CVE-2026-68325)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in the ivrs_acpihid command-line parser when parsing the ivrs_acpihid kernel command-line parameter. A local attacker can supply a specially crafted parameter with more than four entries to cause a denial of service.

145) NULL pointer dereference (CVE-ID: CVE-2026-68328)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in nfp_cpp_resource_find() and nfp_resource_try_acquire() when opening a resource with a matching resource-table entry after mutex allocation fails. A local user can trigger resource acquisition to cause a denial of service.

This issue was identified through static analysis and confirmed by manual source review.

146) Race condition (CVE-ID: CVE-2026-68329)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a race condition in iommu_completion_wait() in the AMD IOMMU subsystem when handling concurrent command completion waits across multiple CPUs. A local user can trigger concurrent IOMMU command activity to cause a use-after-free condition.

The issue occurs because the code may return without waiting for previously queued commands to complete in hardware, which can leave stale translations in use while related page-table pages are freed.

147) Race condition (CVE-ID: CVE-2026-68338)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in packet_set_ring() and packet fanout hook handling in net/packet/af_packet.c when reconfiguring a packet socket ring while a network device is being unregistered. A local user can trigger ring reconfiguration during device unregister handling to cause a denial of service.

The issue occurs when a stale running state causes fanout hook re-registration after the device binding has already been invalidated.

148) Heap-based buffer overflow (CVE-ID: CVE-2026-68349)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in carl9170_rx_stream() when processing USB transfer data in the rx stream failover path. A local attacker can provide specially crafted transfer data to cause a denial of service.

The issue is triggered when two transfers are near the maximum size and their combined copied length exceeds the 65535-byte failover SKB, resulting in skb_over_panic.

149) Out-of-bounds read (CVE-ID: CVE-2026-68351)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in carl9170_cmd_callback() when processing a firmware command response with a length mismatch. A remote attacker can send a specially crafted firmware response to disclose sensitive information.

150) Use-after-free (CVE-ID: CVE-2026-68357)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in watchdog_unregister_governor() and the watchdog pretimeout governor handling logic when unregistering a watchdog governor that is still referenced as default_gov. A local user can trigger governor unregistration and subsequent watchdog device registration or reassignment to cause a denial of service.

The issue occurs when the unregistered governor remains referenced through a dangling default_gov pointer, affecting both newly registered watchdog devices and existing devices whose governor is reassigned.

151) Use-after-free (CVE-ID: CVE-2026-68363)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in ath9k_hif_request_firmware() in drivers/net/wireless/ath/ath9k/hif_usb.c when handling a failed asynchronous firmware request during concurrent USB device disconnect. A local user can trigger a firmware download failure and a concurrent disconnect to cause a denial of service.

The issue is triggered by a race condition between the firmware callback running on the events workqueue and device disconnect, leading to a read from freed memory.

152) Use-after-free (CVE-ID: CVE-2026-68397)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in afiucv_hs_rcv() and the afiucv_hs_callback_* handlers when processing AF_IUCV socket traffic. A local user can trigger a concurrent socket close to cause a denial of service.

The issue arises because the destination socket is looked up under a lock and then used after the lock is released without holding a reference.

153) Use-after-free (CVE-ID: CVE-2026-68398)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in pppol2tp_recv() and PPP channel handling when processing pppol2tp receive traffic concurrently with channel teardown. A local user can trigger concurrent receive and close operations to cause a denial of service or execute arbitrary code.

The issue is reachable by an unprivileged user and affects a channel that is bound but not attached to a PPP unit and not bridged.

154) Improper locking (CVE-ID: CVE-2026-68405)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in ieee80211_do_stop() for AP_VLAN packet cleanup when freeing queued SKBs associated with ps->bc_buf while IRQs are disabled. A local user can trigger AP_VLAN stop processing with buffered packets to cause a denial of service.

The issue occurs because ieee80211_free_txskb() may invoke reporting paths beyond passive SKB release while the IRQ-disabled lock is still held.

155) Memory leak (CVE-ID: CVE-2026-68410)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in helper_firmware_cb() in the libertas USB firmware-download path when handling an asynchronous firmware load. A local user can trigger the firmware-download path to cause a denial of service.

No runtime testing was performed because compatible Libertas USB hardware was unavailable.

156) Improper input validation (CVE-ID: CVE-2026-68425)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state validation in the kernel-handled RMPP receive processing in IB MAD handling when processing unsolicited active RMPP DATA responses. A remote attacker can send a specially crafted unmatched RMPP response to cause a denial of service.

The issue occurs because receive-side reassembly could begin before the full TID and source address were verified against an outstanding send.

157) Use-after-free (CVE-ID: CVE-2026-68426)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in validate_xmit_xfrm() in net/xfrm/xfrm_device.c when processing GSO segment lists with asynchronous crypto handling. A local user can trigger asynchronous processing that steals a segment and leaves a stale skb->prev pointer to cause a denial of service.

The issue occurs when a stolen segment remains referenced as the list tail and is later dereferenced by validate_xmit_skb_list().

158) Use-after-free (CVE-ID: CVE-2026-68428)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the KVM x86 MMU cache cleanup logic when reloading a vendor module after a prior unload. A local user can trigger a vendor module reload sequence with a failed cache initialization to cause a denial of service.

The issue occurs when kvm.ko remains loaded while a vendor module is unloaded and then reloaded, leaving a stale cache pointer that is later passed to kmem_cache_destroy().

159) Improper access control (CVE-ID: CVE-2026-68432)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify VXLAN device configuration across network namespaces.

The vulnerability exists due to improper access control in vxlan_changelink() when handling changelink requests for a VXLAN device whose underlay network namespace differs from the device network namespace. A local privileged user can send a crafted changelink request to modify VXLAN device configuration across network namespaces.

The issue occurs when the caller has CAP_NET_ADMIN in the device network namespace but not in the VXLAN underlay network namespace.

160) Out-of-bounds read (CVE-ID: CVE-2026-68433)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in handle_get_version_reply() in libceph when processing a truncated MON_GET_VERSION_REPLY message. A remote attacker can send a specially crafted reply to disclose sensitive information.

The issue occurs because decoding is bounded by the reused reply buffer size rather than the number of bytes actually received, allowing stale tail bytes from an earlier message to be read.

161) Memory leak (CVE-ID: CVE-2026-68450)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in __add_reloc_root() in fs/btrfs/relocation.c when inserting a relocation root into reloc_root_tree and encountering an unexpected duplicate entry. A local user can trigger the duplicate insert path to cause a denial of service.

This issue occurs because a newly allocated mapping node is left unfreed if insertion finds an existing entry and returns -EEXIST.

162) Insufficient Control Flow Management (CVE-ID: CVE-2026-68480)

CWE-ID: CWE-691 - Insufficient Control Flow Management

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper control flow handling in the x86 Safe-RET sequence when interrupts are injected during execution of the sequence on SRSO-affected systems. A local user can inject interrupts during the Safe-RET sequence to disclose sensitive information.

Only systems affected by SRSO are vulnerable.

163) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72017)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the macb driver transmit queue handling when closing the network device. A local user can trigger device close operations while transmit SKBs remain in flight to cause a denial of service.

The issue affects outgoing SKBs that have not yet been marked as completed and are stored in queue->tx_skb.

164) Use of Uninitialized Variable (CVE-ID: CVE-2026-72020)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information and corrupt forwarded TCP traffic.

The vulnerability exists due to use of uninitialized memory in ip_vs_conn_new and TCP sequence handling in IPVS when processing a malformed sync message that omits sequence data. A remote user can send a specially crafted sync message to disclose sensitive information and corrupt forwarded TCP traffic.

The issue affects connections learned from a sync message when sequence flags are preserved without valid sequence data, causing stale slab bytes to be used in TCP sequence and acknowledgment number rewriting by an IPVS application helper.

165) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-72036)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in multiq_dequeue in the sch_multiq scheduler when handling queued packets after a peek operation on a non-work-conserving child qdisc. A local user can trigger network traffic through the affected queuing path to cause a denial of service.

The issue can desynchronize the child queue length and backlog accounting and lead to a NULL pointer dereference in softirq context on egress.

166) Use-after-free (CVE-ID: CVE-2026-72083)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in core_scsi3_emulate_pro_register_and_move() when processing a crafted iSCSI TransportID in a PERSISTENT RESERVE OUT REGISTER AND MOVE parameter list. A remote user can send a specially crafted request to cause a denial of service.

The issue is triggered when the parameter list spans more than one page, causing the ISID pointer to reference an unmapped region after the buffer is torn down.

167) Out-of-bounds read (CVE-ID: CVE-2026-72084)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in iSCSI PR-OUT TransportID parsing in the Linux kernel SCSI target subsystem when processing a crafted PERSISTENT RESERVE OUT TransportID buffer. A remote attacker can send a specially crafted PR OUT request to cause a denial of service.

The issue is reachable through any fabric that delivers a PR OUT to a device exported through an iSCSI target portal group, including a guest via vhost-scsi.

168) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72086)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a resource leak in scsiback_device_action() in the xen scsi backend when submitting task-management requests and handling target_submit_tmr() failures. A remote user can issue VSCSIIF_ACT_SCSI_ABORT or reset requests to cause a denial of service.

The issue affects a pvSCSI guest and can leak command tags for a LUN session, stopping the LUN, when task-management request submission fails.

169) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72108)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause metadata inconsistency and a denial of service.

The vulnerability exists due to improper state management in dm-thin metadata snapshot handling in drivers/md/dm-thin-metadata.c when reserving or releasing a metadata snapshot and a subsequent metadata commit fails. A local user can issue crafted dmsetup messages to trigger a commit failure and cause metadata inconsistency and a denial of service.

Exploitation requires the ability to manage a thin-pool metadata device and trigger snapshot reserve or release operations under commit-failure conditions.

170) Out-of-bounds read (CVE-ID: CVE-2026-72135)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and corrupt kernel memory.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in the TPM character device read path when processing positional read operations with a pending response. A local user can issue a crafted pread request with a large offset to disclose sensitive information and corrupt kernel memory.

The issue affects the sequential command/response TPM device interface after a command has left a response pending.

171) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72138)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in gntdev_ioctl_map_grant_ref() in the xen grant device driver when handling an ioctl request and copying the operation result to userspace. A local user can trigger a copy_to_user failure after a mapping has been added to the list to cause a denial of service.

The issue can leave a mapping in priv->maps with a dangling list entry and a leaked reference count.

172) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-72142)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the i2c_imx_atomic_read function when processing SMBus block-read operations with a byte count of 0 or a count above I2C_SMBUS_BLOCK_MAX. A local user can trigger a crafted SMBus block read to cause a denial of service.

The issue can leave the i2c bus stuck with SDA held until a power cycle for the affected controller.

173) Improper access control (CVE-ID: CVE-2026-72164)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite file data belonging to another inode.

The vulnerability exists due to improper allocation of occupied clusters in ocfs2_move_extent() and ocfs2_probe_alloc_group() when processing a non-auto OCFS2_IOC_MOVE_EXT operation with a user-supplied physical goal. A local user can supply a crafted occupied goal value to overwrite file data belonging to another inode.

The issue occurs when the supplied goal is at the end of the target block group or when the free-run start is miscalculated.

174) Use-after-free (CVE-ID: CVE-2026-72251)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in nf_nat_sip in net/netfilter/nf_nat_sip.c when handling cloned socket buffers during SIP NAT processing. A local user can trigger packet processing with a cloned skb to cause a denial of service.

The issue occurs in the reply-direction destination port mangling path for SIP traffic.

175) Use-after-free (CVE-ID: CVE-2026-72282)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in kvm_io_bus_get_dev() and vgic_msi_to_its() when processing KVM MMIO bus device lookups for MSI addresses. A local user can trigger access to a matched device after the srcu lock has been dropped to cause a denial of service.

The issue occurs when the returned device matches only by address and is not the expected device type.

176) Improper Initialization (CVE-ID: CVE-2026-72284)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the KVM x86 LAPIC PV EOI handling logic when processing PV EOI state synchronization for a vCPU after PV EOIs have been disabled. A local user can trigger this condition to cause a denial of service.

The issue results in a kernel BUG and invalid opcode exception in the KVM subsystem.

177) Improper input validation (CVE-ID: CVE-2026-72296)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ife_decode() when processing malformed IFE frames. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue can crash the kernel when the inner Ethernet header is not sufficiently accessible from the linear data area before the packet is passed to eth_type_trans().

178) Out-of-bounds read (CVE-ID: CVE-2026-72297)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in pvc_info() when reading /proc/net/atm/pvc after storing a crafted QoS traffic_class value. A local user can supply out-of-range QoS parameters to trigger an out-of-bounds read and disclose sensitive information.

The issue is caused by invalid traffic_class values being accepted into vcc->qos during QoS validation.

179) Use-after-free (CVE-ID: CVE-2026-72323)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the IGMP timer callback when processing incoming IGMP queries during device teardown. A remote attacker can send a crafted IGMP query to cause a denial of service.

Exploitation requires a race between device destruction and IGMP query processing.

180) Off-by-one (CVE-ID: CVE-2026-72339)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an off-by-one error in the qede_rx_build_skb() and qede_tpa_rx_build_skb() functions when handling a NULL return from qede_build_skb() under memory pressure. A local user can trigger memory pressure and network receive processing to cause memory corruption.

The issue can desynchronize the BD ring, which can corrupt DMA page reference counts and lead to SLUB freelist corruption.

181) Use-after-free (CVE-ID: CVE-2026-72389)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the STP timer handling in the Linux kernel bridge subsystem when deleting a bridge while the topology change timer is armed on an administratively down bridge. A local user can trigger bridge topology change detection and delete the bridge to cause a denial of service.

The issue occurs because the IFF_UP check was missing in br_topology_change_detection().

182) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72421)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended unreachable routing behavior.

The vulnerability exists due to improper control flow in fib_lookup() in the IPv4 FIB lookup logic when performing route lookups with CONFIG_IP_MULTIPLE_TABLES enabled and no rule added. A local user can configure routes that trigger lookup of the merged local/main table followed by the default table to bypass intended unreachable routing behavior.

The issue occurs because an error route result from the local or main table can be overwritten by a subsequent lookup in the default table.

183) Out-of-bounds read (CVE-ID: CVE-2026-72450)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds shift in xfrm_selector_match and address matching helpers when processing xfrm selector matching with an AF_UNSPEC selector and an oversized prefix length. A local attacker can provide a crafted selector with a mismatched family or excessive prefix length to cause a denial of service.

The issue can be triggered when an AF_UNSPEC selector is matched against an IPv4 flow while XFRM_STATE_AF_UNSPEC is set.

184) Out-of-bounds read (CVE-ID: CVE-2026-72466)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read and improper resource management in rpcrdma_is_bcall() when processing a short or malformed reply. A remote attacker can send a specially crafted reply to cause a denial of service.

The issue can misclassify a reply as a backchannel call and orphan a persistently DMA-mapped receive buffer, which can drain the Receive queue and lead to RNR NAKs in the peer.

185) Out-of-bounds read (CVE-ID: CVE-2026-72487)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in pci_get_rom_size in drivers/pci/rom.c when processing a broken PCI ROM image. A local user can provide a malformed ROM layout to trigger a kernel crash and cause a denial of service.

On some arm64 systems, exploitation may instead trigger an alignment fault due to unaligned IOMEM access.

186) NULL pointer dereference (CVE-ID: CVE-2026-72502)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in skb_segment() when processing a local TCP packet with gso_size set to 0xFFFF. A local attacker can trigger a large MTU condition that causes the MSS clamp to reach 65535 to cause a denial of service.

The issue occurs because the 0xFFFF MSS value collides with the GSO_BY_FRAGS magic value, and local TCP packets do not use frag_list.

187) Use-after-free (CVE-ID: CVE-2026-74255)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to use-after-free in tipc_l2_send_msg() when handling TIPC layer 2 media disable operations concurrently with RCU readers. A local user can trigger concurrent access to a freed device pointer to execute arbitrary code or cause a denial of service.

The issue is caused by a race condition involving b->media_ptr and network-device lifetime management.

188) Race condition (CVE-ID: CVE-2026-74261)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ALSA sequencer FIFO handling in sound/core/seq/seq_fifo.c when resizing the FIFO while processing and relinking event cells. A local user can trigger concurrent FIFO resize and event handling operations to cause a denial of service.

The issue can leave a retired pool waiting indefinitely for stale cells to drain during pool teardown.

189) Improper Initialization (CVE-ID: CVE-2026-74265)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in mana_gd_create_mana_wq_cq() when handling a failed work queue and completion queue creation. A local user can trigger queue creation failure to cause a denial of service.

The issue can clear an in-use completion queue table entry by destroying a queue with an uninitialized id value of 0.

190) Out-of-bounds write (CVE-ID: CVE-2026-74271)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in __power_supply_populate_supplied_from when processing a device tree property with multiple power-supplies values. A local user can provide a crafted device tree configuration to cause a denial of service.

Exploitation requires the system to process a device tree configuration in which the power-supplies property contains multiple values.

191) Information disclosure (CVE-ID: CVE-2026-74278)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper exposure of sensitive information in bounce_error_event() when delivering bounce error events to a user client via snd_seq_read(). A local user can trigger delivery of a bounce error event and read the returned fixed-length event to disclose sensitive information.

The issue exposes a raw kernel heap pointer from struct snd_seq_event to userspace through copy_to_user() in the fixed-length event handling path.

192) Improper resource shutdown or release (CVE-ID: CVE-2026-74279)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the sg_cleanup error path in setup_sgio_components() when cleaning up DMA mappings after a mapping failure. A local user can trigger the error path to cause a denial of service.

The issue leaks successfully mapped DMA entries while repeatedly unmapping the failed entry.

193) Improper resource shutdown or release (CVE-ID: CVE-2026-74296)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the RDMA/mlx5 UAR deallocation logic when releasing a user access region index. A local user can trigger UAR allocation and release operations to cause a denial of service.

194) Integer overflow (CVE-ID: CVE-2026-74297)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in set_rq_size() in the RDMA/mlx5 queue pair handling code when processing a user-provided rq_wqe_shift value. A local user can supply a crafted shift value to trigger undefined behavior and cause a denial of service.

195) Use-after-free (CVE-ID: CVE-2026-74302)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in hci_unregister_dev() when a timeout fires during device teardown. A local user can trigger device teardown and a timer callback to dereference freed memory to cause a denial of service or execute arbitrary code.

The freed memory may include the hdev->reset function pointer.

196) Race condition (CVE-ID: CVE-2026-74334)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the RDMA nldev resource tracking code when accessing memory region protection domain data during memory region re-registration. A local user can trigger concurrent memory region re-registration and netlink resource access to cause a denial of service.

The issue involves user memory regions whose protection domain pointer can change during in-place re-registration.

197) Heap-based buffer overflow (CVE-ID: CVE-2026-74341)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the wcn36xx HAL response dispatcher when processing an oversized firmware HAL response. A local user can provide a firmware response with an excessive length to cause a denial of service.

The copied data is firmware-controlled content written into a 4096-byte buffer.

198) Out-of-bounds read (CVE-ID: CVE-2026-74377)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in rxe_resp_check_length() and copy_data() when processing a receive WQE from a shared queue buffer mapped into userspace. A local user can modify WQE fields such as num_sge or sge entries during processing to cause an out-of-bounds read.

The issue affects the non-SRQ queue pair receive path.

199) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74378)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a heap-based buffer overflow.

The vulnerability exists due to a time-of-check time-of-use race in get_srq_wqe() when copying a work queue element from a shared receive queue buffer mapped into userspace. A local user can modify num_sge between validation and size calculation to cause a heap-based buffer overflow.

The issue arises because the num_sge field is read twice from shared userspace-accessible memory.

200) Uncontrolled Recursion (CVE-ID: CVE-2026-74382)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in cls_bpf_offload_cmd() in the cls_bpf traffic control offload path when processing a filter replace operation and attempting rollback after repeated tc_setup_cb_replace() failures. A local user can trigger repeated rollback failures to cause a denial of service.

The issue can exhaust kernel stack space during rollback handling, and it is not limited to netdevsim.

201) Use-after-free (CVE-ID: CVE-2026-74388)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ALSA OSS sequencer event handling logic when processing SysEx data embedded in MIDI events and dispatching a pending event after a sequencer port is closed concurrently. A local user can send crafted MIDI bytes that produce a pending SysEx event with a stale pointer to cause a denial of service.

The issue occurs during concurrent port closure before deferred event dispatch.

202) NULL pointer dereference (CVE-ID: CVE-2026-74406)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in vxlan_gro_prepare_receive() when processing packets during GRO handling. A local attacker can trigger concurrent socket state changes to cause a denial of service.

203) Improper resource shutdown or release (CVE-ID: CVE-2026-74416)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in radeon_ring_restore() when handling a failed ring lock during GPU reset. A local user can trigger repeated GPU resets that fail at the lock stage to cause a denial of service.

The issue leaks the ring backup buffer on each failed restore attempt, leading to cumulative kernel memory exhaustion during repeated GPU resets.

204) Integer overflow (CVE-ID: CVE-2026-74417)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in radeon_align_pitch() when creating a dumb buffer. A local user can supply crafted width or bits-per-pixel values to cause a denial of service.

The issue can result in an invalid pitch or a zero-sized dumb buffer.

205) Out-of-bounds write (CVE-ID: CVE-2026-74454)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory and cause a denial of service.

The vulnerability exists due to an out-of-bounds write in vc4_overflow_mem_work() when handling a binner out-of-memory event. A local user can trigger a GPU job overflow to corrupt memory and cause a denial of service.

The issue arises because the GPU is authorized to DMA beyond the intended 512KB overflow slot, potentially overwriting in-flight job data and unrelated CMA memory.

206) Use-after-free (CVE-ID: CVE-2026-74479)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the pktgen proc entry handling in net/core/pktgen.c when concurrently removing and renaming pktgen devices. A local user can trigger a race condition involving proc_remove() on a stale proc_dir_entry to cause a denial of service.

The issue occurs because pktgen_change_name() and pktgen_remove_device() access the same proc entry with inconsistent locking, and exploitation requires winning a race between those paths.

207) Use-after-free (CVE-ID: CVE-2026-74482)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __folio_split() in mm/huge_memory.c when handling a split of a shmem transparent huge page during memory failure processing and truncation. A local user can trigger the vulnerable split path to cause a denial of service.

The issue can occur when a poisoned tail beyond EOF is split while truncation and a concurrent final iput() allow the inode to be evicted and RCU-freed before i_mmap_unlock_read() is reached.

208) Use-after-free (CVE-ID: CVE-2026-74488)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use-after-free in mwifiex_11n_dispatch_amsdu_pkt() when parsing A-MSDU TDLS frames. A remote attacker can send a specially crafted A-MSDU frame with shorter earlier subframes to disclose sensitive information.

Reaching the vulnerable path requires TDLS support in firmware and the TDLS ethertype on the subframe.

209) Off-by-one (CVE-ID: CVE-2026-74495)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in the igbvf TX DMA error cleanup logic when handling TX buffer mapping errors. A local user can trigger a DMA mapping failure after one or more successful mappings to cause a denial of service.

The issue can leak exactly one DMA mapping for the packet head when a fragment mapping fails after earlier mappings succeed.

210) Use-after-free (CVE-ID: CVE-2026-74496)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fou_create() and fou_from_sock() when handling concurrent socket activity after a failed FOU port creation. A local user can request local port 0 and trigger concurrent receive processing to cause a denial of service.

The issue is reachable when local port 0 is requested and the creation path fails after the object remains reachable through sk_user_data.

211) Use of uninitialized resource (CVE-ID: CVE-2026-74508)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in hidp_recv_ctrl_frame() and hidp_recv_intr_frame() in the HIDP subsystem when processing crafted Bluetooth HIDP frames without a transaction header. A remote user can send a specially crafted empty or malformed frame to cause a denial of service.

The issue can terminate the HIDP session when a malformed lower-layer packet causes an extra byte to be consumed as a virtual cable unplug control value.

212) Use-after-free (CVE-ID: CVE-2026-74510)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the Bluetooth management subsystem pair command handling in net/bluetooth/mgmt.c when racing pairing completion or authentication failure callbacks with a cancel pair device request. A local user can trigger concurrent pair and cancel operations to cause a denial of service or execute arbitrary code.

The issue arises from unsafe access to shared pending pairing commands on the hdev->mgmt_pending list during command cancellation and callback processing, and the race can also lead to a second list removal.

213) Double free (CVE-ID: CVE-2026-74519)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to double free in dt_remember_or_free_map() and dt_free_map() in the pinctrl devicetree code when handling a failed dev_name duplication during map initialization. A local attacker can trigger a memory allocation failure during device binding to cause a denial of service.

Exploitation was demonstrated with failslab injection while binding a pinctrl-consuming device.

214) Use-after-free (CVE-ID: CVE-2026-74537)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in iso_conn_ready in the Bluetooth ISO subsystem when handling connection ready events during a concurrent socket close. A local user can trigger a race condition to cause a denial of service.

215) Use-after-free (CVE-ID: CVE-2026-74548)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the forcedeth driver txrx_stats handling in nv_remove() when unregistering a network device. A local user can trigger device removal while code paths such as ndo_get_stats64, the NAPI/xmit data path, or nv_close()/drain still access freed memory to cause a denial of service.

The issue occurs because accesses to the per-CPU statistics structure may continue until network device unregistration completes.

216) Improper resource shutdown or release (CVE-ID: CVE-2026-74550)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown in ICMP/NDISC redirect handling when peer allocation fails under memory pressure or peer tree size caps. A remote attacker can trigger packet forwarding conditions that cause un-rate-limited ICMP/NDISC Redirect messages to be sent to cause a denial of service.

The issue affects both IPv4 and IPv6 redirect paths.

217) Heap-based buffer overflow (CVE-ID: CVE-2026-74556)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in iscsi_tcp_hdr_dissect() in libiscsi_tcp when processing a crafted iSCSI SCSI Command Response pdu. A remote attacker can send a specially crafted response with an oversized data segment to cause a denial of service.

The issue occurs because sense or response data for ISCSI_OP_SCSI_CMD_RSP can exceed the fixed 8192-byte connection buffer while remaining within the negotiated maximum receive data segment length.

218) Out-of-bounds read (CVE-ID: CVE-2026-74557)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in iscsi_scsi_cmd_rsp() when processing a target-supplied SCSI Response sense data segment. A remote attacker can send a crafted SCSI Response with a malformed sense length field to disclose sensitive information.

The over-read can copy up to two bytes of stale conn->data contents into the command's sense buffer, which is returned to userspace.

219) Out-of-bounds write (CVE-ID: CVE-2026-74582)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in packet_snd() and packet_sendmsg_spkt() in the Linux kernel AF_PACKET implementation when handling non-ring send paths during concurrent device reconfiguration. A local user can send crafted packets while triggering a change in hard_header_len to cause an out-of-bounds write.

The issue affects SOCK_RAW send handling, and packet_sendmsg_spkt() is affected by the same inconsistent header length usage across allocation and packet construction.

220) Use of uninitialized resource (CVE-ID: CVE-2026-74584)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the bnxt_re shared userspace page allocation in bnxt_re_alloc_ucontext() when mapping the shared page to userspace through BNXT_RE_MMAP_SH_PAGE after IB_USER_VERBS_CMD_GET_CONTEXT. A local user can perform a single mmap() on the exposed page to disclose sensitive information.

Exploitation requires access to /dev/infiniband/uverbsX on a host with a bnxt_re device.

221) Stack-based buffer overflow (CVE-ID: CVE-2026-74669)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack out-of-bounds write in ip_vs_in_icmp() when rebasing tunnel ICMP errors and processing IPv4 options. A remote attacker can send a specially crafted ICMP packet with IPv4 timestamp options to cause a denial of service.

The issue is triggered because stale IPv4 option metadata from the outer header is retained after the packet is rebased to the quoted original request.

222) Use of Uninitialized Variable (CVE-ID: CVE-2026-74673)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an uninitialized stack-based structure in evdev event handling functions when copying input_event structures to userspace. A local user can read crafted event data from the evdev client buffer to disclose sensitive information.

The issue affects padding bytes in struct input_event on architectures where explicit or implicit padding is present.

223) Use-after-free (CVE-ID: CVE-2026-74705)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in __skb_udp_tunnel_segment() in net/ipv4/udp_offload.c when processing tunnel segmentation for skb data after pulling the tunnel header into the skb head. A local attacker can trigger skb head reallocation and subsequent use of a stale UDP header pointer to cause a denial of service.

224) Use-after-free (CVE-ID: CVE-2026-74743)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the macvlan network device handling in drivers/net/macvlan.c when processing packets on a macvlan device backed by a lower device that requires additional headroom or tailroom. A remote attacker can send network traffic that triggers insufficient buffer space handling to execute arbitrary code.

The issue can be triggered when the lower device requires extra header or trailer space, such as with macsec, ipsec, wireguard, tunnels, or veth with rx headroom.

225) Improper locking (CVE-ID: CVE-2026-80534)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock release in xfs_dq_get_next_id when handling an error from xfs_iread_extents. A local user can trigger the error condition during quota operations to cause a denial of service.

The issue can leave the quota inode locked, causing subsequent quota operations to hang.

226) Out-of-bounds write (CVE-ID: CVE-2026-80574)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in focaltech_process_rel_packet when processing crafted input packets. A remote attacker can trigger a finger index underflow to write before the bounds-checked array and to execute arbitrary code.

The issue occurs because subtracting 1 from a packet finger index of 0 can produce an invalid array index that targets state->fingers[-1].

227) Out-of-bounds write (CVE-ID: CVE-2026-80580)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the fbdev sysfs mode output handling in drivers/video/fbdev/core/fbsysfs.c when processing a long modelist for sysfs output. A local user can trigger sysfs mode listing with a sufficiently long modelist to execute arbitrary code.

228) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-80590)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of gso metadata in inet fragment reassembly when processing crafted IP fragments with attached GSO state. A local user can write specially crafted packets to a tap device to cause a denial of service.

The issue can be triggered by an unprivileged user in its own user namespace, and it may also be reachable in environments where virtio_net_hdr metadata is forwarded to a tap device or where CAP_NET_RAW is available in a network namespace.

229) Out-of-bounds read (CVE-ID: CVE-2026-80603)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect connection tracking state.

The vulnerability exists due to an out-of-bounds read in the parse_dcc() function in nf_conntrack_irc when parsing DCC command data without a newline present. A remote attacker can send specially crafted IRC DCC command data to cause incorrect connection tracking state.

The stray read may consume an uninitialized or stale byte, which can lead to an incorrect DCC IP address or port being recorded in the conntrack expectation.

230) Out-of-bounds read (CVE-ID: CVE-2026-80609)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the qede driver qede_tpa_cont and qede_tpa_end handling of cqe->len_list[] when processing crafted CQE data. A local user can trigger access past the end of the len_list array to cause a denial of service.

231) Use-after-free (CVE-ID: CVE-2026-80714)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ipvs connection handling logic when binding synced connections to a destination. A local user can trigger creation and expiry of a crafted synced connection state to cause a denial of service.

The issue occurs when a synced connection inherits the one-packet flag after it is already hashed, which can leave stale hash nodes pointing to a freed struct ip_vs_conn.

232) Use-after-free (CVE-ID: CVE-2026-80737)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in the AMBA PL011 serial driver's DMA shutdown handling when DMA activity is being terminated. A local user can trigger DMA shutdown while TX callbacks or RX polling remain active to cause memory corruption.

233) Out-of-bounds read (CVE-ID: CVE-2026-80765)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in mousevsc_on_receive_device_info() in the Hyper-V HID driver when processing SYNTH_HID_INITIAL_DEVICE_INFO messages. A local privileged user can send a short initial device-info message with an oversized HID report descriptor length to cause a denial of service.

Exploitation requires control of the Hyper-V host or backend.

234) NULL pointer dereference (CVE-ID: CVE-2026-80819)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper synchronization in the RFCOMM deferred setup acceptance path when processing a recvmsg call after a remote DISC frame is received for a deferred data link connection. A remote attacker can send a DISC frame to a deferred RFCOMM data link connection to cause a denial of service.

235) Integer overflow (CVE-ID: CVE-2026-80909)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an integer overflow during minimum DPB size calculation.

The vulnerability exists due to improper validation of the H.265 reference count in the AMDGPU UVD message decoder when decoding UVD messages. A local user can submit a UVD message with an invalid number of H.265 references to cause an integer overflow during minimum DPB size calculation.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2026/suse-su-20264282-1/