SB2026101305 - Ubuntu update for linux-gcp-7.0

Description

This security bulletin contains information about 1061 vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2023-20585)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to a boundary error in IOMMU. A local administrator can trigger memory corruption and cause loss of SNP guest data integrity.

2) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-92502)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause data loss.

The vulnerability exists due to improper clearing of stale xarray tags in ext4 writeback handling when clean folios are skipped during writeback. A local privileged user can trigger writeback during a system reboot to cause data loss.

The issue occurs in ext4 data=journal mode while the superblock is being remounted read-only during reboot.

3) Use-after-free (CVE-ID: CVE-2026-89774)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in the Bluetooth SCO socket connection handling code when handling SCO connection-ready events concurrently with socket closure. A remote attacker can trigger a race between connection setup and socket release to compromise confidentiality, integrity, and availability.

4) Race condition (CVE-ID: CVE-2026-80886)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the MSM serial driver console UART when userspace writes to the TTY device concurrently with kernel console output. A local user can write to the TTY device while the kernel printk path reconfigures the UART controller to cause a denial of service.

The issue is most likely to occur during system startup or shutdown.

5) Race condition (CVE-ID: CVE-2026-80885)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger processing of out-of-band messages after a network namespace is no longer live.

The vulnerability exists due to improper synchronization in the AFS RxRPC out-of-band message handler when processing queued RxRPC out-of-band messages during network namespace teardown. A remote attacker can send an RxRPC out-of-band message to trigger processing after the namespace is no longer live.

6) Release of invalid pointer or reference (CVE-ID: CVE-2026-80884)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an invalid DMA memory release.

The vulnerability exists due to release of an invalid pointer in the NTB transport memory-window buffer cleanup routine when freeing coherent DMA memory after the DMA address has been modified. A local user can trigger cleanup of an NTB transport memory window to trigger an invalid DMA memory release.

7) Race condition (CVE-ID: CVE-2026-80883)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to submit a job before the address register map is initialized.

The vulnerability exists due to a race condition in the Tegra GR2D and GR3D drivers when submitting a job after the HOST1X client becomes available to userspace and before initialization completes. A local user can submit a job during this initialization window to submit a job before the address register map is initialized.

8) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80882)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a CCM cryptographic request to return an incorrect error value.

The vulnerability exists due to improper handling of an allocation failure in tegra_ccm_do_one_req when allocating an input buffer for a CCM request. A local user can trigger an input-buffer allocation failure to cause a CCM cryptographic request to return an incorrect error value.

9) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80881)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause OCFS2 to process metadata that previously failed validation.

The vulnerability exists due to improper handling of validation failures in ocfs2_read_blocks() when reusing buffer heads returned by sb_getblk(). A local user can trigger reuse of buffer heads retaining BH_Uptodate status after failed validation to cause OCFS2 to process metadata that previously failed validation.

10) Race condition (CVE-ID: CVE-2026-80880)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a race condition.

The vulnerability exists due to a race condition in implicit ODP memory region re-registration when reregistering an implicit ODP memory region without specifying a translation. A local user can reregister an implicit ODP memory region to trigger a race condition.

The race involves implicit child mkeys accessing the memory region's protection domain.

11) Deadlock (CVE-ID: CVE-2026-80879)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a circular locking dependency in ocfs2_dio_end_io_write when completing direct I/O writes involving unwritten extents and orphan cleanup. A local user can perform filesystem operations that trigger conflicting lock acquisition to cause a denial of service.

12) Memory leak (CVE-ID: CVE-2026-80878)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource management in afs_lookup_volume_rcu() when looking up a volume through RCU and acquiring a reference to a dying volume fails. A local user can trigger a volume lookup that encounters this condition to cause a memory leak.

13) Memory leak (CVE-ID: CVE-2026-80877)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource management in afs_update_cell() when processing a cell update with an empty server list. A local user can trigger processing of an empty server list during a cell update to cause a memory leak.

14) Incorrect calculation (CVE-ID: CVE-2026-80876)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect ring-buffer event data length reporting.

The vulnerability exists due to an improper length calculation in ring_buffer_event_length() when handling small ring-buffer events on architectures with forced 8-byte alignment. A local user can trigger processing of small ring-buffer events to cause incorrect ring-buffer event data length reporting.

The issue was observed on a riscv64 kernel with CONFIG_HAVE_64BIT_ALIGNED_ACCESS enabled.

15) Incorrect calculation (CVE-ID: CVE-2026-80875)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect TCP state handling.

The vulnerability exists due to an incorrect transport-header offset calculation in the IPVS TCP state lookup when processing IPv6 packets with extension headers. A remote attacker can send a crafted IPv6 packet with extension headers to cause incorrect TCP state handling.

16) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-80874)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause system instability.

The vulnerability exists due to improper memory reservation in the reserved-memory definitions for DBSC5 DRAM controller inline ECC areas on Renesas Ironhide hardware when the system is under high DRAM utilization. A local user can cause high DRAM utilization to cause system instability.

DRAM regions immediately preceding the inline ECC carveouts are also unprotected by ECC and require reservation.

17) Improper Initialization (CVE-ID: CVE-2026-80873)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a guest L2 hypervisor to observe a stale ESR_EL2 value.

The vulnerability exists due to improper initialization of ESR_EL2 in kvm_inject_el2_exception() when injecting nested SError exceptions. A local user can trigger a nested SError exception to cause a guest L2 hypervisor to observe a stale ESR_EL2 value.

The issue also affects the EASE path in kvm_inject_nested_sea().

18) Race condition (CVE-ID: CVE-2026-80872)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a race condition that accesses driver-private state during teardown.

The vulnerability exists due to a race condition in the TAS2781 HDA I2C and SPI drivers when an asynchronous firmware callback runs after component unbinding has begun. A local user can initiate component unbinding while an asynchronous firmware request is pending to cause a race condition that accesses driver-private state during teardown.

19) Improper locking (CVE-ID: CVE-2026-80871)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause concurrent accesses to the TRNG device to interfere with each other.

The vulnerability exists due to improper locking in xtrng_hwrng_trng_read() when crypto_rng generation and hwrng reads run concurrently. A local user can trigger concurrent crypto_rng generation and hwrng read operations to cause concurrent accesses to the TRNG device to interfere with each other.

20) Return of Wrong Status Code (CVE-ID: CVE-2026-80871)

CWE-ID: CWE-393 - Return of Wrong Status Code

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause cryptographic operations to receive incomplete random data.

The vulnerability exists due to an incorrect success status return in xtrng_trng_generate() when generating random bytes through the crypto_rng interface. A local user can invoke the crypto_rng interface to cause cryptographic operations to receive incomplete random data.

21) Improper input validation (CVE-ID: CVE-2026-80870)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the KFD CRIU restore functions when processing user-supplied CRIU restore data. A local user can supply a restored event or buffer object ID larger than INT_MAX to cause a denial of service.

The denial of service requires panic_on_warn to be enabled.

22) Memory corruption (CVE-ID: CVE-2026-80868)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory allocation alignment in NTFS3 inline data handling when processing NTFS3 resident data. A local user can trigger inline data processing to cause a denial of service.

23) Improper access control (CVE-ID: CVE-2026-80867)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to conduct DMA attacks.

The vulnerability exists due to improper access control in the Alpha-specific pci_mmap_resource() function when mapping PCI BARs while kernel lockdown is enabled. A local user can map a PCI BAR to conduct DMA attacks.

24) Infinite loop (CVE-ID: CVE-2026-80866)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a busy-wait loop in tipc_exit_net() when waiting for pending UDP bearer cleanup work during network namespace exit. A local user can trigger network namespace exit while cleanup work is pending to cause a denial of service.

The issue can result in soft lockups when the exit is executed by a high-priority task or on kernels configured with CONFIG_PREEMPT_NONE.

25) Improper input validation (CVE-ID: CVE-2026-80865)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an invalid user-space pointer to be accessed.

The vulnerability exists due to improper input validation in the copy_user_syms function when processing a user-space pointer array. A local user can provide a user-space pointer array without prior range validation to cause an invalid user-space pointer to be accessed.

26) Race condition (CVE-ID: CVE-2026-80677)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dev_has_sync_state() in the driver core when checking and dereferencing dev->driver without holding the device lock. A local user can trigger a concurrent unbind condition to cause a denial of service.

27) Use-after-free (CVE-ID: CVE-2026-80676)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the vmbus driver matching logic when probing a driver through __driver_attach__(). A local user can trigger access to the driver_override field without proper locking to cause a denial of service.

The issue occurs because the bus match callback can access the field without the device lock being held.

28) Improper access control (CVE-ID: CVE-2026-80675)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass metadata integrity validation.

The vulnerability exists due to improper access control in the signed loader metadata map verification logic when validating map metadata hashes for frozen maps. A remote user can load another BPF program with access to the same metadata map to mutate its contents after hash calculation to bypass metadata integrity validation.

Exploitation requires access to a non-exclusive metadata map used by the signed loader.

29) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exceptional condition handling in register_pid() in tools/perf/builtin-sched.c when reallocating sched->tasks while processing untrusted perf.data. A local user can supply crafted input that triggers realloc failure to cause a denial of service.

Direct reassignment of the realloc result can leak the original pointer and leave task state corrupted because the task count is updated before successful reallocation.

30) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exceptional condition handling in register_pid() in tools/perf/builtin-sched.c when processing untrusted perf.data that triggers allocation failure. A local user can supply crafted input that causes an allocation failure to cause a denial of service.

The issue is triggered because allocation failures are handled with a BUG_ON condition that terminates the process.

31) Heap-based buffer overflow (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in register_pid() in tools/perf/builtin-sched.c when processing an untrusted comm string from perf.data. A local user can supply a crafted perf.data file containing an oversized comm value to cause a denial of service.

The overflow occurs because the comm value is copied into a fixed 20-byte COMM_LEN buffer without a length check.

32) Integer overflow (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in register_pid() in tools/perf/builtin-sched.c when processing untrusted perf.data. A local user can supply a crafted perf.data file with a large pid value to cause a denial of service.

The integer overflow can occur on 32-bit systems and may lead to out-of-bounds writes during task array initialization.

33) Out-of-bounds read (CVE-ID: CVE-2026-80670)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in machine__resolve() when parsing a crafted perf.data sample with a large CPU index. A local user can supply a specially crafted perf.data file to disclose sensitive information.

User interaction is required to open or process the crafted perf.data file.

34) Improper access control (CVE-ID: CVE-2026-80669)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper access control in the bpf lsm hook attachment handling for xfrm_decode_session when attaching a bpf lsm program to the xfrm_decode_session hook. A local privileged user can attach a crafted bpf lsm program that returns an error to cause a denial of service.

The issue is triggered because security_skb_classify_flow() invokes the hook from a void path and reaches BUG_ON() if an error is returned.

35) Race condition (CVE-ID: CVE-2026-80668)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nf_conntrack expectation handling when removing or expiring expectations. A local user can trigger concurrent expectation operations to cause a denial of service.

The issue involves an expectation accessing a stale exp->master pointer after the associated master connection has already been released.

36) Improper locking (CVE-ID: CVE-2026-80667)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in mlx5_mpesw_work() when handling a missing devcom component. A local user can trigger the affected work path to cause a denial of service.

The issue can cause a caller waiting on mpesww->comp to block indefinitely.

37) Race condition (CVE-ID: CVE-2026-80666)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in sco_sock_timeout() and SCO socket handling in net/bluetooth/sco.c when closing a socket while asynchronous timeout work is running. A local user can trigger socket close operations during concurrent timeout processing to cause a denial of service.

The issue can lead to a deadlock because the same socket lock may be acquired twice during the close path and timeout work interaction.

38) NULL pointer dereference (CVE-ID: CVE-2026-80664)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in xt_nat SNAT and DNAT target handlers when installing an unsupported-family compat rule through nft_compat. A local user can instantiate a bridge-family compat rule to cause a denial of service.

The issue is triggered in nf_nat_setup_info() because the handlers assume IP-family conntrack state is present.

39) Link following (CVE-ID: CVE-2026-80663)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite an attacker-chosen file.

The vulnerability exists due to improper link resolution in isst-daemon pidfile handling when opening a pidfile from a fixed path under /tmp. A local user can pre-create a symlink at that path to overwrite an attacker-chosen file.

The issue occurs when a daemon instance is run as root.

40) Out-of-bounds read (CVE-ID: CVE-2026-80662)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the cxl RAS header log handling and trace event path when processing CXL RAS error data. A local user can trigger CXL error handling to copy kernel stack data into the trace event ring buffer and disclose sensitive information.

Userspace can read the exposed trace event data via tracefs.

41) Use-after-free (CVE-ID: CVE-2026-80661)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in TP_printk() handling in drivers/ufs/core/ufs_trace.h when reading UFS trace events from the tracing subsystem after the saved pointer has become invalid. A local user can read the trace file and trigger dereferencing of a freed pointer to cause a denial of service.

The issue occurs because the trace event stored a pointer and TP_printk() dereferenced it later when the event was read, potentially long after the original object had been freed.

42) Deadlock (CVE-ID: CVE-2026-80660)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in the occ hwmon sysfs device handling in drivers/hwmon/occ/common.c when unregistering sysfs-backed devices during concurrent sysfs callbacks. A local user can trigger concurrent sysfs access and device shutdown activity to cause a denial of service.

The issue involves circular locking between the OCC mutex and sysfs callback draining during device deactivation or shutdown.

43) Deadlock (CVE-ID: CVE-2026-80659)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock caused by recursive mutex acquisition in the vub300 mmc host driver when handling a command response timeout and resetting the USB device. A local user can trigger a command timeout that leads to a recursive acquisition of cmd_mutex to cause a denial of service.

The issue occurs because the reset path re-enters vub300_pre_reset() while the worker thread still holds cmd_mutex.

44) NULL pointer dereference (CVE-ID: CVE-2026-80658)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in dw_dp_remove() in the Rockchip DRM dw_dp driver when removing a platform device. A local user can trigger device removal in a state where driver data was not initialized to cause a denial of service.

This can occur when the component bind callback did not run before the remove callback is invoked.

45) NULL pointer dereference (CVE-ID: CVE-2026-80657)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the management mailbox channel cleanup helpers when handling error paths after the mailbox channel has already been destroyed. A local user can trigger the cleanup path to cause a denial of service.

46) Race condition (CVE-ID: CVE-2026-80655)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the zynqmp_power event registration handlers when processing firmware-triggered suspend or subsystem restart events immediately after event registration. A local user can trigger the affected event handling path to cause a denial of service.

The issue can lead to a NULL pointer dereference in work_pending() if the callback runs before the work structures are allocated and initialized.

47) Use-after-free (CVE-ID: CVE-2026-80654)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to use-after-free in the rx mailbox channel handling in drivers/soc/xilinx/zynqmp_power.c when processing mailbox messages after device removal. A local user can trigger message delivery to the stale channel to execute arbitrary code.

The issue occurs because the receive mailbox channel may remain active after the device is removed.

48) Race condition (CVE-ID: CVE-2026-80653)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the hisi_sas v3 hardware SCSI device link handling when executing a remote PHY link reset concurrently with driver removal. A local user can trigger concurrent link reset and device removal operations to cause a kernel warning and destabilize the system.

The issue occurs during SAS PHY revalidation and device cleanup in the hisi_sas driver.

49) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80652)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a zero-length buffer in sev_ioctl_do_pdh_export() when processing a PDH export request. A local user can send a crafted ioctl request with a zero-length certificate chain buffer to cause a denial of service.

The issue results in a kernel BUG when CONFIG_DEBUG_VIRTUAL=y.

50) NULL pointer dereference (CVE-ID: CVE-2026-80651)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dsm_create() in drivers/crypto/ccp/sev-dev-tsm.c when handling a pci device with a NULL bus pointer. A local user can trigger the vulnerable code path to cause a denial of service.

The issue crashes the kernel before SEV TIO setup can proceed.

51) Memory leak (CVE-ID: CVE-2026-80650)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in gc2235_probe() error paths in the atomisp gc2235 driver when cleanup is performed after partial initialization failures. A local user can trigger a failing probe path to cause a denial of service.

The issue includes leaked device resources and cleanup routines being invoked for resources that were not initialized on every error path.

52) Use-after-free (CVE-ID: CVE-2026-80650)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in gc2235_probe() in the atomisp gc2235 driver when handling device initialization errors. A local user can trigger a failing probe path to cause a denial of service.

The issue occurs in driver error-handling paths after partial initialization of subdevice, control handler, or media entity resources.

53) Out-of-bounds read (CVE-ID: CVE-2026-80649)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in scmi_power_name_get() in the arm_scmi firmware driver when processing an externally supplied domain number. A local user can supply an invalid domain value to disclose sensitive information or cause a denial of service.

54) NULL pointer dereference (CVE-ID: CVE-2026-80648)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in spacemit_pin_set_config when handling an invalid pin identifier. A local user can trigger the vulnerable code path to cause a denial of service.

The issue stems from checking the pin id variable instead of the pointer returned by spacemit_get_pin().

55) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-80647)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of completion callbacks in the hns roce completion queue handling logic when processing direct mode completion queues during driver reset. A local user can trigger a driver reset with a direct mode cq present to cause a denial of service.

The issue is triggered specifically when a completion queue is allocated in direct polling mode and the device reset path invokes the completion handler unexpectedly.

56) NULL pointer dereference (CVE-ID: CVE-2026-80646)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in __in6_dev_stats_get() when processing an skb for an l3 master device whose original physical device has been unregistered. A local user can trigger this condition to cause a denial of service.

57) Improper Initialization (CVE-ID: CVE-2026-80645)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper initialization issue in tsi721_db_dpc() when processing doorbell events. A local user can trigger the vulnerable code path to cause a denial of service.

58) Reachable assertion (CVE-ID: CVE-2026-80644)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an assertion misuse in ocfs2_journal_toggle_dirty() in fs/ocfs2/journal.c when mounting a crafted OCFS2 image with an invalid journal dinode. A local user can mount a specially crafted filesystem image to cause a denial of service.

The issue is triggered during mount teardown while mount is still in progress.

59) Improper resource shutdown or release (CVE-ID: CVE-2026-80643)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in igen6_edac driver device handling when unloading the driver. A local user can trigger driver removal to cause a denial of service.

60) Use-after-free (CVE-ID: CVE-2026-80642)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the liveupdate incoming FLB data handling when subsystems retain incoming FLB data for extended use during a live update. A local user can trigger access to freed FLB data to cause a denial of service.

The issue can arise during device enumeration while incoming File-Lifecycle-Bound data is being held beyond its initial retrieval.

61) Improper Initialization (CVE-ID: CVE-2026-80641)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in the wlcore wireless driver cipher suite handling when connecting to an access point with affected firmware and hardware combinations. A remote attacker can trigger repeated key setup failures to cause a denial of service.

The issue can lead to endless hardware recovery and restart cycles on some wl128x devices using older firmware.

62) Out-of-bounds write (CVE-ID: CVE-2026-80640)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a buffer overflow in cxlctl_get_supported_features() in the cxl core feature handling code when processing supported feature entries. A local user can trigger the vulnerable code path to cause a denial of service.

The issue manifests as a fortify runtime assertion in the kernel.

63) Heap-based buffer overflow (CVE-ID: CVE-2026-80639)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a buffer overflow in setup_xor_mapping() in tools/testing/cxl/test/cxl_translate.c when processing xor mapping data. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs in the cxl test code path and results in a runtime fortify panic.

64) Out-of-bounds write (CVE-ID: CVE-2026-80638)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in ocfs2_remove_refcount_extent() when unlinking a refcounted file whose refcount tree has leaf blocks. A local user can trigger the vulnerable code path to cause a denial of service.

The issue is detected by a fortify panic when the last leaf block is removed from a refcount tree and the root is converted back to leaf mode.

65) Type conversion (CVE-ID: CVE-2026-80637)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of unaligned memory access in synproxy timestamp adjustment in netfilter synproxy when processing crafted TCP packets with timestamp options. A remote attacker can send specially crafted network packets to cause a denial of service.

The issue may lead to a crash on strict alignment architectures.

66) NULL pointer dereference (CVE-ID: CVE-2026-80636)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in conntrack extension handling in netfilter when processing unconfirmed conntracks. A remote attacker can trigger code paths that dereference a missing conntrack extension to cause a denial of service.

67) Out-of-bounds read (CVE-ID: CVE-2026-80635)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the wcn36xx_smd_trigger_ba_rsp function when parsing a short trigger BA firmware response. A local user can provide a crafted firmware response to cause a denial of service.

The issue occurs when candidate_cnt is at least 1 and the response does not include the required candidate structure data.

68) Out-of-bounds read (CVE-ID: CVE-2026-80634)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in nft_dev_forward_path() when processing a malformed bridge path stack. A local user can trigger a bridge VLAN untag path condition to disclose sensitive information.

The issue is caused by an underflow of the num_encaps counter that can wrap its value to 255 and lead to reads past the end of the fixed-size info.encap[] stack buffer.

69) Out-of-bounds read (CVE-ID: CVE-2026-80631)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in lzo_decompress_bio() in the Btrfs LZO decompression logic when processing a crafted compressed extent. A local attacker can supply a crafted compressed segment length that extends beyond the compressed input to cause a denial of service.

70) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80630)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the sch_fq_codel queueing discipline when peeking queued packets after packet drops. A local user can trigger packet drops during peek to cause a denial of service.

The issue can incorrectly invoke the parent qlen_notify callback while a packet still remains queued, which may mistakenly deactivate the parent class and lead to wild memory access in sch_qfq.

71) Out-of-bounds write (CVE-ID: CVE-2026-80629)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the octeontx2-af NPC MCAM entry-to-counter mapping logic when handling MCAM entry and counter mapping for reserved entries. A local user can trigger allocation and mapping of a reserved MCAM entry counter to cause a denial of service.

The issue is triggered by AF-reserved MCAM rules such as CPT second-pass entries.

72) Race condition (CVE-ID: CVE-2026-80628)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in snd_seq_oss_readq_clear() in the ALSA OSS sequencer read queue when resetting the queue concurrently with locked queue updates. A local user can trigger queue reset and concurrent read or event handling operations to cause a denial of service.

The race can leave stale records in the queue, drop newly queued records, or report incorrect readiness after wakeup.

73) Out-of-bounds write (CVE-ID: CVE-2026-80627)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in maar_res_walk() when walking system RAM ranges. A local user can trigger reporting of more than 16 memory ranges to cause a denial of service.

74) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80626)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in fsl_emb_pmu_del() when removing a perf event with a negative hardware index. A local user can trigger the vulnerable code path to cause a denial of service.

On systems with CONFIG_PREEMPT enabled, the issue can underflow preempt_count and manifest as a "scheduling while atomic" BUG.

75) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80625)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown order in bonding resource management in the RDMA/hns driver when concurrent driver removal and driver reset occur. A local user can trigger this race condition to cause a denial of service.

The issue may also result in a memory leak due to a leaked notifier callback.

76) Out-of-bounds read (CVE-ID: CVE-2026-80624)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the cs42l43 firmware loading code when processing a firmware image smaller than the firmware header. A local user can provide a specially crafted firmware image to cause a denial of service.

77) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80623)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the coresight etm4x/ete power management handling when powering down CPUs while using coresight tracing. A local user can trigger CPU power management events while tracing is active to cause a denial of service.

This affects system register ETMs, ETE devices, and ACPI-based systems where trace state is not preserved across CPU power down.

78) Use-after-free (CVE-ID: CVE-2026-80622)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tlclk_cleanup() in the tlclk driver when cleaning up the device while user-space processes are still interacting with it. A local user can keep the device in use during module cleanup to cause a denial of service.

The issue is associated with blocked readers in the wait queue and concurrent timer activity during cleanup.

79) NULL pointer dereference (CVE-ID: CVE-2026-80621)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dwc_pcie_rasdes_debugfs_deinit() when tearing down debugfs state for a controller without RAS DES capability. A local user can trigger the affected code path to cause a denial of service.

The issue occurs when RAS DES initialization leaves rasdes_info unset because no RAS DES state is allocated.

80) Double free (CVE-ID: CVE-2026-80620)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double unmap of memory in msix_capability_init() in the PCI/MSI subsystem when handling an error after msix_setup_interrupts() fails. A local user can trigger MSI-X initialization failure to cause a denial of service.

The issue is reachable during MSI-X setup on affected systems.

81) Use-after-free (CVE-ID: CVE-2026-80619)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the aa_replace_profiles function when processing profile replacement data. A local user can trigger the vulnerable code path to cause a denial of service.

82) Double free (CVE-ID: CVE-2026-80618)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in amdgpu_amdkfd_gpuvm_free_memory_of_gpu() when freeing DOORBELL or MMIO remap buffer objects that remain mapped to GPU memory. A local user can trigger memory free operations on such buffer objects to cause a denial of service.

The issue occurs because the buffer object may be unpinned before the function determines it cannot yet be freed and returns -EBUSY, leaving it to be unpinned again later during process teardown.

83) Heap-based buffer overflow (CVE-ID: CVE-2026-80617)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in airoha_ppe_foe_verify_entry() when processing a hash value greater than or equal to half of ppe_num_entries. A local user can trigger the vulnerable code path to cause a denial of service.

The issue is caused by allocating the foe_check_time buffer with too few bytes for u16 entries.

84) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80616)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of memory allocation failures in cfg802154_switch_netns() when switching network namespaces. A local user can trigger an -ENOMEM condition to cause a denial of service.

The issue was identified in the ieee802154 subsystem.

85) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-80615)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper buffer size validation in tun_dst_unclone() in dst_metadata when processing tunnel metadata options. A local user can trigger copying of crafted metadata with options to cause a denial of service.

The issue is triggered on systems built with clang and source fortification enabled.

86) NULL pointer dereference (CVE-ID: CVE-2026-80614)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in emac_irq() when handling an early interrupt during emac_probe initialization. A local attacker can trigger an interrupt before device registers are mapped to cause a denial of service.

87) Use-after-free (CVE-ID: CVE-2026-80613)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a use-after-free in the veth XDP enablement error-handling logic when rolling back queue initialization after failed XDP rxq registration. A local user can trigger XDP enablement failure to cause a use-after-free.

The issue occurs because a previously added NAPI structure is left dangling in the device NAPI list and may later corrupt reallocated memory during device teardown.

88) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-80612)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of skb metadata in lwtunnel encapsulation dispatch helpers when processing forwarded packets that still carry XDP metadata. A local user can send a specially crafted packet through lwtunnel encapsulation to cause a denial of service.

The issue affects RX-originated forwarded packets carrying XDP metadata and can trigger a kernel warning during BPF LWT xmit.

89) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80611)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper handling of function tracing in acpi_idle_lpi_enter() and acpi_processor_ffh_lpi_enter() when entering an ACPI low power idle state with function tracing or Kprobes enabled. A local attacker can trigger idle-state entry on an affected system to cause a denial of service.

The issue is exposed only when function tracing or Kprobes is enabled.

90) Division by zero (CVE-ID: CVE-2026-80610)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in enetc4_default_rings_allocation() when distributing rings among PF and VFs with num_vsi set to zero. A local user can trigger the vulnerable code path to cause a denial of service.

The issue affects i.MX94 standalone ENETC configurations that do not support SR-IOV.

91) Out-of-bounds read (CVE-ID: CVE-2026-80609)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the qede driver qede_tpa_cont and qede_tpa_end handling of cqe->len_list[] when processing crafted CQE data. A local user can trigger access past the end of the len_list array to cause a denial of service.

92) Reachable assertion (CVE-ID: CVE-2026-80607)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable warning condition in parse_btf_arg in tracing probes when adding a kprobe event based on a raw address with a BTF parameter. A local user can add a crafted kprobe event to cause a denial of service.

93) Improper locking (CVE-ID: CVE-2026-80606)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in xe_pt_svm_userptr_pre_commit() and related userptr invalidation paths when processing userptr operations with CONFIG_DRM_XE_USERPTR_INVAL_INJECT enabled. A local user can trigger a userptr invalidation path to cause a denial of service.

Only builds with CONFIG_DRM_XE_USERPTR_INVAL_INJECT enabled are affected.

94) Integer overflow (CVE-ID: CVE-2026-80605)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in picolcd_send_and_wait() when processing crafted input to the HID device. A local user can trigger excessive loop iterations to cause a NULL pointer dereference and crash the kernel.

95) Out-of-bounds read (CVE-ID: CVE-2026-80604)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hid_get_report in drivers/hid/hid-core.c when processing a numbered report with a zero-length data buffer. A local attacker can trigger hid_report_raw_event() with size 0 to cause a denial of service.

The issue occurs because the report ID is read from data[0] before validating that the buffer contains at least one byte.

96) Out-of-bounds read (CVE-ID: CVE-2026-80603)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect connection tracking state.

The vulnerability exists due to an out-of-bounds read in the parse_dcc() function in nf_conntrack_irc when parsing DCC command data without a newline present. A remote attacker can send specially crafted IRC DCC command data to cause incorrect connection tracking state.

The stray read may consume an uninitialized or stale byte, which can lead to an incorrect DCC IP address or port being recorded in the conntrack expectation.

97) Information disclosure (CVE-ID: CVE-2026-80602)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the AMD last branch record filtering logic in perf when processing user-only branch stack sampling requests. A local user can collect branch stack records to disclose sensitive information.

Only AMD processors supporting X86_FEATURE_AMD_LBR_V2 are affected.

98) Use-after-free (CVE-ID: CVE-2026-80601)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in batman-adv gateway client handling in net/batman-adv/gateway_client.c when processing a crafted skb after buffer reallocation. A local attacker can trigger skb processing that uses stale buffer pointers to cause a denial of service.

99) Use-after-free (CVE-ID: CVE-2026-80600)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in batman-adv distributed arp table handling in net/batman-adv/distributed-arp-table.c when processing DHCP ACK packets. A local user can trigger skb buffer reallocation and subsequent access through stale pointers to cause a denial of service.

100) Out-of-bounds read (CVE-ID: CVE-2026-80599)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in batadv_dat_get_vid() when processing packet data without ensuring the ethernet header is accessible. A local user can provide a specially crafted skb to trigger an out-of-bounds access and cause a denial of service.

The issue affects distributed arp table handling paths.

101) Out-of-bounds read (CVE-ID: CVE-2026-80598)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in decompress_lznt() when parsing invalid compressed data from a corrupted NTFS3 image. A local user can supply a crafted NTFS3 image to disclose sensitive information.

102) NULL pointer dereference (CVE-ID: CVE-2026-80597)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the vmu-flash initialization code when initializing the mtd_info device structure without linking it to its parent device. A local user can trigger initialization of the affected component to cause a denial of service.

103) Improper access control (CVE-ID: CVE-2026-80596)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the ims-pcu sysfs attribute handlers when accessing sysfs attributes through a non-control interface. A local user can access exposed sysfs attributes on a secondary data interface to cause a denial of service.

The issue occurs because the driver exposes device attributes on all interfaces bound to the driver, even though only the primary control interface has the required descriptors and internal state.

104) Out-of-bounds read (CVE-ID: CVE-2026-80595)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the ims-pcu driver when processing response data from device buffers. A local user can provide a short device response to disclose sensitive information.

The issue can also result in processing stale data from the buffers.

105) Improper input validation (CVE-ID: CVE-2026-80594)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in ims_pcu_get_cdc_union_desc() when parsing CDC union descriptors from a malicious USB device. An attacker with physical access can provide a crafted descriptor with bLength set to 0 to cause a denial of service.

106) Out-of-bounds read (CVE-ID: CVE-2026-80593)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the atk_ec_present() function in the asus_atk0110 hwmon driver when processing a malformed firmware package returned by the GGRP ACPI method. A local attacker can provide a zero-length sub-package to trigger the out-of-bounds read and disclose sensitive information.

107) Improper input validation (CVE-ID: CVE-2026-80592)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in samples/damon/mtier.c when handling sysfs writes that enable the mtier sample module with invalid address range parameters. A local user can write invalid address range values to trigger a kernel warning and cause a denial of service.

The issue can occur if node0 or node1 address parameters are not properly initialized, including cases where automatic node address detection is enabled and one of the nodes is memoryless.

108) Use of insufficiently random values (CVE-ID: CVE-2026-74438)

CWE-ID: CWE-330 - Use of Insufficiently Random Values

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to obtain insufficiently random data.

The vulnerability exists due to improper implementation in sun4i_ss_prng_generate() in the sun4i_ss_prng rng implementation when generating random bytes through the AF_ALG "rng" algorithm interface. A local user can request random output to obtain insufficiently random data.

The function rounds the destination length down and does not wait for the hardware to be ready before reading bytes.

109) Stack-based buffer overflow (CVE-ID: CVE-2026-74438)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in sun4i_ss_prng_seed() in the sun4i_ss_prng rng implementation when processing a seed supplied through the AF_ALG "rng" algorithm interface. A local user can supply an oversized seed to trigger memory corruption and execute arbitrary code or cause a denial of service.

The vulnerable code path is described as only theoretically usable via the "rng" algorithm type of AF_ALG.

110) Race condition (CVE-ID: CVE-2026-74437)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in uvc_status_stop in the uvcvideo driver when handling asynchronous control status events. A local user can trigger a deadlock condition to cause a denial of service.

Exploitation requires a UVC camera with an asynchronous control.

111) NULL pointer dereference (CVE-ID: CVE-2026-74435)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rxrpc_verify_data in net/rxrpc/recvmsg.c when processing RxRPC message data with an unallocated decode buffer. A local user can trigger a call path that reaches skb_copy_bits() with a NULL destination to cause a denial of service.

112) Memory leak (CVE-ID: CVE-2026-74432)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in rxrpc_recvmsg() when handling recvmsg calls with MSG_PEEK on an already released call. A local user can invoke recvmsg with MSG_PEEK to cause a denial of service.

113) Infinite loop (CVE-ID: CVE-2026-74431)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop in rxrpc_recvmsg() when processing receive operations with an empty recvmsg queue while out-of-band queued data is present. A local user can trigger this condition to cause a denial of service.

114) NULL pointer dereference (CVE-ID: CVE-2026-74430)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rxrpc_input_ackall() when processing forged ACKALL packets for a new service call before any reply packets have been queued. A remote attacker can send a forged ACKALL packet to cause a denial of service.

The issue can be triggered when the call is in RXRPC_CALL_SERVER_RECV_REQUEST state and the transmit queue has not been initialized.

115) Improper input validation (CVE-ID: CVE-2026-74429)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the rxrpc reply handling logic when processing an apparent reply DATA packet before any request DATA packets have been sent on a client call. A remote attacker can send a specially crafted early reply packet to cause a denial of service.

The issue can lead to a kernel oops when a client call has not yet been exposed by transmission of the first packet.

116) NULL pointer dereference (CVE-ID: CVE-2026-74426)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in afs_get_tree() when handling a mount operation with a non-null dyn_root context. A local user can trigger the vulnerable code path to cause a denial of service.

117) NULL pointer dereference (CVE-ID: CVE-2026-74425)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in afs_deliver_cb_init_call_back_state3 in the AFS callback handler when processing CB.InitCallBackState3 requests without an attached server record. A remote attacker can send a crafted callback request to cause a denial of service.

The issue occurs when the rxrpc peer is not mapped to a server record for the incoming callback request.

118) NULL pointer dereference (CVE-ID: CVE-2026-74424)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in fbcon_new_modelist() and related fbcon console handling in drivers/video/fbdev/core/fbcon.c when processing framebuffer modelist changes for a console without vc_data. A local user can trigger a modelist change on such a console to cause a denial of service.

The issue occurs when fb_display[i].mode remains set after the associated console data has been freed.

119) Improper resource shutdown or release (CVE-ID: CVE-2026-74423)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the amdxdna user buffer page pinning logic when pinning user pages. A local user can trigger partial page pinning failure to cause a denial of service.

120) Use-after-free (CVE-ID: CVE-2026-74422)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the inno_hdmi_rockchip_bind() encoder structure handling when cleaning up the DRM encoder after component unbind. A local user can trigger the vulnerable cleanup sequence to cause a denial of service.

The issue occurs because the encoder-containing structure can be released by the component framework before drm_dev_put() later triggers encoder cleanup.

121) Use-after-free (CVE-ID: CVE-2026-74421)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the dw_dp_rockchip_bind() encoder structure allocation and cleanup logic when releasing resources during component unbind and later DRM device cleanup. A local user can trigger the affected cleanup path to cause a denial of service.

The issue occurs because the encoder-containing structure can be freed by the component framework before later access during DRM-managed cleanup.

122) Improper input validation (CVE-ID: CVE-2026-74420)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in drm_gpusvm range creation in drivers/gpu/drm/drm_gpusvm.c when handling VMAs marked with VM_IO or VM_PFNMAP. A local user can trigger creation of an SVM range for such a VMA to cause a denial of service.

The issue can lead to repeated get_pages() failures and an infinite loop inside a driver's page-fault handler.

123) Out-of-bounds read (CVE-ID: CVE-2026-74419)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the amdxdna driver copy_to_user() handling when processing user-supplied buffer sizes for query and info requests. A local user can provide a smaller buffer size than the copied data size to disclose sensitive information.

The issue affects multiple amdxdna AIE query and information paths that copy kernel data to user space.

124) Integer overflow (CVE-ID: CVE-2026-74417)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in radeon_align_pitch() when creating a dumb buffer. A local user can supply crafted width or bits-per-pixel values to cause a denial of service.

The issue can result in an invalid pitch or a zero-sized dumb buffer.

125) Improper resource shutdown or release (CVE-ID: CVE-2026-74416)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in radeon_ring_restore() when handling a failed ring lock during GPU reset. A local user can trigger repeated GPU resets that fail at the lock stage to cause a denial of service.

The issue leaks the ring backup buffer on each failed restore attempt, leading to cumulative kernel memory exhaustion during repeated GPU resets.

126) Use-after-free (CVE-ID: CVE-2026-74415)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the atcspi200 SPI controller driver when the driver is unbound and DMA resources are torn down while the controller is still active. A local user can trigger driver unbind conditions to cause a denial of service.

The issue occurs because DMA resources are initialized after SPI controller registration, allowing DMA transfers to be triggered during teardown.

127) Type Confusion (CVE-ID: CVE-2026-74413)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper type handling in rtw89 PCI AER handlers when handling PCI error recovery events. A local user can trigger the affected error-handling paths to cause a denial of service.

The issue affects the io_error_detected() and io_resume() handlers, which retrieve driver data as the wrong pointer type and operate on incorrect structure offsets.

128) Type Confusion (CVE-ID: CVE-2026-74412)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper type handling in rtw88 PCI AER handlers when handling PCI error recovery events. A local user can trigger a PCI error condition to cause a denial of service.

The issue arises because driver data stored as an ieee80211_hw pointer is retrieved as a net_device pointer, leading to reads and writes at incorrect structure offsets.

129) Integer overflow (CVE-ID: CVE-2026-74411)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer truncation in rtw89_update_6ghz_rnr_chan when processing 6 GHz scan parameters. A local user can trigger Wi-Fi scanning with a large number of 6 GHz parameters to cause a denial of service.

The issue can result in a kernel soft lockup during 6 GHz Wi-Fi scanning and may lead to a system panic.

130) Out-of-bounds read (CVE-ID: CVE-2026-74410)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rtw_pci_rx_napi() when processing firmware RX descriptors on the PCIe transport path. A local attacker can provide a crafted descriptor with a length value that exceeds the DMA buffer size to disclose sensitive information.

The issue occurs because the computed receive length can exceed the size of the pre-allocated DMA buffer before data is copied.

131) Out-of-bounds read (CVE-ID: CVE-2026-74409)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in rtw89_assoc_link_rcu_dereference() when processing firmware-supplied mac_id values from RX descriptors. A local attacker can provide a crafted out-of-range mac_id value to cause a denial of service.

The mac_id field is 8 bits wide, while the assoc_link_on_macid array has only 128 entries.

132) Out-of-bounds read (CVE-ID: CVE-2026-74408)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ath_tx_edma_tasklet() when processing a firmware-provided tx status queue ID. A local attacker can provide an invalid queue ID value to trigger an out-of-bounds array access and cause a denial of service.

133) Race condition (CVE-ID: CVE-2026-74407)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in the ath11k PCI shutdown and SSR recovery handling when shutdown or reboot overlaps with WLAN firmware crash recovery. A local attacker can trigger a reboot during concurrent SSR activity to cause a denial of service.

This issue affects only PCI/MHI-based devices; AHB-based ath11k devices are not affected in normal SSR flows.

134) Race condition (CVE-ID: CVE-2026-74405)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to refcount corruption in the OPP core when adding and looking up dynamic OPP entries concurrently. A local user can trigger concurrent OPP addition and lookup operations to cause a denial of service.

The issue can lead to a potential premature free of a newly added OPP object.

135) Heap-based buffer overflow (CVE-ID: CVE-2026-74404)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one heap-based buffer overflow in snp_filter_reserved_mem_regions() when processing reserved memory region descriptors. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs in the Linux kernel crypto ccp subsystem.

136) NULL pointer dereference (CVE-ID: CVE-2026-74403)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a NULL pointer in sev_tsm_init_locked in drivers/crypto/ccp/sev-dev.c when initializing SNP TIO under memory pressure. A local user can trigger the affected initialization path and cause a denial of service.

The issue occurs because page_address(NULL) may yield an invalid non-NULL address on architectures without HASHED_PAGE_VIRTUAL, leading to dereference of an invalid pointer.

137) Improper Initialization (CVE-ID: CVE-2026-74402)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to obtain insufficiently random entropy.

The vulnerability exists due to improper buffer management in the atmel-sha204a hardware random number generator driver when reading random data from the device response buffer. A local user can read from /dev/hwrng to obtain insufficiently random entropy.

The issue affects both the blocking and non-blocking rng paths.

138) NULL pointer dereference (CVE-ID: CVE-2026-74400)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in bpf_set_dentry_xattr, bpf_remove_dentry_xattr, and related xattr permission checks when handling a negative dentry. A local user can pass a negative dentry to trigger a kernel crash or warning-induced panic to cause a denial of service.

Systems with panic_on_warn enabled may panic when the warning path is reached.

139) Out-of-bounds read (CVE-ID: CVE-2026-74399)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in evm_read_xattrs() when reading the list of enabled EVM xattrs. A local user can trigger a read of the xattrs interface to disclose sensitive information.

The issue occurs when no configured xattrs are enabled, leaving the buffer uninitialized before its length is determined.

140) Improper resource shutdown or release (CVE-ID: CVE-2026-74397)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in mlx5_ib_alloc_transport_domain() when handling transport-domain allocation failures during loopback enablement. A local user can trigger an error path that leaks a transport domain to cause a denial of service.

The issue affects the IB/mlx5 driver in the Linux kernel.

141) Improper resource shutdown or release (CVE-ID: CVE-2026-74396)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mlx5 RDMA UMR XLT cleanup path when handling an ODP populate failure. A local user can trigger an ODP populate failure to cause a denial of service.

If the emergency XLT page is used, the issue can leave xlt_emergency_page_mutex locked.

142) NULL pointer dereference (CVE-ID: CVE-2026-74395)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT in drivers/infiniband/hw/mlx5/devx.c when handling devx subscribe-event requests and unwinding an error after eventfd acquisition fails. A local user can trigger the error path with a crafted subscribe-event request to cause a denial of service.

The issue occurs because the subscription object is linked into the pending list before fields needed by cleanup are initialized.

143) Memory leak (CVE-ID: CVE-2026-74393)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in drm_syncobj_find_fence() when handling invalid flags in sync object fence lookup requests. A local user can supply invalid flags to cause a denial of service.

144) Resource exhaustion (CVE-ID: CVE-2026-74392)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in dm_poll_bio() in the device mapper subsystem when polling target bios through a stacked dm device with io_uring IOPOLL. A local user can trigger repeated polling on a dm-stripe target to cause a denial of service.

The issue can keep a task inside the polling path long enough to trigger an RCU CPU stall.

145) Stack-based buffer overflow (CVE-ID: CVE-2026-74391)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in synthetic field helpers in kernel/trace/trace_events_hist.c when constructing synthetic variable names and generated histogram commands from long key lists, field names, or saved filters. A local user can supply crafted tracing inputs to cause a denial of service.

The issue occurs in tracing functionality while building fixed-size MAX_FILTER_STR_VAL staging buffers.

146) Out-of-bounds write (CVE-ID: CVE-2026-74390)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to out-of-bounds write in irdma_copy_user_pgaddrs when processing user-supplied RDMA memory registration data with lvl set to 0. A local user can provide a umem with more DMA blocks than the supplied page count to cause a denial of service or execute arbitrary code.

The issue affects the lvl==0 case that uses the fixed-size iwmr->pgaddrmem array for QP, CQ, and SRQ rings.

147) Logging of Excessive Data (CVE-ID: CVE-2026-74389)

CWE-ID: CWE-779 - Logging of Excessive Data

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper restriction of excessive logging in the hns roce rdma driver command error handling path when command mailbox failures are repeatedly triggered during hardware context operations. A local user can trigger repeated command failures to cause a denial of service.

The issue can lead to log flooding after command mailbox failures and may result in a system crash when the hardware is abnormal.

148) Use-after-free (CVE-ID: CVE-2026-74388)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ALSA OSS sequencer event handling logic when processing SysEx data embedded in MIDI events and dispatching a pending event after a sequencer port is closed concurrently. A local user can send crafted MIDI bytes that produce a pending SysEx event with a stale pointer to cause a denial of service.

The issue occurs during concurrent port closure before deferred event dispatch.

149) Use-after-free (CVE-ID: CVE-2026-74387)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the ALSA sequencer MIDI output handling in sound/core/seq/seq_midi.c when processing MIDI sequencer events during concurrent output teardown. A local user can trigger concurrent event processing and output teardown to cause a denial of service or execute arbitrary code.

The issue occurs because the event_input path can keep using a stale substream or runtime after the last unuse path releases the rawmidi file.

150) Improper resource shutdown or release (CVE-ID: CVE-2026-74386)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in nvmet_tcp_alloc_queue() in the NVMe target TCP component when handling connection closure during queue allocation. A remote attacker can repeatedly open and close connections to cause a denial of service.

The issue occurs on an error path where the page fragment cache reference held by queue->pf_cache is not released, leading to a page leak over time.

151) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74385)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper exception handling in nvmet_tcp_tls_handshake_done when completing a TCP/TLS handshake. A remote attacker can trigger a failure in nvmet_tcp_set_queue_sock to cause a denial of service.

The issue can occur if the socket is not in TCP_ESTABLISHED state, leading to queue and socket leakage.

152) Out-of-bounds read (CVE-ID: CVE-2026-74383)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in nvme_setup_descriptor_pools when initializing NVMe hardware contexts on systems built without NUMA support. A local user can trigger NVMe namespace initialization to cause a denial of service.

The issue occurs because a NUMA node value of -1 is treated as an unsigned array index, which can fault during nvme_alloc_ns() and leave the namespace without a /dev node.

153) Uncontrolled Recursion (CVE-ID: CVE-2026-74382)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in cls_bpf_offload_cmd() in the cls_bpf traffic control offload path when processing a filter replace operation and attempting rollback after repeated tc_setup_cb_replace() failures. A local user can trigger repeated rollback failures to cause a denial of service.

The issue can exhaust kernel stack space during rollback handling, and it is not limited to netdevsim.

154) Resource management error (CVE-ID: CVE-2026-74381)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count management in host1x buffer object cache handling when pinning and caching buffer object mappings. A local user can trigger caching of a buffer object mapping to cause a denial of service.

The issue stems from a circular reference between cached mappings and the underlying buffer object, which can prevent the buffer object from being freed.

155) Incorrect Check of Function Return Value (CVE-ID: CVE-2026-74380)

CWE-ID: CWE-253 - Incorrect Check of Function Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error return values in pin_job() in the host1x GPU driver when mapping scatter-gather tables through the IOMMU. A local user can trigger the affected code path to cause a denial of service.

The issue involves assigning the iommu_map_sgtable() result to an incorrect integer type, which can turn error conditions into negative overflowed values.

156) NULL pointer dereference (CVE-ID: CVE-2026-74379)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in dev_dax_kmem_remove() when removing dax kmem ranges after partial success during probing. A local user can trigger removal of a device with ranges whose resources were never added to cause a denial of service.

The issue occurs when dev_dax_kmem_probe() partially succeeds and later probe failures leave some range resources unset while removal still iterates over all ranges.

157) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74378)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a heap-based buffer overflow.

The vulnerability exists due to a time-of-check time-of-use race in get_srq_wqe() when copying a work queue element from a shared receive queue buffer mapped into userspace. A local user can modify num_sge between validation and size calculation to cause a heap-based buffer overflow.

The issue arises because the num_sge field is read twice from shared userspace-accessible memory.

158) Out-of-bounds read (CVE-ID: CVE-2026-74377)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in rxe_resp_check_length() and copy_data() when processing a receive WQE from a shared queue buffer mapped into userspace. A local user can modify WQE fields such as num_sge or sge entries during processing to cause an out-of-bounds read.

The issue affects the non-SRQ queue pair receive path.

159) Deadlock (CVE-ID: CVE-2026-74375)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in md_handle_request() and the raid1/raid10 read error recovery path when resubmitting a split md cloned bio while the array is suspended. A local user can trigger read error recovery to cause a denial of service.

The issue occurs because an md cloned bio already holds an active_io reference before another reference is attempted.

160) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74374)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state handling in the md/raid1 and md/raid10 read request paths when processing split and resubmitted failed bios in the error path. A local user can trigger I/O that causes failed bios to be split and resubmitted to cause a denial of service.

The issue can lead to incorrect memory allocation flags being used under memory pressure, which may result in a deadlock.

161) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74373)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource accounting in the md raid1 and raid10 subsystems when handling split md cloned bios on the error path. A local user can trigger read requests that cause failed bios to be split and resubmitted to cause a denial of service.

The issue occurs when a failed bio is split and resubmitted via bio_submit_split_bioset().

162) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-74372)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in raid1_write_request() in the raid1 driver when processing REQ_ATOMIC write requests that encounter a bad block. A local user can trigger the error path with such a write request to cause a denial of service.

The leaked nr_pending reference can prevent an rdev from being removed.

163) Out-of-bounds write (CVE-ID: CVE-2026-74371)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the BPF_PROG_QUERY cgroup query handler when processing a user-supplied bpf_attr structure smaller than the revision field layout. A local user can invoke BPF_PROG_QUERY with a specially crafted smaller attribute buffer to cause a denial of service.

The issue affects the cgroup attach type query path and does not apply to tcx or netkit query handlers because those interfaces were introduced with the revision field already present.

164) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74370)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in luo_session_retrieve() when retrieving a liveupdate session. A local user can trigger concurrent session operations to cause a denial of service.

The issue arises when a concurrent thread releases and frees the session between session lookup and acquisition of the session mutex.

165) Memory leak (CVE-ID: CVE-2026-74368)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() when processing frames with an invalid NWIFI header length during TKIP MIC verification. A remote attacker can send a specially crafted frame to cause a denial of service.

The issue occurs on an error path where the MSDU is no longer referenced by the defragmentation path and is never freed.

166) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74367)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in ath12k_mac_vdev_create() when handling vdev creation error paths. A local user can trigger vdev creation failures to cause a denial of service.

The issue affects cleanup after failures in WMI vdev creation and peer deletion handling, leaving internal ath12k state inconsistent.

167) NULL pointer dereference (CVE-ID: CVE-2026-74366)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ath12k_mac_op_change_sta_links in the ath12k wireless driver when handling unready link states. A local user can trigger link-handling operations that leave a broken link in links_map to cause a denial of service.

The crash can be triggered by subsequent operations such as disconnect handling or PTK key installation for the affected link.

168) Race condition (CVE-ID: CVE-2026-74365)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause silent data corruption.

The vulnerability exists due to a race condition in BTT lane acquisition in the Linux kernel nvdimm BTT subsystem when handling BTT I/O. A local user can trigger concurrent use of the same lane to cause silent data corruption.

The issue occurs because BTT lanes became preemptible while the recursion model still relied on a per-CPU recursion count, allowing another task on the same CPU to bypass locking and use the same lane concurrently.

169) Improper access control (CVE-ID: CVE-2026-74364)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify restricted map contents.

The vulnerability exists due to improper access control in bpf map-in-map handling when looking up and mutating an exclusive inner map through a non-exclusive outer map. A remote user can insert an exclusive map into a non-exclusive outer map and access it from an unrelated program to modify restricted map contents.

For the signed loader, this can defeat the metadata map exclusivity check by allowing cached map metadata to remain validated while the frozen map contents are rewritten through the outer map.

170) Use-after-free (CVE-ID: CVE-2026-74363)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bpffs inode handling when a concurrent unlinkat() drops the last inode reference during RCU path walking. A local user can trigger concurrent path operations to cause a denial of service.

The issue occurs because inode fields and the cached symlink body may still be accessed during RCU pathwalk after the inode is freed.

171) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-74362)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect success status reporting for failed synchronous writes.

The vulnerability exists due to improper check for unusual or exceptional conditions in ext2_dio_write_iter() in fs/ext2/file.c when handling direct I/O writes to O_SYNC/O_DSYNC files. A local user can trigger a failed sync during a write operation to cause incorrect success status reporting for failed synchronous writes.

The issue affects error propagation from generic_write_sync() and may also involve filemap_write_and_wait_range() handling.

172) Improper access control (CVE-ID: CVE-2026-74360)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify protected BPF map values.

The vulnerability exists due to improper access control in bpf_map_elem iterators when attaching an iterator to an exclusive map. A local user can attach an iterator to the map and use the exposed writable buffer to modify protected BPF map values.

The exclusivity check is bypassed because the target map is bound at attach time rather than being referenced from the program.

173) Use-after-free (CVE-ID: CVE-2026-74359)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in configfs_lookup() when handling subsequent getdents(2) operations in a directory after inode allocation failure. A local user can trigger inode allocation failure and then access the affected directory to cause a denial of service.

The issue occurs because a dangling pointer remains in the configfs_dirent structure and is later dereferenced to obtain an inode number.

174) Race condition (CVE-ID: CVE-2026-74358)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in ext4 fast commit wait and wake handling when processing fast commit inode state transitions on 64-bit systems. A local user can trigger filesystem activity that reaches the affected wait and wake paths to cause a denial of service.

Only 64-bit systems are affected.

175) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74356)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in vhost_get_avail_idx in the vhost subsystem when handling available ring entries with mergeable buffers enabled. A local user can trigger repeated processing of available entries to cause a denial of service.

The issue can lead to a host livelock when the guest is not making progress and notifications are re-enabled while entries remain in the ring.

176) Out-of-bounds write (CVE-ID: CVE-2026-74355)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to memory corruption in the intel vt-d iommu device RB-tree handling when probing a device and executing the probe error path for a device that does not support ATS. A local user can trigger a device probe failure to corrupt the device RB-tree and cause a denial of service.

The issue occurs because a zero-initialized RB-tree node may be treated as a tree root during removal if insertion was skipped.

177) Deadlock (CVE-ID: CVE-2026-74354)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in zap_pages() in the BPF arena implementation when zapping pages across tracked VMAs. A local user can trigger the vulnerable page-zapping path to cause a denial of service.

The issue involves an AB-BA deadlock condition around mmap_lock and arena->lock during VMA handling.

178) Improper locking (CVE-ID: CVE-2026-74353)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in kfd_dqm_suspend_bad_queue_mes in the AMD KFD device queue manager when handling a bad queue during queue suspension and removal. A local user can trigger handling of a bad queue to cause a denial of service.

The issue affects restoration of good queues after suspension errors.

179) Use-after-free (CVE-ID: CVE-2026-74352)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in of_reserved_mem_lookup() when dereferencing the global reserved_mem pointer after alloc_reserved_mem_array() fails during post-init use. A local user can trigger access to the affected code path to cause a denial of service.

The issue occurs if dynamic allocation of the reserved_mem array fails, leaving a reference to memory stored in __initdata that is later freed.

180) Use-after-free (CVE-ID: CVE-2026-74351)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a use-after-free in the ocfs2 locking_state debugfs iterator when dumping raw LVB bytes from a copied lock resource after lockres teardown. A local user can read the debugfs locking_state output during a concurrent teardown to disclose sensitive information.

The issue occurs because a copied non-NULL sb_lvbptr can continue to reference the original lock resource after the tracking lock is dropped.

181) Integer underflow (CVE-ID: CVE-2026-74349)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unintended block trimming beyond the requested range.

The vulnerability exists due to an integer underflow in ocfs2_trim_mainbm() when processing a FITRIM range shorter than a cluster. A local user can submit a specially crafted FITRIM range to cause unintended block trimming beyond the requested range.

The issue occurs on filesystems where the cluster size is larger than the block size.

182) Use-after-free (CVE-ID: CVE-2026-74348)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ocfs2 dlm locking_state debugfs open and release handling when opening the locking_state debugfs file during concurrent domain teardown. A local user can open and later close the debugfs file to cause a denial of service.

The issue occurs when the open path stores a raw dlm_ctxt pointer even if acquiring a reference fails, and the release path later accesses that context after it has been freed.

183) Use-after-free (CVE-ID: CVE-2026-74347)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the netfilter conntrack timeout policy handling when removing a timeout policy while conntrack entries or queued packets still reference it. A local privileged user can delete a referenced timeout policy to cause a denial of service.

Exploitation requires the ability to manage conntrack timeout policies in netfilter.

184) Out-of-bounds read (CVE-ID: CVE-2026-74346)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in irdma_handle_q_mem during CQ memory registration when processing CQ page array data. A local user can trigger CQ MR registration with a crafted page layout to disclose sensitive information.

The issue affects GEN_2 hardware and later when the CQ resize feature is enabled.

185) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74344)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in bpf_rb_root_free() and bpf rbtree node handling when removing a surviving node from a later reused rbtree root allocation. A local user can trigger reuse of a stale bpf rbtree node with retained owner and linkage state to cause a denial of service.

The issue arises when a refcounted object survives being dropped and its rb node retains stale tree linkage and an owner pointer to a freed root.

186) Heap-based buffer overflow (CVE-ID: CVE-2026-74341)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the wcn36xx HAL response dispatcher when processing an oversized firmware HAL response. A local user can provide a firmware response with an excessive length to cause a denial of service.

The copied data is firmware-controlled content written into a 4096-byte buffer.

187) Out-of-bounds read (CVE-ID: CVE-2026-74340)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the wcn36xx_smd_print_reg_info_ind function when processing a firmware PRINT_REG_INFO indication. A remote attacker can provide a firmware-controlled count value that exceeds the actual message data to disclose sensitive information.

The issue occurs because the count field is used as a loop bound for indexing a flexible regs[] array without validation against the received message length.

188) Use of Uninitialized Variable (CVE-ID: CVE-2026-74339)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in snd_seq_read() when copying queued variable-length event headers to userspace. A local user can write a direct variable event to itself and read back a kernel pointer from the returned header to disclose sensitive information.

The issue affects ALSA sequencer variable-length events that use SNDRV_SEQ_EXT_CHAINED internally.

189) Improper input validation (CVE-ID: CVE-2026-74338)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the BPF verifier for BPF_LSM_CGROUP program loading when loading a sleepable BPF_LSM_CGROUP program through the bpf(2) interface. A local user can load a specially crafted sleepable BPF program to cause a denial of service.

The issue can be triggered by bypassing libbpf and using bpf(2) directly.

190) Improper locking (CVE-ID: CVE-2026-74337)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the BPF LRU list implementation when NMI and tracepoint BPF programs re-enter per-CPU or global LRU locks on the same CPU. A local user can trigger recursive lock acquisition to cause a denial of service.

The issue can result in an AA deadlock on the affected lock paths.

191) Out-of-bounds read (CVE-ID: CVE-2026-74336)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ieee80211_s1g_check_tim() when parsing a received S1G TIM element. A remote attacker can send a specially crafted wireless frame to disclose sensitive information.

The issue can read up to two bytes beyond the TIM element when the TIM is the last element in the frame.

192) NULL pointer dereference (CVE-ID: CVE-2026-74335)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in bpf_task_from_vpid() when processing network packets in cgroup_skb programs while the current task is exiting. A remote attacker can send network traffic that triggers the vulnerable BPF helper path to cause a denial of service.

The issue occurs in softirq context if execution interrupts a task after its thread_pid has been cleared during process exit.

193) Race condition (CVE-ID: CVE-2026-74334)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the RDMA nldev resource tracking code when accessing memory region protection domain data during memory region re-registration. A local user can trigger concurrent memory region re-registration and netlink resource access to cause a denial of service.

The issue involves user memory regions whose protection domain pointer can change during in-place re-registration.

194) Out-of-bounds read (CVE-ID: CVE-2026-74333)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in create_sdw_dailinks() when iterating over soc_dais entries. A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue occurs when all allocated soc_dais entries are marked as initialised, causing iteration past the end of the array.

195) Out-of-bounds read (CVE-ID: CVE-2026-74332)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in create_sdw_dailinks() when iterating over sof_dais entries. A local user can trigger the vulnerable code path to cause a denial of service.

196) Deadlock (CVE-ID: CVE-2026-74331)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a recursive locking deadlock in firmware_loader power management notification handling when preparing for system suspend or hibernation and caching firmware images. A local attacker can trigger an out-of-memory condition that causes synchronous execution of firmware caching work to cause a denial of service.

The issue occurs when asynchronous work scheduling falls back to synchronous execution after memory allocation for the work entry fails.

197) Race condition (CVE-ID: CVE-2026-74330)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in configfs directory entry child traversal when traversing s_children lists while concurrent cursor movement or freeing can occur. A local user can trigger concurrent configfs operations to cause a denial of service.

The issue affects configfs directory handling in fs/configfs/dir.c.

198) Use-after-free (CVE-ID: CVE-2026-74329)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in watchdog_pm_notifier in the Linux kernel watchdog subsystem when processing suspend and resume notifications after watchdog device unregistration. A local user can trigger a suspend or resume event after unregistering a watchdog device to cause a denial of service.

Only watchdog devices with WDOG_NO_PING_ON_SUSPEND set are affected.

199) Use-after-free (CVE-ID: CVE-2026-74328)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the iommufd pages release logic when detaching from a dma-buf. A local user can trigger dma-buf invalidation callbacks during page release to cause a denial of service.

The issue occurs because the mutex could still be in use through dma-buf invalidation callbacks before the dma-buf is fully detached.

200) NULL pointer dereference (CVE-ID: CVE-2026-74327)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in is_vm_area_hugepages() when handling an invalid vmalloc address. A local attacker can provide an invalid vmalloc address to trigger a kernel crash to cause a denial of service.

201) Use-after-free (CVE-ID: CVE-2026-74325)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the mt76 offchannel link handling in mt76_put_vif_phy_link when processing concurrent TX datapath activity under RCU. A local user can trigger concurrent access to a freed offchannel link object to cause a denial of service.

The issue occurs because an existing RCU reader may continue dereferencing the pointer after it has been freed.

202) Out-of-bounds read (CVE-ID: CVE-2026-74324)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in mt7925_tm_query() when processing a firmware testmode response. A local user can trigger processing of a shorter-than-expected response buffer to disclose sensitive information.

The over-read data is returned to userspace via nla_put() in mt7925_testmode_dump().

203) NULL pointer dereference (CVE-ID: CVE-2026-74323)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mt76_token_release() when handling token release operations with a null wake pointer. A local user can trigger code paths that call mt76_token_release() with a null wake argument to cause a denial of service.

204) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-74323)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in mt7996_tx_prepare_skb() when handling transmission preparation after link_conf or link_sta lookup failures. A local user can trigger error conditions that leak transmit tokens to cause a denial of service.

205) NULL pointer dereference (CVE-ID: CVE-2026-74322)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7996_mac_write_txwi_80211() when processing injected frames via radiotap. A local user can inject a crafted frame to cause a denial of service.

The issue occurs because mac80211 may provide info->control.vif as NULL for injected frames.

206) NULL pointer dereference (CVE-ID: CVE-2026-74321)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an invalid pointer dereference in __btrfs_run_delayed_refs() when processing delayed references. A local user can trigger the vulnerable code path to cause a denial of service.

207) Use-after-free (CVE-ID: CVE-2026-74320)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the sm501fb OF binding code when parsing device tree mode and EDID properties during framebuffer initialization. A local user can supply crafted property values or trigger affected initialization paths to cause a denial of service.

The issue also involves a double free, a buffer overrun, and memory leaks when both CRT and PANEL are enabled or when probe error paths are reached.

208) Deadlock (CVE-ID: CVE-2026-74318)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in the btrfs reflink inline extent cloning logic when cloning an inline extent to a destination offset greater than zero while the filesystem is mounted with flushoncommit. A local user can trigger crafted reflink and write activity to cause a denial of service.

The issue occurs when inline extent data is copied into a destination file beyond its current end of file, leading transaction commit and folio invalidation paths to wait on the same extent lock.

209) Out-of-bounds write (CVE-ID: CVE-2026-74317)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a slab out-of-bounds write in __netif_set_xps_queue in the ixgbe driver when loading an XDP program that configures XDP transmit queues. A local user can load an XDP program to trigger the out-of-bounds write and cause a denial of service.

The issue occurs on E610 adapters on systems with 64 or more CPUs when the last XDP queue is configured.

210) Improper resource shutdown or release (CVE-ID: CVE-2026-74316)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in nfsd4_drop_revoked_stid() when processing FREE_STATEID for an admin-revoked layout stateid. A remote user can send a crafted FREE_STATEID request to cause a denial of service.

The affected stateid remains in the IDR and on the per-client list until the client is destroyed.

211) Improper locking (CVE-ID: CVE-2026-74314)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to unsafe cleanup of special fields in BPF map values in array and hash map update and delete paths when recycling or replacing map values from BPF execution contexts such as NMI context. A local user can trigger map update or delete operations involving special fields to cause a denial of service.

The issue affects tracing programs because referenced kptr destructors, uptr unpinning, and graph root destruction are not generally safe in NMI context.

212) Use-after-free (CVE-ID: CVE-2026-74313)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in vduse_dev_open() when opening a VDUSE device while a concurrent VDUSE_DESTROY_DEV operation removes the same device from the IDR. A local user can trigger concurrent operations on the same device to cause a denial of service.

213) Out-of-bounds read (CVE-ID: CVE-2026-74312)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds access in vhost_vdpa_mmap() and vhost_vdpa_fault() when processing a virtqueue index from vm_pgoff. A local user can provide an out-of-range queue index to trigger driver-specific get_vq_notification() callbacks and cause a denial of service.

The issue may lead to invalid PFN remaps in the callback path.

214) NULL pointer dereference (CVE-ID: CVE-2026-74311)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in virtio rtc virtqueue restore handling when reinitializing virtqueues during device restore. A local user can trigger device restore and cause the guest kernel to crash.

The issue can occur if virtqueue reinitialization fails on virtio-pci, including cases where an earlier queue setup attempt fails before a later one would otherwise succeed.

215) Improper input validation (CVE-ID: CVE-2026-74309)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the octep_vdpa_intr_handler interrupt handler when handling device interrupts with non-contiguous IRQ numbers. A local user can trigger the vulnerable interrupt handling path to cause a denial of service.

The issue occurs because the handler assumes irq - irqs[0] yields the correct ring index, which can fail when the first IRQ is not the base of a contiguous range.

216) Improper input validation (CVE-ID: CVE-2026-74308)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state validation in ext4_journalled_write_end() and ext4_write_inline_data_end() when handling writes on an ext4 filesystem mounted with the data=journal option after a failed inline-data-to-extent conversion. A local user can trigger a crafted write operation to cause a denial of service.

The issue can be triggered when a previous attempt to convert inline data to an extent fails, such as due to insufficient space.

217) Deadlock (CVE-ID: CVE-2026-74307)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in EXT4_IOC_MOVE_EXT when processing a donor file descriptor that refers to a file on a different filesystem. A local user can supply a donor file from a different superblock to cause a denial of service.

Exploitation requires a concurrent filesystem freeze operation to trigger the deadlock cycle.

218) Out-of-bounds write (CVE-ID: CVE-2026-74306)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in qat_vf_resume_write() when handling concurrent writes to the migration-state buffer. A local user can issue concurrent write operations to write past the end of the migration-state buffer and cause a denial of service.

Exploitation requires concurrent access to the affected file operation.

219) Improper access control (CVE-ID: CVE-2026-74305)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended cgroup storage compatibility checks.

The vulnerability exists due to improper access control in bpf prog-array compatibility checks when validating tail-call chains involving cgroup local storage. A local user can load a storage-less BPF program that performs tail calls to bridge between programs with incompatible storage cookies to bypass intended cgroup storage compatibility checks.

Exploitation requires the ability to load and use BPF programs that participate in tail-call chains.

220) NULL pointer dereference (CVE-ID: CVE-2026-74304)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in qca_setup() in the hci_qca Bluetooth driver when handling an hci_uart device attached via a non-serdev path. A local attacker can trigger the vulnerable code path to cause a denial of service.

221) NULL pointer dereference (CVE-ID: CVE-2026-74303)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in qca_dmp_hdr() in the hci_qca Bluetooth driver when handling a non-serdev device path. A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue affects hci_uart attached through non-serdev paths.

222) Use-after-free (CVE-ID: CVE-2026-74302)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in hci_unregister_dev() when a timeout fires during device teardown. A local user can trigger device teardown and a timer callback to dereference freed memory to cause a denial of service or execute arbitrary code.

The freed memory may include the hdev->reset function pointer.

223) Improper resource shutdown or release (CVE-ID: CVE-2026-74301)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in alloc_mtk_intr_urb in the btmtk Bluetooth driver when handling a failure from btmtk_isopkt_pad(). A local user can trigger the error path to cause a denial of service.

224) Out-of-bounds read (CVE-ID: CVE-2026-74300)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in hci_read_codec_capabilities() when parsing a malformed controller response containing truncated codec capability elements. A remote attacker can send a specially crafted controller response to disclose sensitive information.

The issue occurs because the parser validates only the payload length and can record a two-byte capability after receiving only one payload byte.

225) Integer overflow (CVE-ID: CVE-2026-74297)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in set_rq_size() in the RDMA/mlx5 queue pair handling code when processing a user-provided rq_wqe_shift value. A local user can supply a crafted shift value to trigger undefined behavior and cause a denial of service.

226) Improper resource shutdown or release (CVE-ID: CVE-2026-74296)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the RDMA/mlx5 UAR deallocation logic when releasing a user access region index. A local user can trigger UAR allocation and release operations to cause a denial of service.

227) Out-of-bounds read (CVE-ID: CVE-2026-74295)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the hdac_hdmi_set_pin_port_mux() function when handling a written enumerated control value. A local user can supply an out-of-range enum value to disclose sensitive information.

228) Improper input validation (CVE-ID: CVE-2026-74294)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the AIU HDMI and internal codec mux put callbacks when processing written enumerated control values. A local user can supply an out-of-range enum value to cause a denial of service.

229) Improper input validation (CVE-ID: CVE-2026-74293)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src() in the fsl_audmix ASoC driver when handling user-provided enum control values. A local user can supply an out-of-range enum item to cause a denial of service.

The invalid value is converted before bounds checking, and the affected code paths use the converted value in a BIT() test and as an index into a transition table.

230) Out-of-bounds read (CVE-ID: CVE-2026-74292)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tegra_ahub_put_value_enum() in the tegra210 AHUB ASoC driver when processing a written enumerated control value. A local user can supply an out-of-range enum item value to disclose sensitive information.

231) Out-of-bounds read (CVE-ID: CVE-2026-74291)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the ASoC topology parser when parsing a malformed topology blob with non-NUL-terminated PCM, DAI, or stream capability name fields. A local user can supply a specially crafted topology blob to disclose sensitive information.

232) Information disclosure (CVE-ID: CVE-2026-74290)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper exposure of sensitive information in the cls_flow classifier when processing class statistics for map mode rules with user-controlled mask, xor, rshift, addend, and divisor values. A remote user can create a tc classifier and observe the resulting classid through class statistics to disclose sensitive information.

Exploitation requires the ability to use a tc classifier in a user or network namespace.

233) Use-after-free (CVE-ID: CVE-2026-74289)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib_leaf_notify() and fib_info reference handling when dumping IPv4 fib_info entries under RCU during fib notifier processing. A local user can trigger network namespace cleanup or device reload operations that invoke affected fib notifier paths to cause a denial of service.

The issue was reported through the netdevsim notifier path, and IPv6 is not affected by the same condition.

234) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-74288)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in fib_rules_dump() when dumping fib_rule entries during an RCU dump. A local user can trigger fib_rule processing involving a dying fib_rule to cause a denial of service.

235) NULL pointer dereference (CVE-ID: CVE-2026-74286)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the PFCP netdev statistics handler when creating a PFCP rtnetlink device and requesting netdev statistics. A local user can create a PFCP rtnetlink device to trigger the NULL pointer dereference and cause a denial of service.

The issue can be triggered immediately while building the RTM_NEWLINK notification for a newly created device.

236) Race condition (CVE-ID: CVE-2026-74284)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the HFSC scheduler class handling in net/sched/sch_hfsc.c when dequeuing packets from a class whose child qdisc becomes empty. A local user can trigger packet processing that causes a class to be marked passive twice to cause a denial of service.

The issue can incorrectly remove a parent with still-backlogged sibling classes from the virtual time tree, causing queued traffic to stop being dequeued.

237) Improper access control (CVE-ID: CVE-2026-74283)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify TIPC state.

The vulnerability exists due to improper access control in TIPCv2 generic-netlink mutator operations when handling netlink administrative commands. A local user can invoke mutating netlink operations to modify TIPC state.

The issue affects commands that can change the network id and node identity, set or flush key material, and enable or disable a UDP bearer.

238) Integer underflow (CVE-ID: CVE-2026-74282)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow in tipc_sk_conn_proto_rcv() when processing a CONN_MANAGER/CONN_ACK message. A remote attacker can send a specially crafted connection acknowledgment with an oversized ack count to cause a denial of service.

For a local connection, the connected peer socket can trigger the issue.

239) Improper input validation (CVE-ID: CVE-2026-74281)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in tipc_update_nametbl() when processing peer-advertised PUBLICATION items. A remote attacker can send specially crafted bindings with inverted service ranges to cause a denial of service.

The issue causes unbounded binding-table memory to be leaked for the lifetime of the namespace.

240) Improper resource shutdown or release (CVE-ID: CVE-2026-74280)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the sg_cleanup path in drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c when cleaning up DMA mappings after a setup failure. A local user can trigger the cleanup path to cause a denial of service.

The issue uses the wrong loop index during DMA unmapping, which can leak successfully mapped entries while repeatedly unmapping the failed one.

241) Improper resource shutdown or release (CVE-ID: CVE-2026-74279)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the sg_cleanup error path in setup_sgio_components() when cleaning up DMA mappings after a mapping failure. A local user can trigger the error path to cause a denial of service.

The issue leaks successfully mapped DMA entries while repeatedly unmapping the failed entry.

242) Information disclosure (CVE-ID: CVE-2026-74278)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper exposure of sensitive information in bounce_error_event() when delivering bounce error events to a user client via snd_seq_read(). A local user can trigger delivery of a bounce error event and read the returned fixed-length event to disclose sensitive information.

The issue exposes a raw kernel heap pointer from struct snd_seq_event to userspace through copy_to_user() in the fixed-length event handling path.

243) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74277)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper data assignment in iommu_dma_map_sg() when handling PCI P2PDMA scatterlists. A local user can trigger mapping of a multi-segment scatterlist to cause a denial of service.

The issue affects PCI P2PDMA cases involving multi-segment scatterlists.

244) Incorrect calculation (CVE-ID: CVE-2026-74276)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper buffer size calculation in the xilinx SPI driver FIFO size detection logic when handling SPI transactions in irq mode. A local user can trigger an SPI transaction of the assumed FIFO size or more to cause a denial of service.

The issue can cause the driver to spin in a while loop forever after one received byte is lost because the RX FIFO is smaller than the incorrectly assumed size.

245) NULL pointer dereference (CVE-ID: CVE-2026-74274)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the cxl region auto-discovery target array handling in drivers/cxl/core/region.c when attaching endpoint decoders to an auto-assembly region. A local user can trigger auto-discovery with a target array containing NULL holes to cause a denial of service.

The issue can occur when a removed endpoint decoder leaves a NULL hole in the target array instead of being the last element.

246) Improper locking (CVE-ID: CVE-2026-74273)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in the cxl region management code when creating or deleting regions. A local user can trigger concurrent region creation and deletion operations to cause a denial of service.

The issue arises during the window between region construction and target attachment, and between device registration and remove action registration.

247) Race condition (CVE-ID: CVE-2026-74272)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the cxl region deletion logic when handling sysfs requests and root device teardown. A local user can trigger concurrent region deletion operations to cause a denial of service.

The issue involves races between sysfs-triggered region deletion, multiple deletion paths, and kernel teardown of the CXL root device.

248) Out-of-bounds write (CVE-ID: CVE-2026-74271)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in __power_supply_populate_supplied_from when processing a device tree property with multiple power-supplies values. A local user can provide a crafted device tree configuration to cause a denial of service.

Exploitation requires the system to process a device tree configuration in which the power-supplies property contains multiple values.

249) Improper access control (CVE-ID: CVE-2026-74270)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to spoof handshake completion or disrupt an in-flight handshake.

The vulnerability exists due to improper access control in handshake_nl_done_doit() and the handshake genl DONE command when submitting a DONE request for a supplied sockfd without sender authentication. A local user can send a forged DONE message with a chosen status value to spoof handshake success or tear down a legitimate handshake.

The issue affects the DONE downcall of the handshake generic netlink family, where fd lookup confirms only that a pending handshake request exists for the supplied sockfd.

250) NULL pointer dereference (CVE-ID: CVE-2026-74266)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the sch_dualpi2 queue discipline when processing packet queue peek operations after deferred packet drops. A local user can trigger packet processing that causes the parent qlen_notify callback to deactivate a class incorrectly to cause a denial of service.

The issue occurs when the queue length temporarily drops to zero during peek even though one packet still remains queued.

251) Improper Initialization (CVE-ID: CVE-2026-74265)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in mana_gd_create_mana_wq_cq() when handling a failed work queue and completion queue creation. A local user can trigger queue creation failure to cause a denial of service.

The issue can clear an in-use completion queue table entry by destroying a queue with an uninitialized id value of 0.

252) Race condition (CVE-ID: CVE-2026-74264)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the network device watchdog code when concurrent watchdog operations are performed. A local user can trigger concurrent watchdog activity to cause a denial of service.

The issue can lead to list corruption and a kernel crash.

253) NULL pointer dereference (CVE-ID: CVE-2026-74263)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in t7xx_port_ctrl_tx() when cloning skb fragments for the control transmit path. A local user can trigger an skb_clone() failure to cause a denial of service.

254) Race condition (CVE-ID: CVE-2026-74262)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in kcm_attach() and kcm_unattach() callback handling in net/kcm/kcmsock.c when changing lower socket callbacks concurrently. A local user can trigger concurrent callback updates and execution to cause a denial of service.

The issue can lead to stale or misdirected wakeups when callback and sk_user_data state become mismatched across CPUs.

255) Race condition (CVE-ID: CVE-2026-74261)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ALSA sequencer FIFO handling in sound/core/seq/seq_fifo.c when resizing the FIFO while processing and relinking event cells. A local user can trigger concurrent FIFO resize and event handling operations to cause a denial of service.

The issue can leave a retired pool waiting indefinitely for stale cells to drain during pool teardown.

256) Race condition (CVE-ID: CVE-2026-74260)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nf_dup_netdev and nft_fwd_netdev when transmitting duplicated or forwarded packets. A local user can trigger packet transmission in a way that causes imbalanced recursion counter decrementation to cause a denial of service.

The issue is related to possible migration to a different CPU during packet transmission.

257) Improper input validation (CVE-ID: CVE-2026-74258)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in bpf_uprobe_multi_link_attach in kernel/trace/bpf_trace.c when processing user-supplied uprobe_multi array pointers. A local user can supply crafted user-space pointers to trigger a kernel fault and cause a denial of service.

The issue involves missing bounds validation with access_ok before __get_user accesses user-space data.

258) Use-after-free (CVE-ID: CVE-2026-74257)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in udp_bpf_recvmsg() when processing concurrent recvmsg operations on BPF-enabled UDP sockets. A local user can trigger concurrent socket receive operations to cause a denial of service.

The issue arises because sk_msg_recvmsg() accesses an ingress message under a lock but processes it without serialization, allowing multiple threads to touch the same sk_msg.

259) Integer overflow (CVE-ID: CVE-2026-74256)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in bpf_msg_pop_data() in the sockmap BPF message handling code when processing crafted start and len values. A local user can supply out-of-range values to trigger an out-of-bounds pop operation and cause a denial of service.

Exploitation can cause the pop loop to run past the end of the scatterlist and reach an invalid put_page() on an empty slot.

260) NULL pointer dereference (CVE-ID: CVE-2026-72502)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in skb_segment() when processing a local TCP packet with gso_size set to 0xFFFF. A local attacker can trigger a large MTU condition that causes the MSS clamp to reach 65535 to cause a denial of service.

The issue occurs because the 0xFFFF MSS value collides with the GSO_BY_FRAGS magic value, and local TCP packets do not use frag_list.

261) Use-after-free (CVE-ID: CVE-2026-72500)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the bnxt_re SRQ teardown logic when handling an NQ interrupt during SRQ destruction. A local user can trigger SRQ destruction while an interrupt arrives to cause a denial of service.

The issue occurs because toggle values may be written to an already-freed page before firmware teardown completes.

262) Use-after-free (CVE-ID: CVE-2026-72499)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the bnxt_re CQ destruction logic when handling an NQ interrupt during completion queue teardown. A local user can trigger completion queue destruction while an interrupt arrives to cause a denial of service.

The issue occurs because the toggle page may be written after it has already been freed during firmware teardown.

263) Information disclosure (CVE-ID: CVE-2026-72498)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in the RDMA bnxt_re MR info dump functionality when dumping MR information using the rdma tool. A local user can query MR information to disclose sensitive information.

The exposed value is a kernel pointer for mr_hwq.

264) Use-after-free (CVE-ID: CVE-2026-72492)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in same_client_has_lease() and smb_grant_oplock() when handling lease state for existing client oplocks during concurrent close operations. A remote user can trigger a concurrent close condition to cause a denial of service.

The issue occurs because a pointer selected from ci->m_op_list can be used after the last reference is dropped before it is dereferenced.

265) Use-after-free (CVE-ID: CVE-2026-72489)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in nvec_rx_completed() when handling an incomplete RX transfer. A local user can trigger an incomplete RX transfer to execute arbitrary code.

The freed message slot may be reallocated by a concurrent call to nvec_msg_alloc() before the code reads the message type byte.

266) Out-of-bounds read (CVE-ID: CVE-2026-72488)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in sdw_add_element_group_count when processing SoundWire group rate and lane entries. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the loop iterates with an index equal to the element count.

267) Out-of-bounds read (CVE-ID: CVE-2026-72487)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in pci_get_rom_size in drivers/pci/rom.c when processing a broken PCI ROM image. A local user can provide a malformed ROM layout to trigger a kernel crash and cause a denial of service.

On some arm64 systems, exploitation may instead trigger an alignment fault due to unaligned IOMEM access.

268) Use-after-free (CVE-ID: CVE-2026-72486)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the mtk-adsp mailbox driver when handling a late interrupt during device teardown after a failed SOF audio driver initialization. A local attacker can trigger a failed probe condition that leaves the IRQ line active and cause a late interrupt to access freed memory to cause a denial of service.

The crash was observed after probe failure in the SOF audio driver initialization path.

269) NULL pointer dereference (CVE-ID: CVE-2026-72485)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of allocation failure in coresight platform connection management functions when processing device probe data. A local user can trigger memory allocation failure during probe cleanup to cause a denial of service.

The issue occurs because cleanup code iterates connection entries up to inconsistent counter values and dereferences NULL or uninitialized pointers, leading to a kernel panic.

270) Double free (CVE-ID: CVE-2026-72484)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in comp_register_videodev() when handling a video device registration failure. A local user can trigger a device_register() failure during video device registration to cause a denial of service.

The issue occurs in the Linux kernel staging MOST video driver.

271) Integer overflow (CVE-ID: CVE-2026-72483)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to a shift-out-of-bounds error in max3421_hub_control() when handling a USBDEVFS_CONTROL ioctl for the root hub with a crafted wValue parameter. A local user can send a specially crafted ioctl request to corrupt kernel memory.

Exploitation requires access to the root hub device via /dev/bus/usb/.../001.

272) Use-after-free (CVE-ID: CVE-2026-72482)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a double decrement leading to a use-after-free condition in command_ioctl() when handling IO ioctl operations on gpib descriptors. A local user can trigger an error path during ioctl processing to trigger a use-after-free.

Exploitation requires a concurrent close_dev_ioctl() operation on an actively used descriptor.

273) Use of Uninitialized Variable (CVE-ID: CVE-2026-72481)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in the ak8975 magnetometer driver when processing i2c block read results that are shorter than the destination buffer. A local user can trigger the driver to forward partially uninitialized buffer contents to IIO buffers to disclose sensitive information.

The leaked data may be exposed from kernel stack memory to userspace.

274) Out-of-bounds read (CVE-ID: CVE-2026-72480)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ams_event_to_channel() and ams_handle_event() when handling device events. A local attacker can trigger an event with a non-matching scan index to cause a denial of service.

275) Use of Uninitialized Variable (CVE-ID: CVE-2026-72479)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in mma8452_read_raw() when handling a failed I2C block read in mma8452_read(). A local user can trigger an I2C read failure and cause the caller to use uninitialized stack memory to disclose sensitive information.

276) Out-of-bounds read (CVE-ID: CVE-2026-72478)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in run_get_highest_vcn() when mounting an NTFS filesystem containing a crafted $LogFile UpdateMappingPairs record with unterminated mapping-pairs data. A remote attacker can provide a specially crafted filesystem image to cause a denial of service.

The issue is triggered during log replay on mount.

277) Use-after-free (CVE-ID: CVE-2026-72476)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in dma_release_channel() when releasing a dma channel. A local user can trigger the release of a channel whose device reference may already be freed to cause a denial of service.

278) Memory leak (CVE-ID: CVE-2026-72475)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in axi_dmac_prep_peripheral_dma_vec() in the dma-axi-dmac driver when validating DMA vector addresses and lengths. A local user can trigger the failure path with invalid DMA vector parameters to cause a denial of service.

279) Improper resource shutdown or release (CVE-ID: CVE-2026-72474)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the dma-axi-dmac driver descriptor handling when freeing DMA descriptors from softirq context. A local attacker can trigger DMA operations that cause descriptor cleanup to invoke dma_free_coherent() in interrupt context to cause a denial of service.

The issue is observable on architectures such as Microblaze or arm64 where DMA_DIRECT_REMAP is set.

280) Use of Uninitialized Variable (CVE-ID: CVE-2026-72471)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an uninitialized value in ni_seek_data_or_hole() in the ntfs3 file system code when seeking data or holes in a corrupted file. A local user can trigger the vulnerable code path with a corrupted file system state to cause a denial of service.

281) Heap-based buffer overflow (CVE-ID: CVE-2026-72470)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the ntfs3 log replay scratch buffer handling in log_replay() and read_log_page() when mounting a dirty NTFS volume with an on-disk log page size larger than the initially allocated buffer. A local user can mount a specially crafted NTFS volume to cause a denial of service or execute arbitrary code.

Exploitation requires a dirty NTFS volume whose log records a larger page size than the mounting host initially allocated.

282) Use-after-free (CVE-ID: CVE-2026-72469)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in rpcrdma_cm_event_handler() and RDMA connection teardown handling in the xprtrdma component when processing an RDMA_CM_EVENT_ADDR_CHANGE event before RDMA_CM_EVENT_ESTABLISHED. A local user can trigger crafted RDMA connection state changes to cause a denial of service.

The issue occurs because an unmatched reference decrement can underflow the kref and leave disconnect handling operating on a freed endpoint.

283) Race condition (CVE-ID: CVE-2026-72468)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the xprtrdma NFS/RDMA transport removal callback path when racing an NFS/RDMA mount against RDMA device removal. A local user can trigger the race condition to cause a denial of service.

The issue can result in a NULL pointer dereference in the kernel during device removal handling.

284) NULL pointer dereference (CVE-ID: CVE-2026-72467)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rpcrdma_encode_write_list() when processing an NFS/RDMA read with a non-4-byte-aligned receive page length after a connection succeeds with a NULL write-pad memory region. A local user can trigger a connection or reconnection that hits a local memory region allocation, DMA-map, memory region map, or post-send failure to cause a denial of service.

A remote peer alone cannot force the local memory region setup failure required for exploitation.

285) Improper input validation (CVE-ID: CVE-2026-72465)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in rpcrdma_reply_handler() and rpcrdma_post_recvs() when processing a well-formed reply with an unknown XID and an inflated credit grant. A remote attacker can send a specially crafted reply to cause a denial of service.

The issue occurs because the raw credit value parsed from the wire can reach Receive work request allocation logic without being clamped.

286) Resource exhaustion (CVE-ID: CVE-2026-72464)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in rpcrdma_reply_handler() when processing malformed RPC/RDMA replies. A remote attacker can send a sustained stream of short replies or replies with an unrecognized RPC/RDMA version to cause a denial of service.

The issue can drain the client's posted Receive queue and stall the transport until reconnect.

287) Race condition (CVE-ID: CVE-2026-72462)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in AppArmor unix socket mediation in security/apparmor/af_unix.c when accessing the peer socket path during permission checks. A local user can trigger concurrent unix socket operations to cause a denial of service.

The issue occurs when peer_path is used for unix domain socket mediation.

288) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72461)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in AppArmor's update_sk_ctx function when updating the socket security context. A local user can trigger socket context updates to cause a denial of service.

289) NULL pointer dereference (CVE-ID: CVE-2026-72460)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in aa_change_profile() when building a replacement label during a profile change. A local user can trigger label build failure handling to cause a denial of service.

The issue occurs in the AppArmor profile transition logic during processing of profile change requests.

290) Improper resource shutdown or release (CVE-ID: CVE-2026-72459)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in aa_label_alloc() in the AppArmor label handling code when allocating a label and the proxy allocation step fails. A local user can trigger an allocation failure condition to cause a denial of service.

291) NULL pointer dereference (CVE-ID: CVE-2026-72458)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in AppArmor unpack_pdb in security/apparmor/policy_unpack.c when processing a policy database after unpack_dfa fails. A local user can trigger the vulnerable code path to cause a denial of service.

292) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72457)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in unpack_pdb() in AppArmor policy unpacking when processing older policy data that requires allocation of a missing ACCEPT2 table. A local user can supply crafted policy data to trigger an allocation failure and cause a denial of service.

The issue occurs because the function could return a policy database with the required ACCEPT2 table missing after an allocation failure.

293) Improper resource shutdown or release (CVE-ID: CVE-2026-72456)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in get_current_exe_path() when resolving the current executable path and aa_path_name() fails. A local user can trigger a path resolution failure to cause a denial of service.

294) Use of Uninitialized Variable (CVE-ID: CVE-2026-72455)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of an uninitialized pointer in the AppArmor path handling logic when auditing file paths after a dentry has been replaced with aa_null.dentry. A local user can trigger file open operations that reach the affected audit path to cause a denial of service.

The issue can result in a kernel page fault during processing in audit_log_untrustedstring().

295) Use-after-free (CVE-ID: CVE-2026-72454)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition leading to use-after-free in the mipi i3c hci address-to-device lookup function i3c_hci_addr_to_dev() when handling in-band interrupt events in the irq handler. A local attacker can trigger concurrent device addition or removal while an in-band interrupt is being processed to cause a denial of service.

The issue arises because the irq handler cannot take the bus lock protecting the device list.

296) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72453)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in regcache_init in the regcache subsystem when finalizing cache initialization after a populate callback error. A local user can trigger an error in the populate callback to cause a denial of service.

The hidden initialization failure can lead to NULL pointer dereferences when the regcache is later accessed.

297) Double free (CVE-ID: CVE-2026-72452)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in intel_crtc_put_color_blobs()/intel_crtc_free_hw_state() when cleaning up a failed atomic state in the i915 display driver. A local user can trigger an atomic state failure that leads to repeated cleanup of the same CRTC hardware state to cause a denial of service.

The issue can occur if cleared state preparation exits early after a DP tunnel group state lookup failure, allowing the same blob references to be dropped more than once.

298) Out-of-bounds read (CVE-ID: CVE-2026-72450)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds shift in xfrm_selector_match and address matching helpers when processing xfrm selector matching with an AF_UNSPEC selector and an oversized prefix length. A local attacker can provide a crafted selector with a mismatched family or excessive prefix length to cause a denial of service.

The issue can be triggered when an AF_UNSPEC selector is matched against an IPv4 flow while XFRM_STATE_AF_UNSPEC is set.

299) Double free (CVE-ID: CVE-2026-72449)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in kfd_criu_resume_svm() when handling a second AMDKFD_IOC_CRIU_OP request from the same process via /dev/kfd. A local user can trigger repeated cleanup of freed list entries to cause a denial of service.

The issue is reachable by an unprivileged render-group user and is caused by stale list entries left in the criu_svm_metadata_list after cleanup.

300) Improper resource shutdown or release (CVE-ID: CVE-2026-72448)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the otx2_free_sq_res() send-queue resource teardown logic when tearing down a send queue with timestamping enabled. A local user can trigger interface shutdown or device removal to cause a denial of service.

Only send queues using timestamping are affected.

301) Race condition (CVE-ID: CVE-2026-72447)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized kernel memory to userspace.

The vulnerability exists due to a race condition in sctp_diag endpoint dumping when traversing endpoint address lists during diagnostic dumping without holding the socket lock. A local user can trigger concurrent socket operations while requesting SCTP diagnostic endpoint data to disclose uninitialized kernel memory to userspace.

The issue occurs because address counts gathered under RCU protection can become inconsistent before the subsequent copy operation.

302) Out-of-bounds write (CVE-ID: CVE-2026-72446)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or corrupt memory.

The vulnerability exists due to an out-of-bounds write in handle_uaudio_stream_req() when processing a stream disable request with no matching active interface. A local user can send a specially crafted AF_QIPCRTR request to cause a denial of service or corrupt memory.

The issue is reachable from unprivileged local userspace over AF_QIPCRTR.

303) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72445)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the usb qcom audio offload stream handling code when processing a stream enable request with an invalid service interval. A local user can trigger a failed enable request to cause a denial of service.

The issue can leave the substream stuck in a busy state until it is disabled or disconnected.

304) Out-of-bounds read (CVE-ID: CVE-2026-72444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized memory contents.

The vulnerability exists due to an out-of-bounds read in __skb_flow_dissect() when processing packets on non-ethernet devices with flow dissector ethernet address matching enabled. A local user can send a crafted packet through AF_PACKET to disclose uninitialized memory contents.

Exploitation requires a TUN device in L3 mode together with a multiq qdisc and a flower filter matching on eth_src.

305) Use-after-free (CVE-ID: CVE-2026-72443)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ALSA usb-audio MIDI 2.0 endpoint handling code when freeing endpoints after a later setup failure while submitted input URBs can still complete. A local user can trigger the vulnerable create-error path to cause a denial of service.

The issue occurs because a completion handler may dereference freed endpoint state or attempt to resubmit from a stale endpoint after URBs were started.

306) Use of uninitialized resource (CVE-ID: CVE-2026-72441)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory usage in dgram_recvmsg() when copying a socket address to user space after parsing an IEEE 802.15.4 address with mode IEEE802154_ADDR_NONE. A local user can receive a crafted packet and invoke recvmsg() to disclose sensitive information.

The issue occurs because the pan_id field of struct ieee802154_addr is left uninitialized when the address mode is IEEE802154_ADDR_NONE.

307) Improper resource shutdown or release (CVE-ID: CVE-2026-72440)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the raid1 write request handling in drivers/md/raid1.c when processing write requests that fail before being successfully queued. A local user can trigger write failure paths to cause a denial of service.

The issue involves leaked writes_pending and barrier references on error paths.

308) Improper resource shutdown or release (CVE-ID: CVE-2026-72439)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the raid10 write request handling in drivers/md/raid10.c when processing write requests that fail before being queued. A local user can trigger write request failure paths to cause a denial of service.

The issue occurs because certain error paths complete the bio without reaching the normal write completion path.

309) Improper resource shutdown or release (CVE-ID: CVE-2026-72438)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in raid10_handle_discard() in drivers/md/raid10.c when handling discard requests and discard split allocation failures. A local user can trigger discard failure paths to cause a denial of service.

The issue is caused by missing releases of writes_pending and barrier references on certain error paths.

310) Memory leak (CVE-ID: CVE-2026-72437)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in raid1_read_request() in the md/raid1 subsystem when handling retried reads with REQ_NOWAIT set and the read would block on retry. A local user can trigger this condition to cause a denial of service.

The issue occurs when a pre-allocated r1_bio already exists for the retried read and wait_read_barrier() fails.

311) Use-after-free (CVE-ID: CVE-2026-72435)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ipset comment extension handling in netfilter when freeing comment extension pointers. A local user can trigger ipset comment initialization or cleanup operations to cause a denial of service.

312) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72434)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown of delayed work in the ipset garbage collector in netfilter when destroying a set with timeouts enabled. A local user can destroy a crafted set to cause a denial of service.

Only sets configured with timeout support are affected.

313) Use of Uninitialized Variable (CVE-ID: CVE-2026-72433)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in nft_meta_bridge_get_eval in nft_meta_bridge.c when evaluating the NFT_META_BRI_IIFPVID metadata expression. A local attacker can trigger processing of a bridge interface PVID query that encounters an error condition to disclose sensitive information.

314) Use-after-free (CVE-ID: CVE-2026-72431)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in /proc/allocinfo when reading allocinfo data across read batches after module unload. A local user can trigger repeated reads of /proc/allocinfo while a module is unloaded to cause a denial of service.

The issue occurs because iterator state cached from a previous read batch can still reference freed module memory after mod_lock is dropped between batches.

315) Improper resource shutdown or release (CVE-ID: CVE-2026-72430)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to improper resource shutdown or release in tcf_ct_fill_params() in net/sched/act_ct.c when handling failed RTM_NEWACTION requests with TCA_CT_LABELS present on certain error paths. A local user can send a crafted RTM_NEWACTION request to cause a resource leak.

Exploitation requires CAP_NET_ADMIN over a network namespace and is reachable from an unprivileged user namespace on default-userns kernels.

316) Incorrect calculation (CVE-ID: CVE-2026-72428)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass Spectre v4 sanitization checks.

The vulnerability exists due to improper index calculation in check_stack_write_fixed_off() in the BPF verifier when handling fixed-offset stack writes. A local user can trigger a crafted stack write pattern to bypass Spectre v4 sanitization checks.

The issue occurs because the sanitization pre-check examines different stack slot bytes than the write path updates.

317) Use-after-free (CVE-ID: CVE-2026-72427)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the cgroup BPF effective program array handling in kernel/bpf/cgroup.c when updating or detaching BPF programs with BPF_F_PREORDER configurations. A local user can trigger incorrect effective array slot selection to cause a denial of service.

The issue occurs because preorder programs are placed at the front of the effective array, so linear traversal of the program list can select the wrong slot.

318) Improper resource shutdown or release (CVE-ID: CVE-2026-72425)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ice_reset_all_vfs() when resetting virtual functions with FDIR filters enabled. A local user can trigger a VF reset after enabling an FDIR filter to cause a denial of service.

The issue occurs because CTRL VSI objects are invalidated but not freed for affected virtual functions.

319) NULL pointer dereference (CVE-ID: CVE-2026-72424)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the msc313 RTC shared IRQ handler when handling a shared IRQ during device probe before driver data is initialized. A local attacker can trigger the shared interrupt in that window to cause a denial of service.

The issue occurs in interrupt context on systems where the IRQ line is shared with another device.

320) Out-of-bounds write (CVE-ID: CVE-2026-72423)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in conntrack lookup and allocation bpf kfunc wrappers in net/netfilter/nf_conntrack_bpf.c when handling an opts pointer with an invalid size smaller than the end of opts->error. A local user can supply a crafted opts pointer and opts__sz value to cause memory corruption.

Exploitation requires invoking the affected bpf conntrack lookup or allocation helpers with an invalid opts size.

321) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72421)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended unreachable routing behavior.

The vulnerability exists due to improper control flow in fib_lookup() in the IPv4 FIB lookup logic when performing route lookups with CONFIG_IP_MULTIPLE_TABLES enabled and no rule added. A local user can configure routes that trigger lookup of the merged local/main table followed by the default table to bypass intended unreachable routing behavior.

The issue occurs because an error route result from the local or main table can be overwritten by a subsequent lookup in the default table.

322) Race condition (CVE-ID: CVE-2026-72420)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a data race in break_stripe_batch_list() and raid5_make_request() in the md/raid5 subsystem when handling overlapping stripe I/O requests. A local user can submit crafted I/O that triggers the R5_Overlap flag race to cause a denial of service.

The issue can leave a task waiting on a bit indefinitely.

323) Out-of-bounds read (CVE-ID: CVE-2026-72419)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in nf_nat_register_fn in the netfilter nf_nat subsystem when handling netfilter netlink requests after nf_nat_init() has failed. A local privileged user can send a specially crafted netfilter request to cause a denial of service.

The issue can occur when nf_nat_core is built in and initialization has failed, leaving an invalid nat_net pointer state for dependent modules.

324) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72418)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state handling in nf_conncount when processing early-confirmed connection tracking entries for reused TIME_WAIT sockets or similar setup packets. A remote attacker can initiate network connections that trigger miscounting to cause a denial of service.

The issue can cause valid new connections to be falsely rejected in connlimit soft-limiting scenarios.

325) Improper input validation (CVE-ID: CVE-2026-72416)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in nft_compat ebtables target validation when handling bridge table targets. A local user can use a non-bridge target in the ebtables emulation path to cause a denial of service.

326) Out-of-bounds read (CVE-ID: CVE-2026-72415)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ge_put_enum_double() when processing a control write with an out-of-range enumeration index. A local user can supply a crafted enumeration index to disclose sensitive information.

327) Division by zero (CVE-ID: CVE-2026-72414)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in future_base_time() in the sja1105 PTP perout handling code when processing a user-provided period value that becomes zero after conversion to SJA1105 clock ticks. A local user can provide a very small period value to trigger a kernel crash and cause a denial of service.

328) Memory leak (CVE-ID: CVE-2026-72413)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in SCTP INIT handling in net/sctp/sm_statefuns.c when processing INIT chunks with unrecognized parameters. A remote attacker can send a specially crafted INIT chunk to cause a denial of service.

The issue occurs when err_chunk is allocated by sctp_verify_init() and is not freed on certain error and success return paths.

329) Improper input validation (CVE-ID: CVE-2026-72410)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify NIX maximum logical function settings in an invalid state.

The vulnerability exists due to improper input validation in the devlink NIX maximum LF validation logic in rvu_devlink.c when handling devlink commands before or during NIX LF assignment. A local privileged user can issue a devlink command to modify NIX maximum LF settings in an invalid state.

The issue affects the octeontx2-af driver logic that is intended to permit resizing only before any LF attach requests from PFs and VFs and not later or concurrently.

330) Improper locking (CVE-ID: CVE-2026-72409)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the mvneta resume path when resuming the system while NAPI poll is pending after a per-CPU interrupt has been disabled. A local user can trigger a suspend and resume sequence during this condition to cause a denial of service.

This affects Marvell MPIC platforms using the mvneta driver, where the per-CPU interrupt can remain masked after resume and result in complete loss of network connectivity.

331) Out-of-bounds read (CVE-ID: CVE-2026-72408)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in geneve_gro_complete() when processing an attacker-supplied GRO hint option on a tunnel without GRO hint enabled. A remote attacker can send a specially crafted packet to disclose sensitive information.

Tunnels that enable the GRO hint are unaffected.

332) Out-of-bounds read (CVE-ID: CVE-2026-72407)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in geneve_gro_complete() when processing encapsulated geneve packets. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue can occur when the GRO hint state changes concurrently or when re-read option bytes differ from the ones previously parsed.

333) Double free (CVE-ID: CVE-2026-72406)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in gem_init_one() in the sungem network driver when handling a failed register_netdev() call during device probe. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs in the probe error cleanup path for a half-registered device.

334) Use-after-free (CVE-ID: CVE-2026-72405)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in udp_tunnel_nic_device_sync_work() when handling concurrent device operations. A local user can trigger concurrent device operations to cause a denial of service.

The issue arises because a second work item can remain queued while the associated structure is freed.

335) NULL pointer dereference (CVE-ID: CVE-2026-72403)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in fcp_find_fc_interface() in the ALSA FCP USB audio driver when processing a malformed USB device with a vendor-specific interface that has no endpoint descriptors. An attacker with physical access can connect a specially crafted USB device to trigger a kernel crash and cause a denial of service.

336) Information disclosure (CVE-ID: CVE-2026-72402)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the BPF verifier log output in print_bpf_insn() when printing ldimm64 instructions with pointer-bearing pseudo sources. A local user can trigger verifier logging of crafted BPF instructions to disclose sensitive information.

The issue occurs when pointer leaks are not allowed but certain pseudo source types are still resolved to kernel pointer values before the verifier log prints the instruction.

337) Memory leak (CVE-ID: CVE-2026-72401)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in bpf_check() in the BPF verifier when handling a BPF program verification request and a later allocation of env->succ fails after env->insn_aux_data has been allocated. A local user can trigger an error path that bypasses cleanup to cause a denial of service.

338) Out-of-bounds read (CVE-ID: CVE-2026-72400)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in seg6_validate_srh() when processing a BPF program-supplied Segment Routing Header length in the SEG6 encapsulation path. A local user can supply a crafted short SEG6 encapsulation header to disclose sensitive information.

Exploitation is reachable through the BPF SEG6 encap path, including the SEG6 local BPF END_B6 and END_B6_ENCAP actions.

339) Improper input validation (CVE-ID: CVE-2026-72397)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to send incorrect voltage commands to a PMBus device.

The vulnerability exists due to improper input validation in pmbus_data2reg_vid() in the pmbus core when converting user-supplied voltage values for PMBUS_VOUT_COMMAND. A local user can request a voltage using a non-VR11 VID mode to send incorrect voltage commands to a PMBus device.

Only drivers that select a non-VR11 VID mode and expose a regulator or hwmon vout setter are affected.

340) Out-of-bounds read (CVE-ID: CVE-2026-72396)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in adm1275_probe() when comparing a device-provided model string returned by i2c_smbus_read_block_data(). A local user can provide a shortened crafted device string to cause the kernel to read uninitialized stack memory and disclose sensitive information.

Exploitation requires access to a device handled by the adm1275 hwmon driver.

341) Improper handling of exceptional conditions (CVE-ID: CVE-2026-72395)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to bypass hardware protection handling.

The vulnerability exists due to improper exception handling in the pmbus regulator event notification worker when processing combined regulator fault events. A local privileged user can trigger multiple distinct regulator events before the worker runs to bypass hardware protection handling.

The issue occurs because combined event bitmasks are passed unmodified to the regulator core, where strict event handling can leave the fault reason unset.

342) Division by zero (CVE-ID: CVE-2026-72394)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to divide-by-zero in the aspeed_tach_val_to_rpm() function in the aspeed-g6-pwm-tach driver when processing a tachometer value reported as zero. A local user can trigger a zero divisor condition to cause a denial of service.

The issue can result in a kernel panic.

343) NULL pointer dereference (CVE-ID: CVE-2026-72392)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fib6_walk_continue() when resuming a multi-batch IPv6 FIB dump after a concurrent table insertion changes hash-chain ordering. A remote attacker can trigger netlink dump processing to cause a denial of service.

The issue occurs because walker state can become inconsistent, with the root referencing a different table while the node still points into the previous one.

344) Memory leak (CVE-ID: CVE-2026-72391)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in sfp_i2c_mdiobus_destroy() when removing a copper or RollBall SFP module that instantiated an MDIO bus. A local user can trigger module hot-removal to cause a denial of service.

The issue is triggered on module hot-removal and not on driver unbind.

345) Use-after-free (CVE-ID: CVE-2026-72390)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the sch_teql qdisc implementation when processing concurrent modifications to the teql master slaves list during packet transmission and qdisc teardown. A local user can trigger concurrent qdisc operations to cause a denial of service.

The issue arises from a race condition across CPUs involving stale pointers retained during list traversal.

346) Use-after-free (CVE-ID: CVE-2026-72389)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the STP timer handling in the Linux kernel bridge subsystem when deleting a bridge while the topology change timer is armed on an administratively down bridge. A local user can trigger bridge topology change detection and delete the bridge to cause a denial of service.

The issue occurs because the IFF_UP check was missing in br_topology_change_detection().

347) Improper locking (CVE-ID: CVE-2026-72388)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the panthor scheduler fence handling code when accessing shared dma_fence objects from hardirq context. A local user can trigger fence operations and race lock acquisition to cause a denial of service.

The issue arises because dma_fence objects may be shared with other subsystems and accessed from hardirq context.

348) NULL pointer dereference (CVE-ID: CVE-2026-72387)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an invalid pointer dereference in group_process_tiler_oom() when handling an ERR_PTR() heap pointer. A local user can trigger the vulnerable code path to cause a denial of service.

349) Memory leak (CVE-ID: CVE-2026-72386)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in the panthor scheduler group eviction handling when canceling pending tiler OOM work. A local user can trigger group eviction before the tiler OOM work is serviced to cause a denial of service.

350) NULL pointer dereference (CVE-ID: CVE-2026-72385)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fprobe_fgraph_entry() when processing a per-ip fprobe list that changes between sizing and fill walks under rcu_read_lock(). A local user can register a fprobe on an already-live ip to cause a denial of service.

351) Use-after-free (CVE-ID: CVE-2026-72384)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ts4800 irqchip chained interrupt handler when the parent interrupt fires after the driver has been removed. A local user can trigger the parent interrupt after driver removal to cause a denial of service.

The issue stems from the chained handler not being cleared during device removal, leaving a dangling handler reference.

352) Use-after-free (CVE-ID: CVE-2026-72383)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in sctp_free_addr_wq() and sctp_addr_wq_timeout_handler() when handling addr_wq_timer teardown. A local attacker can trigger a race condition to cause a denial of service.

The issue arises because a timer handler may continue running after the associated wait queue has been freed.

353) Integer underflow (CVE-ID: CVE-2026-72382)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow in parse_dacl() in fs/smb/server/smbacl.c when processing a crafted security descriptor in SMB2_SET_INFO security information requests. A remote attacker can send a specially crafted request to cause a denial of service.

The issue can bypass the ACE count guard for undersized DACLs and trigger large temporary ACL state and pointer-array allocations.

354) Out-of-bounds write (CVE-ID: CVE-2026-72380)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in pvcalls_front_event_handler() when processing a backend-supplied ring response with an out-of-range req_id. A local user can supply a crafted backend response to cause memory corruption.

The issue affects the Xen pvcalls frontend in deployments where the frontend does not trust its backend.

355) Improper access control (CVE-ID: CVE-2026-72379)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to create a temporary file with invalid ownership.

The vulnerability exists due to improper access control in vfs_tmpfile() when creating an O_TMPFILE on an idmapped mount that does not map the caller's fsuid or fsgid. A local user can create a temporary file on such a mount to create a temporary file with invalid ownership.

The issue affects filesystems that support idmapped mounts and implement tmpfile handling, as well as overlayfs through upper-layer tmpfile creation.

356) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72378)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in afs_extract_vl_addrs() when parsing AFS volume location address data. A local user can trigger processing of malformed address data to cause a denial of service.

357) NULL pointer dereference (CVE-ID: CVE-2026-72377)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the AFS symlink and mountpoint folio release handling when memory management code attempts to release folios for AFS symlinks or mountpoints without buffer_heads. A local attacker can trigger folio release on a crafted AFS symlink or mountpoint to cause a denial of service.

The issue occurs because AS_RELEASE_ALWAYS is set for AFS symlinks and mountpoints even though their address space operations do not provide a release_folio callback.

358) Improper Initialization (CVE-ID: CVE-2026-72376)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in afs_alloc_cell in fs/afs/cell.c when allocating AFS cells. A local user can trigger an idr_alloc_cyclic() failure to cause a denial of service.

359) Improper Initialization (CVE-ID: CVE-2026-72375)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in afs_vnode lock_work handling when processing file locking operations on AFS inodes. A local user can trigger lock operations on a reused inode to cause a denial of service.

The issue can lead to kernel warnings from debug object handling, and the affected work item may still be running during inode eviction.

360) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72374)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of incomplete message parsing state in afs callback service message parsers when processing callback notification request streams. A remote attacker can send crafted callback messages with incomplete packet sequences to cause a denial of service.

The issue affects the AFS filesystem client callback service that listens through an rxrpc server for callback notifications.

361) NULL pointer dereference (CVE-ID: CVE-2026-72373)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing null pointer check in afs_break_some_callbacks() when handling callback breaks for an unknown AFS volume. A local user can trigger callback processing referencing an unknown volume to cause a denial of service.

362) Race condition (CVE-ID: CVE-2026-72372)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in net->cells_dyn_ino in the AFS subsystem when modifying and removing cell entries. A local user can trigger concurrent AFS cell allocation and destruction operations to cause a denial of service.

363) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72371)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in afs_insert_volume_into_cell() when replacing an AFS volume entry in the cell volume tree. A local user can trigger volume replacement operations to cause a denial of service.

The issue can cause the old volume to be removed from the tree twice while the new volume is never removed.

364) Improper resource shutdown or release (CVE-ID: CVE-2026-72370)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in iomap direct I/O handling in fs/iomap/direct-io.c when processing atomic direct I/O requests with a size mismatch that results in a short bio. A local user can trigger the error path with a short bio to cause a denial of service.

The issue occurs because pages already attached to the bio are not released before the bio reference is dropped on the affected error path.

365) Integer overflow (CVE-ID: CVE-2026-72369)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an integer overflow in minix_blocks_needed() in the Minix filesystem superblock handling when mounting a crafted Minix v3 filesystem image. An attacker with physical access can provide a crafted filesystem image with inode or zone counts near UINT_MAX to trigger a kernel panic.

The issue occurs because a zero bitmap block count can be accepted as valid, leading minix_fill_super() to dereference s_imap[0] or s_zmap[0] without allocated bitmap buffers.

366) Double free (CVE-ID: CVE-2026-72368)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double unlock in cachefiles_get_directory() when handling an -ENOMEM error from start_creating(). A local user can trigger the affected error path to cause a denial of service.

The issue corrupts the rwsem state after the parent directory lock has already been released in __start_dirop().

367) Integer underflow (CVE-ID: CVE-2026-72367)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data corruption.

The vulnerability exists due to an integer underflow in fs/iomap/ioend.c when handling concurrent truncate and writeback operations around EOF. A local user can trigger concurrent file append writes and truncation to cause data corruption.

The issue occurs when EOF moves to or before the ioend start offset, causing a negative size calculation to wrap to a large unsigned value.

368) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72365)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in netfs writethrough write handling when processing asynchronous O_SYNC writes. A local user can trigger writethrough write operations to cause a denial of service.

Asynchronous O_SYNC writes may not be collected as intended.

369) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72364)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in netfs_writepages writeback logic when handling writeback errors. A local user can trigger a writeback error condition to cause a denial of service.

370) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72363)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource state management in netfs writeback handling when processing writeback iteration after an ENOMEM condition. A local user can trigger memory pressure during writeback operations to cause a denial of service.

371) NULL pointer dereference (CVE-ID: CVE-2026-72362)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in xe_pt_zap_ptes_entry() when processing unpopulated page-table entries during a page-table walk. A local user can trigger the driver to handle an entry with a NULL child pointer to cause a denial of service.

372) Double free (CVE-ID: CVE-2026-72361)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in hw_engine_init() in the drm/xe hw_engine component when handling a probe failure error path for a managed BO allocated with xe_managed_bo_create_pin_map(). A local user can trigger the affected initialization error path to cause a denial of service.

The issue occurs because the managed BO already has a devm cleanup action registered, and a second cleanup happens during device-managed resource unwinding.

373) Improper input validation (CVE-ID: CVE-2026-72360)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the xe GuC relay PF request handler when processing FAST_REQUEST or EVENT relay messages. A local user can send unsupported relay messages to trigger an assertion on the PF side to cause a denial of service.

The issue affects VF/PF relay handling in SR-IOV environments.

374) Improper access control (CVE-ID: CVE-2026-72357)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource access in __in_uprobe_trampoline in arch/x86/kernel/uprobes.c when checking whether an instruction pointer is in an uprobe trampoline during uprobe unregister and optimization handling. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the check uses the tracer context rather than the traced process context for VMA lookup.

375) Improper resource shutdown or release (CVE-ID: CVE-2026-72356)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in cifs_issue_read() when handling a failed read request. A local user can trigger a failed read operation to cause a denial of service.

376) Integer overflow (CVE-ID: CVE-2026-72352)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in hid_bpf_get_data() in the HID-BPF subsystem when validating a caller-provided offset and size. A local user can supply a crafted offset and size combination to cause a denial of service.

Exploitation requires the ability to invoke the HID-BPF helper.

377) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-72350)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds shift operation in u32_match_it() in the xt_u32 netfilter match when evaluating a malformed u32 rule during packet processing. A local user can supply a crafted u32 rule with a shift count of 32 or more to cause a denial of service.

378) Integer overflow (CVE-ID: CVE-2026-72349)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended rate-based matching logic.

The vulnerability exists due to integer truncation in xt_rateest_mt() in netfilter xt_rateest when processing rate estimator values on high-speed links. A local user can trigger rate comparisons involving byte rates above 2^32-1 to bypass intended rate-based matching logic.

The issue occurs on links faster than approximately 34 Gbps, where the byte rate may exceed 4.3 GBps and no longer fits in 32-bit variables.

379) Improper input validation (CVE-ID: CVE-2026-72347)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the xt_connmark CONNMARK target revision 2 handling when evaluating a rule with invalid shift parameters. A local user can install a malformed rule with a shift_bits value of 32 or more or an invalid shift_dir value to cause a denial of service.

The issue is triggered when the malformed rule is evaluated in the packet path.

380) Off-by-one (CVE-ID: CVE-2026-72345)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in mlx5_lag_create_single_fdb() rollback logic when handling error rollback during single-FDB creation. A local user can trigger a failure during single-FDB creation to cause a denial of service.

The reverse cleanup loop may operate on uninitialized state or double-tear-down a rule that was already rolled back.

381) Out-of-bounds write (CVE-ID: CVE-2026-72343)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in mlx5e_hv_vhca_stats_work() and mlx5e_hv_vhca_stats_create() when handling hypervisor VHCA statistics after channel initialization. A local user can trigger stats handling with an incorrectly sized buffer to cause a denial of service.

The issue can result from a zero-sized allocation that leaves the buffer pointer set to ZERO_SIZE_PTR, and may also occur across a detach and resume cycle when buffer sizing becomes smaller than the persisted channel count.

382) Race condition (CVE-ID: CVE-2026-72342)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mlx5 hv vhca stats agent registration and workqueue handling when processing asynchronous control invalidation callbacks during agent creation. A local user can trigger the vulnerable control path to cause a denial of service.

The issue can lead to a NULL function pointer invocation, timer list corruption, or a NULL pointer dereference.

383) Race condition (CVE-ID: CVE-2026-72341)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mlx5 driver channel statistics handling when reading netdevice statistics concurrently with channel initialization. A local user can trigger concurrent statistics queries to cause a denial of service.

The issue can lead to a NULL pointer dereference on weakly ordered architectures such as ARM, PowerPC, and RISC-V during NIC bringup.

384) Race condition (CVE-ID: CVE-2026-72340)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt hardware rule entries.

The vulnerability exists due to a race condition in the microchip vcap api and debugfs rule dump handling when accessing shared Super VCAP instances concurrently. A local user can trigger concurrent rule dump and rule write operations to corrupt hardware rule entries.

The issue affects sparx5 and lan969x devices where IS0 and IS2 instances share the same Super VCAP hardware block, cache, and command registers.

385) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-72338)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to perform an out-of-bounds heap write.

The vulnerability exists due to a time-of-check time-of-use race condition leading to an out-of-bounds write in the act_pedit tc offload handling when sizing and filling a flow_rule buffer during cls_flower offload processing. A local privileged user can trigger concurrent action and classifier operations to perform an out-of-bounds heap write.

The written data is attacker-controlled and can corrupt an adjacent slab object.

386) Use-after-free (CVE-ID: CVE-2026-72337)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Bluetooth 6LoWPAN debugfs enable handler when processing a debugfs enable write that races with module exit. A local user can trigger an enable state change and race it with module teardown to cause a denial of service.

The issue occurs because queued work can later access stale state, including listen_chan, after the debugfs operation has returned.

387) Use-after-free (CVE-ID: CVE-2026-72336)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in lowpan_control_write in the Bluetooth 6LoWPAN subsystem when handling a debugfs control write that races with L2CAP connection teardown. A local user can trigger concurrent connection and disconnect or device close activity to cause a denial of service.

The issue arises because an L2CAP connection reference is not held after device protection is released, allowing the connection to be freed before later dereference.

388) Use-after-free (CVE-ID: CVE-2026-72335)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mgmt_add_adv_patterns_monitor_complete in the Bluetooth management subsystem when handling advertisement monitor add completion after a failed MSFT offload add operation. A local user can send a crafted Bluetooth management request to trigger the use of freed memory and cause a denial of service.

The issue occurs in the queued management add flow after a monitor is inserted before the powered MSFT setup step, and it was reproduced by KASAN as a slab-use-after-free.

389) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72334)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of malformed packet sequences in the Bluetooth ISO packet reassembly logic in net/bluetooth/iso.c when processing malformed ISO_START, ISO_CONT, and ISO_END frames from a Bluetooth controller. A remote attacker can send a specially crafted sequence of malformed Bluetooth ISO frames to cause a denial of service.

The issue can lead to a kernel panic when an oversized ISO_END frame is processed, and malformed fragment sequences can also leave an unfinished receive buffer allocated.

390) Improper resource shutdown or release (CVE-ID: CVE-2026-72333)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the Bluetooth L2CAP LE credit handling logic when processing repeated LE CoC traffic. A remote attacker can stream data to the host to exhaust the signaling identifier range and cause a denial of service.

The issue can cause subsequent L2CAP_LE_CREDITS packets to be sent with invalid identifier 0, which some remote stacks ignore, permanently stalling the channel.

391) Deadlock (CVE-ID: CVE-2026-72332)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in amdxdna_hwctx_sync_debug_bo() and amdxdna_drm_config_hwctx_ioctl() when invoking hardware context operations while the device is suspended. A local user can trigger the affected ioctl or debug buffer synchronization path to cause a denial of service.

The issue occurs when a power management resume operation is triggered while the device lock is already held.

392) Use-after-free (CVE-ID: CVE-2026-72331)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the amdxdna memory mapping handling code when releasing or populating mapped ranges. A local user can trigger a race involving a freed VMA reference to cause a denial of service.

Exploitation requires local access to interact with the affected amdxdna subsystem.

393) Improper handling of exceptional conditions (CVE-ID: CVE-2026-72330)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of zero-length TLS application_data records in tls_sw_read_sock() when processing a specially crafted TLS record. A remote attacker can send a zero-length TLS application_data record to cause a denial of service.

Only the read_sock() path is affected.

394) Use-after-free (CVE-ID: CVE-2026-72328)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the amdxdna umap handling in aie2_populate_range() when racing concurrent memory mapping operations with object release. A local user can trigger concurrent operations to reuse a released amdxdna_umap object and execute arbitrary code.

The issue occurs because a reference may be acquired for an amdxdna_umap while release is already in progress.

395) NULL pointer dereference (CVE-ID: CVE-2026-72327)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in v3d_get_cpu_indirect_csd_params() when processing a userspace-supplied indirect BO handle during indirect CSD setup. A local user can submit a bogus or stale handle to cause a denial of service.

396) Integer underflow (CVE-ID: CVE-2026-72326)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect rate accounting.

The vulnerability exists due to an integer underflow in the CAKE packet length calculation in net/sched/sch_cake.c when processing packets with a negative overhead adjustment. A local user can configure a crafted overhead value to cause incorrect rate accounting.

Exploitation requires the ability to configure CAKE scheduler parameters.

397) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72325)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper hardware feature state management in the amd perf events handling in arch/x86/events/amd/core.c when reloading virtualization state on PerfMonV2-capable processors. A local user can toggle SVM on a CPU with active LBR events to cause a denial of service.

The issue occurs on processors that have LBR but not BRS, where writing the deprecated BRS enable bit triggers a #GP fault.

398) Improper resource shutdown or release (CVE-ID: CVE-2026-72324)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mvebu GPIO IRQ domain removal handler when unbinding the device. A local user can trigger device unbinding to cause a denial of service.

399) Resource management error (CVE-ID: CVE-2026-72321)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in igmp_mod_timer() and igmp_stop_timer() when deleting or stopping IGMP timers during concurrent multicast group removal. A local user can trigger IGMP processing that reaches these code paths to cause a denial of service.

The issue can occur when the affected multicast list entry is accessed from an RCU reader path while the group is concurrently removed from the list.

400) NULL pointer dereference (CVE-ID: CVE-2026-72316)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in metadata_open() when handling an allocation failure. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because a NULL return value was treated as a valid metadata pointer instead of an error.

401) Race condition (CVE-ID: CVE-2026-72315)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the cifs client direct i/o request cleanup and unmount handling when processing direct i/o writes during unmount. A local user can trigger direct i/o activity and unmount a cifs mount to cause a denial of service.

The issue results in a busy dentry warning because dentry reference counts may remain in use until delayed cleanup work completes.

402) Improper handling of exceptional conditions (CVE-ID: CVE-2026-72314)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in regulator_lock_two() when handling lock contention between two regulators. A local user can trigger lock contention to cause a denial of service.

This issue is exploitable in practice on MIPS systems.

403) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-72313)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of CRTC selection in drm fb-helper when synchronizing fbdev output to vblank. A local user can trigger display update handling on a system where fbdev output is not on the selected CRTC to cause a denial of service.

The issue can result in vblank wait timeouts and kernel warnings when fbdev output is not on CRTC 0.

404) Improper access control (CVE-ID: CVE-2026-72312)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disable the PF promiscuous and all-multicast receive rules.

The vulnerability exists due to improper access control in the nix_set_rx_mode mailbox handler when processing a VF interface request with promiscuous and all_multi flags set to false. A local user can bring up or tear down a VF interface to disable the PF promiscuous and all-multicast receive rules.

The issue occurs because the rule enable and disable APIs operate on the PF even when the mailbox request is issued through a VF interface.

405) Integer overflow (CVE-ID: CVE-2026-72310)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer overflow in smb2_ioctl_query_info() when validating a PASSTHRU_FSCTL response payload from a malicious server. A remote attacker can send a specially crafted server response to disclose sensitive information.

The out-of-bounds read occurs during a later copy_to_user() operation after a wrapped offset-plus-length check passes.

406) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72308)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in mlxsw_sp_port_lag_join() when handling an error from mlxsw_sp_port_lag_index_get(). A local user can trigger the error path to cause a denial of service.

407) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72307)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect reference count management in mlxsw_sp_vrs_lpm_tree_replace() when rolling back failed LPM tree replacements for virtual routers. A local user can trigger an error during LPM tree replacement to cause a denial of service.

408) Race condition (CVE-ID: CVE-2026-72306)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in vduse_dev_msg_sync and vduse_dev_read_iter in drivers/vdpa/vdpa_user/vduse_dev.c when handling VDUSE device message processing. A local user can trigger concurrent message operations to cause a denial of service.

The issue can lead to a double list_del() crash when a timed-out message is concurrently removed.

409) Improper Initialization (CVE-ID: CVE-2026-72305)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in VDUSE bounce page allocation when mapping bounce pages to userspace. A local user can trigger bounce page mappings to disclose sensitive information.

410) Improper input validation (CVE-ID: CVE-2026-72304)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in sof_ipc4_bytes_put when processing user-supplied control data. A local user can provide crafted control data with a mismatched size field to cause a denial of service.

The copy length is derived from the previously stored buffer header rather than the incoming header, which can result in truncated data or stale bytes being copied.

411) Out-of-bounds read (CVE-ID: CVE-2026-72303)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in sof_ipc4_control_update in sound/soc/sof/ipc4-control.c when handling malformed module notifications. A local user can send a specially crafted notification payload with an invalid size to cause a denial of service.

412) Integer overflow (CVE-ID: CVE-2026-72302)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds access.

The vulnerability exists due to integer overflow in sof_ipc3_control_update() in sound/soc/sof/ipc3-control.c when processing firmware-provided control data. A local user can provide a crafted num_elems value to trigger size miscalculation and cause an out-of-bounds access.

The issue occurs on 32-bit platforms where the size calculation can wrap to a smaller value, allowing a mismatched size check to pass before snd_sof_update_control is reached.

413) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-72301)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use flaw in sof_ipc3_bytes_put() when copying user-supplied control data. A local user can provide crafted control data with a different size than the previously stored buffer contents to cause a denial of service.

The copied length is derived from the old buffered size rather than the incoming size field.

414) Out-of-bounds read (CVE-ID: CVE-2026-72301)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in sof_ipc3_bytes_get() when handling crafted control data. A local user can provide crafted control data with an invalid size value to disclose sensitive information.

415) Out-of-bounds read (CVE-ID: CVE-2026-72300)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in sof_parse_token_sets in the SOF topology parser when parsing malformed topology private data. A local user can provide a specially crafted topology blob with a truncated trailing vendor array to cause a denial of service.

416) Integer overflow (CVE-ID: CVE-2026-72298)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow leading to out-of-bounds write in qrtr_endpoint_post() when processing a crafted incoming qrtr packet. A remote attacker can send a specially crafted packet to cause a denial of service.

Only 32-bit systems are affected; 64-bit systems are unaffected.

417) Out-of-bounds read (CVE-ID: CVE-2026-72297)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in pvc_info() when reading /proc/net/atm/pvc after storing a crafted QoS traffic_class value. A local user can supply out-of-range QoS parameters to trigger an out-of-bounds read and disclose sensitive information.

The issue is caused by invalid traffic_class values being accepted into vcc->qos during QoS validation.

418) Resource exhaustion (CVE-ID: CVE-2026-72293)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in _gaccess_shadow_fault() in the KVM s390 gaccess handling code when handling shadow fault processing. A local user can trigger shadow fault handling to cause a denial of service.

The issue affects the KVM s390 vsie path and can prevent forward progress.

419) Use of Uninitialized Variable (CVE-ID: CVE-2026-72292)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory in kvm_s390_get_cmma_bits() when handling KVM_S390_GET_CMMA_BITS requests on the non-peek migration path. A local user can invoke the affected operation to disclose sensitive information.

Only pages with the CMMA dirty bit set have their output bytes written, while clean and unmapped pages within the reported span can leave gaps that are copied to user space.

420) Improper resource shutdown or release (CVE-ID: CVE-2026-72290)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in kvm_s390_pci_aif_enable() when handling AIF enablement errors. A local user can trigger a failure during AIF enablement to cause a denial of service.

The issue affects the s390 KVM PCI interrupt setup error path.

421) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72286)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in KVM SEV/SNP intra-host migration and mirroring logic when migrating or mirroring SEV-SNP virtual machines. A local user can initiate migration or mirroring of a crafted SEV-SNP VM to cause a denial of service.

The issue affects SEV-SNP guests because required SNP-specific state and VMSA features are not fully transferred or initialized during intra-host migration or mirroring.

422) Out-of-bounds read (CVE-ID: CVE-2026-72285)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in tdx_td_init() and CPUID parsing when processing a KVM_TDX_INIT_VM request with a concurrently modified cpuid entry count. A local user can modify cpuid.nent between the initial read and the subsequent copy to cause an out-of-bounds read.

The issue arises from a mismatch between the cpuid entry count used to size the copied initialization data and the count later used as the array bound during CPUID entry lookup.

423) Improper Initialization (CVE-ID: CVE-2026-72284)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the KVM x86 LAPIC PV EOI handling logic when processing PV EOI state synchronization for a vCPU after PV EOIs have been disabled. A local user can trigger this condition to cause a denial of service.

The issue results in a kernel BUG and invalid opcode exception in the KVM subsystem.

424) Use-after-free (CVE-ID: CVE-2026-72283)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the KVM x86 irqfd bypass handling in arch/x86/kvm/irq.c when updating the interrupt remapping table entry for bypass fails. A local user can trigger the affected irqfd routing state to cause a denial of service.

The issue can occur when the irqfd remains reachable through KVM routing while the associated producer is freed separately, such as when a VFIO PCI vector is disabled independently of routing updates.

425) Use-after-free (CVE-ID: CVE-2026-72282)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in kvm_io_bus_get_dev() and vgic_msi_to_its() when processing KVM MMIO bus device lookups for MSI addresses. A local user can trigger access to a matched device after the srcu lock has been dropped to cause a denial of service.

The issue occurs when the returned device matches only by address and is not the expected device type.

426) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72280)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper handling of a warning condition in nested virtualization system register handling when a guest writes to the ZCR_EL2 system register alias in a nested context. A remote user can trigger the bogus warning to cause a denial of service.

Exploitation requires nested virtualization with FEAT_NV2 advertised to the L1 hypervisor.

427) Improper resource shutdown or release (CVE-ID: CVE-2026-72276)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in metronomefb_probe() when handling an error path after deferred I/O initialization. A local user can trigger device initialization failure to cause a denial of service.

428) Memory leak (CVE-ID: CVE-2026-72275)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in broadsheetfb_probe() when handling device initialization errors. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs because memory allocated for pagerefs in deferred I/O initialization is not released on an error path.

429) Improper resource shutdown or release (CVE-ID: CVE-2026-72274)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in hecubafb_probe() when handling device initialization errors. A local user can trigger an error path during initialization to cause a denial of service.

430) Memory leak (CVE-ID: CVE-2026-72273)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in efifb_probe() in the efifb framebuffer driver when processing option strings returned by fb_get_options(). A local user can trigger the vulnerable code path to cause a denial of service.

431) Memory leak (CVE-ID: CVE-2026-72272)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in radeonfb_pci_register() when handling error paths after allocating display mode list entries. A local user can trigger the affected code path to cause a denial of service.

432) Memory leak (CVE-ID: CVE-2026-72271)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in i740fb_probe() when handling device initialization error paths. A local user can trigger the vulnerable error conditions to cause a denial of service.

433) Memory leak (CVE-ID: CVE-2026-72270)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in s3_pci_probe() when probing a PCI device. A local user can trigger the driver initialization error path to cause a denial of service.

434) Improper resource shutdown or release (CVE-ID: CVE-2026-72269)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in uvesafb_probe() when handling error paths during device initialization. A local user can trigger an error condition to cause a denial of service.

435) Memory leak (CVE-ID: CVE-2026-72268)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in tdfxfb_probe() in the tdfxfb driver when handling device initialization error paths. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when CONFIG_FB_3DFX_I2C is defined.

436) Memory leak (CVE-ID: CVE-2026-72267)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in alloc_carmine_fb() when handling an error path after converting video modes to a modelist. A local user can trigger the vulnerable code path to cause a denial of service.

437) Memory leak (CVE-ID: CVE-2026-72266)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in vesafb_probe() in the vesafb driver when probing the device and processing framebuffer options. A local user can trigger the vulnerable code path to cause a denial of service.

438) Memory leak (CVE-ID: CVE-2026-72265)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in nvidiafb_probe() when handling device initialization errors. A local user can trigger an error path during device probing to cause a denial of service.

439) Memory leak (CVE-ID: CVE-2026-72264)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in trident_pci_probe() when handling a PCI device probe error path. A local user can trigger the vulnerable code path to cause a denial of service.

440) Memory leak (CVE-ID: CVE-2026-72263)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in snd_sof_load_topology when loading a topology file whose filename contains "dummy" while tplg_cnt is 0. A local user can trigger repeated topology load attempts to cause a denial of service.

441) Heap-based buffer overflow (CVE-ID: CVE-2026-72262)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to a heap-based buffer overflow and out-of-bounds read in the SOF IPC3 bytes control handling in sound/soc/sof/ipc3-control.c when processing data through the ALSA TLV kcontrol interface. A local user can send specially crafted control data to cause a denial of service or disclose sensitive information.

The issue affects the bytes_ext put and get paths, including an error-path restore operation that can write past the end of the allocated buffer.

442) Out-of-bounds write (CVE-ID: CVE-2026-72261)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in snd_sof_update_control when processing firmware-provided control data. A local user can provide inconsistent control data values to cause a denial of service.

The issue occurs because num_elems was validated against a stored size field but not against the actual ipc_control_data allocation size before memcpy.

443) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72260)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in mt8192_afe_pcm_dev_probe() when probing the MT8192 AFE device and reinitializing the regmap cache during runtime power management resume. A local user can trigger device probe under conditions where runtime resume fails to cause a denial of service.

The issue can leave the power management usage count incremented and continue probe while the device may not be accessible.

444) Improper resource shutdown or release (CVE-ID: CVE-2026-72259)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the MT8192 AFE probe path when handling reserved memory assignment during device probe and driver cleanup. A local user can trigger device probe failure or driver unbind to cause a denial of service.

The issue occurs when reserved memory is successfully assigned and is not released during cleanup.

445) Improper resource shutdown or release (CVE-ID: CVE-2026-72258)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the MT8183 AFE probe in sound/soc/mediatek/mt8183/mt8183-afe-pcm.c when handling device probe failures or driver removal. A local user can trigger device initialization and cleanup conditions to cause a denial of service.

The issue arises when reserved memory is assigned through of_reserved_mem_device_init() and the assignment is not released consistently on cleanup.

446) NULL pointer dereference (CVE-ID: CVE-2026-72257)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in graph_callback in the q6apm ASoC component when handling late DSP buffer-done responses after buffers have been freed. A local user can trigger the race condition to cause a denial of service.

This issue is exposed by a race between buffer cleanup and asynchronous DSP response handling.

447) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72256)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of template conntrack state in xt_cluster_mt() in the netfilter xt_cluster matcher when processing packets associated with a template conntrack. A local user can trigger packet processing that reaches xt_cluster_hash() with incomplete conntrack state to cause a denial of service.

The issue occurs when the raw table CT target attaches a template conntrack to skb->_nfct before normal conntrack processing.

448) Use-after-free (CVE-ID: CVE-2026-72255)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in nf_queue handling of bridge fake dst references when processing bridged packets queued to NFQUEUE. A local user can queue bridged packets to NFQUEUE during bridge device teardown to cause a denial of service.

The issue affects systems with CONFIG_BRIDGE_NETFILTER enabled and involves queued packets carrying a fake rtable associated with a bridge device.

449) NULL pointer dereference (CVE-ID: CVE-2026-72254)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the nft_fib netdev egress hook handling when evaluating a fib expression in a netdev egress base chain. A local user can create a crafted nftables rule using a fib expression on the netdev egress hook to cause a denial of service.

The issue occurs because netdev hook numbers alias NF_INET_* values, allowing an egress chain to pass validation and then fault on the transmit path when nft_in(pkt) is NULL.

450) NULL pointer dereference (CVE-ID: CVE-2026-72253)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the nf_conntrack_sip SIP helper when processing traffic with sip_external_media enabled in subsystems where routing information is unavailable. A local user can send specially crafted network traffic to cause a denial of service.

The issue affects tc ingress and openvswitch when the sip_external_media module parameter is set to 1.

451) Out-of-bounds write (CVE-ID: CVE-2026-72252)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to out-of-bounds writes in the nft_pipapo_match handling in netfilter nft_set_pipapo when processing set element insertions after a prior memory allocation failure left a cloned match in an invalid state. A local user can trigger an allocation failure and then perform a subsequent insertion in the same batch to cause memory corruption.

The issue can also affect a subsequent transaction because a bad clone may persist when the abort callback is not executed after the initial failure.

452) Incorrect calculation (CVE-ID: CVE-2026-72250)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an unset header offset in nf_ct_frag6_reasm() when processing IPv6 fragments on the NF_INET_LOCAL_OUT defragmentation path. A local user can send a specially crafted fragmented IPv6 packet to cause a denial of service.

The issue occurs because skb->mac_header may still hold the unset sentinel value when no link-layer header is present yet.

453) Improper access control (CVE-ID: CVE-2026-72247)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass connection counting limits.

The vulnerability exists due to improper access control in nf_conncount when processing connection tuples across conntrack zones. A remote attacker can send network traffic that creates connections with matching tuples in different zones to bypass connection counting limits.

The issue affects the tuple dedup logic in __nf_conncount_add(), where original-direction tuples are compared using an incorrect zone direction value.

454) Improper resource shutdown or release (CVE-ID: CVE-2026-72245)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in host1x_device_add() error handling for host1x_device_parse_dt() when processing device tree data. A local user can trigger a failure in device parsing to cause a denial of service.

455) Incorrect calculation (CVE-ID: CVE-2026-72244)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource allocation in the gpu buddy allocator when handling contiguous fallback allocation requests that require min_block_size alignment. A local user can trigger a misaligned allocation attempt to cause a denial of service.

456) Improper access control (CVE-ID: CVE-2026-72243)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass SELinux connect-related permission checks.

The vulnerability exists due to improper access control in the SELinux socket_sendmsg() hook when using TCP Fast Open on TCP or MPTCP stream sockets. A local user can send data with MSG_FASTOPEN to bypass SELinux connect-related permission checks.

457) NULL pointer dereference (CVE-ID: CVE-2026-72242)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in selinux_sctp_bind_connect() when processing SCTP ASCONF operations from the softirq path. A local user can trigger the vulnerable SCTP bind or connect handling to cause a denial of service.

The issue occurs when the hook is invoked from the ASCONF softirq path, where no file reference guarantees that sk->sk_socket is non-NULL.

458) Out-of-bounds read (CVE-ID: CVE-2026-72241)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the uleds_write function when processing a user-supplied LED name string. A local user can supply a non-null-terminated string to disclose sensitive information.

459) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72240)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference leak in sm501_register_device() when handling a failed device registration. A local user can trigger platform_device_register() to fail to cause a denial of service.

460) Division by zero (CVE-ID: CVE-2026-72238)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in early_serial_init() when parsing the console=uart8250 boot parameter. A local user can supply an empty, zero, invalid, or overflowing baud rate value to cause a denial of service.

The issue causes the system to hang during early boot.

461) Information disclosure (CVE-ID: CVE-2026-72237)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel memory addresses.

The vulnerability exists due to improper access control in the amd_brs_match_plm() branch privilege-level filtering in the AMD BRS perf event handling code when processing user-only branch stack sampling requests. A local user can invoke perf branch sampling with PERF_SAMPLE_BRANCH_USER to disclose kernel memory addresses.

The issue affects AMD processors supporting X86_FEATURE_BRS and occurs for branch records that transition from the kernel to user space.

462) Observable discrepancy (CVE-ID: CVE-2026-72236)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper restriction of speculative execution in __hw_perf_event_init() in arch/s390/kernel/perf_cpum_cf.c when processing a user-controlled perf event configuration value as an array index. A local user can supply a crafted event->attr.config value to disclose sensitive information.

463) Use-after-free (CVE-ID: CVE-2026-72235)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in batadv_interface_rx() in the batman-adv soft interface code when processing received packets after a potential skb reallocation. A remote attacker can send a specially crafted packet to cause a denial of service.

464) Use-after-free (CVE-ID: CVE-2026-72233)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in batman-adv BLA handling when processing crafted network packets. A local attacker can send a specially crafted packet to cause a denial of service.

465) Out-of-bounds read (CVE-ID: CVE-2026-72232)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in batadv_interface_tx() when processing a truncated packet redirected to a batadv interface through a tc filter. A local user can attach a tc filter that truncates the packet and redirects it to a batadv interface to disclose sensitive information.

Exploitation requires eBPF TC hook access.

466) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72231)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper state management in batadv_send_tt_request() in the batman-adv translation table component when handling translation table requests after send buffer allocation failure. A local attacker can trigger repeated translation table requests to cause a denial of service.

The issue can lead to request storms because information about a pending translation table request is lost after a failed send attempt.

467) Improper resource shutdown or release (CVE-ID: CVE-2026-72230)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in batadv_frag_send_packet() in the batman-adv fragmentation component when processing packets with an empty payload or a zero fragment size. A local user can trigger the error path with such packet conditions to cause a denial of service.

468) Improper resource shutdown or release (CVE-ID: CVE-2026-72229)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource shutdown in batman-adv mesh interface cleanup when netdev registration is vetoed after creating the untagged VLAN object. A local user can trigger mesh interface registration failure to cause a memory leak.

The issue occurs because the untagged VLAN object is created during the NETDEV_REGISTER notifier path, and .dellink is not called when registration is aborted.

469) Improper resource shutdown or release (CVE-ID: CVE-2026-72228)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in batman-adv fragmentation handling in net/batman-adv/fragmentation.c when linearizing packets with a frag_list before splitting them. A local user can trigger a linearization failure with a crafted packet state to cause a denial of service.

470) Out-of-bounds read (CVE-ID: CVE-2026-72227)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the batman-adv multicast forwarding code when processing a crafted network header containing an undersized batadv_tvlv_mcast_tracker structure. A remote attacker can send a specially crafted packet to disclose sensitive information.

471) Integer underflow (CVE-ID: CVE-2026-72225)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer underflow in jbd2_journal_initialize_fast_commit() when initializing fast commit journal metadata. A local user can trigger journal initialization with crafted journal parameters to cause a denial of service.

The issue can corrupt j_last, j_fc_first, and j_free, leading to journal abort.

472) Memory leak (CVE-ID: CVE-2026-72224)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of allocated memory in btt_init() in the nvdimm btt subsystem when handling BTT initialization failures. A local user can trigger an initialization failure to cause a denial of service.

473) Memory leak (CVE-ID: CVE-2026-72223)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in discover_arenas() in the nvdimm btt subsystem when handling arena discovery failures. A local user can trigger an arena discovery failure to cause a denial of service.

474) Memory leak (CVE-ID: CVE-2026-72219)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in nlm_lookup_file() when processing file handles rejected by the underlying export. A remote attacker can present crafted file handles that trigger nlm_do_fopen() failures to cause a denial of service.

Each failed open attempt leaks one newly allocated nlm_file object.

475) Improper update of reference count (CVE-ID: CVE-2026-72218)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper reference count management in lockd nlm_lookup_file() when handling cached file lookups after nlm_do_fopen() failure. A remote user can trigger a failed file-open operation to cause a denial of service.

The issue occurs because the file reference count is incremented but not released, preventing the file from being reaped between requests.

476) Memory leak (CVE-ID: CVE-2026-72216)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in qcom_add_minidump_segments() when adding custom dump segments. A local user can trigger minidump segment handling failures to cause a denial of service.

477) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72215)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect stack handling in prom_printf() when calling 32-bit firmware code from a kernel thread in 64-bit MIPS configurations. A local user can trigger console output during system bootstrap to cause a denial of service.

The issue occurs when the initial console remains in use late into bootstrap, causing the kernel to hang before startup completes.

478) Improper resource shutdown or release (CVE-ID: CVE-2026-72214)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in cpcap_battery_detect_battery_type() in the cpcap-battery driver when handling battery property reads. A local user can trigger repeated battery property reads to cause a denial of service.

The issue is caused by a missing nvmem_device_put() call on the success and read-failure paths, which can create a permanent reference leak and prevent the nvmem device from being freed.

479) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72213)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in alloc_hugetlb_folio() when handling hugetlb cgroup reserved and non-reserved charges. A local user can trigger hugetlb folio allocation and later freeing to cause a denial of service.

The issue causes a page_counter underflow because the reserved charge path stores the wrong cgroup pointer in the folio and the reserved uncharge later decrements a counter that was never charged for that cgroup.

480) Out-of-bounds write (CVE-ID: CVE-2026-72212)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to memory corruption in create_altmaps_and_memory_blocks() in mm/memory_hotplug.c when handling a failure after successful memory addition with memmap_on_memory enabled. A local user can trigger this error path to cause a denial of service or execute arbitrary code.

The issue occurs because vmemmap pages allocated from an altmap may be freed into the system buddy allocator before the physical linear mapping for that memory is destroyed.

481) Out-of-bounds write (CVE-ID: CVE-2026-72197)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in do_action() in fs/ntfs3/fslog.c when processing a crafted NTFS image during mount. An attacker with physical access can provide a specially crafted NTFS image to cause a denial of service.

The issue is triggered in the DeleteIndexEntryAllocation case when an on-disk INDEX_BUFFER entry contains a malformed size value, causing memmove() to use an invalid length. User interaction is required to mount the crafted filesystem image.

482) Out-of-bounds write (CVE-ID: CVE-2026-72196)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in log_replay() in the ntfs3 filesystem log replay code when mounting a malformed NTFS filesystem image. A local user can supply a crafted log record header with inconsistent lcns_follow values to cause a denial of service.

The issue is triggered on the mount path during the analysis pass.

483) Integer underflow (CVE-ID: CVE-2026-72195)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an integer underflow leading to an out-of-bounds read in do_action() UpdateResidentValue handling in fs/ntfs3/fslog.c when processing a crafted on-disk NTFS log record during mount. A local user can supply a crafted filesystem image to trigger an oversized resident attribute data_size and disclose sensitive information.

The issue occurs when attr_off and redo_len from the on-disk log record make aoff + dlen smaller than data_off, causing data_size to wrap to nearly 4 GiB.

484) Infinite loop (CVE-ID: CVE-2026-72193)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop in check_rstbl() in the ntfs3 driver when mounting a crafted NTFS3 disk image. A local user can provide a specially crafted filesystem image to cause a denial of service.

User interaction may be required in environments that automatically mount attached removable media.

485) Improper access control (CVE-ID: CVE-2026-72183)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass signal restrictions and send signals to processes outside its Landlock domain.

The vulnerability exists due to improper access control in the Landlock SIGIO delivery path when handling asynchronous SIGIO delivery for process-group file or socket owners. A local user can configure a file or socket owner with crafted fcntl settings to signal an entire process group to bypass signal restrictions and send signals to processes outside its Landlock domain.

Exploitation requires a sandboxed process that owns a file or socket and can trigger SIGIO delivery to a process group that includes an out-of-domain process such as a supervisor or security monitor.

486) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72182)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a refcount leak in is_full_charged() in the charger-manager power supply driver when checking the fuel_gauge power supply state. A local user can trigger the affected code path to cause a denial of service.

487) Out-of-bounds write (CVE-ID: CVE-2026-72181)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to memory corruption in mipsmt_sys_sched_setaffinity when copying a user-supplied CPU mask from user space with CONFIG_CPUMASK_OFFSTACK enabled. A local user can supply a crafted CPU affinity mask to cause memory corruption.

Only systems with CONFIG_CPUMASK_OFFSTACK enabled are vulnerable.

488) Improper access control (CVE-ID: CVE-2026-72180)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass a userfaultfd write-protection trap.

The vulnerability exists due to improper preservation of protection metadata in change_non_present_huge_pmd() when processing a writable device-private PMD swap entry during a huge PMD downgrade. A local user can invoke mprotect() on a UFFD_WP-marked device-private THP to bypass a userfaultfd write-protection trap.

The issue occurs because the uffd write-protect bit is stripped and the trap is bypassed on swap-in.

489) Improper resource shutdown or release (CVE-ID: CVE-2026-72179)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in populate_cache_leaves in arch/riscv/kernel/cacheinfo.c when traversing device tree cache nodes. A local user can trigger the vulnerable code path to cause a denial of service.

The issue results in a node reference leak when loop traversal ends naturally because the current node pointer becomes NULL.

490) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72178)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in damon_commit_target() and DAMON context commit handling in mm/damon/core when committing target pids between DAMON contexts and the commit operation fails. A local user can trigger a failed DAMON context commit to cause a denial of service.

The issue occurs in a supported but uncommon case where target pids are committed from a source context to a destination context that does not use the [f]vaddr operation set, and failure can occur during the commit operation, including due to memory allocation with a huge number of target regions.

491) Use of Uninitialized Variable (CVE-ID: CVE-2026-72177)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uninitialized memory dereference in damon_sysfs_access_pattern_add_dirs() when handling error paths during sysfs directory creation. A local user can trigger allocation failures in crafted sysfs operations to cause a denial of service.

The issue occurs because directory references are released in the wrong order on error paths, and a memory leak may also result.

492) Use of Uninitialized Variable (CVE-ID: CVE-2026-72176)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uninitialized memory access in damon_sysfs_scheme_add_dirs() when handling an internal error during tried_regions directory setup. A local user can trigger the error path to cause a denial of service.

The issue occurs in the DAMON sysfs schemes code path when tried_regions directory setup fails from the initial allocation.

493) Race condition (CVE-ID: CVE-2026-72175)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in make_uffd_wp_huge_pte() in fs/proc/task_mmu.c when handling PAGEMAP_SCAN write-protection of a present HugeTLB PTE. A local user can trigger the race to cause a denial of service.

The issue can cause hardware Dirty or Accessed updates in the live PTE to be lost.

494) Deadlock (CVE-ID: CVE-2026-72174)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a self-deadlock in pagemap_scan_pte_hole() when processing a PAGEMAP_SCAN ioctl with PM_SCAN_WP_MATCHING on a hugetlb VMA that reaches an unpopulated range. A local user can issue a crafted PAGEMAP_SCAN ioctl request to cause a denial of service.

The calling thread may hang in an unkillable state when the scan reaches an unpopulated part of the hugetlb range.

495) Reachable assertion (CVE-ID: CVE-2026-72173)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to a reachable stale assertion in pagemap_pmd_range_thp() in fs/proc/task_mmu.c when processing pagemap PMD entries. A local user can trigger processing of a PMD device-private entry to trigger a kernel warning.

The condition involves device-private entries at the PMD level.

496) Improper Initialization (CVE-ID: CVE-2026-72172)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to uninitialized memory in struct pages for ZONE_DEVICE in mm/mm_init.c when hot-plugging DAX memory into an unoccupied subsection of an early section. A local attacker can hot-plug crafted DAX memory to cause a denial of service.

The issue occurs because the unoptimized boot memmap is reused for early sections while only a reduced number of struct pages are initialized, leaving remaining tail struct pages uninitialized.

497) Incomplete cleanup (CVE-ID: CVE-2026-72171)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cleanup in register_device() in the slram driver when handling device registration failures. A local user can trigger allocation or registration failures to cause a denial of service.

The issue occurs after a partially initialized entry has already been linked into the global device list, and a later cleanup can dereference or free invalid state from that failed entry.

498) Race condition (CVE-ID: CVE-2026-72170)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in v9fs_dec_count in the 9p filesystem inode handling code when processing unlink operations in cacheless mode. A local user can trigger heavy unlink workloads to cause a kernel warning and system instability.

Only systems using the 9p filesystem in cacheless mode are affected.

499) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72169)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in scratch_size_update() when processing fixed scratch sizes provided via the command line. A local user can specify an unaligned scratch size to cause a denial of service.

The issue occurs because scratch areas are released as MIGRATE_CMA, which can result in a pageblock being only partially marked as scratch.

500) Use of Uninitialized Variable (CVE-ID: CVE-2026-72168)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in the vmu-flash driver when initializing memcard structures. A local user can trigger the vulnerable code path to cause a denial of service.

501) Improper resource shutdown or release (CVE-ID: CVE-2026-72167)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the pl35x NAND controller probe routine when unloading the affected kernel module after mapping device registers. A local user can trigger the affected probe and unload path to cause a denial of service.

502) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72166)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper signal handling in p9_client_rpc() in net/9p/client.c when handling P9_TFLUSH requests over an fd transport with no peer. A local user can trigger a fatal signal while a thread is blocked in the affected code path to cause a denial of service.

The issue can cause the affected task to sleep indefinitely and, in practice, can stall coredump handling in multi-threaded processes.

503) Out-of-bounds read (CVE-ID: CVE-2026-72165)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds access in nand_select_target() when handling an invalid chip-select target index. A local attacker can trigger the vulnerable code path with an out-of-range cs value to cause a denial of service.

504) Improper access control (CVE-ID: CVE-2026-72164)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite file data belonging to another inode.

The vulnerability exists due to improper allocation of occupied clusters in ocfs2_move_extent() and ocfs2_probe_alloc_group() when processing a non-auto OCFS2_IOC_MOVE_EXT operation with a user-supplied physical goal. A local user can supply a crafted occupied goal value to overwrite file data belonging to another inode.

The issue occurs when the supplied goal is at the end of the target block group or when the free-run start is miscalculated.

505) NULL pointer dereference (CVE-ID: CVE-2026-72163)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ocfs2_assure_trans_credits() when completing a direct write over unwritten extents after a journal abort. A local user can trigger a direct write operation and cause the kernel to panic to cause a denial of service.

Exploitation requires an ocfs2 direct I/O write path where the journal aborts during I/O completion, such as after an I/O error.

506) Out-of-bounds read (CVE-ID: CVE-2026-72162)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in ocfs2_sum_rightmost_rec when processing a corrupted inode embedded extent list from disk. A local user can provide a crafted ocfs2 filesystem image with invalid extent list metadata to cause a denial of service.

The issue is triggered when l_next_free_rec is zero or exceeds l_count in the embedded extent list of an inode.

507) NULL pointer dereference (CVE-ID: CVE-2026-72161)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ocfs2_checkpoint_inode() when evicting cached inodes during unmount. A local user can trigger inode eviction after journal shutdown to cause a denial of service.

The issue occurs because the journal may already have been freed and set to NULL during shutdown before remaining cached inodes are evicted.

508) Improper input validation (CVE-ID: CVE-2026-72160)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ocfs2_validate_inode_block() and ocfs2_filecheck_validate_inode_block() when processing forged OCFS2 inode metadata. A local user can provide a crafted dinode with non-canonical i_mode type bits to cause a denial of service.

The issue affects the normal read path and the online filecheck read path.

509) Improper input validation (CVE-ID: CVE-2026-72159)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ocfs2 inode validation when processing a forged dinode on an OCFS2 volume. A local user can provide a malformed inode with non-zero i_size and zero i_clusters to cause a denial of service.

Sparse regular files are exempt on volumes mounted with sparse allocation enabled, while non-inline directories are also affected by this malformed size and cluster state.

510) Out-of-bounds read (CVE-ID: CVE-2026-72158)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in create_feature_instance() when processing crafted DFHv1 parameter headers from a malicious FPGA device. An attacker with physical access can provide a malicious FPGA device with crafted parameter headers to cause a denial of service.

The issue occurs because the computed parameter size can exceed the feature boundary and is then used in a memcpy_fromio() operation against the ioremap'd region.

511) Out-of-bounds write (CVE-ID: CVE-2026-72157)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to an out-of-bounds write in tbnet_poll() when processing a multi-frame ThunderboltIP packet with a peer-supplied frame_count that exceeds the fragment array capacity. A remote attacker can send a specially crafted packet with 19 or more small frames to corrupt memory.

The issue occurs because the first frame is placed in the skb linear area while subsequent frames are added as page fragments.

512) Out-of-bounds read (CVE-ID: CVE-2026-72156)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in mpf_ops_parse_header() in the microchip-spi FPGA manager driver when parsing a crafted bitstream header with a zero header_size value. A local attacker can supply a crafted bitstream to trigger the out-of-bounds read and cause a denial of service.

The issue is triggered specifically when the header_size field at offset 24 is zero, causing a read one byte before the start of the buffer.

513) Improper locking (CVE-ID: CVE-2026-72155)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock state handling in the spi_nor_sr_unlock() function in the spi-nor software protection logic when processing unlock requests for locked blocks at the beginning of the device. A local user can request unlocking of the currently locked block or blocks to cause a denial of service.

The issue occurs when the first block, or a few first blocks, are locked and both top and bottom unlocking paths can achieve the same result.

514) Improper locking (CVE-ID: CVE-2026-72154)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cache synchronization in jump label handling in arch/openrisc/kernel/jump_label.c and arch/openrisc/kernel/patching.c when updating static keys on SMP systems. A local user can trigger static key updates to cause a denial of service.

The issue affects OpenRISC SMP systems, and stale instruction cache lines may persist on remote cores after code patching.

515) Out-of-bounds read (CVE-ID: CVE-2026-72153)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in crossbar_domain_free() in the irqchip crossbar component when freeing IRQ domain mappings. A local user can trigger release of a crafted IRQ mapping state to cause a denial of service.

The issue can also leave the crossbar register connection to the source interrupt active because the wrong index is used for the irq_map entry and register update.

516) Improper locking (CVE-ID: CVE-2026-72152)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of task state and wake-up logic in wait_for_tpm_stat() in the TPM TIS core when waiting for TPM status changes on the IRQ wait path. A local user can trigger TPM operations that exercise the affected wait path to cause a denial of service.

The issue is associated with the IRQ-based wait path and can trigger a kernel warning when CONFIG_DEBUG_ATOMIC_SLEEP is enabled.

517) Use-after-free (CVE-ID: CVE-2026-72151)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in tpm_buf_append_salt in drivers/char/tpm/tpm2-sessions.c when handling asynchronous ecdh-nist-p256 KPP operations. A local attacker can trigger entropy polling that reaches the vulnerable code path to cause a denial of service.

The issue occurs when the resolved KPP backend is asynchronous, such as atmel-ecc, HPRE, or keembay-ocs, and no user interaction is required.

518) Use of Uninitialized Variable (CVE-ID: CVE-2026-72150)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to uninitialized memory in rpc_sysfs_xprt_switch_add_xprt_store() when handling sysfs input for transport creation. A local user can submit crafted input that triggers use of uninitialized structure fields to cause a denial of service or disclose sensitive information.

Uninitialized fields such as srcaddr, bc_xps, and flags may lead to unpredictable behavior depending on stack contents.

519) Improper input validation (CVE-ID: CVE-2026-72149)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the Tegra GPC DMA driver burst size calculation when processing DMA transfer requests whose lengths are not evenly divisible by the configured maximum burst size. A local user can trigger a DMA transfer with a crafted length to cause a denial of service.

This issue can cause the DMA engine to hang with a partial burst at the end, and it was observed with PL011 UART TX DMA transfers of arbitrary lengths.

520) Race condition (CVE-ID: CVE-2026-72148)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dw_edma_v0_core_start() when concurrently starting DMA channels. A local user can trigger concurrent channel operations to cause a denial of service.

The DONE_INT_MASK and ABORT_INT_MASK registers are shared by all DMA channels, and the issue arises from a non-atomic read-modify-write sequence while updating them.

521) NULL pointer dereference (CVE-ID: CVE-2026-72147)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dw_edma_pcie_probe() when binding a device dynamically via sysfs without driver data. A local user can bind a matching device entry without driver data to trigger a kernel crash and cause a denial of service.

522) Improper Initialization (CVE-ID: CVE-2026-72146)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in the rz-dmac DMA driver interrupt handling path when registering interrupts before channel and driver state is fully initialized. A local attacker can trigger an interrupt during device initialization to cause a denial of service.

The interrupt handler may access an uninitialized channel base pointer and uninitialized descriptor lists.

523) Improper resource shutdown or release (CVE-ID: CVE-2026-72144)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in dell_init() in the dell-laptop driver when handling initialization errors after resource registration. A local user can trigger an initialization failure path to cause a denial of service.

The issue occurs after rfkill setup when later LED or backlight registration fails, leaving the notifier, debugfs directory, keyboard backlight LED, or optional touchpad LED registered despite initialization failure.

524) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72143)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource restoration in Intel Speed Select Technology performance profile control handling in drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c when resuming from suspend. A local user can trigger a suspend and resume cycle to cause a denial of service.

The issue affects restoration of SST-PP control for power domains other than power domain 0.

525) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-72142)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the i2c_imx_atomic_read function when processing SMBus block-read operations with a byte count of 0 or a count above I2C_SMBUS_BLOCK_MAX. A local user can trigger a crafted SMBus block read to cause a denial of service.

The issue can leave the i2c bus stuck with SDA held until a power cycle for the affected controller.

526) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72141)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exceptional-condition handling in the i2c-imx SMBus block-read state machine when processing an SMBus block read with a byte count of 0 or an invalid oversized count. A local user can trigger a crafted block-read transaction to cause a denial of service.

The issue can leave the I2C bus stuck because the controller fails to complete the transfer with the required NACK and STOP sequence.

527) Use-after-free (CVE-ID: CVE-2026-72140)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mlxbf_i2c_init_resource() when handling an error from devm_platform_get_and_ioremap_resource(). A local user can trigger the error path to cause a denial of service.

528) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72138)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in gntdev_ioctl_map_grant_ref() in the xen grant device driver when handling an ioctl request and copying the operation result to userspace. A local user can trigger a copy_to_user failure after a mapping has been added to the list to cause a denial of service.

The issue can leave a mapping in priv->maps with a dangling list entry and a leaked reference count.

529) Improper access control (CVE-ID: CVE-2026-72136)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify an xfrm interface across network namespace boundaries.

The vulnerability exists due to improper access control in xfrmi_changelink() when handling changelink requests for xfrm interfaces. A local privileged user can send a changelink request from one network namespace to rewrite an interface that lives in another network namespace to modify an xfrm interface across network namespace boundaries.

The issue occurs because the capability check was performed only against dev_net(dev) and not against the interface link network namespace.

530) Out-of-bounds read (CVE-ID: CVE-2026-72135)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and corrupt kernel memory.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in the TPM character device read path when processing positional read operations with a pending response. A local user can issue a crafted pread request with a large offset to disclose sensitive information and corrupt kernel memory.

The issue affects the sequential command/response TPM device interface after a command has left a response pending.

531) Improper Initialization (CVE-ID: CVE-2026-72134)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data corruption.

The vulnerability exists due to improper state management in the spi-imx ECSPI transfer handling when falling back from DMA to PIO after DMA descriptor preparation fails. A local user can trigger a transfer that falls back to PIO to cause data corruption.

This can occur on systems where ECSPI DMA is described but DMA descriptor preparation fails, causing the controller to continue the transfer with DMA-mode settings still applied.

532) Improper Initialization (CVE-ID: CVE-2026-72133)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in the spi-uniphier driver interrupt handling logic when registering an interrupt handler before initializing the associated completion. A local attacker can trigger an interrupt during driver initialization to cause a denial of service.

This may lead to complete() being called on an uninitialized completion, resulting in undefined behavior.

533) Resource exhaustion (CVE-ID: CVE-2026-72132)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect resource accounting in NFS commit-list writeback accounting when handling unstable writes split into multiple sub-folio requests. A local user can trigger writes that are split into many small requests to cause a denial of service.

Exploitation requires NFS client write activity where a folio is split into multiple requests, such as with pNFS flexfiles striping or wsize-limited splitting.

534) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72131)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the nvme-apple driver queue tag handling when submitting commands on Apple A11 systems. A local user can issue commands that trigger duplicate tag reuse across the admin and I/O queues to cause a denial of service.

The issue affects Apple A11 systems where pending command tags must be unique across the admin and I/O queues, and firmware may crash with a duplicate tag error.

535) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72128)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in nvmet_sq_create() when handling submission queue creation requests with an invalid queue identifier. A local user can trigger an error path that leaks a controller reference to cause a denial of service.

536) Information disclosure (CVE-ID: CVE-2026-72127)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in netdev_nl_napi_fill_one() when handling NETDEV_CMD_NAPI_GET requests from a child pid namespace. A remote attacker can issue a NETDEV_CMD_NAPI_GET request to disclose sensitive information.

The issue occurs because the reported NAPI kthread PID is returned from the initial pid namespace instead of the caller's pid namespace.

537) Use-after-free (CVE-ID: CVE-2026-72126)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the isotp socket release and receive timer handling in net/can/isotp.c when processing concurrent CAN ISO-TP socket release and network device unregister events. A local user can trigger the race condition to cause a denial of service.

The issue occurs because an in-flight receive handler may re-arm a timer on a socket that has already been freed.

538) Use-after-free (CVE-ID: CVE-2026-72125)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race in the Linux kernel CAN ISO-TP socket handling in net/can/isotp.c when releasing a socket concurrently with NETDEV_UNREGISTER. A local user can trigger concurrent socket release and device unregistration to cause a denial of service.

The issue can leave a stale CAN filter referencing a freed socket.

539) Race condition (CVE-ID: CVE-2026-72124)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the can isotp socket transmission state machine in net/can/isotp.c when handling concurrent send, receive, echo, timer, and socket release events. A local user can trigger concurrent state transitions to cause a denial of service.

The issue affects TX state handling across sendmsg(), the RX path, and hrtimer callbacks.

540) Use-after-free (CVE-ID: CVE-2026-72123)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the can bcm rx operation handling in net/can/bcm.c when tearing down bcm rx operations concurrently with packet reception and timer activity. A local user can trigger a race condition to cause a denial of service.

The issue involves a thrtimer callback dereferencing a deallocated bcm_op object after an RCU grace period elapses.

541) Race condition (CVE-ID: CVE-2026-72122)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the socket to match traffic from unintended CAN interfaces.

The vulnerability exists due to a race condition in bcm_sendmsg() in net/can/bcm.c when processing CAN BCM socket operations concurrently with device unregistration or concurrent socket binding. A local user can trigger concurrent operations on a shared socket to cause the socket to match traffic from unintended CAN interfaces.

Exploitation requires a race with concurrent bcm_notify() or bcm_connect() updates to the socket state.

542) Race condition (CVE-ID: CVE-2026-72121)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in net/can/bcm.c when updating filter and timer values concurrently with handling incoming CAN traffic. A local user can trigger concurrent bcm_rx_setup() and RX handler activity to cause a denial of service.

The issue affects concurrent access to timer, filter, and stored frame state in the broadcast manager CAN implementation.

543) Use-after-free (CVE-ID: CVE-2026-72120)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the net/can/bcm.c broadcast manager operation list handling when traversing and releasing bcm_op structures under RCU protection. A local user can trigger crafted CAN BCM socket operations to cause a denial of service.

The issue involves inconsistent RCU list operations for tx_ops and rx_ops during setup, proc traversal, and socket release.

544) Race condition (CVE-ID: CVE-2026-72119)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the net/can/bcm.c CAN BCM transmission handling when updating existing transmit operations from userspace while transmit and timeout processing occur concurrently. A local user can send crafted CAN BCM configuration data to trigger inconsistent frame or timer state and cause a denial of service.

The issue involves partially updated or unvalidated frame data being observable during concurrent transmission processing, and torn 64-bit ktime_t reads on 32-bit platforms.

545) Race condition (CVE-ID: CVE-2026-72118)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause incorrect procfs statistics output.

The vulnerability exists due to a race condition in bcm_rx_handler() and related CAN BCM statistics handling in net/can/bcm.c when processing concurrent CAN frame reception on different CPUs for the same rx operation. A local attacker can trigger concurrent CAN frame processing to cause incorrect procfs statistics output.

For rx operations subscribed on all interfaces, concurrent handling on different CPUs can cause frames_filtered to become larger than frames_abs, leading to a bogus or even negative reduction percentage in procfs.

546) Race condition (CVE-ID: CVE-2026-72117)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose incorrect interface and timestamp metadata to user space.

The vulnerability exists due to a race condition in bcm_rx_handler() when processing CAN frames for rx operations subscribed on all interfaces. A local user can trigger concurrent frame handling on different CPUs to disclose incorrect interface and timestamp metadata to user space.

The issue affects rx operations with ifindex set to 0, where the same operation is registered in the shared per-netns wildcard filter list, and torn 64-bit timestamp stores may occur on 32-bit platforms.

547) Race condition (CVE-ID: CVE-2026-72116)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the net/can/bcm.c CAN broadcast manager rx_ops handling when an RX_SETUP update races with device unregistration. A local user can perform an RX_SETUP update during concurrent device removal to cause a denial of service.

Frame delivery for the updated filter may silently stop for the affected ifindex. This does not apply to rx_ops using ifindex 0 for all CAN devices.

548) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72116)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the net/can/bcm.c CAN broadcast manager tx_ops handling when a CAN device is unregistered while cyclic transmission remains active. A local user can trigger device removal conditions for an existing operation to cause a denial of service.

The issue can leave an hrtimer re-arming indefinitely and may allow injection into a later reused ifindex until an explicit TX_SETUP update occurs.

549) Race condition (CVE-ID: CVE-2026-72115)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the can bcm rx handler when processing matching frames for an ANYDEV rx operation from multiple interfaces concurrently. A local user can trigger concurrent frame handling to cause a denial of service.

The issue affects ANYDEV rx operations with an active RX timeout and/or throttle timer, and can cause spurious RX_TIMEOUT notifications and corruption of last_frames metadata.

550) Improper input validation (CVE-ID: CVE-2026-72114)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in bcm_rx_setup() in the CAN BCM subsystem when processing RX_SETUP messages with RX_RTR_FRAME. A local user can supply a crafted RTR-reply frame with an invalid length to cause a denial of service.

The issue affects RTR replies configured through RX_SETUP and involves validation of CAN and CAN FD frame length limits.

551) Race condition (CVE-ID: CVE-2026-72113)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing device reference count in the CAN BCM socket handling code when unregistering CAN filters during concurrent device unregistration. A local user can trigger concurrent socket and device unregistration conditions to cause a denial of service.

The issue can leave a stale CAN filter pointing to a soon-to-be-freed bcm_op or socket.

552) Improper input validation (CVE-ID: CVE-2026-72111)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass BPF memory safety checks.

The vulnerability exists due to improper register state handling in check_mem_access() in the BPF verifier when processing a context load of an LSM hook return value. A local user can load a hook return value into a register with stale bounds to bypass BPF memory safety checks.

The issue arises from a verifier/runtime mismatch because the verifier may treat the register as having a narrower range than the actual runtime value.

553) Use-after-free (CVE-ID: CVE-2026-72110)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in task BPF storage handling in copy_process() and free_task() when handling a fork operation that aborts before task BPF storage is initialized. A local user can trigger a failed fork from a process inserted into a task storage map to cause a denial of service or execute arbitrary code.

Exploitation is reachable when the calling process has been inserted into a task storage map.

554) Improper resource shutdown or release (CVE-ID: CVE-2026-72109)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cleanup in sparx5_register_notifier_blocks() in the sparx5 switchdev component when handling initialization failures after workqueue allocation fails. A local user can trigger initialization failure conditions to cause a denial of service.

The issue leaves a switchdev blocking notifier registered on the error path.

555) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72108)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause metadata inconsistency and a denial of service.

The vulnerability exists due to improper state management in dm-thin metadata snapshot handling in drivers/md/dm-thin-metadata.c when reserving or releasing a metadata snapshot and a subsequent metadata commit fails. A local user can issue crafted dmsetup messages to trigger a commit failure and cause metadata inconsistency and a denial of service.

Exploitation requires the ability to manage a thin-pool metadata device and trigger snapshot reserve or release operations under commit-failure conditions.

556) Out-of-bounds read (CVE-ID: CVE-2026-72107)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dm-era writeset handling when processing I/O for tables with a non-zero start sector. A local user can trigger out-of-bounds memory access to cause a denial of service.

The issue occurs because an absolute mapped-device block number is used instead of a target-relative block number during writeset lookup.

557) Heap-based buffer overflow (CVE-ID: CVE-2026-72106)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in list_version_get_info in dm-ioctl when processing ioctl requests. A local user can send a specially crafted ioctl request to cause a denial of service.

558) Integer overflow (CVE-ID: CVE-2026-72105)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in create_log_context in drivers/md/dm-log.c when calculating bitmap memory size for large region_count values on 32-bit systems. A local user can trigger the vulnerable code path to cause a denial of service.

Only 32-bit systems are affected.

559) NULL pointer dereference (CVE-ID: CVE-2026-72104)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in parse_cache_opts in the dm-pcache target when parsing malformed optional argument name/value pairs during target construction. A local user can supply a recognized option name without a corresponding value to cause a denial of service.

560) Incomplete cleanup (CVE-ID: CVE-2026-72103)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to recover sensitive key material from memory.

The vulnerability exists due to improper lifetime management in the table device file handling in drivers/md/dm.c when opening a backing device. A local privileged user can invoke cryptsetup operations that leave an extra copy of the LUKS volume key in the thread keyring to recover sensitive key material from memory.

The issue is gated by CAP_SYS_ADMIN, and the residual key material may remain recoverable from RAM after a luksSuspend operation.

561) Double free (CVE-ID: CVE-2026-72102)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in dm_early_create in drivers/md/dm-ioctl.c when resuming a device-mapper device after swapping in a new table. A local user can trigger a dm_resume failure to cause a denial of service.

562) Improper Initialization (CVE-ID: CVE-2026-72101)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in dm-integrity when processing integrity metadata with a hash size smaller than the device tuple size. A local user can trigger integrity processing to disclose sensitive information.

The issue occurs because remaining tuple bytes are not zeroed as intended when the hash size is less than the tuple size, which can leak uninitialized kernel memory.

563) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72100)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in dm-integrity when handling an out-of-limits bio. A local user can trigger a limit check failure to cause a denial of service.

The issue can result in a deadlock because a locked range is not unlocked on the error path.

564) Incorrect calculation (CVE-ID: CVE-2026-72099)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper calculation in dm-integrity when processing integrity metadata tags. A local user can trigger incorrect hash offset handling to cause a denial of service.

565) NULL pointer dereference (CVE-ID: CVE-2026-72097)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dm_verity_loadpin_is_bdev_trusted when checking whether a block device is trusted. A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue occurs if the device has no table.

566) Race condition (CVE-ID: CVE-2026-72096)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to bypass audit logging of corrupted block errors.

The vulnerability exists due to a race condition in dm-verity error handling in drivers/md/dm-verity-target.c when handling concurrent corrupted block errors. A local attacker can trigger concurrent error conditions to bypass audit logging of corrupted block errors.

567) Use of Uninitialized Variable (CVE-ID: CVE-2026-72095)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an uninitialized memory access in amdgpu_userq_wait_*() through dma_fence_dedup_array() when handling a zero-count fence array. A local user can trigger the zero-count condition to cause a denial of service.

The issue can occur because dma_fence_dedup_array() returns 1 for empty input, which can lead to dereference of an uninitialized fence slot.

568) Use-after-free (CVE-ID: CVE-2026-72093)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in amdxdna_gem_dmabuf_mmap() when handling memory mapping after vm_insert_pages() fails. A local user can trigger the error path during a dma-buf mmap operation to cause a denial of service.

569) NULL pointer dereference (CVE-ID: CVE-2026-72092)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the amdxdna_cmd_submit() ioctl path when handling an AMDXDNA_EXEC_CMD ioctl on devices without a cmd_submit operation. A local user can send a crafted ioctl request to cause a denial of service.

The issue affects AIE4 SR-IOV virtual function devices that do not implement the cmd_submit callback.

570) NULL pointer dereference (CVE-ID: CVE-2026-72091)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in amdxdna command submission and scheduler handling when processing a user command submission with an invalid command BO handle. A local user can issue a specially crafted AMDXDNA_EXEC_CMD ioctl with cmd_handles set to 0 to cause a denial of service.

Exploitation requires access to the accel node on a system with a probed AMD NPU.

571) Improper access control (CVE-ID: CVE-2026-72090)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access or manipulate debug buffer synchronization across client contexts.

The vulnerability exists due to improper access control in amdxdna_drm_sync_bo_ioctl() and amdxdna_hwctx_sync_debug_bo() when handling SYNC_DIRECT_FROM_DEVICE requests. A local user can invoke the ioctl with a crafted handle state to access or manipulate debug buffer synchronization across client contexts.

The issue occurs because the debug buffer handle namespace and hardware context ownership are resolved using the buffer object's stored client pointer instead of the calling file context.

572) Out-of-bounds read (CVE-ID: CVE-2026-72089)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in fw_log_print_lines() when processing a firmware log with a size smaller than its header. A local user can supply a crafted firmware log to cause a denial of service or disclose sensitive information.

A zero-sized log can cause callers to loop forever on the same header.

573) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72088)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in hpsa_scsi_ioaccel2_queue_command() in the hpsa SCSI driver when handling an IOACCEL2 reset condition. A local user can trigger the affected code path to cause a denial of service.

The issue occurs when phys_disk->in_reset is set during command processing.

574) Memory leak (CVE-ID: CVE-2026-72087)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in lpfc_sli4_driver_resource_setup() in the lpfc driver when handling early exit error paths during driver resource setup. A local user can trigger the affected error paths to cause a denial of service.

575) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72086)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a resource leak in scsiback_device_action() in the xen scsi backend when submitting task-management requests and handling target_submit_tmr() failures. A remote user can issue VSCSIIF_ACT_SCSI_ABORT or reset requests to cause a denial of service.

The issue affects a pvSCSI guest and can leak command tags for a LUN session, stopping the LUN, when task-management request submission fails.

576) Improper resource shutdown or release (CVE-ID: CVE-2026-72082)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in efct_hw_io_abort() when handling an I/O abort request after request tag allocation fails. A local user can trigger this error path to cause a denial of service.

The abort_in_progress flag may remain set even though the abort was never submitted, causing subsequent abort attempts for the same I/O to return an in-progress error and block recovery.

577) Memory leak (CVE-ID: CVE-2026-72081)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in efct_dispatch_fcp_cmd() in the efct SCSI driver when processing an unsolicited FCP command with an unsupported additional CDB. A remote attacker can send a crafted FCP command to cause a denial of service.

578) Use-after-free (CVE-ID: CVE-2026-72080)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in event file handling for the default resctrl resource group when reading a monitoring event file during unmount or teardown. A local user can read a monitoring event file concurrently with unmount to cause a denial of service.

The issue occurs because the default resource group is not marked deleted, allowing a waiting reader to resume after kernfs node teardown and dereference already-freed file private data.

579) Use-after-free (CVE-ID: CVE-2026-72079)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a use-after-free or double-free.

The vulnerability exists due to a use-after-free and double-free in ims_pcu_disconnect() when handling the disconnection of a crafted USB interface. An attacker with physical access can present a malicious device with a data interface masquerading as the control interface to trigger a use-after-free or double-free.

580) Improper input validation (CVE-ID: CVE-2026-72078)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in the ims-pcu driver control endpoint handling when parsing a malicious USB device interface. An attacker with physical access can provide a crafted device with a non-interrupt IN control endpoint to cause a denial of service.

The issue may lead to kernel warnings or undefined behavior.

581) Improper resource shutdown or release (CVE-ID: CVE-2026-72077)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the ims-pcu firmware update handler when processing an asynchronous firmware update. A local user can trigger firmware validation failure to cause a denial of service.

582) Out-of-bounds read (CVE-ID: CVE-2026-72076)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in ims_pcu_irq() debug logging when handling a control URB with an actual_length exceeding the input buffer size. A local attacker can trigger the vulnerable debug logging path to disclose sensitive information.

The issue occurs because the debug output reads from the wrong buffer when the interrupt is associated with the control URB.

583) Race condition (CVE-ID: CVE-2026-72075)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ims_pcu_reset_device() sysfs callback when handling concurrent reset_device sysfs requests and other commands. A local user can trigger concurrent sysfs operations to cause a denial of service.

The issue can corrupt a shared command buffer during concurrent access.

584) Type Confusion (CVE-ID: CVE-2026-72074)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to type confusion in the CDC union descriptor parser in the ims-pcu driver when parsing a crafted USB CDC union descriptor. An attacker with physical access can provide a device with a manipulated bMasterInterface0 value to cause a denial of service.

585) Use-after-free (CVE-ID: CVE-2026-72073)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in the vub300_probe error path in drivers/mmc/host/vub300.c when handling a failed mmc_add_host() call after the inactivity timer has been armed. A local user can trigger a probe failure race to cause a use-after-free.

Exploitation requires a failure during device probe after the inactivity timer is armed, and the queued deadwork may continue running after the timer callback has completed.

586) Use-after-free (CVE-ID: CVE-2026-72072)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mlx5e MACsec RX offload handling when deleting and processing offloaded MACsec RX SC entries concurrently. A local user can trigger concurrent RX SC deletion and RX datapath processing to cause a denial of service.

The issue affects the RX datapath under RCU lookup and reference handling of metadata_dst objects.

587) Use-after-free (CVE-ID: CVE-2026-72071)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in user_event_mm_dup() and the user_events enabler handling in kernel/trace/trace_events_user.c when walking the parent mm enabler list during fork() while an enabler is concurrently unregistered. A local user can register an enabler and then concurrently unregister it and call fork() to cause a denial of service.

Exploitation requires access to open user_events_data and a race between concurrent operations in a multithreaded process.

588) Use-after-free (CVE-ID: CVE-2026-72070)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in lbtf_free_adapter() when handling device removal during a firmware command timeout. A local user can trigger concurrent teardown and timer callback execution to cause a denial of service.

589) Integer overflow (CVE-ID: CVE-2026-72068)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer truncation in update_rlimit_cpu() when converting the RLIMIT_CPU value to nanoseconds on 32-bit kernels. A local user can set a CPU time limit of 5 seconds or more to cause a denial of service.

Only 32-bit kernels are affected. Limit enforcement remains correct, but the process CPU timer may be programmed to fire prematurely.

590) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72067)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in cpuhp_invoke_callback() when unwinding earlier callbacks for the same hotplug state after an instance callback failure. A local user can trigger a CPU hotplug state transition failure to cause a denial of service.

591) Stack-based buffer overflow (CVE-ID: CVE-2026-72066)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in states_show() in kernel/cpu.c when generating sysfs output for CPU hotplug states. A local user can read the affected sysfs entry to cause a denial of service.

592) Improper locking (CVE-ID: CVE-2026-72063)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper interaction with a mutex in tegra_gpio_direction_input() and tegra_gpio_direction_output() when changing GPIO direction on shared GPIO lines. A local user can trigger GPIO direction operations while a per-line spinlock is held to cause a denial of service.

The issue can lead to sleeping in an atomic context.

593) Race condition (CVE-ID: CVE-2026-72062)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in mediatek_gpio_irq_type() when handling concurrent IRQ type configuration on GPIOs in the same bank. A local user can trigger concurrent configuration changes to corrupt shared interrupt trigger state and cause a denial of service.

The issue affects bank-shared interrupt trigger fields such as rising and falling because each GPIO chip instance represents an entire bank of 32 pins.

594) Improper access control (CVE-ID: CVE-2026-72061)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ipip6_changelink() in the sit tunnel handler when handling changelink requests for a tunnel whose link network namespace differs from the device network namespace. A local privileged user can send a changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the caller has CAP_NET_ADMIN in the device network namespace but not in the tunnel link network namespace.

595) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-72060)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt network interface statistics and generate excessive log entries.

The vulnerability exists due to improper check for unusual or exceptional conditions in icssg_ndo_get_stats64() in the TI ICSSG ethernet driver when retrieving PA statistics on hardware without a PA stats block. A local user can trigger regular statistics polling to corrupt network interface statistics and generate excessive log entries.

The issue occurs because a negative error value is accumulated into unsigned statistics fields, resulting in incorrect rx_errors, rx_dropped, and tx_dropped counters.

596) Improper resource shutdown or release (CVE-ID: CVE-2026-72059)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in t7xx_cldma_late_init() in the t7xx WWAN CLDMA driver when handling late initialization failures during TX and RX ring setup. A local user can trigger a ring initialization failure to cause a denial of service.

597) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72058)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in ixp4xx_hss_probe() when allocating and registering HDLC netdev objects. A local user can trigger device initialization and removal to cause a denial of service.

The issue stems from allocating two different netdev objects and later unregistering and freeing a different object than the one that was registered.

598) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72057)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper preservation of control-buffer state in tcf_ct_handle_fragments() in the act_ct component when handling fragmented traffic through connection-tracking defragmentation. A remote attacker can send specially crafted fragmented packets to cause a denial of service.

System impact occurs when panic_on_warn is enabled.

599) Improper resource shutdown or release (CVE-ID: CVE-2026-72056)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in ena XDP TX queue handling in the ena network driver when setting up regular TX queues after XDP TX queues have already been created. A local user can trigger regular TX setup failures to cause a denial of service.

The issue occurs in error-handling paths that omit teardown of previously created XDP TX queues.

600) Improper access control (CVE-ID: CVE-2026-72055)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in vti6_changelink() in the ip6_vti component when handling changelink requests for a tunnel device associated with another network namespace. A local privileged user can send a changelink request from a namespace where they hold CAP_NET_ADMIN to modify tunnel configuration across network namespaces.

The issue arises when the device network namespace and the tunnel link network namespace differ.

601) Improper access control (CVE-ID: CVE-2026-72054)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in vti_changelink() in the ip_vti component when handling changelink requests for a tunnel whose link network namespace differs from the device network namespace. A local privileged user can send a changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the device is created in or moved to a different network namespace than the one from which the request is issued.

602) Improper access control (CVE-ID: CVE-2026-72053)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify IPIP tunnel configuration in another network namespace.

The vulnerability exists due to improper access control in ipip_changelink() in net/ipv4/ipip.c when handling changelink requests for an IPIP device whose tunnel link resides in a different network namespace. A local privileged user can send a changelink request from a network namespace where they have CAP_NET_ADMIN to modify IPIP tunnel configuration in another network namespace.

The issue occurs when dev_net(dev) and the tunnel link namespace differ, such as after the device is created in or moved to a different network namespace.

603) Improper access control (CVE-ID: CVE-2026-72052)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify tunnel link configuration across network namespaces.

The vulnerability exists due to improper access control in ip6gre_changelink() and ip6erspan_changelink() when handling changelink requests for devices and tunnel links in different network namespaces. A remote privileged user can send a crafted changelink request to modify tunnel link configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace, causing capability checks to be applied only to the device namespace.

604) Improper access control (CVE-ID: CVE-2026-72051)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ip6_tnl_changelink() when handling changelink requests for IPv6 tunnel devices across network namespaces. A local privileged user can send a crafted netlink changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace.

605) Memory leak (CVE-ID: CVE-2026-72050)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the nix_setup_bpids() function when handling setup failures after allocating BPID resources. A local user can trigger an error path to cause a denial of service.

606) Improper access control (CVE-ID: CVE-2026-72049)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the legacy IEEE802154_NL generic netlink LLSEC dump operations when handling LLSEC_LIST_KEY dump requests. A local user can issue a crafted generic netlink dump request to disclose sensitive information.

The issue exposes the raw 16-byte AES-128 LLSEC key bytes for any wpan netdev that has an administrator-installed LLSEC key.

607) Memory leak (CVE-ID: CVE-2026-72048)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a memory leak in ca8210_spi_transfer() in the ca8210 IEEE 802.15.4 driver when submitting asynchronous SPI transfers. A local attacker can trigger spi_async() submission failures to cause a denial of service.

Repeated retry attempts under sustained SPI bus contention can leak a new allocation on each occurrence.

608) Type conversion (CVE-ID: CVE-2026-72047)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper pointer size handling in the ca8210 debugfs test interface when exchanging kmalloc'd buffer pointers through a kfifo on 64-bit systems. A local user can interact with the debugfs test interface to cause a denial of service.

Only 64-bit builds with CONFIG_IEEE802154_CA8210_DEBUGFS enabled are vulnerable.

609) Improper access control (CVE-ID: CVE-2026-72045)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in rvu_mbox_handler_lmtst_tbl_setup() when handling mailbox requests that specify base_pcifunc. A remote user can supply a crafted base_pcifunc value to disclose sensitive information.

Exploitation requires a VF caller on cn10k hardware, and the issue is limited to redirecting LMTLINE sharing outside the caller's own PF.

610) Use-after-free (CVE-ID: CVE-2026-72042)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in handle_read_event_rsp() in the IPMI message handler when rolling back failed event delivery after allocating receive messages for earlier users. A local user can trigger event delivery failures to cause a denial of service.

The issue can leave a freed user object linked on the interface user list, leading to later dereference of freed memory or a refcount_t addition-on-zero warning.

611) Improper resource shutdown or release (CVE-ID: CVE-2026-72040)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in i_ipmi_request() in the IPMI message handler when handling a request with a caller-supplied recv_msg and an error occurs. A local user can trigger an error path using a supplied receive message to cause a denial of service.

The issue occurs because the reference count on the associated user object remains elevated on certain error paths.

612) Memory leak (CVE-ID: CVE-2026-72039)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in bnx2x_alloc_mem_bp() when handling allocation failures for fp[i].tpa_info. A local user can trigger allocation failure conditions to cause a denial of service.

613) Improper resource shutdown or release (CVE-ID: CVE-2026-72038)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in setup_cn23xx_octeon_pf_device() in drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c when handling a PF number lookup failure during device initialization. A local user can trigger the affected initialization path to cause a denial of service.

614) Use of uninitialized resource (CVE-ID: CVE-2026-72037)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of an uninitialized resource in lan743x_hardware_init() and lan743x_hs_syslock_acquire() when probing the device and reading strap status. A local user can trigger device initialization to cause a denial of service.

This issue can trip the spinlock debug check when CONFIG_DEBUG_SPINLOCK is enabled.

615) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-72036)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in multiq_dequeue in the sch_multiq scheduler when handling queued packets after a peek operation on a non-work-conserving child qdisc. A local user can trigger network traffic through the affected queuing path to cause a denial of service.

The issue can desynchronize the child queue length and backlog accounting and lead to a NULL pointer dereference in softirq context on egress.

616) NULL pointer dereference (CVE-ID: CVE-2026-72035)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the sch_taprio scheduler when processing ordinary egress through a non-work-conserving child qdisc after a peeked packet is orphaned and queue state is desynchronized. A local attacker can trigger network egress through a qfq child to cause a denial of service.

The issue can panic the kernel from softirq, and the qfq child can be re-entered on an emptied list.

617) NULL pointer dereference (CVE-ID: CVE-2026-72034)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in capable_wrt_mount() when handling open_by_handle_at() on a detached mount during a race condition. A local privileged user can trigger the race using open_tree(..., OPEN_TREE_CLONE) and open_by_handle_at() to cause a denial of service.

The issue occurs when a detached mount is dissolved while open_by_handle_at() is between mount state checks, causing mount->mnt_ns to become NULL.

618) Memory leak (CVE-ID: CVE-2026-72032)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in hws_bwc_matcher_move() in the mlx5 HWS matcher handling code when setting a resize target after allocating a replacement matcher. A local user can trigger a resize-target setup failure to cause a denial of service.

Exploitation requires access to an environment using mlx5 HWS-capable functionality.

619) Improper resource shutdown or release (CVE-ID: CVE-2026-72031)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper device power state handling in libata-core for the PNY CS900 1TB SSD when entering device-initiated slumber during idle. A local user can trigger idle conditions to cause a denial of service.

The issue can cause the SATA link to go down and not recover, forcing the filesystem read-only.

620) Out-of-bounds write (CVE-ID: CVE-2026-72030)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in ata_dev_config_cpr() and the VPD page B9h emitter when processing a device-reported concurrent positioning ranges log. An attacker with physical access can connect a crafted device that reports an invalid concurrent positioning ranges count to cause a denial of service.

The issue can affect both parsing of the returned log data and emission of one descriptor per range into a fixed-size response buffer.

621) Out-of-bounds read (CVE-ID: CVE-2026-72029)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read and improper validation of device-supplied offsets and lengths in mux_dl_adb_decode() in the iosm MUX downlink decoder when processing modem-supplied aggregated datagram tables in a received skb. A local attacker can provide crafted offset and length values to trigger out-of-bounds reads and an infinite loop to disclose sensitive information and cause a denial of service.

The issue can be triggered by a modem that supplies malformed table and datagram metadata after the iosm net device is up, and the loop runs in softirq while cloning the skb on each pass.

622) Improper Initialization (CVE-ID: CVE-2026-72028)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in arch/riscv/kernel/probes/rethook_trampoline.S when handling kretprobe stack access on risc-v systems. A local user can configure a kretprobe that reads a word from the stack to cause a denial of service.

The issue occurs because the original stack pointer is not preserved in the saved register state, which can leave regs->sp with an arbitrary value during stack access.

623) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72027)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause data corruption.

The vulnerability exists due to improper handling of error conditions in compaction_free() when processing pages during memory compaction. A local attacker can trigger free_pages_prepare() to fail and cause corrupted pages to be added back to the free page list to cause data corruption.

624) Improper resource shutdown or release (CVE-ID: CVE-2026-72026)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in imsic_early_acpi_init() when handling ACPI IMSIC initialization failures. A local user can trigger an error path during initialization to cause a denial of service.

The issue occurs when imsic_setup_state() fails after a firmware node has been allocated.

625) Out-of-bounds write (CVE-ID: CVE-2026-72025)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the monwriter misc device when reusing data buffers with a different data length. A local user can submit crafted records with a changed data length to cause memory corruption.

By default, access to the device is restricted to root-only permissions.

626) Race condition (CVE-ID: CVE-2026-72024)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mac802154 interface removal logic when handling asynchronous transmit completion during interface teardown. A local user can trigger interface removal while transmit completion paths access the interface list to cause a denial of service.

The issue arises because queue wake, stop, and disable paths walk local->interfaces under RCU while bulk hardware teardown removes interface entries.

627) Memory leak (CVE-ID: CVE-2026-72023)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in otx2_init_hw_resources() and the SQ resource unwind path when handling initialization failures. A local user can trigger an initialization failure to cause a denial of service.

Exploitation requires access to a system using the OcteonTX2 PF driver.

628) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72022)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in llc_ui_autobind() when repeatedly autobinding and closing LLC sockets. A local user can perform repeated autobind and close cycles to cause a denial of service.

The issue can consume all dynamic SAP values, causing subsequent autobind operations to fail with -EUSERS.

629) Incorrect calculation (CVE-ID: CVE-2026-72021)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect connection state tracking.

The vulnerability exists due to improper calculation of buffer offsets in SCTP state lookup in net/netfilter/ipvs/ip_vs_proto_sctp.c when processing IPv6 SCTP packets with extension headers. A remote attacker can send a specially crafted IPv6 SCTP packet with extension headers to cause incorrect connection state tracking.

This can cause an SCTP connection to be moved to the established state before the SCTP handshake has completed, resulting in incorrect timeout handling and destination counter updates.

630) Out-of-bounds read (CVE-ID: CVE-2026-72019)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in macsec_encrypt() when processing packets transmitted through the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS path with an unset MAC header. A local user can send a specially crafted packet to disclose sensitive information.

The 12-byte heap over-read may be emitted on the wire as the frame's outer source and destination MAC addresses.

631) Out-of-bounds write (CVE-ID: CVE-2026-72018)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform an out-of-bounds write in kernel memory.

The vulnerability exists due to out-of-bounds write in smc_lo_move_data() when processing peer-supplied offset and size values. A remote attacker can send crafted data parameters to perform an out-of-bounds write in kernel memory.

The issue affects the software loopback implementation, which does not enforce memory region bounds like real ISM hardware.

632) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72017)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the macb driver transmit queue handling when closing the network device. A local user can trigger device close operations while transmit SKBs remain in flight to cause a denial of service.

The issue affects outgoing SKBs that have not yet been marked as completed and are stored in queue->tx_skb.

633) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72016)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in cpuhp_smt_enable() and CPU present-mask handling when processing CPU hotplug operations on arm64 ACPI systems with CPUs marked present before registration. A local user can trigger SMT hotplug control on such a system to cause a denial of service.

The issue occurs on arm64 systems booted with ACPI where some CPUs are enumerated as online-capable but are not enabled and have not yet been registered.

634) Double free (CVE-ID: CVE-2026-72015)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in RMID management in fs/resctrl/rdtgroup.c when unmounting and removing pseudo-locked resctrl groups. A local user can create a pseudo-locked group and trigger unmount processing to cause a denial of service.

The issue affects pseudo-locked groups whose RMID is freed during setup and then freed again during cleanup.

635) NULL pointer dereference (CVE-ID: CVE-2026-72013)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in machine_kexec_prepare() when processing kexec image segments. A local user can provide a kexec image segment with a NULL buffer pointer to cause a denial of service.

The issue occurs in the RISC-V kexec path during handling of segments prepared through kexec_file_load().

636) Use-after-free (CVE-ID: CVE-2026-72012)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the osnoise tracer instance unregistration logic when unregistering an osnoise tracing instance while RCU readers are traversing the instance list. A local user can trigger instance unregistration to cause a denial of service.

637) Out-of-bounds read (CVE-ID: CVE-2026-72011)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in memtop_get_page_count() when using a user-controlled level value to access the memtop_pages array. A local user can supply a crafted level value to disclose sensitive information.

The issue involves speculative execution on s390 systems.

638) Division by zero (CVE-ID: CVE-2026-72010)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in mpol_relative_nodemask in the cpuset mempolicy rebind path when handling a CPU hotplug event for a task in a child cpuset with an unset cpuset.mems and a VMA mempolicy using MPOL_F_RELATIVE_NODES. A local user can create such a cpuset configuration and trigger CPU hotplug handling to cause a denial of service.

Exploitation requires a child cpuset where cpuset.mems is not set and a VMA mempolicy configured with MPOL_F_RELATIVE_NODES.

639) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72009)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the imx93-blk-ctrl power domain handling for MIPI DSI and CSI when managing shared clock and reset resources. A local user can trigger concurrent use of the DSI and CSI domains to cause a denial of service.

The issue occurs because the two domains share control bits for clock and reset, so one domain may disable a resource while the other remains active.

640) NULL pointer dereference (CVE-ID: CVE-2026-72008)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper handling of null pointer dereference conditions in the MediaTek power domain driver when probing or cleaning up HW_VOTER type power domains. A local attacker can trigger a failed probe or removal path to cause a denial of service.

The issue occurs because the driver used DIRECT_CTL domain status and power-off logic for HW_VOTER domains in certain probe and cleanup paths.

641) Improper locking (CVE-ID: CVE-2026-72007)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a timing issue in the imx8m block control power-on sequence for VC8000E when powering up the VC8000E domain. A local user can trigger power up and down cycling to cause a denial of service.

The issue is associated with the i.MX8MP VC8000E and VPU_NOC power down handshake, which may hang during power state cycling.

642) Memory leak (CVE-ID: CVE-2026-72006)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in mlx5_st_dealloc_index() when repeatedly allocating and releasing mkeys carrying TPH steering-tag hints. A local user can trigger repeated allocation and release cycles to cause a denial of service.

The issue occurs when the last reference to an ST table entry is dropped and the associated bookkeeping structure remains unfreed, causing slab memory usage to grow over time.

643) Improper Initialization (CVE-ID: CVE-2026-72005)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in rt2x00lib_probe_dev() and rt2x00lib_remove_dev() when handling probe failures before work items are initialized. A local user can trigger an early probe failure to cause a denial of service.

The issue occurs when drv_data or workqueue allocation fails before intf_work, autowakeup_work, and sleep_work have been set up.

644) Memory leak (CVE-ID: CVE-2026-72004)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in ieee80211_register_hw() when copying supported band structures. A local user can trigger hardware registration with memory allocation failure conditions to cause a denial of service.

The issue occurs on an error path after rate control has been initialized.

645) Heap-based buffer overflow (CVE-ID: CVE-2026-72003)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in brcmf_notify_auth_frame_rx() in the brcmfmac cyw wireless driver when processing a short authentication frame during the external SAE authentication exchange. A remote attacker can send a specially crafted short authentication frame from a malicious access point to cause a denial of service or execute arbitrary code.

The issue can be triggered by a malicious or malfunctioning access point during the external SAE authentication exchange.

646) Insufficient Control Flow Management (CVE-ID: CVE-2026-68480)

CWE-ID: CWE-691 - Insufficient Control Flow Management

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper control flow handling in the x86 Safe-RET sequence when interrupts are injected during execution of the sequence on SRSO-affected systems. A local user can inject interrupts during the Safe-RET sequence to disclose sensitive information.

Only systems affected by SRSO are vulnerable.

647) Integer underflow (CVE-ID: CVE-2026-68479)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow leading to out-of-bounds read and out-of-bounds write in rtlbt_parse_firmware() when parsing a malformed Bluetooth firmware patch during Bluetooth setup. A local user can supply a specially crafted firmware patch to cause a denial of service.

The issue can be triggered by a firmware patch shorter than the version field, and arithmetic wraparound may affect 32-bit architectures.

648) Out-of-bounds write (CVE-ID: CVE-2026-68478)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to corrupt memory.

The vulnerability exists due to an out-of-bounds write in the ms_block Memory Stick block translation layer when processing a Memory Stick card that reports an excessive number of blocks. An attacker with physical access can provide a crafted card with a block count above the supported maximum to corrupt memory.

The issue occurs because the card-supplied block count can cause indexing past the end of the fixed free_block_count array.

649) Improper resource shutdown or release (CVE-ID: CVE-2026-68475)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to improper resource shutdown or release in sunxi_reset_init() in the sunxi reset driver when handling an ioremap() failure. A local user can trigger initialization that causes ioremap() to fail to cause a resource leak.

650) Out-of-bounds read (CVE-ID: CVE-2026-68474)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in spufs_mem_mmap_access() when accessing the SPU local store through a memory-mapped area. A local user can supply a crafted offset and length to read beyond the LS_SIZE buffer and disclose sensitive information.

The issue affects 64-bit systems because the existing clamp does not properly limit access against the local store size.

651) Improper access control (CVE-ID: CVE-2026-68473)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in mask_user_address() in arch/powerpc/include/asm/uaccess.h when handling user-supplied addresses on E500 hardware. A local user can supply a crafted user address to cause a denial of service.

Only PowerPC E500 systems are affected.

652) Out-of-bounds read (CVE-ID: CVE-2026-68472)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in cfg80211_gen_new_ie() when processing a malicious EHT multi-link element in an MBSSID beacon. A remote attacker can send a specially crafted beacon frame to cause a denial of service.

The issue is triggered through a malicious access point broadcasting a short EHT MLE that is later reused while building nontransmitted BSS information.

653) Improper input validation (CVE-ID: CVE-2026-68471)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ieee80211_mle_size_ok() and ieee80211_mle_common_size() when parsing multi-link element data. A remote attacker can send specially crafted MLE data to cause a denial of service.

The issue affects validation of advertised common information lengths for known MLE types, including Reconfiguration and Priority Access MLEs.

654) Out-of-bounds read (CVE-ID: CVE-2026-68470)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the mac80211 RX path when processing unsupported extension frames and S1G beacon extension frames. A remote attacker can send a specially crafted wireless frame to cause a denial of service.

The issue affects extension-frame handling before unsupported extension subtypes are dropped, and S1G beacon processing requires the target system to receive crafted 802.11 frames.

655) Race condition (CVE-ID: CVE-2026-68469)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in mwifiex_ret_802_11_associate() in the mwifiex wireless driver when processing an association command response during roaming. A local user can trigger repeated roam or connection changes to cause a denial of service.

The issue can leave scan requests permanently busy so later userspace scan requests fail with -EBUSY. The behavior was observed on IW412 firmware when power-save sleep events coincided with association handling.

656) Improper Initialization (CVE-ID: CVE-2026-68467)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the mchp23k256 SPI flash driver when probing id-table-only SPI device matches. A local user can attach or register a device that matches through the SPI id table to cause a denial of service.

The issue occurs because the driver may use incorrect chip capacity data and wrong MTD geometry for non-OF SPI modalias matches.

657) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68466)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in the lpc32xx_xmit_dma() function when waiting for DMA transfer completion. A local user can trigger a DMA completion timeout to cause a denial of service.

The timed out transfer may continue accessing the buffer after an error condition occurs.

658) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-68465)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the esdhc_change_pinstate() function of the sdhci-esdhc-imx driver when changing pinctrl states. A local user can trigger a pinctrl state transition to cause a denial of service.

Only devices with a sleep pinctrl state but without 100mhz or 200mhz high-speed pin states are affected.

659) Improper access control (CVE-ID: CVE-2026-68464)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper access control in the sdhci-esdhc-imx suspend and resume interrupt handling logic when processing a WIFI out-of-band wakeup during a suspend and resume transition. A local attacker can trigger a crafted wakeup and card interrupt sequence to cause a denial of service.

The issue occurs when the usdhc interrupt remains enabled while the controller is still in runtime suspend state, leading to an unhandled interrupt warning.

660) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68463)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper error handling in the sdhci_esdhc_suspend() function in the sdhci-esdhc-imx driver when handling a suspend operation after a runtime power management resume failure. A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue can lead to a kernel panic if hardware registers are accessed while the device is unclocked.

661) Out-of-bounds write (CVE-ID: CVE-2026-68458)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory.

The vulnerability exists due to an out-of-bounds write in binder_transaction() in the Android Binder driver when processing binder transactions to a txn_security_ctx node. A local user can send a crafted binder transaction with BINDER_TYPE_PTR objects to corrupt memory.

The issue occurs because the security context length is read after it has been cleared, which causes the scatter-gather buffer end offset to be miscalculated.

662) Race condition (CVE-ID: CVE-2026-68456)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in the ueagle-atm USB driver disconnect handler when handling device removal during asynchronous pre-firmware loading. A local attacker can unplug a device while firmware loading is still in progress to cause a denial of service.

The issue is associated with the firmware sysfs fallback mechanism and manifests when device teardown runs concurrently with the asynchronous firmware request.

663) Improper input validation (CVE-ID: CVE-2026-68455)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in luo_session_ioctl() when handling session ioctl operations. A local user can invoke an ioctl intended for a different session type to cause a denial of service.

The issue can trigger unexpected internal errors and WARN() messages when incoming-only operations are used on an outgoing session.

664) NULL pointer dereference (CVE-ID: CVE-2026-68454)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a null page reference in kvm_s390_pci_aif_enable() in the KVM s390 PCI code when registering IRQs without a summary bit specified. A local user can request IRQ registration without an AISB to cause a denial of service.

The issue is triggered when a guest enables adapter interruption forwarding without specifying a summary bit.

665) Memory leak (CVE-ID: CVE-2026-68450)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in __add_reloc_root() in fs/btrfs/relocation.c when inserting a relocation root into reloc_root_tree and encountering an unexpected duplicate entry. A local user can trigger the duplicate insert path to cause a denial of service.

This issue occurs because a newly allocated mapping node is left unfreed if insertion finds an existing entry and returns -EEXIST.

666) Infinite loop (CVE-ID: CVE-2026-68449)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in the NCQ tag completion bit-scanning logic in sata_dwc_isr() in drivers/ata/sata_dwc_460ex.c when processing NCQ tag completion data with only high bits set in the tag mask. A local attacker can trigger this condition to cause a denial of service.

The issue can occur in hardirq context while a spinlock is held.

667) Improper access control (CVE-ID: CVE-2026-68448)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the overlayfs copy_file_range handling in fs/overlayfs/file.c when performing cross-superblock copy operations. A local user can invoke a copy operation between different overlayfs filesystems to disclose sensitive information.

The issue occurs because read access to the source file is checked with destination overlayfs mounter credentials instead of source overlayfs mounter credentials.

668) Out-of-bounds read (CVE-ID: CVE-2026-68447)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the amdkfd CRIU checkpoint handling for the MQD control stack when copying checkpoint data to userspace. A local user can trigger a checkpoint operation with a hardware-reported control stack size larger than the allocated buffer object to disclose sensitive information.

The issue can leak kernel data from adjacent GTT memory to userspace.

669) Improper input validation (CVE-ID: CVE-2026-68446)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in vmw_gb_surface_define_internal when handling a userspace surface creation request with a crafted array_size value. A local user can submit a specially crafted request to cause a denial of service.

The array_size limit depends on which Shader Model is available.

670) Improper access control (CVE-ID: CVE-2026-68445)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass shader validation and execute untrusted GPU shader code.

The vulnerability exists due to improper access control in vc4_gem_object_mmap() when handling mappings of validated shader buffer objects. A local user can map a validated shader buffer object read-only and then use mprotect() to make it writable to bypass shader validation and execute untrusted GPU shader code.

The issue affects validated shader buffer objects that are initially mapped read-only but can later be upgraded to writable mappings.

671) NULL pointer dereference (CVE-ID: CVE-2026-68444)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ffa_partition_info_get() when processing a NULL partition UUID argument. A local attacker can trigger the vulnerable function with a NULL argument to cause a denial of service.

The issue results in a kernel panic.

672) Use-after-free (CVE-ID: CVE-2026-68443)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the gigabyte_waterforce driver probe path when handling device initialization failure after device I/O has been started. A local attacker can trigger the race condition during probe failure to execute arbitrary code.

The issue is caused by a race condition between hid_input_report() and execution immediately following hid_device_io_start() in the probe function.

673) Use-after-free (CVE-ID: CVE-2026-68442)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service and execute arbitrary code.

The vulnerability exists due to use-after-free in btrfs_drop_extent_map_range() and btrfs_free_extent_map() when splitting extent maps during logging. A local user can trigger crafted filesystem activity to cause a denial of service and execute arbitrary code.

The issue is caused by split extent maps incorrectly inheriting EXTENT_FLAG_LOGGING and later being freed while still linked on the inode's modified_extents list.

674) NULL pointer dereference (CVE-ID: CVE-2026-68441)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in qdisc filter chain classification handling when processing TC_ACT_REDIRECT from a TC filter attached to a qdisc filter chain. A local user can trigger TC_ACT_REDIRECT, for example via an eBPF program calling bpf_redirect(), to cause a denial of service.

The issue occurs when the caller does not set up bpf_net_context, and the clsact fast path is unaffected.

675) Out-of-bounds write (CVE-ID: CVE-2026-68440)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in txgbe_read_eeprom_hostif() when reading module EEPROM data through ethtool. A local user can trigger a non-4-aligned length read to cause a denial of service.

676) NULL pointer dereference (CVE-ID: CVE-2026-68439)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7925_mcu_bss_he_tlv() when handling HE BSS configuration data. A local user can trigger the vulnerable code path to cause a denial of service.

677) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68437)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the pvr_queue_prepare_job() and paired fragment job handling in the drm/imagination PowerVR queue logic when processing paired geometry and fragment jobs. A local user can submit crafted paired jobs to cause a denial of service.

The issue can lead to kernel warnings and job timeouts because the code may check CCCB space in the geometry queue instead of the fragment queue and then fail to write the full command sequence.

678) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-68436)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory allocation in dc_create() when initializing the AMD display manager. A local user can trigger GPU initialization so that allocation of struct dc fails and cause a denial of service.

The issue can leave the display unusable after amdgpu probe aborts during device initialization.

679) NULL pointer dereference (CVE-ID: CVE-2026-68434)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mid8250_probe() and mid8250_remove() in the 8250_mid serial driver when handling setup and exit callbacks for affected platforms. A local user can trigger the vulnerable code path to cause a denial of service.

The issue affects Denverton, Ice Lake Xeon D, and Snowridge platforms.

680) Out-of-bounds read (CVE-ID: CVE-2026-68433)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in handle_get_version_reply() in libceph when processing a truncated MON_GET_VERSION_REPLY message. A remote attacker can send a specially crafted reply to disclose sensitive information.

The issue occurs because decoding is bounded by the reused reply buffer size rather than the number of bytes actually received, allowing stale tail bytes from an earlier message to be read.

681) Improper access control (CVE-ID: CVE-2026-68432)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify VXLAN device configuration across network namespaces.

The vulnerability exists due to improper access control in vxlan_changelink() when handling changelink requests for a VXLAN device whose underlay network namespace differs from the device network namespace. A local privileged user can send a crafted changelink request to modify VXLAN device configuration across network namespaces.

The issue occurs when the caller has CAP_NET_ADMIN in the device network namespace but not in the VXLAN underlay network namespace.

682) Out-of-bounds read (CVE-ID: CVE-2026-68431)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ksmbd connection request handling when processing short SMB2 transform requests on an SMB 2.1 connection. A remote attacker can send a specially crafted truncated transform packet to disclose sensitive information.

The issue occurs when a transform packet is accepted even though the negotiated dialect does not provide transform handling.

683) Reachable assertion (CVE-ID: CVE-2026-68430)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable assertion in the amdgpu gfx8 fence emission logic when processing GPU fence operations. A local user can trigger the affected code path to cause a denial of service.

The issue results in a kernel crash.

684) Race condition (CVE-ID: CVE-2026-68429)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in drm_dp_mst_topology_queue_probe() when handling hotplug or link-loss events during MST topology teardown. A local user can trigger concurrent monitor connect or disconnect activity to cause a denial of service.

The issue can lead to spurious kernel warnings and compositor crashes when connecting or disconnecting DP MST monitors.

685) Use-after-free (CVE-ID: CVE-2026-68428)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the KVM x86 MMU cache cleanup logic when reloading a vendor module after a prior unload. A local user can trigger a vendor module reload sequence with a failed cache initialization to cause a denial of service.

The issue occurs when kvm.ko remains loaded while a vendor module is unloaded and then reloaded, leaving a stale cache pointer that is later passed to kmem_cache_destroy().

686) Use-after-free (CVE-ID: CVE-2026-68427)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in host1x_bo_clear_cached_mappings() when clearing cached mappings. A local user can trigger the vulnerable code path to cause a denial of service.

687) Use-after-free (CVE-ID: CVE-2026-68426)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in validate_xmit_xfrm() in net/xfrm/xfrm_device.c when processing GSO segment lists with asynchronous crypto handling. A local user can trigger asynchronous processing that steals a segment and leaves a stale skb->prev pointer to cause a denial of service.

The issue occurs when a stolen segment remains referenced as the list tail and is later dereferenced by validate_xmit_skb_list().

688) Improper input validation (CVE-ID: CVE-2026-68425)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state validation in the kernel-handled RMPP receive processing in IB MAD handling when processing unsolicited active RMPP DATA responses. A remote attacker can send a specially crafted unmatched RMPP response to cause a denial of service.

The issue occurs because receive-side reassembly could begin before the full TID and source address were verified against an outstanding send.

689) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68422)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing release of a reference in merge_reloc_roots() in the btrfs relocation code when handling an unexpected reloc_root for a root. A local user can trigger this condition to cause a denial of service.

The issue results in a root reference leak.

690) Resource management error (CVE-ID: CVE-2026-68421)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources in kernel/sched/ext.c. A local user can perform a denial of service (DoS) attack.

691) Out-of-bounds read (CVE-ID: CVE-2026-68420)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in xfrm_state_find() when processing outbound xfrm policies with optional IPTFS templates. A local user can create a crafted outbound policy and trigger packet processing to cause a denial of service.

Only outbound policies are affected; IN and FWD policies are not impacted.

692) Improper access control (CVE-ID: CVE-2026-68419)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in irdma_rereg_user_mr when re-registering non-memory regions. A local user can invoke rereg_mr on a specially registered QP, CQ, or SRQ region to cause a denial of service.

The issue affects special RDMA registrations created through a two-step userspace allocation and registration process where the region does not have a valid mkey.

693) NULL pointer dereference (CVE-ID: CVE-2026-68418)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the irdma queue pair creation path when creating a queue pair with a zero user_wqe_bufs value. A local user can submit a crafted queue pair creation request to cause a denial of service.

694) Race condition (CVE-ID: CVE-2026-68417)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in siw_create_qp() and QP lookup handling when creating and looking up queue pairs. A local user can trigger a QPN lookup for a queue pair that is still being constructed to cause a denial of service.

The issue occurs because the queue pair can be published before its queues, completion queue pointers, state, completion object, and device list entry are fully initialized.

695) Double free (CVE-ID: CVE-2026-68416)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in add_mtd_device() error handling for MTD partitions when handling device registration or nvmem provider initialization failures. A local user can trigger a failure in these error paths to cause a denial of service.

The issue also causes a WARN_ON condition because the partition node remains linked in the parent's partitions list when the release callback is invoked.

696) Use-after-free (CVE-ID: CVE-2026-68415)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in xfrm_state_gc_task and xfrm state mode callback handling when processing a failed IPTFS state setup or failed clone before publishing mode_data. A local user can trigger state setup failure and deferred garbage collection to cause a denial of service.

The issue occurs because a dead state can retain a stale mode callback table pointer after the temporary module reference is dropped, and the fault can be triggered later when garbage collection runs after the xfrm_iptfs module has been unloaded.

697) Use-after-free (CVE-ID: CVE-2026-68414)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in cfg80211_sched_scan_results_wk when processing scheduled scan result work during device unregister. A local user can trigger scheduled scan result handling during interface teardown to cause a denial of service.

The issue is caused by a race condition between the scheduled-scan result path and the unregister/free path.

698) Improper resource shutdown or release (CVE-ID: CVE-2026-68413)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ipw2100_pci_init_one() when handling error paths during device initialization. A local attacker can trigger initialization failures to cause a denial of service.

699) Memory leak (CVE-ID: CVE-2026-68412)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in cfg80211_wext_siwscan() when processing a scan request with an SSID length greater than IEEE80211_MAX_SSID_LEN. A local user can send a crafted scan request to cause a denial of service.

700) Out-of-bounds write (CVE-ID: CVE-2026-68411)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in hwsim_virtio_rx_work() when processing a virtio RX length reported by the device. A remote attacker can report an oversized length value to cause a denial of service.

The issue can trigger skb_over_panic() and panic the guest system.

701) Memory leak (CVE-ID: CVE-2026-68410)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in helper_firmware_cb() in the libertas USB firmware-download path when handling an asynchronous firmware load. A local user can trigger the firmware-download path to cause a denial of service.

No runtime testing was performed because compatible Libertas USB hardware was unavailable.

702) Use-after-free (CVE-ID: CVE-2026-68409)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the mac80211 link RX stats handling in sta_remove_link() when processing concurrent link removal and RX fast-path access. A local attacker can trigger the race condition to cause a denial of service.

The issue occurs only when uses_rss is enabled, which is when pcpu_rx_stats exists.

703) Deadlock (CVE-ID: CVE-2026-68408)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in cfg80211 PMSR work handling when closing a netlink socket that owns a PMSR session concurrently with interface teardown. A local user can close the socket and trigger concurrent interface shutdown processing to cause a denial of service.

The deadlock is also reachable from cfg80211_leave_locked() when interface cleanup is performed under wiphy_lock.

704) Memory leak (CVE-ID: CVE-2026-68407)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in nl80211_parse_beacon() when processing beacon data with fewer RNR entries than MBSSID entries. A local user can supply crafted beacon data to cause a denial of service.

705) Improper input validation (CVE-ID: CVE-2026-68406)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in PMSR FTM request parsing in cfg80211/nl80211 when processing user-supplied PMSR FTM request attributes. A remote attacker can send a specially crafted request with an out-of-range preamble value to cause a denial of service.

706) Improper locking (CVE-ID: CVE-2026-68405)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in ieee80211_do_stop() for AP_VLAN packet cleanup when freeing queued SKBs associated with ps->bc_buf while IRQs are disabled. A local user can trigger AP_VLAN stop processing with buffered packets to cause a denial of service.

The issue occurs because ieee80211_free_txskb() may invoke reporting paths beyond passive SKB release while the IRQ-disabled lock is still held.

707) Race condition (CVE-ID: CVE-2026-68404)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nl80211_netlink_notify() and cfg80211 wireless device autodisconnect handling when releasing a NETLINK_GENERIC socket that owns a connection. A local user can release a crafted netlink socket to cause a denial of service.

The issue occurs because autodisconnect work can be queued after teardown has cancelled pending work and after the wireless device has been removed from the device list.

708) Improper Initialization (CVE-ID: CVE-2026-68403)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in brcmf_sdio_probe() and brcmf_sdio_remove() when handling an early probe failure during SDIO device initialization. A local attacker can trigger a workqueue allocation failure to cause a denial of service.

The issue occurs because the cleanup path cancels bus->datawork before the work item has been initialized.

709) Out-of-bounds read (CVE-ID: CVE-2026-68402)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in cfg80211_is_element_inherited() when parsing a crafted wireless frame containing a zero-length extension element. A remote attacker can send a specially crafted frame to disclose sensitive information.

The issue is triggered during element parsing when a non-inheritance context exists, such as while parsing a per-STA profile of a Multi-Link element in a (re)association response or a non-transmitted BSS profile.

710) Out-of-bounds write (CVE-ID: CVE-2026-68401)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in ffa_setup_and_transmit() in the arm_ffa firmware driver when handling malformed memory region descriptors. A local user can trigger the vulnerable code path to cause a denial of service.

The issue includes writing the reserved field out of bounds for FFA versions earlier than 1.2 and insufficient size validation before writing constituents.

711) Out-of-bounds write (CVE-ID: CVE-2026-68400)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the arm_ffa memory region descriptor handling code when calculating endpoint memory access descriptor offsets while processing memory region descriptors. A local user can trigger the vulnerable code path with a crafted descriptor layout to cause a denial of service.

The issue arises from using a default structure size instead of the descriptor's ep_mem_offset value, which can cause calculated descriptor offsets to exceed the fragment size.

712) Use-after-free (CVE-ID: CVE-2026-68399)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sk_clone() and BPF socket local storage handling when cloning sockets and an early bailout occurs before BPF storage cloning. A local user can trigger socket cloning that fails before storage initialization completes to cause a denial of service.

Only systems with BPF syscall support enabled are vulnerable.

713) Use-after-free (CVE-ID: CVE-2026-68398)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in pppol2tp_recv() and PPP channel handling when processing pppol2tp receive traffic concurrently with channel teardown. A local user can trigger concurrent receive and close operations to cause a denial of service or execute arbitrary code.

The issue is reachable by an unprivileged user and affects a channel that is bound but not attached to a PPP unit and not bridged.

714) Use-after-free (CVE-ID: CVE-2026-68397)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in afiucv_hs_rcv() and the afiucv_hs_callback_* handlers when processing AF_IUCV socket traffic. A local user can trigger a concurrent socket close to cause a denial of service.

The issue arises because the destination socket is looked up under a lock and then used after the lock is released without holding a reference.

715) Race condition (CVE-ID: CVE-2026-68396)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the SCSI error handling logic when scheduling the error handler while commands are timed out or inactive. A local user can trigger error-handling conditions to cause a denial of service.

The issue can prevent the error handler thread from waking.

716) Improper Initialization (CVE-ID: CVE-2026-68395)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in the sata_dwc_460ex driver interrupt handling during device probe when enabling SATA interrupts before the IRQ handler is registered. A local attacker can trigger an interrupt during probe or cause a probe failure after interrupts are unmasked to cause a denial of service.

The issue can result in a spurious interrupt storm if the controller asserts an interrupt with no registered handler.

717) Use-after-free (CVE-ID: CVE-2026-68394)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth management subsystem when processing crafted MGMT_OP_LOAD_CONN_PARAM requests that queue a connection parameter update. A local user can send crafted requests that free a queued connection-parameter entry before the queued callback runs to cause a denial of service.

The issue occurs in queued connection update handling for an existing LE central connection.

718) Use-after-free (CVE-ID: CVE-2026-68393)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in net/bluetooth/hci_sync.c when accessing RCU-protected Bluetooth connection objects outside the critical section. A local user can trigger concurrent connection state changes to cause a denial of service.

The issue affects Bluetooth HCI synchronization code and occurs because connection objects may be deleted concurrently before dereference is complete.

719) Use-after-free (CVE-ID: CVE-2026-68392)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth management subsystem net/bluetooth/mgmt.c when handling unpair and disconnect operations. A local user can trigger these operations to cause a denial of service.

The issue arises from dereferencing RCU-protected connection pointers outside the required critical section.

720) Use-after-free (CVE-ID: CVE-2026-68391)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth management subsystem in net/bluetooth/mgmt.c when handling Bluetooth management operations involving pending command callbacks and connection lookups. A local user can trigger connection state changes during these operations to cause a denial of service.

The issue involves dereferencing RCU-protected hci_conn pointers outside critical sections and accessing connection state without the required device lock, which can also lead to a data race.

721) Race condition (CVE-ID: CVE-2026-68390)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in hci_sync connection parameter lookup handling when accessing Bluetooth connection parameters without holding hdev->lock. A local user can trigger concurrent Bluetooth operations to cause a denial of service.

722) Use-after-free (CVE-ID: CVE-2026-68389)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in qca_controller_memdump() in the Qualcomm Bluetooth hci_qca driver when processing a controller-reported memdump with an invalid zero dump size. A local user can trigger a crafted invalid memdump condition to cause a denial of service.

The issue can leave memdump collection state stale and IBS disabled after the aborted dump, which may block waiters or later transmit handling.

723) Out-of-bounds read (CVE-ID: CVE-2026-68388)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in smb3_simple_fallocate_range() when handling server-reported allocated ranges during fallocate operations. A local user can trigger fallocate on an SMB client mount backed by a server that returns overlapping or malformed allocated ranges to cause a denial of service.

A later write to a skipped hole may fail with ENOSPC.

724) Race condition (CVE-ID: CVE-2026-68387)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in raw_setsockopt() and raw flags bitfield handling in net/can/raw.c when changing socket options concurrently. A local user can trigger concurrent setsockopt operations to cause a denial of service.

The issue was introduced after flags were consolidated into a single bitfield, leading to a read-modify-write race during flag updates.

725) Improper input validation (CVE-ID: CVE-2026-68386)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state validation in sockmap update handling in net/core/sock_map.c when processing updates for unhashed UDP sockets. A local user can use a BPF program to look up an unbound UDP socket and then bind the socket to trigger a refcount imbalance and cause a denial of service.

The issue is triggered by a transition of a UDP socket from an unbound state to a bound state, which causes the reference decrement to be skipped and results in a memory leak.

726) Incorrect Comparison (CVE-ID: CVE-2026-68385)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect buffer selection in csum_partial() fallback logic in arch/s390/lib/csum-partial.c when calculating checksums on machines without the vector facility. A local user can trigger checksum calculation to cause a denial of service.

Only s390 systems without the vector facility are affected.

727) Race condition (CVE-ID: CVE-2026-68384)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in xe_bo_move() and VF CCS attach and detach handling when processing buffer object moves during VF migration. A local user can trigger a VF migration event while a copy job is in flight to cause a denial of service.

The issue affects virtual function CCS state handling during transitions between SYSTEM and TT memory, including cases where execution is paused mid-copy.

728) Use-after-free (CVE-ID: CVE-2026-68383)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the xe GuC scheduler timeline name handling when destroying an exec queue while scheduler fences still reference the timeline name. A local user can trigger exec queue destruction while outstanding scheduler fences still reference the freed name to cause a denial of service.

The issue arises because the scheduler keeps a pointer to the timeline name after the exec queue lifetime ends, creating an RCU-lifetime mismatch.

729) Deadlock (CVE-ID: CVE-2026-68382)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in the GuC exec queue destruction logic in the xe drm driver when asynchronously tearing down exec queues during device cleanup. A local user can trigger asynchronous queue destruction to cause a denial of service.

The issue arises when final device reference handling occurs from a destroy worker while cleanup is draining the same workqueue.

730) Use-after-free (CVE-ID: CVE-2026-68381)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in async oplock and lease break notification handling in fs/smb/server/oplock.c when processing asynchronous oplock break notifications during connection teardown. A remote user can trigger a race condition to cause a denial of service.

Exploitation requires a race between connection teardown and an oplock or lease break notification.

731) Use-after-free (CVE-ID: CVE-2026-68380)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the amdxdna job scheduler when accessing job->mm from the DRM scheduler worker thread after job submission. A local user can submit a job and trigger access to a freed mm_struct to cause a denial of service.

The issue arises because current->mm is stored as a raw pointer without holding a structural reference for the lifetime of the job.

732) Improper resource shutdown or release (CVE-ID: CVE-2026-68379)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the tcp_v4_rcv and tcp_v6_rcv TIME_WAIT socket handling paths when processing packets that fail PSP policy checks. A remote attacker can send network packets that trigger PSP policy failure to cause a denial of service.

The issue results in a memory leak of tcp_tw_bucket structures in both IPv4 and IPv6 receive paths.

733) NULL pointer dereference (CVE-ID: CVE-2026-68378)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in dpll_msg_add_pin_ref_sync() when handling dpll pin unregistration events for shared pins with ref_sync pairs. A local user can trigger unregistration of affected dpll devices to cause a denial of service.

The issue occurs when a pin is registered with multiple dpll devices and a ref_sync partner has already been removed from the current device's pin references while remaining registered with another device.

734) Use-after-free (CVE-ID: CVE-2026-68377)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tunnel_key_release_params() in net/sched/act_tunnel_key.c when handling concurrent tunnel key action processing on the datapath. A local user can trigger a race condition to cause a denial of service.

The issue arises because a reader may still access the old params structure under RCU while the associated metadata_dst is released synchronously.

735) Out-of-bounds read (CVE-ID: CVE-2026-68376)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in sctp_auth_get_hmac() when processing SCTP authentication parameters during association initialization. A local user can configure four HMAC identifiers to trigger memory corruption that leads to an out-of-bounds read and disclose sensitive information.

The issue stems from an undersized auth_hmacs array in struct sctp_cookie that can corrupt the adjacent auth_chunks field and cause an invalid HMAC identifier to be accepted.

736) Improper Initialization (CVE-ID: CVE-2026-68375)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in bnxt_aux_devices_init() and the bnxt_aux_dev_release() release callback when unwinding errors after auxiliary_device_init(). A local user can trigger an allocation failure during auxiliary device initialization to cause a denial of service.

The issue arises because the release callback may dereference or clear partially initialized state.

737) Race condition (CVE-ID: CVE-2026-68374)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in bos_descriptors_read() in the USB core sysfs interface when reading BOS descriptors while the associated usb_device BOS data is being reset and freed concurrently. A local user can trigger concurrent device reset activity during sysfs access to cause a denial of service.

738) Out-of-bounds read (CVE-ID: CVE-2026-68373)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in at76_guess_freq() when processing truncated beacon or probe response frames during scanning. A remote attacker can send a specially crafted wireless management frame to disclose sensitive information.

The issue is reachable from at76_rx_tasklet() while scanning.

739) Use-after-free (CVE-ID: CVE-2026-68372)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the USB Type-C connector handling in drivers/usb/core/port.c when processing Thunderbolt dock unplug and concurrent partner-disconnect events. A local user can trigger a crafted hot-unplug race to cause a denial of service.

Exploitation requires a race between component unbind, USB disconnect, and UCSI partner-disconnect handling during dock hot-plug events.

740) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-68371)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in the omap2430_probe() function when probing the omap2430 USB MUSB platform device. A local user can trigger the driver probe to cause a denial of service.

The issue can leave pdev->dev.of_node with an unbalanced reference count because a borrowed device tree node pointer is released incorrectly.

741) Race condition (CVE-ID: CVE-2026-68370)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dummy_hcd shared fifo_req handling when processing small IN transfers through the emulated single-request FIFO fast-path. A local user can trigger concurrent request queueing and completion handling to cause a denial of service.

The issue can overwrite the request completion function pointer while a completion callback is still running, leading to a general protection fault or page fault in dummy_timer.

742) Infinite loop (CVE-ID: CVE-2026-68369)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of copy_to_user() results in printer_read() in the USB gadget printer function when processing read requests with an unwritable user buffer. A local user can trigger a read operation with an unwritable user buffer to cause a denial of service.

The issue can result in an infinite loop if RX data is available and an iteration makes no progress.

743) Out-of-bounds read (CVE-ID: CVE-2026-68368)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ncm_unwrap_ntb() in the USB gadget NCM function when parsing host-supplied NTBs. A remote attacker can supply a crafted NTB with invalid block lengths, datagram offsets, or datagram lengths to disclose sensitive information.

Exploitation requires a malicious USB host interacting with a system using the affected USB gadget functionality.

744) Use-after-free (CVE-ID: CVE-2026-68367)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the f_tcm delayed set_alt work handler when processing delayed USB gadget alternate-setting changes during disconnect or function teardown. A local user can trigger function unlink or teardown while delayed set_alt work is still pending to cause a denial of service.

The issue was reproduced by KASAN in tcm_delayed_set_alt after the function state was freed through configfs unlink operations.

745) Out-of-bounds read (CVE-ID: CVE-2026-68366)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in uvc_send_response() when processing a UVCIOC_SEND_RESPONSE ioctl with a crafted response length. A local user can supply a crafted struct uvc_request_data to cause an out-of-bounds read and disclose sensitive information.

746) Out-of-bounds write (CVE-ID: CVE-2026-68365)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the io_edgeport USB serial driver ring buffer when processing interrupt-status packets that report transmit credits. A local user can provide a malicious or non-conforming USB device that returns excessive transmit credits to cause a denial of service.

Exploitation requires the system to interact with a USB serial device using the affected driver.

747) Deadlock (CVE-ID: CVE-2026-68364)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in the amdgpu display manager ISM disable path when handling suspend and resume while ISM delayed work is in flight. A local user can trigger suspend or resume activity to cause a denial of service.

The issue can cause a system hang while video is playing.

748) Use-after-free (CVE-ID: CVE-2026-68363)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in ath9k_hif_request_firmware() in drivers/net/wireless/ath/ath9k/hif_usb.c when handling a failed asynchronous firmware request during concurrent USB device disconnect. A local user can trigger a firmware download failure and a concurrent disconnect to cause a denial of service.

The issue is triggered by a race condition between the firmware callback running on the events workqueue and device disconnect, leading to a read from freed memory.

749) NULL pointer dereference (CVE-ID: CVE-2026-68362)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ath11k_hal_srng_access_begin and the ath11k driver restart path when handling firmware ready events after a failed initialization. A local user can trigger a subsystem restart after firmware ready handling fails to cause a denial of service.

The issue occurs because the driver can enter recovery with an inconsistent registered state after firmware ready processing does not complete successfully.

750) Use-after-free (CVE-ID: CVE-2026-68361)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in corsairpsu_probe() and HID input report handling when stopping a device after probe failure while input reports are still being processed. A local user can trigger the race condition during device initialization failure to execute arbitrary code.

The issue is triggered by a race condition between hid_input_report() and the code path immediately following hid_device_io_start() during probe failure.

751) Use-after-free (CVE-ID: CVE-2026-68360)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the corsair-cpro driver probe function when handling device I/O during probe failure after I/O start. A local user can trigger the vulnerable code path to execute arbitrary code.

The issue is caused by a race condition between hid_input_report() and execution immediately following hid_device_io_start() during probing.

752) Use-after-free (CVE-ID: CVE-2026-68359)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the nzxt-smart2 driver probe function when stopping a device after device I/O has been started and probe subsequently fails. A local user can trigger device initialization failure to execute arbitrary code.

The issue is caused by a race condition between hid_input_report() and execution immediately following hid_device_io_start() during probe error handling.

753) Use-after-free (CVE-ID: CVE-2026-68358)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the nzxt-kraken3 driver probe function when handling device initialization failures after device I/O has been started. A local user can trigger a probe failure after I/O start to execute arbitrary code.

The issue is caused by a race condition between hid_input_report() and execution immediately following hid_device_io_start() during probe.

754) Use-after-free (CVE-ID: CVE-2026-68357)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in watchdog_unregister_governor() and the watchdog pretimeout governor handling logic when unregistering a watchdog governor that is still referenced as default_gov. A local user can trigger governor unregistration and subsequent watchdog device registration or reassignment to cause a denial of service.

The issue occurs when the unregistered governor remains referenced through a dangling default_gov pointer, affecting both newly registered watchdog devices and existing devices whose governor is reassigned.

755) Division by zero (CVE-ID: CVE-2026-68356)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in the airoha watchdog driver when handling a zero clock frequency value during device probe or time-left calculation. A local user can trigger use of an improperly configured or unmanaged clock to cause a denial of service.

The issue occurs when clk_get_rate() returns 0.

756) Out-of-bounds read (CVE-ID: CVE-2026-68355)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in ath11k_hal_rx_msdu_list_get() when processing msdu descriptor entries. A local attacker can trigger a zero buffer address in the first msdu_details entry to cause a denial of service.

757) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68354)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of fragment list boundaries in the firewire networking fragmented datagram reassembly logic when processing fragmented datagrams. A remote attacker can send specially crafted fragmented datagrams to cause a denial of service.

The issue can prevent complete datagrams from being correctly recognized during reassembly.

758) Out-of-bounds read (CVE-ID: CVE-2026-68353)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ath6kl_wmi_tx_complete_event_rx() when processing a crafted WMI TX complete event from firmware. A local user can supply an inflated num_msg field to disclose sensitive information.

The num_msg field is firmware-controlled and can cause reads of up to 1020 bytes past the WMI event buffer.

759) Out-of-bounds read (CVE-ID: CVE-2026-68352)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in ath6kl_wmi_connect_event_rx() when parsing firmware-controlled connect event information elements. A local attacker can supply crafted length fields to trigger out-of-bounds reads and disclose sensitive information.

The issue can also corrupt the wmi->is_wmm_enabled state during parsing.

760) Out-of-bounds read (CVE-ID: CVE-2026-68351)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in carl9170_cmd_callback() when processing a firmware command response with a length mismatch. A remote attacker can send a specially crafted firmware response to disclose sensitive information.

761) Out-of-bounds read (CVE-ID: CVE-2026-68350)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in carl9170_tx_process_status() when processing firmware-controlled TX status entries. A local attacker can provide a crafted firmware response with an oversized hdr.ext value to disclose sensitive information.

The issue is caused by an off-by-two bounds check error that allows two extra iterations past valid _tx_status entries.

762) Heap-based buffer overflow (CVE-ID: CVE-2026-68349)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in carl9170_rx_stream() when processing USB transfer data in the rx stream failover path. A local attacker can provide specially crafted transfer data to cause a denial of service.

The issue is triggered when two transfers are near the maximum size and their combined copied length exceeds the 65535-byte failover SKB, resulting in skb_over_panic.

763) Out-of-bounds read (CVE-ID: CVE-2026-68348)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the TAS2781 firmware parser when parsing malformed firmware description strings. A local user can supply a crafted firmware image without a NUL terminator to cause a denial of service.

The issue occurs because variable-length description strings are processed with strlen() before verifying that the terminator is present within the firmware buffer.

764) Improper locking (CVE-ID: CVE-2026-68347)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in the AMD IOMMU nested domain allocation and free paths when handling ioctl requests and domain teardown. A local user can trigger lock ordering violations to cause a denial of service.

The issue involves HARDIRQ-safe to HARDIRQ-unsafe lock ordering in gdom allocation and the IOMMU_DESTROY free path.

765) Memory leak (CVE-ID: CVE-2026-68346)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in cs35l41_get_acpi_mute_state() when repeatedly querying the ACPI _DSM mute state. A local user can trigger repeated successful queries to cause a denial of service.

Each successful query leaks the returned _DSM result object because it is owned by the caller and is not freed after use.

766) Out-of-bounds read (CVE-ID: CVE-2026-68346)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in cs35l41_get_acpi_mute_state() when processing a malformed ACPI _DSM firmware response. A local user can provide a crafted firmware response to cause a denial of service.

The issue occurs because the code assumes the returned ACPI object is a buffer with at least one byte and directly dereferences the returned buffer pointer.

767) NULL pointer dereference (CVE-ID: CVE-2026-68345)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in __destroy_component_cfg() in the arm mpam component configuration handling when destroying component configuration for RIS entries without an mbwu_state object. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because mbwu_state is allocated per RIS only for RISes with MBWU monitors.

768) Out-of-bounds read (CVE-ID: CVE-2026-68343)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in parse_dfs_referrals() in the SMB client DFS referral parser when processing a malformed DFS referral response with an oversized PathConsumed value. A remote attacker can send a specially crafted DFS referral response to cause an out-of-bounds read.

The issue occurs when PathConsumed is larger than the search name length used for later DFS path parsing.

769) Use-after-free (CVE-ID: CVE-2026-68342)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ovpn_peer_release_p2p() in the OpenVPN peer handling code when destroying an OVPN UDP socket after a peer replacement. A local user can trigger peer replacement and socket teardown to cause a denial of service.

The issue occurs when a replacement peer is published before the old UDP socket destruction path runs, leaving a stale peer reference reachable from later cleanup paths.

770) Use-after-free (CVE-ID: CVE-2026-68341)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in unlock_ovpn() in the ovpn peer handling code when iterating over the release_list during peer release processing. A local user can trigger the vulnerable code path to cause a denial of service.

771) Out-of-bounds read (CVE-ID: CVE-2026-68340)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the OCC poll response parser in drivers/hwmon/occ/common.c when parsing a truncated transport response. A local user can supply a malformed poll response to cause a denial of service.

The issue occurs because the parser used the backing-array capacity instead of the current response data length as the parse boundary, and malformed-response errors were not propagated before the OCC was published as active.

772) Out-of-bounds read (CVE-ID: CVE-2026-68339)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in btusb_recv_event_realtek() when processing short Realtek vendor events. A local attacker can send a specially crafted Bluetooth HCI vendor event to cause a denial of service.

Short vendor events may be misclassified as coredump events because the code inspects a missing third byte.

773) Race condition (CVE-ID: CVE-2026-68338)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in packet_set_ring() and packet fanout hook handling in net/packet/af_packet.c when reconfiguring a packet socket ring while a network device is being unregistered. A local user can trigger ring reconfiguration during device unregister handling to cause a denial of service.

The issue occurs when a stale running state causes fanout hook re-registration after the device binding has already been invalidated.

774) NULL pointer dereference (CVE-ID: CVE-2026-68337)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the bpf_redirect helpers and skb_do_redirect() when processing tc BPF programs attached to a proper qdisc without a bpf_net_context. A local user can attach or run a BPF program that calls a redirect helper or returns TC_ACT_REDIRECT to cause a denial of service.

The issue occurs on qdisc paths where tc BPF execution does not establish the required per-task network context.

775) NULL pointer dereference (CVE-ID: CVE-2026-68336)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in bond_send_validate() in the bonding driver when processing ARP monitor validation with IPv6 disabled. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when the system is booted with the 'ipv6.disable=1' parameter.

776) Use-after-free (CVE-ID: CVE-2026-68335)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the RDS receive path when delivering an incoming message across network namespace boundaries. A local user can create network namespaces and send a crafted message to trigger a dangling connection reference and potentially execute arbitrary code.

The issue is reachable from unprivileged user namespaces using CLONE_NEWUSER and CLONE_NEWNET.

777) Race condition (CVE-ID: CVE-2026-68334)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in rxrpc_wake_up_io_thread() when waking the rxrpc I/O thread. A local user can trigger concurrent operations that cause a NULL pointer dereference to cause a denial of service.

778) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68333)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper release of a resource in dpaa2_switch_port_disconnect_mac in the dpaa2-switch driver when disconnecting a MAC endpoint device. A local user can repeatedly connect and disconnect the MAC endpoint to cause a denial of service.

779) Use-after-free (CVE-ID: CVE-2026-68332)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in airoha_ppe_deinit() when releasing NPU resources while RCU readers may still hold a reference. A local user can trigger the deinitialization path to cause a denial of service.

The issue occurs because existing RCU read-side critical sections may continue using the NPU reference after it has been freed.

780) Improper resource shutdown or release (CVE-ID: CVE-2026-68331)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the dpaa2 Ethernet MAC disconnect path when disconnecting a MAC endpoint device. A local user can repeatedly trigger connect and disconnect operations to cause a denial of service.

The issue leaks a device reference stored in mac->mc_dev on each successful connect that is later disconnected.

781) Use of uninitialized resource (CVE-ID: CVE-2026-68330)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause silent data corruption.

The vulnerability exists due to improper DMA buffer synchronization in airoha_npu_send_msg() when processing NPU mailbox responses through a shared DMA buffer on non-cache-coherent systems. A local user can trigger mailbox operations that cause the CPU to read stale cached data to cause silent data corruption.

The issue is timing-sensitive and is more likely when the response is read immediately after DMA unmapping without intervening cache-evicting operations.

782) Race condition (CVE-ID: CVE-2026-68329)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a race condition in iommu_completion_wait() in the AMD IOMMU subsystem when handling concurrent command completion waits across multiple CPUs. A local user can trigger concurrent IOMMU command activity to cause a use-after-free condition.

The issue occurs because the code may return without waiting for previously queued commands to complete in hardware, which can leave stale translations in use while related page-table pages are freed.

783) NULL pointer dereference (CVE-ID: CVE-2026-68328)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in nfp_cpp_resource_find() and nfp_resource_try_acquire() when opening a resource with a matching resource-table entry after mutex allocation fails. A local user can trigger resource acquisition to cause a denial of service.

This issue was identified through static analysis and confirmed by manual source review.

784) NULL pointer dereference (CVE-ID: CVE-2026-68327)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in wanxl_reset in the wanxl PCI device removal path when handling early probe failures before BAR mapping. A local user can trigger device initialization failure conditions to cause a denial of service.

The issue occurs on an error path where the PLX MMIO BAR has not yet been mapped, leaving card->plx NULL when cleanup invokes the reset routine.

785) Out-of-bounds read (CVE-ID: CVE-2026-68326)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in mwifiex_process_uap_event() and the assoc_req_ies parsing path when processing a firmware-reported uAP association event with a crafted event length. A local attacker can supply a malicious or malformed event from a mwifiex device to disclose sensitive information.

The issue can be triggered by a malicious or malfunctioning mwifiex USB, SDIO, or PCIe device while the interface is operating in AP/uAP mode. An underflow in the calculated length may also cause stale event buffer bytes to be exposed through an NL80211_CMD_NEW_STATION notification.

786) Stack-based buffer overflow (CVE-ID: CVE-2026-68325)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in the ivrs_acpihid command-line parser when parsing the ivrs_acpihid kernel command-line parameter. A local attacker can supply a specially crafted parameter with more than four entries to cause a denial of service.

787) Out-of-bounds write (CVE-ID: CVE-2026-68324)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in dmar_latency_disable() when disabling latency statistics for a type value greater than 0. A local user can trigger the vulnerable code path to cause a denial of service.

When the type value is greater than 0, the operation writes beyond the end of the allocated array and corrupts adjacent memory.

788) Race condition (CVE-ID: CVE-2026-68323)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in tipc_udp_rcast_add() and cleanup_bearer() in net/tipc/udp_media.c when updating the udp bearer replicast list during peer discovery and bearer cleanup. A local user can enable a TIPC bearer from an unprivileged user namespace and trigger concurrent list updates to cause a denial of service.

The issue can corrupt the kernel list structure and trigger a kernel BUG during bearer cleanup.

789) NULL pointer dereference (CVE-ID: CVE-2026-68322)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the RDS IPv6 address check logic when binding an RDS socket to an IPv6 address while IPv6 is disabled. A local user can bind an RDS socket to an IPv6 address to cause a denial of service.

The issue occurs on systems booted with the ipv6.disable=1 parameter.

790) Memory leak (CVE-ID: CVE-2026-68321)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the txgbe driver FDIR filter cleanup logic when removing the driver after adding perfect FDIR filters while the interface is down. A local user can add perfect FDIR filters and trigger driver removal to cause a denial of service.

The issue occurs because filters kept on the software list for later restore are not freed if unregister_netdev() does not call ndo_stop.

791) Heap-based buffer overflow (CVE-ID: CVE-2026-68320)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in sctp_association_init and SCTP authentication chunk handling when processing endpoint authentication chunk lists containing more than 16 entries. A local user can add excessive chunk identifiers to trigger memory corruption and cause a denial of service.

792) Deadlock (CVE-ID: CVE-2026-68319)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in the pds_core reset and device removal handling when a PCI reset thread runs concurrently with device removal. A local user can trigger concurrent reset and remove operations to cause a denial of service.

The issue occurs because the reset work waits for a device lock that is already held during the unbind sequence, while device removal waits for the workqueue to complete.

793) Use-after-free (CVE-ID: CVE-2026-68318)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the pds_core driver workqueue handling during device removal and teardown when processing queued work and interrupt-driven events. A local user can trigger device removal or teardown activity to cause a denial of service.

The issue can be reached when queued work is scheduled after the workqueue has been destroyed, including timeout handling in device command reset and NotifyQ interrupt activity before the interrupt handler is freed.

794) Race condition (CVE-ID: CVE-2026-68317)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition and NULL pointer dereference in the pds_core auxiliary device add and delete logic when concurrent add or delete operations access the same auxiliary device slot. A local user can trigger concurrent device add or delete operations to cause a denial of service.

The issue arises because the shared slot is not consistently checked and updated under config_lock in both paths.

795) Out-of-bounds write (CVE-ID: CVE-2026-68316)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or overwrite memory outside the intended buffer.

The vulnerability exists due to out-of-bounds write in the command stream validation logic in drivers/accel/ethosu/ethosu_gem.c when processing crafted command streams with 16/32/64-bit element sizes. A local user can submit a specially crafted command stream to cause a denial of service or overwrite memory outside the intended buffer.

The issue is caused by incorrect element size accounting for NHWC format and by using different element-size bitfields for IFM/IFM2 and OFM.

796) Integer overflow (CVE-ID: CVE-2026-68315)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow in sctp_process_strreset_inreq() when processing a crafted SCTP RESET_IN_REQUEST from a peer. A remote attacker can send a specially crafted SCTP stream reset request to cause a denial of service.

Exploitation is only possible on interfaces with MTU greater than 65535, such as loopback with IPv6 jumbograms.

797) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68314)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in mctp_i3c_mod_init() in the mctp i3c driver when registering the i3c notifier and initializing existing buses before driver registration completes. A local user can trigger a driver registration failure to cause a denial of service.

The issue leaves a notifier pointing to a module that failed to load and leaks allocated bus objects.

798) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68313)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in __tipc_nl_compat_dumpit in the TIPC netlink compatibility handler when processing dumpit callback results. A local user can trigger a negative return value path to cause a denial of service.

The issue can lead to an infinite loop that prevents genl_mutex from being released, causing tasks waiting on the mutex to starve in D state.

799) Improper resource shutdown or release (CVE-ID: CVE-2026-68312)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in cifs_close_deferred_file(), cifs_close_all_deferred_files(), and cifs_close_deferred_file_under_dentry() when handling deferred close cancellation and allocation failure under memory pressure. A local user can trigger deferred close processing in low-memory conditions to cause a denial of service.

The issue occurs when cancel_delayed_work() succeeds and the subsequent allocation for local processing fails, causing a cifsFileInfo reference and an open server handle to leak.

800) NULL pointer dereference (CVE-ID: CVE-2026-68311)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7925_sta_set_decap_offload() in the mt76 mt7925 wireless driver when updating decap offload state for an MLO station. A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue occurs when a vif valid_links entry does not have a corresponding link STA for the station.

801) NULL pointer dereference (CVE-ID: CVE-2026-68310)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in HE capability handling in mt7915_mcu_bss_he_tlv() and mt7915_mcu_sta_bfer_tlv() when processing HE-specific setup for a vif type with no matching capability entry. A local user can trigger HE-specific processing to cause a denial of service.

802) NULL pointer dereference (CVE-ID: CVE-2026-68309)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt76_connac_mcu_uni_bss_he_tlv() when processing HE BSS TLV data. A local user can trigger the vulnerable code path to cause a denial of service.

803) NULL pointer dereference (CVE-ID: CVE-2026-68308)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the mt7996 MCU handling code when processing HE PHY capability data. A local user can trigger code paths that use a NULL capability pointer to cause a denial of service.

804) NULL pointer dereference (CVE-ID: CVE-2026-68307)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mt7925_vif_connect_iter() and mt76_connac_mcu_uni_add_dev() when replaying firmware state for links during reset recovery. A local user can trigger MLO link changes or timeout recovery conditions to cause a denial of service.

The issue occurs when the driver temporarily tracks a link whose mac80211 bss_conf is no longer present.

805) NULL pointer dereference (CVE-ID: CVE-2026-68306)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7996_mcu_sta_bfer_eht() when handling EHT PHY capability data. A local attacker can trigger the vulnerable code path to cause a denial of service.

806) Improper Initialization (CVE-ID: CVE-2026-68304)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the brcmfmac cfg80211 key management handling when processing 802.1X-SHA256 PMK configuration requests. A local user can send a crafted netlink request to trigger a kernel warning and cause a denial of service.

The issue occurs when 802.1X-SHA256 mode is used without the required firmware supplicant configuration.

807) NULL pointer dereference (CVE-ID: CVE-2026-68303)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the vc4_hvs_unbind and vc4_v3d_unbind functions when unbinding dependent vc4 drivers after vc4-drm removal. A local user can trigger driver unbind operations to cause a denial of service.

The issue occurs because the dependent drivers access master driver data after the vc4-drm device has already been removed.

808) Use-after-free (CVE-ID: CVE-2026-68302)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the AMT packet handling logic in drivers/net/amt.c when processing crafted network packets that trigger skb header pulls and head reallocation. A remote attacker can send specially crafted packets to cause a denial of service or potentially execute arbitrary code.

The issue affects multiple AMT receive and transmit paths that cache skb header pointers and later dereference them after helpers such as pskb_may_pull(), ip_mc_may_pull(), ipv6_mc_may_pull(), iptunnel_pull_header(), ip_mc_check_igmp(), or ipv6_mc_check_mld() move the skb head.

809) Memory leak (CVE-ID: CVE-2026-68301)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in hsr_del_port() when unregistering or destroying an HSR slave device while HSR is active. A local user can unregister or destroy a slave device to cause a denial of service.

The issue occurs because VLAN 0 and other synced VLANs can remain referenced on the slave device after it is detached from the HSR master.

810) Improper Authentication (CVE-ID: CVE-2026-68300)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass authentication.

The vulnerability exists due to improper authentication in sctp_auth_chunk_verify() when processing SCTP chunks with a NULL auth_chunk. A remote user can send a specially crafted SCTP chunk to bypass authentication.

This can occur for new connections or when no AUTH chunk precedes a COOKIE-ECHO chunk.

811) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68299)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of encapsulated packet headers in vmxnet3_get_hdr_len() when processing Geneve-encapsulated packets. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue is triggered when descriptor fields describe the inner header instead of the outer header, including cases where the outer protocol is UDP or the outer and inner IP versions differ.

812) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68298)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in xe_vm_create() in the drm/xe virtual memory management code when handling creation failures after SVM initialization. A local user can trigger drm_gpuvm_resv_object_alloc() allocation failure to cause a denial of service.

For fault-mode VMs, the issue can also leave pagemap owner and pagemap resources unreleased on the error path.

813) Improper input validation (CVE-ID: CVE-2026-68297)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in TIPC netlink MTU property handling when processing user-supplied MTU values through TIPC media or bearer configuration requests. A local user can supply an MTU value greater than 65535 to trigger a division by zero and cause a denial of service.

Exploitation is possible by an unprivileged user via a user namespace.

814) Improper locking (CVE-ID: CVE-2026-68296)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock management in GRE tunnel initialization in net/ipv4/ip_gre.c and net/ipv6/ip6_gre.c when transmitting through GRE, GRETAP, or ip6gre tunnels configured with SEQ or CSUM encapsulation. A local user can trigger network transmission through a specially configured tunnel to cause a denial of service.

The issue can lead to an ABBA deadlock involving _xmit_lock acquisition on the underlay device.

815) Improper access control (CVE-ID: CVE-2026-68294)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass network namespace isolation.

The vulnerability exists due to improper access control in the AF_QIPCRTR socket creation logic and global QRTR state handling when creating and using QRTR sockets from a separate network namespace. A local user can create an AF_QIPCRTR socket in another network namespace and send crafted QRTR datagrams to sockets owned by a different namespace to bypass network namespace isolation.

The receiving socket may treat the message as originating from node id 1, making it indistinguishable from a legitimate local client.

816) Out-of-bounds read (CVE-ID: CVE-2026-68293)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the MCIA register handling in the mlx5 driver when processing module EEPROM reads via ethtool. A local user can trigger a read of module EEPROM data to cause a denial of service.

The issue is detected on kernels built with FORTIFY_SOURCE, where it results in a kernel BUG.

817) Improper resource shutdown or release (CVE-ID: CVE-2026-68292)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the ice driver transmit queue handling when rebuilding queues after a PCI reset. A local user can enable ETF offload on a PF Tx queue and trigger a PCI reset to cause a denial of service.

The issue affects non-PF VSI types because queue state is checked by queue index without distinguishing VSI type, which can cause a 64-byte tstamp_ring allocation to be leaked on each reset.

818) NULL pointer dereference (CVE-ID: CVE-2026-68291)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the idpf driver core initialization and removal handling when allocation errors occur during initialization followed by reset or module removal. A local privileged user can trigger failed initialization and then reset or remove the module to cause a denial of service.

The issue occurs because max_vports is set before the related vports, netdevs, and vport_config buffers are successfully allocated.

819) Use-after-free (CVE-ID: CVE-2026-68290)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in rds_tcp_skbuf_handler in the RDS TCP sysctl handler when handling a concurrent sysctl write during network namespace teardown. A local user can trigger a concurrent sysctl write to cause a denial of service.

The race occurs because the network namespace is derived from a listen socket that may already have been freed.

820) Integer overflow (CVE-ID: CVE-2026-68289)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in tipc_recvmsg() and tipc_recvstream() when processing oversized user-supplied buffer lengths. A local user can supply an excessively large buffer length via io_uring provided buffers to cause a denial of service.

The issue can trigger a WARN_ON that may lead to a kernel panic on systems configured with panic_on_warn.

821) Use of uninitialized resource (CVE-ID: CVE-2026-68288)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in NET_DM_ATTR_PAYLOAD handling in net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() when constructing netlink messages containing packet payload data. A local user can receive a specially crafted netlink message to disclose sensitive information.

The issue occurs when the packet payload length is not 4-byte aligned, causing 1 to 3 padding bytes to remain uninitialized and be leaked to user space.

822) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-68287)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper calculation of buffer size in net/core/drop_monitor.c when handling 64-bit drop monitor attributes on affected architectures. A local user can trigger packet report generation to cause a denial of service.

This affects 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS because 64-bit netlink attributes may require additional padding for alignment.

823) Race condition (CVE-ID: CVE-2026-68286)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe() in net/core/drop_monitor.c when updating 64-bit per-CPU statistics after releasing drop_queue.lock with interrupts re-enabled. A local attacker can trigger reentrant execution during the stats update to cause a denial of service.

On 32-bit architectures, a nested interrupt on the same CPU during the seqcount-based update can corrupt the seqcount state or statistics value.

824) Use-after-free (CVE-ID: CVE-2026-68284)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tcp_bpf_sendmsg() when two threads send on the same socket and an error occurs after waiting for socket memory. A local user can trigger concurrent send operations to cause a denial of service.

The issue occurs in the sockmap BPF path and involves stale cork state being mistaken for a stack-local temporary message.

825) Use-after-free (CVE-ID: CVE-2026-68283)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a use-after-free in event trigger cleanup in the tracing subsystem when freeing trigger private data during concurrent tracepoint handling. A local user can trigger concurrent tracepoint activity while removing a trigger to cause a use-after-free condition.

The issue affects histogram and enable trigger teardown paths where tracepoint handlers may still access satellite data after the trigger has been removed.

826) NULL pointer dereference (CVE-ID: CVE-2026-68282)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a null pointer in rockchip_dp_probe() in the analogix_dp-rockchip driver when processing a platform device with no memory resource available. A local user can trigger the vulnerable code path to cause a denial of service.

827) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68281)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of dependencies in prepare_job() in the PowerVR DRM scheduler queue handling code when submitting paired geometry and fragment jobs to the fragment CCCB. A local user can submit specially crafted paired jobs to cause a denial of service.

The issue can lead to kernel warnings and potentially job timeouts when the fragment command queue is almost full.

828) Improper resource shutdown or release (CVE-ID: CVE-2026-68280)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in cdns_dsi power management operations when handling runtime suspend and system suspend transitions. A local user can trigger suspend operations to cause a denial of service.

The issue results in a kernel warning when clocks are disabled twice.

829) Out-of-bounds read (CVE-ID: CVE-2026-68279)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in drm_dp_sideband_parse_remote_dpcd_read() and drm_dp_sideband_parse_remote_i2c_read_ack() when parsing remote DPCD and I2C sideband reply messages from an MST hub. A remote attacker can send a specially crafted sideband reply with an oversized num_bytes value to disclose sensitive information.

The issue can be triggered by a malicious or misbehaving MST hub.

830) Out-of-bounds write (CVE-ID: CVE-2026-68278)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to out-of-bounds write in drm_dp_sideband_append_payload() when processing forged DP MST sideband reply messages from a connected device. An attacker with physical access can send crafted sideband reply data to cause memory corruption.

The issue is reachable from a DP MST device over a physical connection.

831) Out-of-bounds read (CVE-ID: CVE-2026-68277)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the sideband reply parsers in drm_dp_mst_topology.c when parsing crafted sideband reply messages. A local user can provide a crafted message with a truncated 2-byte field to disclose sensitive information.

The out-of-bounds read can access data from adjacent struct fields including curchunk_len, curchunk_idx, and curlen.

832) Out-of-bounds write (CVE-ID: CVE-2026-68276)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the cleaner shader sysfs path in amdgpu_gfx_run_cleaner_shader_job() when filling the shader IB buffer. A local user can trigger the cleaner shader sysfs path to overflow the allocated buffer and cause a denial of service.

The issue can result in a kernel page fault on GFX rings because a 16-dword IB allocation is overrun by writes based on an align_mask value of 0xff.

833) NULL pointer dereference (CVE-ID: CVE-2026-68275)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the AMDGPU_GEM_OP_GET_MAPPING_INFO path of amdgpu_gem_op_ioctl() when handling a request for mapping info for an unmapped buffer object. A local user can issue a crafted ioctl request to cause a denial of service.

The issue is reachable by a process able to issue the ioctl through the render group.

834) Heap-based buffer overflow (CVE-ID: CVE-2026-68274)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the steered register list allocation in drivers/gpu/drm/xe/xe_guc_capture.c when allocating and filling steered register lists for DSS steering. A local user can trigger device unbind on a platform with compute-only DSS bits to cause a denial of service.

The overflow occurs because the allocation size is calculated from the geometry DSS mask alone, while the filling logic iterates over the union of geometry and compute DSS masks, which can corrupt adjacent slab objects and the drmres list_head during drm_managed_release.

835) Use-after-free (CVE-ID: CVE-2026-68273)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free and NULL pointer dereference in the amdgpu context pstate handling code when initializing or finalizing GPU contexts while stable pstate state changes are processed. A local user can create and tear down crafted contexts to cause a denial of service.

The issue arises because context pstate ownership transitions were not consistently protected by the stable_pstate_ctx_lock, and sysfs-triggered state changes can race with context handling.

836) NULL pointer dereference (CVE-ID: CVE-2026-68272)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper input validation leading to a NULL-pointer dereference in amdgpu_cs_pass1() and amdgpu_cs_p2_shadow() when processing an undersized AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk. A local user can submit a specially crafted chunk with zero length to cause a denial of service.

This is reachable by an unprivileged process in the render group.

837) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68271)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() when handling failed u_memcpya() allocations during user copy operations. A local user can trigger an allocation failure to cause a denial of service.

The issue can lead to a kernel oops from dereferencing an ERR_PTR value, and a different failure path can also result in a memory leak.

838) Integer overflow (CVE-ID: CVE-2026-68270)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in drm_sysfb_get_visible_size_si in drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c when calculating the visible size of the system framebuffer. A local user can supply large height and stride values to trigger incorrect size calculation and cause a denial of service.

839) Observable discrepancy (CVE-ID: CVE-2026-68269)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper restriction of speculative execution in the parallel submission slot handling in set_proto_ctx_engines_parallel_submit() when processing a userspace-controlled parallel submission slot. A local user can supply a crafted slot value to disclose sensitive information.

840) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68268)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in __xe_svm_handle_pagefault in the xe drm driver when handling non-migratable faults requiring device memory. A local user can trigger such a fault to cause a denial of service.

841) Improper access control (CVE-ID: CVE-2026-68267)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass register access restrictions.

The vulnerability exists due to improper access control in the OA register whitelist handling in the xe DRM driver when initializing or resetting whitelist entries. A local user can access OA registers through non-privileged slots to bypass register access restrictions.

The issue can occur after probe, GT reset, resume, and engine reset.

842) Use-after-free (CVE-ID: CVE-2026-68266)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the xe dma-buf imported buffer object handling when tearing down imported buffer objects after dma_buf_dynamic_attach() or buffer object creation fails. A local user can trigger creation of a crafted imported dma-buf buffer object to cause a denial of service.

The issue can be reached on failure paths where the buffer object already references the exporter's reservation object and that reservation object is later accessed asynchronously during delayed deletion.

843) Out-of-bounds read (CVE-ID: CVE-2026-68265)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the xe_vm.c BO prefetch handling for BO VMAs when processing a prefetch region of DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the value -1 is used as an index into region_to_mem_type[] for a BO VMA prefetch operation.

844) Out-of-bounds write (CVE-ID: CVE-2026-68264)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in xe_pt_update_ops_init() and the vm_bind path in the xe driver when retrying page table update preparation after lock contention or OOM eviction. A local user can trigger repeated retries to cause a denial of service.

The issue can corrupt SLUB-poisoned memory and lead to a subsequent use-after-free crash in xe_migrate_update_pgtables_cpu().

845) Double free (CVE-ID: CVE-2026-68263)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in drm_sched_entity_fini() in the PowerVR DRM queue cleanup path when destroying queues after queue kill handling. A local user can trigger queue teardown in a crafted context lifecycle to cause a denial of service.

The issue is associated with a refcount underflow and use-after-free warning in the drm/imagination PowerVR driver.

846) Incorrect calculation (CVE-ID: CVE-2026-68262)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information or corrupt memory in userspace.

The vulnerability exists due to improper pointer arithmetic in pvr_set_uobj_array() when copying an array of kernel objects to a userspace array with a differing element stride. A local user can supply crafted stride values to cause later copies to read from incorrect kernel addresses or write to incorrect userspace offsets to disclose sensitive information or corrupt memory in userspace.

The issue occurs in the slow path when the userspace element size differs from the kernel object size, and padding is not cleared for each element.

847) NULL pointer dereference (CVE-ID: CVE-2026-68261)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in pvr_context_create and pvr_vm_context_lookup handling when processing a DRM_IOCTL_PVR_CREATE_CONTEXT ioctl request with an invalid VM context handle. A local user can send a specially crafted ioctl request to cause a denial of service.

848) Race condition (CVE-ID: CVE-2026-68260)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to a NULL pointer dereference in the PowerVR GPU virtual memory mapping logic when performing map or unmap operations while a find operation is in progress. A local user can issue crafted ioctl requests to trigger the NULL pointer dereference and cause a denial of service.

849) Improper input validation (CVE-ID: CVE-2026-68259)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in allocate_event_notification_slot in the amdkfd event handling code when processing a user-supplied restore event id. A local user can provide an out-of-bounds event id to cause a denial of service.

The issue is related to the restore_id option used by CRIU.

850) Improper input validation (CVE-ID: CVE-2026-68258)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in kfd CRIU restore queue handling when processing user-supplied private restore data. A local user can provide an out-of-bounds queue type or mismatched mqd_size values to cause a denial of service.

Exploitation requires access to the CRIU restore functionality in the amdkfd subsystem.

851) Integer overflow (CVE-ID: CVE-2026-68257)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in drm/amdkfd queue buffer handling in kfd_queue_acquire_buffers() and kfd_queue_release_buffers() when calculating the CWSR save area size. A local user can provide crafted queue properties with large ctx_save_restore_area_size values to cause a denial of service.

The issue can result in an undersized CWSR save area that firmware later overruns.

852) Memory leak (CVE-ID: CVE-2026-68256)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in detect_link_and_local_sink in the AMD display link detection code when handling a DisplayPort alt mode timeout. A local user can trigger the timeout path to cause a denial of service.

853) Out-of-bounds read (CVE-ID: CVE-2026-68255)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in virtio_get_edid_block() when parsing device-supplied EDID responses. A remote privileged user can supply a crafted virtio-gpu EDID response with a large reported size and high extension count to disclose sensitive information.

Exploitation requires control of a malicious virtio-gpu backend.

854) Improper input validation (CVE-ID: CVE-2026-68254)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the intel_vrr.c VRR capability handling when processing EDID monitor range data. A local user can provide crafted min/max vertical frequency values to trigger a division by zero and cause a denial of service.

855) Out-of-bounds write (CVE-ID: CVE-2026-68253)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the intel_hdcp_required_content_stream function when processing HDCP content stream data. A local user can trigger a stream count overflow to cause a denial of service.

856) Reachable assertion (CVE-ID: CVE-2026-68252)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of invalid address alignment checks in sdma_v7_0_ring_emit_fence() in the amdgpu SDMA v7.0 driver when processing fence addresses. A local user can trigger a misaligned fence address condition to cause a denial of service.

The issue results in a kernel crash because a BUG_ON() assertion is reachable in this code path.

857) Reachable assertion (CVE-ID: CVE-2026-68251)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable kernel assertion in sdma_v6_0_ring_emit_fence() in the amdgpu sdma v6.0 driver when processing a fence address with the low two bits set. A local user can trigger the vulnerable code path to cause a denial of service.

858) Reachable assertion (CVE-ID: CVE-2026-68250)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a BUG_ON assertion in sdma_v5_2_ring_emit_fence() in the amdgpu sdma_v5_2 component when processing a crafted fence address. A local user can trigger the BUG_ON condition to cause a denial of service.

859) Reachable assertion (CVE-ID: CVE-2026-68249)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable assertion in the sdma_v5_0 fence emission logic when processing a crafted fence address. A local user can trigger the BUG_ON() condition to cause a denial of service.

The issue results in a kernel crash rather than continued execution.

860) NULL pointer dereference (CVE-ID: CVE-2026-68248)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in active_instance in the i915 DRM driver when handling memory allocation failure during GFP_ATOMIC allocation. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when kmem_cache_alloc returns NULL and the function returns node->base derived from a NULL node.

861) Improper input validation (CVE-ID: CVE-2026-68247)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the panel type selection logic in drivers/gpu/drm/i915/display/intel_bios.c when parsing LFP Data Block panel_type2 values from VBT data. A local user can provide a specially crafted panel_type2 value to cause a denial of service.

The issue affects the handling of LFP2 device panel selection.

862) Reachable assertion (CVE-ID: CVE-2026-68246)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of invalid alignment conditions in gfx_v11_0.c when processing misaligned GPU addresses and fence addresses. A local user can trigger a kernel BUG_ON condition to cause a denial of service.

863) Use-after-free (CVE-ID: CVE-2026-68245)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in amdgpu_vm_get_task_info_pasid() when looking up task information by PASID. A local user can trigger the flawed lookup path to cause a denial of service.

864) Memory leak (CVE-ID: CVE-2026-68244)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the i915 GEM proto context creation extension handling when processing user extensions after a successful BALANCE/PARALLEL_SUBMIT extension. A local user can submit crafted context creation extensions to cause a denial of service.

The issue occurs when an error is triggered while processing a subsequent user extension after BALANCE/PARALLEL_SUBMIT has already succeeded.

865) NULL pointer dereference (CVE-ID: CVE-2026-68243)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the i915 GEM context SSEU parameter handling in set_proto_ctx_sseu() when applying I915_CONTEXT_PARAM_SSEU to a context engine slot previously set to I915_ENGINE_CLASS_INVALID or I915_ENGINE_CLASS_INVALID_NONE. A local user can configure the same slot and trigger the affected operation to cause a denial of service.

866) NULL pointer dereference (CVE-ID: CVE-2026-68242)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in execlists_create_virtual() in the i915 GPU driver when handling the ioctl path and sched_engine allocation fails. A local user can trigger sched_engine allocation failure through a crafted ioctl interaction to cause a denial of service.

867) Infinite loop (CVE-ID: CVE-2026-68241)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper control of a loop in intel_dp_check_mst_status() in the i915 DisplayPort MST handling code when servicing sink-originated DP MST ESI interrupts. A local user can trigger repeated interrupt processing to cause a denial of service.

The issue can occur if the sink device remains stuck and does not clear incoming interrupts.

868) Improper resource shutdown or release (CVE-ID: CVE-2026-68240)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in drm_gpusvm_get_pages() and the err_unmap cleanup path when handling device page mappings after a later page-mapping error. A local user can trigger a later mapping error after device mappings have already been created to cause a denial of service.

The issue occurs because previously created device mappings are not cleaned up if a later page mapping fails.

869) NULL pointer dereference (CVE-ID: CVE-2026-68239)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of NULL and handle page entries in ttm_pool_backup when processing backup pages during memory reclaim and purge operations. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can result in a kernel NULL pointer dereference and general protection fault.

870) Improper resource shutdown or release (CVE-ID: CVE-2026-68238)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in amdgpu_acpi_vfct_bios() when fetching and processing the ACPI VFCT table. A local user can trigger repeated calls to the vulnerable function to cause a denial of service.

The issue leaks an ACPI table mapping because the reference obtained with acpi_get_table() is not released on exit paths after the table is acquired.

871) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68237)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state handling in amdgpu_userq_pre_reset in the amdgpu user queue fence handling when processing a GPU reset. A local user can trigger a reset while a queue fence remains pending in a non-mapped state to cause a denial of service.

The issue can leave eviction, suspend, or process teardown waiting indefinitely on a fence that never signals, which can wedge the machine.

872) Double free (CVE-ID: CVE-2026-68236)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in dm_update_crtc_state() in the AMD display manager when handling error paths after releasing new_stream on the skip_modeset path. A local user can trigger a later error condition after the initial release to cause a denial of service.

The issue occurs because a dangling pointer may be released again after a color management failure reaches the fail label.

873) NULL pointer dereference (CVE-ID: CVE-2026-68235)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in dce100_find_first_free_match_stream_enc_for_link() and link_set_dpms_on() when handling DisplayPort MST stream encoder assignment. A local user can trigger DisplayPort MST multi-monitor handling to cause a denial of service.

The issue affects DCE8-class ASICs in a DisplayPort MST daisy-chain setup, such as when a second monitor is hot-plugged or already connected at boot.

874) Improper resource shutdown or release (CVE-ID: CVE-2026-68234)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in amdgpu_bo_create_reserved() when handling repeated calls with a non-NULL BO pointer. A local user can trigger repeated resume or firmware buffer reload operations to cause a denial of service.

The issue occurs because repeated calls increase the BO pin count, while teardown only removes a single pin reference, preventing the buffer object from being moved, swapped, or evicted.

875) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68233)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown of a timer in vc4_bo_cache_destroy() in the vc4 BO cache when tearing down the BO cache. A local user can trigger the affected code path to cause a denial of service.

876) Improper resource shutdown or release (CVE-ID: CVE-2026-68232)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in drm_gpusvm_range_evict() in drivers/gpu/drm/drm_gpusvm.c when handling a kvmalloc_array() allocation failure. A local user can trigger the vulnerable error path to cause a denial of service.

877) Improper resource shutdown or release (CVE-ID: CVE-2026-68231)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in airspy_start_streaming() in the airspy USB media driver when starting streaming after the USB device has been disconnected. A local user can trigger streaming with queued buffers present to cause a denial of service.

The issue occurs because buffers accepted before start_streaming() are not returned on the error path.

878) Out-of-bounds write (CVE-ID: CVE-2026-68230)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in c3_isp_params_awb_wt() and c3_isp_params_ae_wt() in drivers/media/platform/amlogic/c3/isp/c3-isp-params.c when processing ae and awb configuration. A local user can provide crafted zone counts to trigger invalid memory access and cause a denial of service.

879) Out-of-bounds read (CVE-ID: CVE-2026-68229)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in _cedrus_write_ref_list() when processing malformed or unsupported H.264 reference list entries. A local user can provide crafted stateless slice control reference list entries to disclose sensitive information.

880) Race condition (CVE-ID: CVE-2026-68228)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the wave5 encoder buffer handling in drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c when processing encoder completion and re-queuing buffers. A local user can queue the same buffer before it is removed from the m2m ready queue to cause a denial of service.

The issue can result in a self-referential ready-queue entry, after which list pointers are poisoned when the entry is deleted.

881) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68227)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource lifetime management in the cx231xx USB media driver when the driver is unbound from a USB interface without physical device disconnection. A local user can trigger driver unbind or reconfiguration conditions to cause a denial of service.

The issue can be triggered during probe deferral or configuration changes.

882) NULL pointer dereference (CVE-ID: CVE-2026-68226)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in cx23885_dev_setup() in the cx23885 driver when handling a memory mapping failure for PCI BAR0. A local attacker can trigger the vulnerable code path to cause a denial of service.

883) NULL pointer dereference (CVE-ID: CVE-2026-68225)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in alvium_ctrl_init in the alvium CSI-2 driver when initializing V4L2 controls. A local user can trigger the vulnerable control initialization path to cause a denial of service.

884) NULL pointer dereference (CVE-ID: CVE-2026-68224)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an error pointer dereference in mali_c55_isp_enable_streams() when enabling streams after obtaining the remote source pad. A local user can trigger the vulnerable code path to cause a denial of service.

885) Improper resource shutdown or release (CVE-ID: CVE-2026-68223)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the vdec_open() function when opening the video decoder device and initialization of controls fails. A local user can open the device to cause a denial of service.

The issue occurs in the error path after m2m context allocation, resulting in a kernel memory leak.

886) Improper resource shutdown or release (CVE-ID: CVE-2026-68222)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in msi2500_start_streaming() and queued buffer cleanup handling when starting streaming after buffers have been queued by the vb2 framework. A local user can trigger start_streaming() error paths to cause a denial of service.

The issue occurs on multiple start_streaming() failure paths, including device disconnect, interrupted locking, USB ADC setup failure, isochronous initialization failure, and streaming command failure. In some cases, queued buffers are not returned as expected and submitted isochronous URBs may remain active without being consumable by the driver.

887) Improper resource shutdown or release (CVE-ID: CVE-2026-68221)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the npcm-video driver probe and remove paths when handling device initialization failures or device removal. A local user can trigger the driver probe or unbind operations to cause a denial of service.

The issue can leak both the allocated npcm_video structure and a reserved memory association entry under certain initialization failure conditions.

888) Memory leak (CVE-ID: CVE-2026-68220)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the imx8-isi crossbar and pipe cleanup paths when repeatedly loading and unloading the affected kernel module. A local user can trigger module initialization and cleanup cycles to cause a denial of service.

The issue occurs because subdevice active state allocated by v4l2_subdev_init_finalize() is not released during cleanup.

889) Improper input validation (CVE-ID: CVE-2026-68219)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the imx8-isi scaling configuration logic when processing crafted image scaling parameters. A local user can supply specially crafted width or height values to cause a denial of service.

The issue can cause the affected process to stop responding even when interrupted with Ctrl+C.

890) Improper resource shutdown or release (CVE-ID: CVE-2026-68218)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the dm1105 driver remove() callback when removing the device. A local user can trigger device removal to cause a denial of service.

891) Improper resource shutdown or release (CVE-ID: CVE-2026-68217)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in start_streaming() in the pwc USB media driver when handling a start_streaming() failure after isochronous URB submission. A local user can trigger a streaming start failure to cause a denial of service.

The issue occurs because a buffer moved from queued_bufs into fill_buf is not drained on the error path, which leads to a WARN_ON(owned_by_drv_count).

892) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68216)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in start_streaming() in the pwc USB camera driver when handling queued video buffers during streaming startup failure conditions. A local user can trigger a streaming startup failure to cause a denial of service.

The issue can be triggered when the USB device is already disconnected or when locking is interrupted by a signal.

893) Improper resource shutdown or release (CVE-ID: CVE-2026-68215)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the si476x radio driver probe error path when handling device initialization failures. A local user can trigger a probe failure to cause a denial of service.

894) Use-after-free (CVE-ID: CVE-2026-68214)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in rtl2832_remove() when removing a device while concurrent I2C transfers are still in flight through the mux adapter. A local user can trigger device removal during concurrent I2C activity to cause a denial of service.

The issue arises because delayed work may be rescheduled after cancellation by a concurrent thread during device teardown.

895) Improper resource shutdown or release (CVE-ID: CVE-2026-68213)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in rtl2832_sdr_start_streaming() and queued buffer handling when handling start_streaming() failures. A local user can trigger a streaming start failure to cause a denial of service.

The issue occurs because buffers queued before streaming are not returned to the videobuf2 framework on error paths, which can trigger a WARN_ON and leak queued buffers.

896) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68212)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in saa7134_video_init1 in the saa7134 video driver when probing a device and initializing video and VBI queues. A local user can trigger initialization failures that leave allocated resources unreleased and may result in use of uninitialized DMA resources to cause a denial of service.

The issue occurs during device probing before the device is fully registered, so the normal cleanup path is not executed.

897) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68211)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in dcmipp_bytecap_start_streaming() when starting video buffer streaming with an unresolved source subdevice in the media graph. A local user can trigger streaming setup in this state to cause a denial of service.

The issue occurs because queued buffers are not returned on the early error path, which can trigger a WARN_ON and leak buffers.

898) Improper resource shutdown or release (CVE-ID: CVE-2026-68210)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the stm32 dcmi driver async notifier handling when probing the device and reset operations fail. A local user can trigger a probe failure to cause a denial of service.

The issue occurs because the notifier remains registered on the error path when probe exits before the normal remove path is reached.

899) Improper resource shutdown or release (CVE-ID: CVE-2026-68209)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the sun4i_csi_start_streaming() path of the sun4i-csi driver when handling streaming startup with an unsupported CSI format. A local user can trigger streaming initialization with a format that has no matching CSI format to cause a denial of service.

The issue occurs because queued video buffers are not returned on the error path after they have already been handed to the driver by the vb2 framework.

900) Unchecked Return Value (CVE-ID: CVE-2026-68208)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of NULL pointer allocation failures in vip_probe_slice() when probing media slices. A local user can trigger the vulnerable code path to cause a denial of service.

901) Improper resource shutdown or release (CVE-ID: CVE-2026-68207)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the v4l2 device registration handling in vpe_probe() when probing the TI VPE driver with missing vpe_top resources. A local user can trigger device probing in this state to cause a denial of service.

The issue occurs on an error path after v4l2_device_register() succeeds, leaving the v4l2 device registered when probe initialization fails.

902) Improper input validation (CVE-ID: CVE-2026-68206)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the V4L2 HEVC slice control validation path when processing HEVC slice parameters. A local user can supply crafted active L0/L1 reference counts to cause a denial of service.

The issue affects stateless HEVC drivers, and validation was missing before driver-specific code consumed the shared control data.

903) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68205)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper ownership handling in v4l2_async_register_subdev_sensor() when registering a V4L2 subdevice sensor asynchronously. A local user can trigger registration of a crafted or removable sensor driver module to cause a denial of service.

The issue can leave the sensor driver's module owner unset, allowing the module to be removed while the subdevice is still in use by a notifier such as a CSI-2 receiver bridge driver.

904) Race condition (CVE-ID: CVE-2026-68204)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unexpected results.

The vulnerability exists due to improper state management in vivid_update_format_cap() and vivid_update_format_out() when changing CROP, COMPOSE, or SCALE capability controls after REQBUFS and before STREAMON while the queue state is not properly enforced. A local user can change these controls to cause unexpected results.

The issue affects the vivid media test driver during the window between buffer request setup and the start of streaming.

905) Improper resource shutdown or release (CVE-ID: CVE-2026-68203)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in vivid_init() in drivers/media/test-drivers/vivid/vivid-core.c when handling error paths during device and driver initialization. A local user can trigger initialization failure conditions to cause a denial of service.

The issue involves a device reference leak on platform_device_register() failure and incorrect cleanup after successful driver registration when workqueue creation fails.

906) Use-after-free (CVE-ID: CVE-2026-68202)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ALSA sequencer queue timer handling in snd_seq_timer_delete() and related queue destruction logic when accessing /dev/snd/seq and re-opening a queue timer during queue teardown. A local user can issue crafted sequencer operations to leave a timer instance live and trigger a dereference of freed queue memory to cause a denial of service.

No queue ownership is required.

907) Use-after-free (CVE-ID: CVE-2026-68201)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the ALSA timer subsystem, specifically slave timer callback handling in snd_timer_close_locked() and remove_slave_links(), when closing a master timer instance while a slave callback is still in flight. A local user can trigger timer close operations while a slave callback is active to cause a denial of service.

The issue occurs because a slave instance can be freed after its ->timer pointer is cleared, causing its close path to skip draining an already running callback.

908) Use-after-free (CVE-ID: CVE-2026-68200)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in ALSA timer callback handling in sound/core/timer.c when triggering the same userspace-driven timer concurrently through the TRIGGER ioctl. A local user can issue concurrent timer trigger operations to cause a use-after-free.

The issue is reachable by any user able to open /dev/snd/timer, including through a user timer instance and through a sequencer queue timer bound to the userspace-driven timer.

909) Out-of-bounds read (CVE-ID: CVE-2026-68199)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in aggr_recv_addba_req_evt() in the ath6kl wireless driver when processing a firmware-supplied ADDBA window size. A remote attacker can supply a crafted window size value to cause a denial of service.

The issue arises because an out-of-range window size can lead to a zero-size or overflowed allocation before subsequent memory access.

910) Use-after-free (CVE-ID: CVE-2026-68198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in aggr_reset_state() in the ath6kl wireless driver when handling a race between timer callback execution and TID state teardown. A local user can trigger the race condition to cause a denial of service.

The timer callback may continue accessing rx_tid[] and stat[] fields after the associated aggr_conn structure is freed, and it can re-arm itself while the reset routine is running.

911) NULL pointer dereference (CVE-ID: CVE-2026-68197)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mwifiex_tdls_add_ht_oper() when setting up a TDLS link to a peer while associated with an access point that advertises HT Capabilities but omits the HT Operation element. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the driver checks bcn_ht_cap but dereferences bcn_ht_oper, which may remain NULL after beacon parsing.

912) Out-of-bounds read (CVE-ID: CVE-2026-68196)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in wilc_parse_assoc_resp_info() in the wilc1000 driver when parsing a received association response. A remote attacker can send a specially crafted short association response frame to disclose sensitive information.

A response shorter than the 6-byte fixed header can trigger the issue, and a response shorter than four bytes may cause an out-of-bounds read of status_code at offsets 2 and 3.

913) NULL pointer dereference (CVE-ID: CVE-2026-68195)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mt7615_rx_check() and mt7615_queue_rx_skb() when processing PKT_TYPE_TXRX_NOTIFY on non-mmio buses. A local user can trigger the RX worker to handle a crafted TXRX_NOTIFY event to cause a denial of service.

The issue affects mt7663 USB and SDIO buses where the tx_cleanup callback is NULL.

914) NULL pointer dereference (CVE-ID: CVE-2026-68194)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7921_rx_check() and mt7921_queue_rx_skb() when handling PKT_TYPE_TXRX_NOTIFY events on non-mmio buses. A local user can trigger the vulnerable code path to cause a denial of service.

The issue affects USB and SDIO bus configurations because the tx_cleanup callback is NULL on those non-mmio buses.

915) NULL pointer dereference (CVE-ID: CVE-2026-68193)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt7925_rx_check() and mt7925_queue_rx_skb() when handling PKT_TYPE_TXRX_NOTIFY on non-mmio buses. A local attacker can trigger the affected code path to cause a denial of service.

The issue occurs on USB devices because the tx_cleanup callback is NULL for non-mmio queue operations.

916) Double free (CVE-ID: CVE-2026-68192)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in brcmf_pcie_release_scratchbuffers() when releasing scratch and ring update DMA buffers during reset and device removal. A local user can trigger repeated sequential release to cause a denial of service.

The issue occurs when reset teardown runs before device removal, causing the same DMA allocation to be freed a second time.

917) NULL pointer dereference (CVE-ID: CVE-2026-68191)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to null pointer dereference in ath12k_dp_link_peer_rhash_tbl_destroy in the ath12k driver when cleaning up an uninitialized hash table during device unbind or failed initialization. A local user can trigger driver cleanup in this state to cause a denial of service.

The issue occurs if the device was never fully started or if initialization failed before the hash table was created.

918) NULL pointer dereference (CVE-ID: CVE-2026-68191)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to null pointer dereference in ath12k_link_sta_rhash_tbl_destroy in the ath12k driver when cleaning up an uninitialized hash table during device unbind or failed initialization. A local user can trigger driver cleanup in this state to cause a denial of service.

The issue occurs if the device was never fully started or if initialization failed before the hash table was created.

919) Out-of-bounds read (CVE-ID: CVE-2026-68190)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the rtw_get_wps_ie() function when parsing IE data from network frames. A remote attacker can send a specially crafted network frame to cause a denial of service.

920) Use-after-free (CVE-ID: CVE-2026-68189)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in UUID list traversal in hci_sync.c when generating EIR data or class-of-device data during asynchronous command sync work. A local user can add and remove Bluetooth UUID entries through the management socket to cause a denial of service.

The issue is triggered by a race condition between command sync work and management socket operations.

921) Use-after-free (CVE-ID: CVE-2026-68188)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in rfcomm_tty_set_termios() and rfcomm_send_rpn() when handling TTY ioctl requests on an RFCOMM device during a concurrent session teardown. A local user can trigger a race condition to cause a denial of service or execute arbitrary code.

The issue is caused by concurrent access to dlc->session without proper locking while krfcommd can unlink the DLC and free the associated session.

922) Out-of-bounds read (CVE-ID: CVE-2026-68187)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in transfer_args_to_stack() when processing execve arguments on affected no-MMU builds. A local user can supply an excessively long argument or environment string to trigger the faulty loop behavior and cause a denial of service.

Only CONFIG_MMU=n builds are affected, and the vulnerable code path is used by binfmt_flat and binfmt_elf_fdpic.

923) NULL pointer dereference (CVE-ID: CVE-2026-68186)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in load_misc_binary() and begin_new_exec() when processing a binfmt_misc entry with the open-binary flag after an interpreter open fails with -ENOEXEC. A local user can register a crafted binfmt_misc entry and execute a matching native ELF binary to cause a denial of service.

Exploitation requires binfmt_misc to be mountable in a user namespace and relies on the interpreter being located on a FUSE mount whose server fails the open request with -ENOEXEC.

924) Out-of-bounds read (CVE-ID: CVE-2026-68184)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a stack out-of-bounds read in mmc_ioctl_cdrom_volume() when processing the CDROMVOLCTRL ioctl on drives that return a non-zero block descriptor length. A local user can invoke the CDROMVOLCTRL ioctl to disclose sensitive information.

The issue is not triggered by CDROMVOLREAD and only occurs on drives that report a non-zero block descriptor length.

925) Improper resource shutdown or release (CVE-ID: CVE-2026-68183)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the stratix10-svc memory management code when freeing allocated memory after failed lookups. A local user can trigger memory allocation and free operations to cause a denial of service.

926) Improper Initialization (CVE-ID: CVE-2026-68182)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the comedi_parport interrupt handler and attach logic when handling interrupts during device attachment. A local user can supply a crafted I/O port base address or trigger a premature interrupt to cause a denial of service.

The issue can occur if the interrupt handler runs before the comedi device is fully attached, including when a user-supplied I/O port base address is not backed by real parallel port hardware.

927) Use-after-free (CVE-ID: CVE-2026-68181)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mei_cl_bus_dev_release() in the MEI bus driver when cleaning up a MEI client bus device. A local user can trigger concurrent cleanup access to cause a denial of service.

The issue involves queue cleanup running without the device lock and traversal of file_list after releasing the final bus reference.

928) Improper resource shutdown or release (CVE-ID: CVE-2026-68180)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the intel_th MSC output release path when opening and closing MSC output files. A local user can repeatedly open MSC output files to cause a denial of service.

Each successful MSC output open leaks one device reference because the release callback used for MSC outputs does not drop the reference acquired during open.

929) Improper locking (CVE-ID: CVE-2026-68179)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in nsm_dev_ioctl() in drivers/misc/nsm.c when processing an ioctl request with an invalid user pointer during copy_from_user(). A local user can send a crafted ioctl request to cause a denial of service.

The issue is triggered on the pre-lock error path before the mutex is acquired.

930) Use-after-free (CVE-ID: CVE-2026-68178)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute code in kernel context.

The vulnerability exists due to use-after-free in the NSM misc device file operations handling in /dev/nsm when invoking ioctl on an open file descriptor after the nsm module has been unloaded. A local user can open /dev/nsm, keep the file descriptor open, and later issue an ioctl after module removal to execute code in kernel context.

The issue is exposed when the driver is built as a module and an open /dev/nsm file descriptor outlives removal of the module that provides the ioctl callbacks.

931) Use-after-free (CVE-ID: CVE-2026-68177)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the enable_event trigger handling in kernel tracing when processing active enable or disable event triggers during module removal. A local user can remove a module while a related trigger remains active to cause a denial of service.

The issue occurs because trigger execution can continue until after an RCU grace period ends.

932) NULL pointer dereference (CVE-ID: CVE-2026-68176)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mmiotrace read() function when reading mmiotrace data after mmio_pipe_open() fails to find a PCI device. A local user can trigger the vulnerable read path to cause a denial of service.

933) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68175)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in the mmiotrace tracer trace_pipe handling when closing the trace_pipe file with the mmiotrace tracer active. A local user can repeatedly open and close trace_pipe to cause a denial of service.

If the trace_pipe is read to completion, the resources are cleaned up; repeated partial reads such as reading a single line can trigger a large leak.

934) NULL pointer dereference (CVE-ID: CVE-2026-68174)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an invalid pointer dereference in __ftrace_set_clr_event_nolock() and update_event_fields() when filtering or setting events for a specific module on dynamic events. A local user can write a module-specific event filter such as ':mod:' to trigger a kernel crash and cause a denial of service.

Exploitation requires a dynamic event with a non-zero reference count, such as one with active event triggers or perf attachments.

935) Race condition (CVE-ID: CVE-2026-68173)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ublk driver recovery and device readiness handling in drivers/block/ublk_drv.c when processing user recovery state transitions. A local user can trigger recovery completion in an invalid state to cause a denial of service.

The issue can strand a request while holding its tag, causing subsequent fsync operations to block in uninterruptible sleep and device teardown to hang.

936) Out-of-bounds read (CVE-ID: CVE-2026-68172)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in huge_ptep_get()/find_num_contig in arch/arm64/mm/hugetlbpage.c when handling unaligned addresses within contpmd/contpte-mapped hugetlb folios. A local user can trigger the kernel to process such an address to cause a denial of service.

This can cause the kernel to iterate beyond the PTE table and dereference an invalid pointer, which may panic the kernel. The issue is specific to arm64 systems, and incorrect CONT_PTES versus CONT_PMDS handling is noted on systems using 16K page size.

937) Use-after-free (CVE-ID: CVE-2026-68170)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in mptcp_backlog_purge() and backlog handling in net/mptcp/protocol.c when closing an MPTCP subflow during concurrent softirq RX processing. A local user can trigger concurrent subflow close and backlog processing to cause a denial of service or execute arbitrary code.

The issue occurs because backlog cleanup for a closing subflow was performed without proper serialization under mptcp_data_lock(), which could leave skb->sk referencing a freed subflow socket.

938) Use-after-free (CVE-ID: CVE-2026-68169)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mptcp_userspace_pm_get_local_id() in the MPTCP userspace path manager when processing overlapping MP_JOIN SYN and MPTCP_PM_CMD_SUBFLOW_DESTROY operations. A local user can trigger a race condition to cause a denial of service.

The race window is narrow and was reproduced with a locally constructed stress test.

939) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68168)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in afs_edit_dir_remove() when handling AFS directory block 0. A local user can trigger directory removal operations to cause a denial of service.

940) Improper access control (CVE-ID: CVE-2026-68166)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to inject chosen return addresses.

The vulnerability exists due to improper access control in userfaultfd registration for virtual memory areas when registering shadow stack or special VMAs. A local user can register a shadow stack VMA with userfaultfd and inject a page with chosen return addresses via UFFDIO_COPY to inject chosen return addresses.

The issue involves shadow stack VMAs, and special VMAs are also affected in cases where a driver implements vm_uffd_ops.

941) Improper input validation (CVE-ID: CVE-2026-68165)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in damon_set_regions() when processing user-supplied DAMON monitoring target regions. A local user can provide empty regions with equal start and end values to cause a denial of service.

The issue can trigger WARN_ONCE() on kernels built with CONFIG_DAMON_DEBUG_SANITY enabled, and can also lead to a divide-by-zero in damon_merge_two_regions().

942) Improper input validation (CVE-ID: CVE-2026-68164)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in damon_set_regions() when processing overlapping input ranges. A local user can provide overlapping or invalid address ranges to trigger a division by zero and cause a denial of service.

The issue can also lead to unexpected DAMON and DAMOS behavior, including malformed monitoring results and repeated application of actions to overlapping regions.

943) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68163)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to improper handling of device-private PMD entries in page_vma_mapped_walk() in mm/page_vma_mapped.c when processing device-private PMD entries during page mapping walks with migration handling. A local user can trigger page_vma_mapped_walk() to misinterpret a device-private entry as a migration entry to cause memory corruption.

A race condition may also occur if a device-private PMD is split before the PMD lock is acquired.

944) Use-after-free (CVE-ID: CVE-2026-68162)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the SCTP auth_enable sysctl handler when handling writes to an already opened sysctl file during network namespace teardown. A local user can write to the auth_enable sysctl entry to cause a denial of service.

The issue is exposed during initialization before the SCTP control socket exists and during teardown after the control socket has been released.

945) Improper resource shutdown or release (CVE-ID: CVE-2026-68161)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in SCTP UDP tunnel sockets during net namespace teardown when tearing down a network namespace with SCTP UDP tunneling enabled. A local user can trigger namespace teardown while the sockets remain installed to cause a denial of service.

Only systems using per-network-namespace SCTP UDP tunneling are affected.

946) Out-of-bounds read (CVE-ID: CVE-2026-68160)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ceph_handle_caps() and ceph_update_snap_trace() when processing a crafted Ceph MDS caps message with a malicious snap_trace_len value. A remote attacker can send a specially crafted message to disclose sensitive information.

Exploitation requires a malicious or compromised MDS to send a version 1 message so the IMPORT path is reached without prior version-gated validation of snap_trace_len.

947) Out-of-bounds write (CVE-ID: CVE-2026-68159)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack out-of-bounds write in __decode_pg_temp(), __decode_pg_upmap_items(), and OSDMap handling in net/ceph/osdmap.c when processing a crafted OSDMap containing an oversized pg_temp, pg_upmap, or pg_upmap_items entry. A remote attacker can send a specially crafted OSDMap entry to cause a denial of service.

The issue is triggered when the decoded list is later copied into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE].

948) Integer overflow (CVE-ID: CVE-2026-68158)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer overflow in decode_new_up_state_weight() when processing a corrupted CEPH_MSG_OSD_MAP message containing a crafted osdmap. A remote attacker can send a specially crafted message to disclose sensitive information.

The issue can lead to out-of-bounds reads while decoding the new_state portion of the osdmap.

949) NULL pointer dereference (CVE-ID: CVE-2026-68157)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in get_immediate_parent() in net/ceph/osdmap.c when processing malformed CRUSH hierarchy metadata during localized read selection. A local user can trigger lookup of a parent bucket whose type has no matching entry in type_names to cause a denial of service.

The issue occurs when a parent bucket name exists in the CRUSH map but its type name metadata is missing, causing an invalid pointer to be passed to strcmp().

950) Use-after-free (CVE-ID: CVE-2026-68156)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Ceph authorizer handling code when processing a rebuilt authorizer during a messenger reconnect. A local user can trigger an authorizer update that reallocates the buffer and then cause a reconnect to use a stale pointer to cause a denial of service.

The issue is triggered when a newer service ticket causes the authorizer to be rebuilt and the rebuilt authorizer no longer fits in the existing buffer.

951) Improper input validation (CVE-ID: CVE-2026-68155)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ceph_monmap_decode() when processing a CEPH_MSG_MON_MAP monmap message. A remote attacker can send a specially crafted monmap advertising zero monitors to cause a denial of service.

The issue is triggered when the client later attempts to open a session with a monitor, causing an assertion in pick_new_mon() to fire.

952) Out-of-bounds read (CVE-ID: CVE-2026-68154)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in crush_decode and the CRUSH mapper when parsing a malformed CRUSH map. A local user can supply a crafted CRUSH map with a zero bucket type to cause a denial of service.

The issue arises because bucket type 0 is reserved for devices, and an invalid map can make the mapper treat a negative bucket ID as a device and index the OSD weight array with a negative value.

953) Use-after-free (CVE-ID: CVE-2026-68153)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the monmap debugfs file handler when processing a concurrent read during client teardown. A local user can read the monmap debugfs file during teardown to cause a denial of service.

The issue is triggered by a race condition between debugfs access and ceph client teardown.

954) Use-after-free (CVE-ID: CVE-2026-68152)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the AMT delayed work handling in drivers/net/amt.c when processing queued delayed work during device removal. A local user can trigger a race condition involving AMT device shutdown to cause a denial of service or execute arbitrary code.

The issue occurs because delayed work items can be re-queued from event_wq after cancellation and then access a freed amt_dev structure after the netdev has been released.

955) Improper resource shutdown or release (CVE-ID: CVE-2026-68151)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the binfmt_elf_fdpic PT_INTERP program header handling when processing a crafted FDPIC ELF binary. A local user can execute a specially crafted binary to cause a denial of service.

The issue can be triggered repeatedly, and the affected file may remain unwritable for as long as the system runs.

956) Improper locking (CVE-ID: CVE-2026-68150)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in do_thaw_all_callback() and __iterate_supers() in fs/super.c when performing an emergency thaw of all frozen filesystems. A local user can trigger the emergency thaw operation to cause a denial of service.

The issue results from a double unlock of s_umount that can corrupt the rwsem state and trigger a kernel warning.

957) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68149)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended ACL handling and retain stale access control list data.

The vulnerability exists due to improper cache state handling in posix ACL caching for fuse inodes in the Linux kernel when invalidating cached ACL entries. A local user can trigger ACL updates and cache invalidation conditions to bypass intended ACL handling and retain stale access control list data.

The issue affects fuse filesystems that opt out of POSIX ACL caching when the fuse server does not negotiate POSIX ACL support.

958) Use-after-free (CVE-ID: CVE-2026-68148)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a use-after-free in find_or_insert_direct_key() when reusing cached direct keys for inodes from different super_blocks. A local user can cause different super_blocks to reference the same cached direct key to cause a use-after-free.

The issue affects the legacy fscrypt_direct_keys table used by v1 encryption policies with FSCRYPT_POLICY_FLAG_DIRECT_KEY, while the v2 policy equivalent is not affected.

959) Use-after-free (CVE-ID: CVE-2026-68147)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a use-after-free in fscrypt_destroy_inline_crypt_key() and fscrypt_get_devices() in fs/crypto/inline_crypt.c when evicting inline encryption keys for filesystem block devices. A local user can trigger key eviction during inode eviction under direct reclaim to cause a use-after-free.

The issue occurs when dynamic allocation of the block-device array fails, causing key memory to be freed without first evicting the key from all associated block devices.

960) Race condition (CVE-ID: CVE-2026-68146)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ftrace trace_parser handling in ftrace_regex_write(), ftrace_graph_write(), ftrace_regex_release(), and ftrace_graph_release() when processing concurrent writes and release operations on a shared trace file descriptor. A local user can issue concurrent operations from multiple threads to cause a denial of service.

The issue occurs when a userspace process shares an opened trace file descriptor across multiple threads, causing corruption of the parser's internal state fields.

961) Out-of-bounds write (CVE-ID: CVE-2026-68145)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in ifs_set_range_dirty() when processing a zero-length range. A local user can trigger a user buffer fault that results in copied == 0 during a write operation to cause a denial of service.

The issue is reachable from __iomap_write_end() when copy_folio_from_iter_atomic() returns 0 and the folio is already uptodate.

962) Use-after-free (CVE-ID: CVE-2026-68144)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in pep_get_sb() when processing Phonet socket buffer data. A remote attacker can send a specially crafted network packet to cause a denial of service.

963) Race condition (CVE-ID: CVE-2026-68143)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to an out-of-bounds write and use-after-free in slip_receive_buf() and sl_realloc_bufs() when processing received SLIP data during a concurrent MTU change. A local user can trigger receive processing while racing an MTU change to cause a denial of service or execute arbitrary code.

964) Improper access control (CVE-ID: CVE-2026-68142)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify Geneve tunnel device configuration in another network namespace.

The vulnerability exists due to improper access control in geneve_changelink() when handling rtnetlink changelink requests for a Geneve device whose underlay network namespace differs from the device network namespace. A local privileged user can send a specially crafted changelink request to modify Geneve tunnel settings in the underlay network namespace.

The issue arises when the Geneve device has been created in or moved to a different network namespace than the one associated with its underlay sockets.

965) NULL pointer dereference (CVE-ID: CVE-2026-68141)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in afiucv_hs_callback_syn() when handling connection requests that enter the connection-refused path after child socket allocation fails. A local user can trigger this condition to cause a denial of service.

The issue occurs because the code calls iucv_sock_kill() with a NULL child socket pointer.

966) Use-after-free (CVE-ID: CVE-2026-68140)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the af_iucv message queue handling when processing queued message notifications after a connection is severed. A local user can trigger connection severing with queued notifications still pending and then invoke recvmsg() to cause a denial of service.

The issue occurs because queued notifications retain stale references to a freed iucv_path.

967) NULL pointer dereference (CVE-ID: CVE-2026-68139)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mlx5e_devcom_event_mpv in the Linux kernel mlx5 mlx5e multiport devcom handling when replaying affiliation events during PCI error recovery. A local user can trigger a crafted device recovery sequence to cause a denial of service.

The issue occurs because peer private data can become visible before the corresponding devcom backpointer is initialized, allowing a master-up event to reach a peer with a NULL devcom pointer.

968) Race condition (CVE-ID: CVE-2026-68138)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to use-after-free and double-free in qdisc_get_rtab() and qdisc_put_rtab() when processing concurrent RTM_NEWTFILTER requests that add flower filters with a police action carrying the same rate. A local user can send concurrent netlink filter configuration requests to cause a denial of service.

The corrupted qdisc_rate_table object is shared system-wide because the affected rate-table list is process-global rather than per-network-namespace.

969) Use-after-free (CVE-ID: CVE-2026-68137)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in x25_kill_by_neigh() when handling termination of an X.25 neighbour while walking the global X.25 socket list. A local user can trigger concurrent socket release and neighbour teardown operations to cause a denial of service.

The issue is triggered by a race condition after the list lock is dropped and before the socket lifetime is pinned.

970) Improper input validation (CVE-ID: CVE-2026-68136)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state validation in skb_gro_receive_list() in the GRO subsystem when processing flush-marked aggregated packets. A remote attacker can send specially crafted network traffic to cause a denial of service.

The issue can corrupt the frag_list chain and later trigger a kernel panic when skb_segment() processes the malformed packet state.

971) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68135)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in the hip04_rx_poll() receive path when handling a build_skb() failure. A local user can trigger build_skb() failures to cause a denial of service.

The issue leaks an RX buffer and its DMA mapping when slot references are overwritten, and also involves a newly allocated RX fragment if dma_map_single() fails.

972) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68134)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state validation in the ptp_s390 driver when initializing and unregistering PTP clocks on systems where facility 28 or PTFF QPT support is unavailable. A local user can trigger initialization of the vulnerable component to cause a denial of service.

The issue is specific to s390 PTP clock handling.

973) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68133)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the ice_ptp_rebuild() function in the Intel ice PTP driver when handling a PF reset while PTP is uninitialized. A local user can trigger this condition to cause a denial of service.

This was observed during driver unload after passing PF1 through to a virtual machine.

974) Deadlock (CVE-ID: CVE-2026-68132)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in the emergency thaw worker in fs/super.c when thawing frozen block devices. A local user can trigger emergency thaw handling to cause a denial of service.

The issue can deadlock against itself while reacquiring s_umount and can block subsequent unmount, freeze, or thaw operations for the affected filesystem and block device.

975) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68131)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of positive result codes in drivers/block/rbd.c when processing a corrupted reply to an object map update request. A remote attacker can send a corrupted reply to trigger an assertion and cause a denial of service.

The issue is triggered in the RBD object map update path for write requests.

976) Improper access control (CVE-ID: CVE-2026-68130)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in ntlm_authenticate() when processing an NTLM authentication request containing a crafted username field and PreviousSessionId. A remote user can supply a username matching a victim account and a victim session identifier to cause a denial of service.

The issue can destroy another user's SMB session before the NTLMv2 response is validated.

977) Resource exhaustion (CVE-ID: CVE-2026-68129)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource handling in the gve Rx queue handling logic when processing received packets under extreme memory pressure. A local user can trigger page allocation failures that leave too few descriptors posted to hardware to cause a denial of service.

The issue can result in a permanent Rx queue stall because no receive completions are generated, preventing NAPI from being scheduled again.

978) Out-of-bounds write (CVE-ID: CVE-2026-68128)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in ice_parser_profile_init when processing a crafted VIRTCHNL_OP_ADD_RSS_CFG request with an out-of-range ptype value. A remote user can send a specially crafted VIRTCHNL request to cause a denial of service.

The issue can be triggered by a malicious VF supplying a ptype value greater than or equal to 1024, which can lead to a kernel page fault.

979) Use-after-free (CVE-ID: CVE-2026-68127)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to use-after-free in ila_update_ipv6_locator() and ila_csum_adjust_transport() when processing a crafted IPv6 packet routed through a configured ILA checksum-adjust-transport route or receive-side mapping. A remote attacker can send a specially crafted IPv6 packet to trigger a use-after-free.

Exploitation requires a configured ILA checksum-adjust-transport route or receive-side mapping.

980) Use-after-free (CVE-ID: CVE-2026-68126)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mac802154_scan_worker() when racing scan requests against interface deletion or PHY removal. A local user can trigger a scan while concurrently deleting the interface to cause a denial of service.

The issue is reachable by racing TRIGGER_SCAN against DEL_INTERFACE.

981) Out-of-bounds read (CVE-ID: CVE-2026-68125)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in llsec_do_decrypt_auth() when processing crafted IEEE 802.15.4 secured frames with payloads shorter than the authentication tag. A remote attacker can send a specially crafted frame to cause a denial of service.

The crafted frame can reach the vulnerable path from an IEEE 802.15.4 peer in radio range.

982) Out-of-bounds write (CVE-ID: CVE-2026-68124)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to perform out-of-bounds heap writes.

The vulnerability exists due to an out-of-bounds write in the MCTP serial receive state machine in drivers/net/mctp/mctp-serial.c when processing a zero-length MCTP serial frame. A local privileged user can send a specially crafted zero-length frame followed by data bytes to perform out-of-bounds heap writes.

Exploitation requires attaching the N_MCTP line discipline and bringing the resulting mctpserial network device up before sending bytes through the tty receive path.

983) Integer underflow (CVE-ID: CVE-2026-68123)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow in queue_userspace_packet() in the openvswitch subsystem when processing userspace actions on segmented gso packets after truncation. A local user can send a specially crafted packet that triggers truncation and segmentation handling to cause a denial of service.

The issue occurs because truncation state is reused across smaller gso segments, allowing the preserved length value to exceed the current packet length.

984) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68122)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in the ovpn TCP error-handling paths when processing TCP RX or TX errors while deferred peer deletion work is already pending. A local user can trigger concurrent error paths to leak peer references and cause a denial of service.

The issue is caused by a race condition between the RX and TX error paths and results in peer objects not being freed.

985) Use-after-free (CVE-ID: CVE-2026-68121)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in pppoe_sendmsg() when handling a blocked send while a non-Ethernet port is added to an empty team device. A local user can trigger skb head reallocation and subsequent writes through a stale PPPoE header pointer to cause memory corruption.

The issue occurs because device header callbacks may reallocate the skb head and invalidate saved pointers into it.

986) Improper input validation (CVE-ID: CVE-2026-68120)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the rtase network driver transmit path when processing malformed IPv4 or IPv6 packets for transmission. A local user can send a specially crafted packet to cause a denial of service.

The issue is triggered by specific incomplete TCP or UDP headers and by certain UDP packets using destination ports 319 or 320 with transport data shorter than the required length.

987) Use of uninitialized resource (CVE-ID: CVE-2026-68119)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory in standalone TCP-AO response handling in tcp_v4_send_ack() and tcp_v6_send_response() when processing TCP responses with TCP-AO options whose MAC length is not four-byte aligned. A remote attacker can send packets that trigger standalone TCP responses to disclose sensitive information.

Only the one to three alignment padding bytes after the TCP-AO MAC are exposed, and the issue affects both IPv4 and IPv6 response paths.

988) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68118)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of reset packets in tcp_check_req() when processing in-window RST segments in the SYN-RECEIVED request-socket path. A remote attacker can send a specially crafted non-exact RST packet to cause a denial of service.

The issue affects connection handling before a connection is fully established.

989) Use-after-free (CVE-ID: CVE-2026-68117)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tipc_sk_create() and tipc_release() in the TIPC socket handling code when handling a failed accept() path after socket insertion failure. A local user can trigger creation of a large number of TIPC sockets and invoke accept() to cause a denial of service.

The issue is reached when the per-netns TIPC socket rhashtable hits its maximum size, leaving a pre-allocated child socket with a dangling sock->sk pointer during release.

990) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68116)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended traffic filtering.

The vulnerability exists due to improper state management in vxlan multicast database remote source list handling when replacing the source list of an existing (*, G) remote entry. A local user can trigger a failed source list replacement to bypass intended traffic filtering.

An EXCLUDE filter may start forwarding traffic that should be blocked, while an INCLUDE filter may drop traffic that should be forwarded.

991) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68115)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in the amdgpu gfx_v10 code when processing misaligned GPU addresses. A local user can trigger a BUG_ON condition to cause a denial of service.

992) Reachable assertion (CVE-ID: CVE-2026-68114)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to reachable assertion use in drm/amdgpu gfx12.1 ring and fence handling code when processing crafted alignment-related values. A local user can trigger BUG_ON conditions to cause a denial of service.

993) Reachable assertion (CVE-ID: CVE-2026-68113)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of assertion checks in drm/amdgpu gfx12 ring command emission routines when processing misaligned gpu or memory addresses. A local user can trigger code paths with improperly aligned addresses to cause a denial of service.

The issue can crash the kernel via reachable BUG_ON() conditions in multiple gfx12 amdgpu paths.

994) Reachable assertion (CVE-ID: CVE-2026-68112)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of assertion checks in gfx_v9_4_3.c when processing misaligned GPU addresses in amdgpu ring operations. A local user can trigger a BUG_ON condition to cause a denial of service.

995) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68111)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in the amdgpu gfx_v9_0 driver when processing misaligned GPU buffer or address values. A local user can trigger BUG_ON() assertions with crafted alignment-related values to cause a denial of service.

The issue results in a kernel crash instead of a warning when alignment checks fail.

996) Reachable assertion (CVE-ID: CVE-2026-68110)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable assertion in sdma_v4_4_2_ring_emit_fence() in the amdgpu SDMA 4.4.2 driver when emitting fence commands. A local user can trigger the assertion condition to cause a denial of service.

997) Reachable assertion (CVE-ID: CVE-2026-68109)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a kernel assertion in the amdgpu sdma_v7_1 fence emission logic when processing a crafted fence address. A local user can trigger the BUG_ON condition to cause a denial of service.

998) Integer overflow (CVE-ID: CVE-2026-68108)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds memory access.

The vulnerability exists due to integer overflow in amdgpu_vce_ring_parse_cs() in the VCE command stream parser when processing crafted VCE command streams with oversized image dimensions. A local user can submit a specially crafted command stream to cause out-of-bounds memory access.

The issue occurs when image dimensions wrap the calculated buffer size and bypass validation before reaching the GPU firmware.

999) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-68107)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in the amdgpu vcn_v4_0 command submission handling in drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c when processing an indirect buffer. A local user can modify the indirect buffer between reads to cause a denial of service.

The issue affects the VCN4 encoding parameter parsing path.

1000) Division by zero (CVE-ID: CVE-2026-68106)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in the amdgpu UVD H264 and H264 Perf decode paths when processing crafted frame dimensions with a width or height less than 16. A local user can submit crafted decoding parameters to cause a denial of service.

1001) NULL pointer dereference (CVE-ID: CVE-2026-68105)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the amdgpu driver KIQ ring handling when loading the driver after MES initialization fails. A local user can trigger driver loading to cause a denial of service.

The issue occurs on ASICs that use MES, where the KIQ ring is owned by MES and may be incorrectly left marked as ready after initialization failure.

1002) Use-after-free (CVE-ID: CVE-2026-68104)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the amdgpu ACP power management domain cleanup logic when removing the ACP power domain. A local user can trigger the affected cleanup path to cause a denial of service.

1003) Out-of-bounds read (CVE-ID: CVE-2026-68100)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in set_ntacl_dacl() when processing a crafted security descriptor during SMB2_QUERY_INFO(SecInfo=DACL). A remote user can send a crafted SMB2_SET_INFO request containing a malformed ACE and later trigger SMB2_QUERY_INFO to disclose sensitive information.

The issue affects inodes carrying a POSIX access ACL, and the malformed security descriptor is stored raw after being accepted because parse_dacl() breaks on a bad ACE instead of returning an error.

1004) Integer overflow (CVE-ID: CVE-2026-68099)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow leading to out-of-bounds reads in ksmbd DACL builders when processing ACL entries. A remote attacker can send data that causes malformed ACL construction to cause a denial of service.

The issue occurs because an overflowed size value is consumed after loop termination, causing the committed NT ACL to under-report the bytes written and become malformed when re-parsed by clients or ksmbd itself.

1005) Out-of-bounds read (CVE-ID: CVE-2026-68098)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in set_posix_acl_entries_dacl() in ksmbd when processing a DACL whose ACE copying stops early because size accounting overflows. A local user can provide a crafted DACL that causes the dedup walk to scan past the copied ACE array and disclose sensitive information.

The issue occurs because the dedup walk is bounded by the original NT ACE count rather than the number of ACEs actually copied into the rebuilt DACL.

1006) Out-of-bounds read (CVE-ID: CVE-2026-68097)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in set_ntacl_dacl() in ksmbd when processing crafted ACE data in NT ACLs. A remote user can supply an undersized ACE with a SID sub-authority count that exceeds the declared ACE size to cause a denial of service.

The out-of-bounds access occurs later during the POSIX ACL deduplication walk after the malformed ACE has been copied.

1007) Deadlock (CVE-ID: CVE-2026-68096)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a recursive locking deadlock in audit_dupe_exe() in the Linux kernel audit subsystem when handling file move events for executable audit rules. A local user can move a file that matches an existing executable audit rule to cause a denial of service.

Exploitation requires an existing executable audit rule that matches the file being moved.

1008) Race condition (CVE-ID: CVE-2026-68095)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in fuse_uring_do_register in fs/fuse/dev_uring.c when registering a FUSE io_uring ring entry while a connection abortion is occurring. A local user can trigger concurrent registration and connection abort operations to cause a denial of service.

The issue can leave the abort or unmount thread hung indefinitely in an unkillable state and may leak ring, queue, and entry objects.

1009) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68093)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource lifecycle management in KVM SVM ASID handling when resuming a vCPU after a CPU hotplug cycle. A local user can trigger CPU hotplug conditions and resume execution of a affected vCPU to cause a denial of service.

The issue can result in ASID collisions between vCPUs from different VMs, causing stale TLB translations and KVM internal emulation failures.

1010) Out-of-bounds read (CVE-ID: CVE-2026-68082)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in decode_lockers() in net/ceph/cls_lock_client.c when parsing OSD-supplied lock information. A remote user can send a specially crafted OSD reply to disclose sensitive information.

Exploitation requires control of a malicious or compromised OSD and can be triggered against kernel clients that issue the lock.get_info class method, such as during RBD exclusive lock acquisition in a multi-tenant Ceph deployment.

1011) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68081)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the KVM nVMX nested VM-Enter handling in arch/x86/kvm/vmx/nested.c when emulating VMLAUNCH or VMRESUME with invalid guest state. A local user can repeatedly trigger failed nested VM-Enter operations to cause a denial of service.

The issue occurs when KVM synthesizes a nested VM-Exit on invalid guest state, allowing pinned vmcs12 pages or mappings to be leaked if the operation is retried.

1012) Use-after-free (CVE-ID: CVE-2026-64586)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the brcmfmac bus_reset work handling when a reset is scheduled during device removal. A local user can trigger a bus reset through the debugfs "reset" entry to cause a denial of service.

The issue affects shared bus_reset work across PCIe, SDIO, and USB removal paths, and brcmf_fw_crashed() could also be triggered before driver attachment completed.

1013) Use-after-free (CVE-ID: CVE-2026-64585)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in esd_usb_disconnect() and unlink_all_urbs() when handling USB device disconnect events. A local user can trigger a device disconnect condition to cause a denial of service.

The issue occurs because per-netdev private data embedded in the net_device allocation is dereferenced after free during teardown.

1014) Use-after-free (CVE-ID: CVE-2026-64584)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the f_midi driver work handler when handling concurrent userspace writes to an open rawmidi substream during device teardown. A local user can write to a rawmidi substream to trigger pending work on a freed midi object and cause a denial of service.

The issue occurs because the rawmidi device can remain usable by an open substream after USB endpoints have been disabled and before the final midi object reference is released.

1015) Use-after-free (CVE-ID: CVE-2026-64583)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Broadcom BDC USB gadget UDC driver IRQ handler and delayed work processing when tearing down the driver during device removal. A local user can trigger a shared interrupt or delayed work execution during teardown to cause a denial of service.

The issue occurs in the window after teardown of endpoint and DMA-related structures begins while the IRQ handler remains deliverable, and delayed work may also execute after removal.

1016) Use-after-free (CVE-ID: CVE-2026-64582)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in rxe_mmap in the RDMA/rxe subsystem when processing a memory mapping request concurrently with a DESTROY_CQ ioctl. A local user can trigger a race condition to cause a denial of service or execute arbitrary code.

Exploitation requires winning a narrow race window between the mmap path and concurrent object destruction.

1017) Double free (CVE-ID: CVE-2026-64581)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in xfrm_user_policy() when racing a per-socket policy change with packet transmission on a connected UDP socket. A local user can trigger concurrent socket operations to cause a denial of service.

The issue is reachable by an unprivileged user via a user and network namespace.

1018) Double free (CVE-ID: CVE-2026-64580)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in xfrm6_fill_dst() when handling an error path after in6_dev_get(dev) returns NULL. A local user can trigger network operations that reach the affected code path to cause a denial of service.

The issue underflows a net_device reference count and can lead to kernel warnings while waiting for the device to become free.

1019) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64579)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in xfrm_hash_rebuild() in the xfrm policy subsystem when rebuilding policy hashes under memory pressure. A local user can trigger policy reinsertions that take the allocating inexact insertion path and cause a kernel crash.

The issue is reachable under memory pressure and can be triggered deterministically with failslab.

1020) Out-of-bounds read (CVE-ID: CVE-2026-64578)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ksmbd_smb2_check_message() when processing a crafted compound SMB2 request. A remote attacker can send a specially crafted compound request with a trailing element that is too small to hold StructureSize2 to disclose sensitive information.

The issue occurs when the last compound element contains only a 64-byte SMB2 header, causing a 2-byte read at offset 64 to extend past the receive buffer.

1021) Unchecked Return Value (CVE-ID: CVE-2026-64577)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of a failed buffer pull in gtp1u_send_echo_resp() in the Linux kernel GTP implementation when processing a crafted short echo request packet. A remote attacker can send a specially crafted packet to cause a kernel panic.

The issue is triggered by a 16 to 19 byte echo request that causes skb_pull_data() to fail while execution continues and skb data is moved below the buffer head.

1022) Use of Uninitialized Variable (CVE-ID: CVE-2026-64576)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in nh_res_bucket_migrate() when handling rtnetlink nexthop operations. A local user can send a specially crafted netlink message to cause a denial of service.

The issue can lead to a general protection fault and kernel panic when an error path dereferences an uninitialized extack message pointer.

1023) NULL pointer dereference (CVE-ID: CVE-2026-64575)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in bpf_iter_tcp_batch() and bpf_iter_tcp_seq_stop() when handling a batch reallocation failure during BPF TCP iterator processing. A local user can trigger a failed read path to dereference a cookie as a struct sock to cause a denial of service.

The issue can lead to a kernel panic.

1024) Use-after-free (CVE-ID: CVE-2026-64574)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ieee80211_if_read_link and related mac80211 link handling when reading debugfs link files after a vif link update error path leaves stale debugfs entries for newly added links. A local user can open and read a debugfs link file referencing freed memory to cause a denial of service.

The issue is triggered when drv_change_vif_links() fails after new links have been allocated and initialized.

1025) Integer underflow (CVE-ID: CVE-2026-64573)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in the qca_tlv_check_data() TLV parser when parsing a crafted firmware TLV with an undersized NVM tag length. A local user can supply a specially crafted firmware image to trigger out-of-bounds access and cause a denial of service.

The issue is caused by an integer underflow in the loop bound calculation for TLV_TYPE_NVM records.

1026) Use-after-free (CVE-ID: CVE-2026-64572)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib_table_lookup() and the IPv4 FIB alias list handling in fib_trie.c when processing concurrent route insertion failure and lookup operations. A local privileged user can trigger a route insertion error path and perform a concurrent lookup to cause a denial of service.

Exploitation requires CAP_NET_ADMIN and a registered FIB notifier that can reject a route, such as when an IPv4 FIB resource is exhausted on a netdevsim device.

1027) Out-of-bounds read (CVE-ID: CVE-2026-64571)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in p54_rx_eeprom_readback() when processing a device-supplied EEPROM readback frame. An attacker with physical access can send a truncated frame with a matching advertised length to disclose sensitive information.

The issue can be triggered by a malicious USB device.

1028) Double free (CVE-ID: CVE-2026-64570)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in ieee80211_set_fils_discovery() when handling FILS discovery template updates after an allocation failure. A local user can trigger an allocation failure and cause the same object to be queued for freeing multiple times to cause a denial of service.

The issue is triggered when a later update or AP teardown re-queues an object that still points to memory already scheduled for RCU freeing.

1029) NULL pointer dereference (CVE-ID: CVE-2026-64569)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mpls_valid_fib_dump_req() when handling an RTM_GETROUTE dump request for AF_MPLS with strict checking and no RTA_OIF attribute. A local user can send a specially crafted netlink request to cause a denial of service.

The issue affects CONFIG_INET=n builds.

1030) Double free (CVE-ID: CVE-2026-64568)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in ieee80211_set_unsol_bcast_probe_resp() when handling updates to unsolicited broadcast probe response templates after an allocation failure. A local user can trigger a later update or AP teardown to cause a denial of service.

The issue occurs because the pointer can still reference an object already queued for RCU freeing after kzalloc() fails.

1031) Out-of-bounds read (CVE-ID: CVE-2026-64567)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in io_ctl_check_crc() in the btrfs free space cache loader when loading a corrupted v1 free space cache. A local user can modify free space cache header counts to exceed the number of allocated pages to cause a denial of service.

The invalid out-of-bounds slot is treated as a struct page and can lead to a general protection fault during crc32c() processing.

1032) Out-of-bounds write (CVE-ID: CVE-2026-64566)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to memory corruption in iptfs_skb_add_frags() when processing shared fragment references for nested transport-mode SA traffic. A local user can trigger crafted packet processing to cause a denial of service.

The issue can lead to kernel-visible memory corruption and a kernel panic when ESP decrypts in place on fragments still referenced by the outer IPTFS SKB.

1033) Heap-based buffer overflow (CVE-ID: CVE-2026-64565)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in ims_pcu_handle_response() when processing oversized packets from a malicious USB device. An attacker with physical access can send a specially crafted oversized USB packet to execute arbitrary code.

The issue arises because ims_pcu_process_data() does not properly bound-check read_pos, allowing it to be overwritten and later used as a controlled index during response handling.

1034) Use-after-free (CVE-ID: CVE-2026-64564)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in sctp_process_asconf_param() when processing crafted SCTP ASCONF DEL-IP parameters. A remote attacker can send a specially crafted SCTP ASCONF message to cause a denial of service.

The issue can occur when a single ASCONF carries DEL-IP parameters that free the cached transport and a later wildcard DEL-IP reuses the dangling transport pointer.

1035) Use-after-free (CVE-ID: CVE-2026-64563)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in rhashtable_walk_next in the rhashtable iterator logic when resuming multi-fragment rhashtable walks across walk_stop and walk_start boundaries after a table restart. A local user can trigger a stale iterator pointer dereference to cause a denial of service.

Concrete affected call paths include netlink_diag and TIPC.

1036) Use-after-free (CVE-ID: CVE-2026-64562)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in KVM nested VMX shadow VMCS handling when freeing nested virtualization state asynchronously with respect to loaded VMCS clearing during vCPU migration. A local user can trigger nested virtualization cleanup and vCPU migration to execute VMCLEAR on a freed shadow VMCS and cause a denial of service.

The issue occurs because vmcs01 may still reference the shadow VMCS until explicit VMCLEAR completes.

1037) Improper Initialization (CVE-ID: CVE-2026-64561)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the KVM x86 shadow MMU page fault handling code when processing stale page faults after reclaiming shadow pages. A local user can trigger page faults that lead KVM to map memory into an invalid root to cause a denial of service.

The issue occurs when reclaiming shadow pages invalidates an in-use root, causing child shadow pages created during map or fetch operations to inherit an invalid role and violate the invariant that invalid shadow pages must not appear on the list of active MMU pages.

1038) Use-after-free (CVE-ID: CVE-2026-64560)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the posix CPU timers subsystem when handling a non-leader exec() race involving POSIX CPU timer deletion, setting, or rearming. A local user can trigger concurrent exec() and timer operations to execute arbitrary code.

The issue occurs when a TGID-targeted timer remains inherited across exec(), and can also cause user-visible transient -ESRCH errors or prevent timer rearming.

1039) Improper input validation (CVE-ID: CVE-2026-64559)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to improper input validation in the PKEY_VERIFYPROTK ioctl in drivers/s390/crypto/pkey_api.c when processing a user-supplied request structure from user space. A local user can provide a crafted buffer length value to execute arbitrary code or cause a denial of service.

1040) Out-of-bounds write (CVE-ID: CVE-2026-64558)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the pkey_pckmo key_to_protkey() handler implementation when processing a target buffer for generated output data. A local user can provide a target buffer with an insufficient length to execute arbitrary code.

1041) Use-after-free (CVE-ID: CVE-2026-64557)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in l2cap_sock_new_connection_cb() in the Bluetooth L2CAP subsystem when handling a newly enqueued child socket reachable through the accept queue after the parent socket lock is released. A remote attacker can trigger a crafted Bluetooth L2CAP connection to execute arbitrary code.

The issue occurs because another task may accept and free the child socket before the callback dereferences it.

1042) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64555)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect hypervisor state handling.

The vulnerability exists due to improper state management in kvm_hyp_handle_mops() when handling a MOPS exception during nested virtualization. A local user can trigger this code path to cause incorrect hypervisor state handling.

The issue affects arm64 KVM in nested virtualization scenarios.

1043) Use-after-free (CVE-ID: CVE-2026-64554)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in br_ip6_fragment() when processing crafted IPv6 packets on a cloned skb. A local user can send a specially crafted packet to cause a denial of service.

The issue results from dereferencing a stale prevhdr pointer after skb_checksum_help() reallocates the skb head, and the resulting write can trigger a kernel panic.

1044) Information disclosure (CVE-ID: CVE-2026-64553)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an information leak caused by improper clearing of padding bytes in PSAMPLE_ATTR_DATA handling in net/psample/psample.c when copying packet data into a netlink attribute. A local user can trigger processing of packet data whose length is not divisible by 4 bytes to disclose sensitive information.

The issue occurs because netlink attributes are padded to 4-byte boundaries.

1045) Out-of-bounds write (CVE-ID: CVE-2026-64552)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in receive_big() when processing a device-announced packet length from a virtio backend. A remote attacker can announce a specially crafted length value to cause memory corruption.

The issue can result in a NULL fragment being handed up the receive path.

1046) Out-of-bounds read (CVE-ID: CVE-2026-64550)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rmnet_map_ingress_handler() and __rmnet_map_ingress_handler() when processing a crafted short MAP frame on the no-aggregation ingress path. A local user can send a specially crafted frame to disclose sensitive information.

The issue occurs when ingress deaggregation is disabled, causing packet parsing to use the on-wire packet length without verifying skb->len first.

1047) Out-of-bounds read (CVE-ID: CVE-2026-64549)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in bpa10x_setup() when processing a crafted device response to the vendor command. An attacker with physical access can return a one-byte or unterminated response to disclose sensitive information.

The out-of-bounds data may be exposed through the kernel log and the firmware-info debugfs file.

1048) Integer overflow (CVE-ID: CVE-2026-64548)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow leading to an out-of-bounds write in bpf_msg_push_data() when processing a crafted len value in the copy fallback path. A local user can supply a crafted len value to cause a denial of service.

Exploitation requires access to BPF-driven sockmap message processing and occurs when the scatterlist ring is full or nearly full.

1049) Out-of-bounds read (CVE-ID: CVE-2026-64547)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in net1080_rx_fixup() when processing a crafted short frame from a malicious NetChip 1080 device. An attacker with physical access can send a frame advertising a large even packet length to cause a denial of service.

1050) Out-of-bounds read (CVE-ID: CVE-2026-64546)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in drm_parse_tiled_block() when parsing a crafted DisplayID tiled-display block in EDID data. A local user can supply crafted EDID data with a truncated tiled-display block to disclose sensitive information.

The issue is triggered when the tiled-display block declares a small payload length near the end of a DisplayID extension.

1051) NULL pointer dereference (CVE-ID: CVE-2026-64545)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in xdp_master_redirect() when processing XDP_TX on a bond slave during upper-master unlinking. A local user can trigger packet processing in this race window to cause a denial of service.

The issue can lead to a kernel panic when the receiving device no longer has an upper-master adjacency but is still treated as a bond slave.

1052) Out-of-bounds read (CVE-ID: CVE-2026-64544)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in pefile_digest_pe_contents when processing a crafted PE file. A local user can supply a specially crafted PE file to cause a denial of service.

The issue occurs because an unsigned subtraction can underflow after the trailing-data hash length calculation exceeds the PE length, which can lead to a kernel panic on unmapped vmalloc guard pages.

1053) Use-after-free (CVE-ID: CVE-2026-64543)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tipc_disc_rcv() when processing TIPC discovery messages on a UDP bearer. A local user can trigger network namespace-accessible TIPC bearer operations and send crafted traffic to cause a denial of service.

Exploitation requires CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. The affected functionality is reachable from an unprivileged user namespace because the TIPCv2 generic netlink family is netnsok and its bearer commands do not require GENL_ADMIN_PERM.

1054) NULL pointer dereference (CVE-ID: CVE-2026-64542)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in accept_untracked_na() when handling IPv6 neighbor advertisement packets. A local user can trigger concurrent network namespace activity to cause a denial of service.

It is reachable by an unprivileged user via a network namespace.

1055) Out-of-bounds read (CVE-ID: CVE-2026-64540)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in genelink_rx_fixup() when processing device-supplied aggregated RX frames from a crafted GeneLink (GL620A) USB device. An attacker with physical access can provide a short URB with inconsistent packet length metadata to disclose sensitive information.

The issue can leak adjacent kernel heap contents to the network stack as soon as the USB network interface is up.

1056) Stack-based buffer overflow (CVE-ID: CVE-2026-64539)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in eir_create_adv_data() in the Bluetooth EIR advertising data builder when constructing legacy advertising data for an LE-only controller. A local user can supply crafted advertising instance data to trigger a stack out-of-bounds write and cause a denial of service.

Exploitation requires CAP_NET_ADMIN and access to the legacy advertising path on an LE-only controller.

1057) NULL pointer dereference (CVE-ID: CVE-2026-64538)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fib6_nh_mtu_change() when processing router advertisement-driven MTU changes. A remote attacker can send a specially crafted ICMPv6 router advertisement to cause a denial of service.

The issue can occur during interface teardown when the IPv6 device pointer has been cleared while nexthop-backed routes are still being walked.

1058) Improper input validation (CVE-ID: CVE-2026-64537)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the bridge cfm ccm transmission logic when configuring an invalid ccm interval. A local user can set an invalid expiration interval to trigger a tight workqueue loop and exhaust memory to cause a denial of service.

The issue can result in immediate re-arming of delayed work and repeated skb allocations until out-of-memory conditions occur.

1059) Out-of-bounds read (CVE-ID: CVE-2026-64533)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in log_replay() in fs/ntfs3 when replaying a malformed NTFS filesystem restart table. A local user can provide a specially crafted filesystem image to cause a denial of service.

The issue occurs during conversion of DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records for version 0 restart tables.

1060) Out-of-bounds write (CVE-ID: CVE-2026-64532)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in do_action() in fs/ntfs3/fslog.c when processing a crafted on-disk NTFS index entry in UpdateRecordDataRoot or UpdateRecordDataAllocation. A local user can mount or otherwise supply a specially crafted NTFS image to trigger the out-of-bounds write and cause a denial of service.

The issue occurs because view.data_off and the resulting write length are not properly bounded against the NTFS_DE entry size.

1061) Type conversion (CVE-ID: CVE-2026-64349)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access of device registers in dwc3_ulpi_setup() when configuring USB2 PHY settings. A local user can trigger the vulnerable code path to cause a denial of service.

The issue is associated with incorrect arguments passed to dwc3_readl() and dwc3_writel() in the DWC3 core driver.