SB2026101315 - Ubuntu update for linux-nvidia-tegra

Description

This security bulletin contains information about 689 vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2026-97509)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference counting in the Thunderbolt XDomain service lifetime handling when releasing an XDomain service. A local user can trigger service release after the parent XDomain is released to cause a denial of service.

2) Improper input validation (CVE-ID: CVE-2026-80901)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause IPVS to process ICMP messages with invalid checksums.

The vulnerability exists due to improper checksum validation in IPVS ICMP and ICMPv6 handling when processing ICMP messages. A remote attacker can send an ICMP message with an invalid checksum to cause IPVS to process ICMP messages with invalid checksums.

The issue includes ICMPv6 packets from clients and ICMPv6 responses from real servers when checksum validation is not performed by hardware.

3) Use-after-free (CVE-ID: CVE-2026-80721)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Bluetooth ISO socket handling in net/bluetooth/iso.c when deleting an ISO connection. A local user can trigger connection deletion while ISO sockets still access a dangling hcon reference to cause a denial of service.

The issue is related to races involving ISO connection teardown and stale hcon references.

4) Use-after-free (CVE-ID: CVE-2026-80589)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in disk_release in the block layer when handling a probe failure for a disk that issued I/O before add_disk(). A remote attacker can trigger a failed disk initialization sequence that leaves a queue timeout timer pending to execute arbitrary code.

The issue can occur when a disk probe fails before the disk is added, including cases involving NVMe namespace initialization.

5) Improper input validation (CVE-ID: CVE-2026-80587)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in the MPTCP option parser when processing incoming MPTCP suboptions. A remote attacker can send specially crafted packets with inconsistent suboption combinations to execute arbitrary code.

The issue affects handling of mutually exclusive or unexpected combinations of MPTCP suboptions.

6) Missing initialization of resource (CVE-ID: CVE-2026-80586)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, corrupt data, or cause a denial of service.

The vulnerability exists due to improper state reset in MPTCP DSS option parsing in net/mptcp/options.c when processing malformed DSS options with an unexpected size. A remote attacker can send crafted MPTCP packets to disclose sensitive information, corrupt data, or cause a denial of service.

The issue can occur when a malformed DSS option is followed by another DSS option or MPC plus data, causing inconsistent state or access to uninitialized data.

7) Improper Initialization (CVE-ID: CVE-2026-80585)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and corrupt integrity.

The vulnerability exists due to improper state management in mptcp_fastopen_subflow_synack_set_params() and check_fully_established() when processing data-less TCP Fast Open SYN packets with a valid cookie. A remote attacker can send a specially crafted SYN packet to cause a denial of service and corrupt integrity.

The issue occurs when a valid-cookie SYN carries no data, leaving the receive queue empty and stale MPTFO state behind.

8) Out-of-bounds write (CVE-ID: CVE-2026-80584)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the qeth SNMP and ARP query ioctl handlers when processing user-supplied buffer lengths. A remote attacker can supply a crafted length value that causes an integer underflow in a bounds check and trigger a memcpy() past the allocated buffer to execute arbitrary code.

The issue occurs because a user-supplied length smaller than the fixed offset can wrap a u32 subtraction, and a zero-length allocation can also result in an invalid zero-sized buffer.

9) Out-of-bounds write (CVE-ID: CVE-2026-80583)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify memory, or cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the tx_macro_dec_mode_get() and tx_macro_dec_mode_put() kcontrol handlers in sound/soc/codecs/lpass-tx-macro.c when accessing enumerated control values. A local user can access a crafted enumerated control value through the "DEC0 MODE" to "DEC7 MODE" controls to disclose sensitive information, modify memory, or cause a denial of service.

On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the issue is detected as an access overflow and reads of these controls fail with -EINVAL.

10) Out-of-bounds write (CVE-ID: CVE-2026-80580)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the fbdev sysfs mode output handling in drivers/video/fbdev/core/fbsysfs.c when processing a long modelist for sysfs output. A local user can trigger sysfs mode listing with a sufficiently long modelist to execute arbitrary code.

11) Use-after-free (CVE-ID: CVE-2026-80579)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to a use-after-free in the fbdev mode handling logic when processing FBIOPUT_VSCREENINFO requests with FB_ACTIVATE_INV_MODE. A local user can delete a videomode that is still referenced by fb_info->mode to disclose sensitive information, modify data, or cause a denial of service.

The stale pointer may later be dereferenced during sysfs mode reads through show_mode().

12) Out-of-bounds read (CVE-ID: CVE-2026-80578)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to out-of-bounds read in fb_io_read() when processing a read operation after a partial copy_to_user() result. A local user can provide a faulty user buffer to trigger pointer desynchronization and disclose sensitive information and cause a denial of service.

The issue occurs because the source pointer can become over-advanced relative to the remaining byte count after a partial copy.

13) Out-of-bounds write (CVE-ID: CVE-2026-80576)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory and cause a denial of service.

The vulnerability exists due to an out-of-bounds write in amdgpu_cs_p2_ib() when processing user-supplied indirect buffer lengths for command submission. A local user can submit an oversized indirect buffer to corrupt memory and cause a denial of service.

The issue affects GFX rings and can destabilize command submission because the indirect buffer length is encoded into packet control fields.

14) Out-of-bounds write (CVE-ID: CVE-2026-80574)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in focaltech_process_rel_packet when processing crafted input packets. A remote attacker can trigger a finger index underflow to write before the bounds-checked array and to execute arbitrary code.

The issue occurs because subtracting 1 from a packet finger index of 0 can produce an invalid array index that targets state->fingers[-1].

15) Use-after-free (CVE-ID: CVE-2026-80572)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the byd driver timer callback handling in drivers/input/mouse/byd.c when disconnecting the device while timer callbacks are running or being re-armed. A local user can trigger a race condition to execute arbitrary code.

The issue arises because the callback can dereference freed private data and its psmouse pointer during driver disconnect.

16) Heap-based buffer overflow (CVE-ID: CVE-2026-80570)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in rmi_f54_buffer_queue() when handling a failed report operation after the V4L2 format has been changed to a smaller size. A local user can trigger an error path that leaves a stale larger report size and cause it to be copied into a smaller buffer to execute arbitrary code or cause a denial of service.

The issue is caused by failure to clear f54->report_size on certain error paths in rmi_f54_work().

17) Out-of-bounds write (CVE-ID: CVE-2026-80569)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the synaptics-rmi4 F54 diagnostics report handling in rmi_f54_work() when processing a malicious or malfunctioning RMI4 device report with larger F55 electrode counts than F54 counts. A local user can provide a specially crafted device that reports inconsistent electrode counts to execute arbitrary code.

The issue can also cause an out-of-bounds read during the subsequent V4L2 dequeue memcpy().

18) Heap-based buffer overflow (CVE-ID: CVE-2026-80568)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the synaptics-rmi4 F54 V4L2 input handling when changing the diagnostic report input while streaming. A local user can switch the input mid-stream to trigger a larger report size than the allocated buffers and execute arbitrary code.

The issue occurs because V4L2 buffers are allocated based on the report size at stream start.

19) Improper resource shutdown or release (CVE-ID: CVE-2026-80565)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper resource shutdown or release in the qce algorithm registration logic in drivers/crypto/qce/core.c when handling a failure during algorithm registration. A local user can trigger a registration failure to execute arbitrary code.

20) Out-of-bounds read (CVE-ID: CVE-2026-80561)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to out-of-bounds read in decode_locker() in net/ceph/cls_lock_client.c when decoding locker data from an OSD response. A remote attacker can send a specially crafted OSD response to disclose sensitive information and cause a denial of service.

Exploitation requires a malicious or compromised OSD to interact with a kernel client issuing the lock.get_info class method, such as during RBD exclusive lock acquisition.

21) Improper privilege management (CVE-ID: CVE-2026-80560)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper access control in restore_sigcontext() in the openrisc signal handling code when returning from a signal handler through a crafted sigframe. A local user can craft a sigframe that modifies privileged SR bits to escalate privileges.

By clearing SPR_SR_DME, data accesses can occur without MMU translation or protection, enabling read and write access to arbitrary physical memory.

22) Race condition (CVE-ID: CVE-2026-80559)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a system crash.

The vulnerability exists due to a race condition in the sur40 input device initialization and polling path when opening the input device before the V4L2 video device and vb2_queue are fully initialized. A local user can open the device to trigger the polling worker thread and cause a system crash.

The issue is triggered during device initialization ordering in sur40_probe().

23) Out-of-bounds read (CVE-ID: CVE-2026-80558)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, corrupt memory, or cause a denial of service.

The vulnerability exists due to out-of-bounds read in ceph_pg_to_up_acting_osds() and calc_target() when processing a corrupted osdmap containing an invalid primary_temp OSD index. A remote attacker can send a crafted osdmap with a nonexistent OSD index to trigger out-of-bounds array access to disclose sensitive information, corrupt memory, or cause a denial of service.

The issue occurs because the primary_temp OSD index was not properly validated before being used as the target OSD for a request.

24) Out-of-bounds read (CVE-ID: CVE-2026-80557)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, execute arbitrary code, or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in decode_watchers() when processing a crafted obj_list_watch_response_t reply with struct_len set to 0. A remote attacker can send a specially crafted OSD response to disclose sensitive information, execute arbitrary code, or cause a denial of service.

Exploitation requires a malicious or compromised OSD and can be triggered when a kernel client invokes CEPH_OSD_OP_LIST_WATCHERS.

25) Use-after-free (CVE-ID: CVE-2026-80556)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the atmci_remove function in the atmel-mci driver when removing the module while queued or running bh_work is still pending. A local user can trigger a race condition during module removal to execute arbitrary code.

The issue arises because the interrupt handler, timeout timer, or DMA completion callback can schedule the work item before cleanup completes.

26) Improper resource shutdown or release (CVE-ID: CVE-2026-80555)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the vfio_ccw channel program initialization logic when processing channel programs containing Transfer in Channel segments. A remote attacker can trigger cp_init() failure during ccwchain construction to cause a denial of service.

The issue occurs because cleanup does not release all allocated CCW segments if initialization fails before the channel program is marked initialized.

27) Uncontrolled Recursion (CVE-ID: CVE-2026-80554)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to uncontrolled recursion in vfio_ccw channel program processing when handling channel programs with many TIC-linked segments. A remote attacker can supply a crafted channel program to execute arbitrary code.

The issue arises because channel programs are processed recursively and segment counts created by Transfer-In-Channel (TIC) CCWs were not equivalently limited.

28) Use-after-free (CVE-ID: CVE-2026-80553)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the vfio_ccw device workqueue handling when closing or releasing a device with pending work items. A local user can trigger device close or release while queued work is still pending to execute arbitrary code.

29) Out-of-bounds write (CVE-ID: CVE-2026-80552)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify memory, or cause a denial of service.

The vulnerability exists due to an out-of-bounds access in vfio_ccw region read and write handlers when processing read or write requests for vfio_ccw regions with an out-of-range region index. A local user can supply a crafted region index to disclose sensitive information, modify memory, or cause a denial of service.

The issue affects vfio_ccw read and write region handling on s390.

30) Improper input validation (CVE-ID: CVE-2026-80551)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to improper input validation in the vfio_ccw channel program IDAW handling when reading the first IDAW and then processing the full IDAL. A remote attacker can trigger inconsistent IDAW reads to execute arbitrary code or cause a denial of service.

The issue affects the s390 vfio_ccw subsystem and arises because the first IDAW is read separately from the full IDAL.

31) Out-of-bounds read (CVE-ID: CVE-2026-80550)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ccwchain_calc_length() when processing chained channel command words in a channel program. A remote attacker can supply a crafted channel program to disclose sensitive information.

The issue occurs because the routine may examine a 257th CCW entry before rejecting an oversized chain.

32) Improper locking (CVE-ID: CVE-2026-80549)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper locking in the vfio_ccw driver when handling a device transitioning to a not-operational state. A local privileged user can trigger this condition to cause a denial of service.

The cleanup may occur asynchronously while other locks are held in the calling sequence.

33) Race condition (CVE-ID: CVE-2026-80548)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges and compromise confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in the vfio_ccw I/O resource handling and channel program lifecycle management when processing concurrent I/O operations and state transitions. A local user can trigger concurrent operations to escalate privileges and compromise confidentiality, integrity, and availability.

The issue affects the s390 vfio_ccw driver.

34) Race condition (CVE-ID: CVE-2026-80547)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to a race condition in the vfio_ccw crw handling logic when processing asynchronous hardware events and userspace reads of the crw region. A local user can trigger concurrent access to the crw list to disclose sensitive information, modify data, or cause a denial of service.

The issue affects the s390 vfio_ccw subsystem and involves the crw queue being accessed from asynchronous hardware-driven paths.

35) Improper input validation (CVE-ID: CVE-2026-80541)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in amdgpu_gem_create_ioctl() when processing GEM create requests with invalid domain combinations. A local user can submit a specially crafted domain combination to cause a denial of service.

The issue is triggered when CPU, GTT, or VRAM domains are combined with DOORBELL, GDS, GWS, or OA domains, causing amdgpu_bo_placement_from_domain() to exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON().

36) Integer overflow (CVE-ID: CVE-2026-80540)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an integer overflow in the amdgpu UVD decode message handler when processing crafted decode parameters. A local user can supply a crafted pitch value to trigger the overflow and execute arbitrary code.

The issue is in the Linux kernel DRM AMDGPU UVD decode path.

37) Out-of-bounds write (CVE-ID: CVE-2026-80536)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in xlog_recover_do_reg_buffer() when processing a crafted XFS filesystem image during mount-time log recovery. A remote attacker can mount a specially crafted filesystem image to execute arbitrary code.

The issue is reachable during mount-time recovery on production kernels where the bounds check was enforced only by an ASSERT().

38) Improper resource shutdown or release (CVE-ID: CVE-2026-80528)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a kernel crash.

The vulnerability exists due to improper resource shutdown or release in handle_reply() in fs/ceph/mds_client.c when processing Ceph MDS replies and filling inode and dentry cache data. A remote attacker can send a specially crafted Ceph MDS reply to cause a kernel crash.

The issue occurs because Ceph-private data stored in current->journal_info may be dereferenced by another filesystem during reclaim.

39) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80527)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in __ceph_get_caps() when handling Ceph capability revocation and reacquisition. A remote attacker can trigger conflicting operations that leave stale mds_wanted state and cause a reader to wait indefinitely to cause a denial of service.

The issue occurs when a cap update requesting FILE_RD does not reach the MDS after mds_wanted has been raised, leaving the client without the wanted file read capability while local state still indicates it is wanted.

40) Out-of-bounds read (CVE-ID: CVE-2026-80526)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds read in tas2562_volume_control_put() when processing userspace volume control values. A local user can supply a specially crafted control value to execute arbitrary code.

The out-of-bounds array access uses a user-controlled index derived from the volume value and may result in an unintended value being written to the device.

41) Use-after-free (CVE-ID: CVE-2026-80521)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a use-after-free in unix_del_edge() and the af_unix garbage collector when processing concurrent socket edge updates and garbage collection. A local user can trigger concurrent send() and close() operations on crafted unix socket reference cycles to execute arbitrary code or cause a denial of service.

The issue occurs in a race window where a new edge becomes visible to garbage collection before its skb is queued, allowing a dead strongly connected component to be partially freed while stale scc_entry state remains reachable during a later GC walk.

42) Out-of-bounds read (CVE-ID: CVE-2026-74752)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in SCTP COOKIE_ECHO handling when processing peer-controlled cookie AUTH fields with cookie authentication disabled. A remote attacker can send a forged cookie with a crafted RANDOM length to disclose sensitive information.

The issue is reachable when cookie authentication is disabled, and malformed AUTH parameters restored from the cookie are not validated against local backing arrays.

43) Out-of-bounds write (CVE-ID: CVE-2026-74752)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in SCTP COOKIE_ECHO handling when processing peer-controlled cookie AUTH fields with cookie authentication disabled. A remote attacker can send a forged cookie with a crafted HMAC identifier to execute arbitrary code.

The issue is reachable when cookie authentication is disabled, and malformed AUTH parameters restored from the cookie are not validated against local backing arrays.

44) Race condition (CVE-ID: CVE-2026-74748)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in __ip_set_put_byindex() in the netfilter ipset subsystem when list:set garbage collection and set swap operations occur concurrently. A local user can trigger concurrent ipset operations to cause a denial of service.

The issue can lead to a kernel BUG and panic from timer softirq context.

45) Out-of-bounds read (CVE-ID: CVE-2026-74747)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ip_vs_nat_icmp() when processing embedded IP headers in ICMP packets after copying header data into the skb head. A local user can modify the ihl field to trigger out-of-bounds access and disclose sensitive information, modify data, or cause a denial of service.

The issue occurs because the embedded header length was not revalidated after reading data from skb fragments.

46) Use-after-free (CVE-ID: CVE-2026-74746)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the netfilter flowtable subsystem when inserting flow tuple nodes into the rhashtable. A remote attacker can trigger garbage collection to observe a partially installed flow to execute arbitrary code.

KASAN reported read and write access to freed slab memory in the flowtable and rhashtable path.

47) Use-after-free (CVE-ID: CVE-2026-74744)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the ipvlan network device component when handling packet header and tailroom requirements inherited from the underlying physical device. A remote attacker can trigger packet processing that causes insufficient headroom or tailroom reservation to execute arbitrary code.

The issue can occur when the underlying physical or stacked lower device requires extra headroom or tailroom for headers or trailers.

48) Use-after-free (CVE-ID: CVE-2026-74743)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the macvlan network device handling in drivers/net/macvlan.c when processing packets on a macvlan device backed by a lower device that requires additional headroom or tailroom. A remote attacker can send network traffic that triggers insufficient buffer space handling to execute arbitrary code.

The issue can be triggered when the lower device requires extra header or trailer space, such as with macsec, ipsec, wireguard, tunnels, or veth with rx headroom.

49) Out-of-bounds read (CVE-ID: CVE-2026-74739)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in u32_bind_class() when processing cls_u32 walker callback entries. A local user can trigger class binding on a hash table entry that is incorrectly treated as a tc_u_knode to disclose sensitive information.

The issue occurs because u32_walk() can enumerate both tc_u_hnode and tc_u_knode objects, but the affected code unconditionally treats the callback argument as a tc_u_knode.

50) Out-of-bounds read (CVE-ID: CVE-2026-74737)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds memory access in the am65-cpsw-nuss packet reception path when processing RX DMA descriptor metadata containing the source tag. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because the driver uses the full 16-bit source tag as the port identifier even though only the lower 8 bits represent the MAC port ID, while the upper 8 bits are hardware-reserved and may contain arbitrary values.

51) Improper access control (CVE-ID: CVE-2026-74736)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in cls_bpf_prog_from_efd() in net/sched/cls_bpf.c when attaching a device-bound bpf classifier program to a network device via cls_bpf with skip_sw. A local user can attach a program bound to a different device and then delete the original device to cause a denial of service.

The issue can trigger a kernel warning and may panic the system when panic_on_warn=1.

52) Race condition (CVE-ID: CVE-2026-74733)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unintended register reads or writes.

The vulnerability exists due to improper synchronization in pca953x_irq_bus_sync_unlock() in the gpio-pca953x driver when handling interrupt state changes and accessing regmap without holding the i2c_lock. A local user can trigger concurrent operations to cause unintended register reads or writes.

The issue arises because multiple threads may access regmap operations without the required driver lock.

53) Use-after-free (CVE-ID: CVE-2026-74730)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the NFS FREE_STATEID handling in fs/nfs/nfs4proc.c when processing a delayed FREE_STATEID operation. A local user can trigger a delayed FREE_STATEID operation to cause a denial of service.

54) Race condition (CVE-ID: CVE-2026-74726)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in bond_alb_monitor in the bonding ALB implementation when handling active slave changes under RTNL. A local user can trigger network interface state changes to cause a denial of service.

The issue can lead to a null pointer dereference and kernel panic, and in failover cases can underflow the new slave's promiscuity counter and leave it stuck in promiscuous mode.

55) Use-after-free (CVE-ID: CVE-2026-74725)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the enic driver teardown work handling in enic_remove() when a TX timeout fires during device removal. A local attacker can trigger a TX timeout race to cause a denial of service.

The issue is caused by a race condition in which tx_hang_reset may be scheduled after the network device has been freed.

56) Out-of-bounds write (CVE-ID: CVE-2026-74724)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in ip_vs_nat_icmp when processing ICMP packets with a modified embedded IPv4 header length field. A local attacker can modify a packet while it is processed by IPVS to cause memory corruption.

57) Out-of-bounds read (CVE-ID: CVE-2026-74723)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the btrfs lzo decompression logic when reading a crafted inline lzo compressed file extent from a crafted btrfs image. A local user can supply a crafted filesystem image containing an invalid inline extent header to cause a denial of service.

The issue is triggered when the inline extent contains only an lzo header without the required segment header or payload, and user interaction is required to access the crafted filesystem data.

58) Improper Initialization (CVE-ID: CVE-2026-74720)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in adjust_ptr_min_max_vals() in the BPF verifier when handling commuted arithmetic involving scalar += pointer operations. A local user can execute a crafted BPF program to cause a denial of service.

The issue occurs because the destination register did not preserve the complete pointer register state, which could leave frame number and parent identity tracking inconsistent for pointer provenance.

59) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74717)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error conditions in the mlx5 firmware tracer core dump logic when processing a tracer creation failure. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can lead to an ERR_PTR dereference and kernel panic during core dump handling.

60) Race condition (CVE-ID: CVE-2026-74715)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the BPF conntrack kfuncs when processing a shared map value for the opts argument during conntrack lookup or allocation. A local user can modify opts->netns_id concurrently to trigger an unmatched namespace reference release and cause a denial of service.

Exploitation requires the ability to invoke the affected BPF conntrack kfuncs with an opts argument that can reference a shared map value.

61) Use-after-free (CVE-ID: CVE-2026-74714)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bpf_iter_tcp_established_batch() when iterating over established TCP sockets. A local user can trigger concurrent socket activity and read an iter/tcp link to cause a denial of service.

This issue can occur when request_sock objects are visible in the ehash chain before their reference count is initialized, leading to a stale reachable socket being freed prematurely.

62) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-74713)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in vhost_iotlb_add_range_ctx() and related vhost IOTLB allocation paths when handling userspace- or guest-controlled IOTLB mapping requests. A local user can send crafted mapping updates that keep allocating IOTLB entries beyond the configured limit to cause a denial of service.

Non-retiring tables could continue allocating entries after reaching their configured limit, and full-range mappings are split into two IOTLB entries.

63) Out-of-bounds read (CVE-ID: CVE-2026-74711)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in pmbus_notify() in the PMBus hwmon subsystem when processing device attributes in notification logic. A local user can trigger notification handling with a non-sensor_device_attribute attribute to disclose sensitive information.

The issue is caused by type confusion from casting multiple attribute structure types to struct sensor_device_attribute.

64) Out-of-bounds read (CVE-ID: CVE-2026-74710)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in AF_XDP TX metadata handling in xdp_umem_reg() when processing a registered TX metadata length smaller than 16 bytes. A local user can register a crafted TX metadata length to disclose sensitive information.

65) Use-after-free (CVE-ID: CVE-2026-74705)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in __skb_udp_tunnel_segment() in net/ipv4/udp_offload.c when processing tunnel segmentation for skb data after pulling the tunnel header into the skb head. A local attacker can trigger skb head reallocation and subsequent use of a stale UDP header pointer to cause a denial of service.

66) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74704)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of malformed packets in sch_cake ACK filter when parsing malformed IP headers. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue may result in warning log flooding, or a kernel panic when panic_on_warn is enabled.

67) Out-of-bounds read (CVE-ID: CVE-2026-74701)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in key_extract() in the Open vSwitch flow extraction logic when processing a packet on an ARPHRD_NONE device with a user-controlled protocol field indicating Ethernet. A local user can send a specially crafted packet with an insufficient linear header to cause a denial of service.

The issue is triggered when the packet is received from devices such as TUN.

68) Race condition (CVE-ID: CVE-2026-74700)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a race condition in net/sched/cls_api.c when handling concurrent classifier creation requests in the same chain and priority. A local user can trigger concurrent u32 and flower filter operations to cause a use-after-free.

Exploitation requires concurrent requests that race during tc_new_tfilter processing.

69) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-74697)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to improper hardware interaction in the bnxt_en AGG ring handling in the bnxt driver when processing TPA data with EOP and relaxed ordering enabled. A local user can trigger network traffic processing that causes overlapping zero padding to corrupt data.

The issue was reported on some ARM systems using 57508 (P5) chips, and it occurs when TPA is enabled.

70) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74696)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in TCP Fast Open listener queue accounting when migrating pending Fast Open children across SO_REUSEPORT listeners. A remote attacker can establish multiple pending Fast Open requests during listener migration to cause a denial of service.

This only occurs with SO_REUSEPORT listener migration involving still-pending TCP Fast Open children.

71) Improper resource shutdown or release (CVE-ID: CVE-2026-74695)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in netfilter nf_flow_table offload hooks and the XFRM offload path when processing incoming sk_buffs that already carry a ref-counted dst_entry. A local user can trigger packet handling that overwrites the existing destination reference to cause a denial of service.

The issue leaks a previous dst_entry reference count and triggers a DEBUG_NET_WARN_ON_ONCE assertion in skb_dst_check_unset().

72) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74692)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in smc_listen_out() in net/smc/af_smc.c when handling TCP connection attempts while a listener is being closed. A remote attacker can open TCP connections during the race window to cause a denial of service.

The issue can leak child smc_sock objects, their clcsock objects, and references, which can exhaust kernel memory.

73) Incorrect behavior order (CVE-ID: CVE-2026-74691)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown sequence in the thunderbolt networking teardown logic when disabling thunderbolt DMA paths during interface teardown. A local user can trigger interface teardowns to cause a denial of service.

On affected systems, repeated teardowns can eventually take the XDomain control channel down, after which the peer node disappears until the controller is power cycled.

74) Use-after-free (CVE-ID: CVE-2026-74690)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ism interrupt handler and ism_dev_exit() cleanup path when handling interrupts during device removal. A local user can trigger concurrent interrupt handling during device teardown to cause a denial of service.

75) Out-of-bounds read (CVE-ID: CVE-2026-74689)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in vcc_setsockopt() when processing crafted setsockopt calls. A local user can supply a mismatched level or a shortened optlen value to trigger an out-of-bounds read and disclose sensitive information.

The issue can also be triggered if a cgroup BPF setsockopt filter shrinks optlen after entry.

76) Use-after-free (CVE-ID: CVE-2026-74688)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the SCTP control chunk handling logic when transmitting a queued HEARTBEAT ACK after the associated peer transport has been removed. A remote attacker can trigger peer transport removal while a control chunk retains a stale transport pointer to cause a denial of service.

The issue occurs when src_out_of_asoc_ok is enabled and the HEARTBEAT ACK remains queued on control_chunk_list instead of being transmitted immediately.

77) Use-after-free (CVE-ID: CVE-2026-74687)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the at91sam9 watchdog timer callback handling in drivers/watchdog/at91sam9_wdt.c when tearing down the driver after probe failure or device removal. A local user can trigger driver teardown while the timer callback rearms the timer to cause a denial of service.

The issue occurs because a running timer callback may continue accessing devm-allocated at91wdt memory after it has been freed.

78) NULL pointer dereference (CVE-ID: CVE-2026-74684)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in tap_get_user_xdp() when parsing a virtio-net header from an XDP buffer before assigning skb->dev. A local user can provide a crafted XDP buffer with a GSO virtio-net header and a zero protocol value to cause a denial of service.

The issue is triggered on the vhost TX path.

79) Improper resource shutdown or release (CVE-ID: CVE-2026-74678)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ax88179_tx_fixup() when processing transmitted socket buffers with NETIF_F_SG enabled and skb_linearize() fails. A local user can trigger transmission of packets under memory pressure to cause a denial of service.

The issue occurs because the socket buffer is not freed when the function returns NULL on the linearization failure path.

80) Race condition (CVE-ID: CVE-2026-74675)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in kbd_keycode in drivers/tty/vt/keyboard.c when handling keyboard input while accessing vc->port.tty. A local user can trigger the race to cause a denial of service.

81) Out-of-bounds write (CVE-ID: CVE-2026-74670)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the IPVS estimator logic in net/netfilter/ipvs/ip_vs_est.c when processing temporary estimators during network namespace teardown after IPVS is disabled. A local user can trigger estimator enqueue operations in this state to cause a denial of service.

The issue occurs when the initial calculation phase exits without installing positive chain and tick limits, allowing the estimator thread to continue with zero limit values.

82) Stack-based buffer overflow (CVE-ID: CVE-2026-74669)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack out-of-bounds write in ip_vs_in_icmp() when rebasing tunnel ICMP errors and processing IPv4 options. A remote attacker can send a specially crafted ICMP packet with IPv4 timestamp options to cause a denial of service.

The issue is triggered because stale IPv4 option metadata from the outer header is retained after the packet is rebased to the quoted original request.

83) Race condition (CVE-ID: CVE-2026-74668)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an inconsistent use of hard_header_len in the tpacket_snd() transmit ring send path in net/packet/af_packet.c when processing tx ring frames during packet transmission. A local user can trigger concurrent netdevice reconfiguration and send crafted ring frames to cause a denial of service.

The issue can make the reserved headroom smaller than the amount later pushed, or make the computed copy length negative.

84) Out-of-bounds read (CVE-ID: CVE-2026-74667)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the packet-socket transmit path in net/packet/af_packet.c when transmitting frames through the PACKET_QDISC_BYPASS path. A local user can send a specially crafted packet through a packet socket to cause a denial of service.

The issue occurs when a driver reads eth_hdr(skb) on transmit with an unset MAC header.

85) Race condition (CVE-ID: CVE-2026-74666)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in packet_set_ring() and pressure clearing logic in af_packet when reconfiguring the ring while packet_poll() or packet_recvmsg() accesses receive state. A local user can reconfigure the packet socket ring and trigger packet polling or receive operations to cause a denial of service.

The issue can cause __packet_rcv_has_room() to dereference stale or NULL ring storage.

86) Uncontrolled Recursion (CVE-ID: CVE-2026-74663)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in qdisc hierarchy handling in net/sched qdisc grafting logic when creating and grafting a new child qdisc below an already deep parent. A local user can create a deeply nested qdisc hierarchy to cause a denial of service.

The issue affects the create-and-graft path that is not covered by the existing loop check.

87) Race condition (CVE-ID: CVE-2026-74662)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in inet_frag_create() and the fragment queue timer handling in net/ipv4/inet_fragment.c when processing fragmented packets with a zero or negative fragment timeout. A remote attacker can send specially crafted fragmented network traffic to cause a denial of service.

The issue occurs because the timer may run before the queue is published in the fqdir rhashtable, which can leave a stale hash node after reference handling becomes unbalanced.

88) Use-after-free (CVE-ID: CVE-2026-74661)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mac802154_beacon_worker when processing beacon work after interface teardown. A local user can trigger beacon worker activity and interface teardown to cause a denial of service.

The issue occurs because the worker continues to use a sub-interface and embedded wpan_dev after the RCU read-side critical section has ended and the request has been freed.

89) Use-after-free (CVE-ID: CVE-2026-74660)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ebt_nflog netfilter target when processing packets that match an ebtables nflog rule during concurrent unloading of the nfnetlink_log module. A local user can trigger packet logging through a crafted ebtables nflog rule to cause a denial of service.

Exploitation requires a race with module teardown while an ebtables nflog rule remains callable.

90) Use-after-free (CVE-ID: CVE-2026-74656)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib_nhc_update_mtu() when walking the nexthop exception table during MTU updates. A local user can trigger concurrent updates to access a freed fib_nh_exception object and cause a denial of service.

The issue involves insufficient synchronization with PMTU exception updates, and KASAN reported a read-after-free during the vulnerable code path.

91) Out-of-bounds read (CVE-ID: CVE-2026-74651)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in rtw_get_wpa_ie() when parsing vendor-specific information elements from received management frames or WPA IE data. A remote attacker can send a specially crafted management frame or crafted IE data to disclose sensitive information.

The issue can be triggered by a short trailing vendor-specific information element whose length is 0 to 5 bytes.

92) Out-of-bounds write (CVE-ID: CVE-2026-74649)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write out of bounds or disclose sensitive information.

The vulnerability exists due to out-of-bounds write in the OnAuthClient() shared-key authentication handler when processing a malformed WLAN_EID_CHALLENGE element during shared-key authentication. A remote attacker can send a specially crafted wireless authentication frame to write out of bounds or disclose sensitive information.

The issue is reachable over the air before association.

93) Out-of-bounds read (CVE-ID: CVE-2026-74648)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in rtw_cfg80211_monitor_if_xmit_entry() when processing truncated monitor transmit frames. A local user can send a specially crafted truncated frame to disclose sensitive information or cause a denial of service.

The issue occurs after removal of the radiotap header while handling 802.11 headers and related calculated header spans.

94) Race condition (CVE-ID: CVE-2026-74647)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in fastrpc_req_munmap_impl in the fastrpc driver when processing concurrent buffer unmap requests. A local user can trigger concurrent unmap operations to cause a denial of service.

The issue occurs when multiple threads invoke unmap concurrently for the same buffer.

95) Race condition (CVE-ID: CVE-2026-74646)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in fastrpc_internal_invoke() when handling an interrupted invoke after wait_for_completion_interruptible() returns -ERESTARTSYS. A local user can trigger an interrupted invoke to cause a denial of service.

96) Improper input validation (CVE-ID: CVE-2026-74641)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read and write arbitrary kernel memory or cause a denial of service.

The vulnerability exists due to improper input validation in snd_us428ctls_vm_fault() and snd_usx2y_hwdep_pcm_vm_fault() when handling mmap page faults with a user-controlled page offset. A local user can supply a crafted mmap() offset to map a kernel page outside the allocated shared memory region to read and write arbitrary kernel memory or cause a denial of service.

Exploitation requires access to the hwdep node of an attached US-X2Y device, and in the us428 control path the FPGA image must be loaded through the same node first.

97) Use-after-free (CVE-ID: CVE-2026-74637)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in perf/core group handling when processing a PERF_IOC_FLAG_GROUP ioctl on a detached sibling event after CPU hotplug detachment. A local user can issue a crafted ioctl on a surviving perf event file descriptor to cause a denial of service.

The issue occurs when a sibling event is detached with DETACH_GROUP and kept alive while its group_leader pointer still references a leader that is later freed.

98) Out-of-bounds read (CVE-ID: CVE-2026-74635)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the bit_cursor() function in drivers/video/fbdev/core/bitblit.c when processing screen buffer values as glyph indexes. A local user can write an arbitrary 16-bit value to /dev/vcsa to disclose sensitive information.

The issue can also be triggered when stale screen buffer data retains high-bit characters after switching from a 512-glyph font to a 256-glyph font.

99) Use-after-free (CVE-ID: CVE-2026-74634)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in ring_buffer_subbuf_order_set() and rb_advance_iter() when changing the ring buffer sub-buffer order while resizing is disabled. A local user can trigger a non-consuming reader to access freed buffer pages to cause a denial of service.

The issue affects non-consuming reader scenarios in the ring buffer.

100) Race condition (CVE-ID: CVE-2026-74632)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in mm/huge_memory.c when handling concurrent page faults and shrinker activity for the huge zero folio. A local user can trigger concurrent memory-management activity to cause a denial of service.

Only systems without CONFIG_PERSISTENT_HUGE_ZERO_FOLIO are affected.

101) Use-after-free (CVE-ID: CVE-2026-74631)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in smc_rx_splice when processing splice operations. A local user can trigger a refcount imbalance to cause a denial of service.

The issue can underflow page refcounts in the VM-backed RMB path.

102) Use-after-free (CVE-ID: CVE-2026-74630)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in in6_dev_get() and inet6_dev handling when processing IPv6 device state during concurrent device teardown. A local user can trigger network operations that race with device teardown to cause a denial of service or execute arbitrary code.

The issue arises from invalid reference acquisition after the object reference count has already reached zero, and the freed object may be accessed after the RCU read-side section ends.

103) Use-after-free (CVE-ID: CVE-2026-74628)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the x25 socket timer handlers when processing timer callbacks during socket teardown. A local user can trigger timer activity on an x25 socket being destroyed to cause a denial of service.

The issue involves a race condition in which a timer callback may rearm after the socket has passed its cancel point, leading to use of freed memory on a subsequent timer expiry.

104) Improper resource shutdown or release (CVE-ID: CVE-2026-74626)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in ntb_netdev_rx_handler() in the ntb_netdev driver when handling received packets and allocating replacement receive buffers. A remote attacker can send packets that trigger allocation failures and exhaust the receive queue to cause a denial of service.

The issue can stall packet reception while the network interface remains up.

105) Memory leak (CVE-ID: CVE-2026-74625)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in nf_ct_bridge_pre() when processing non-IPv4 and non-IPv6 Ethernet frames after a bridge nftables ct zone set rule has attached a conntrack template. A remote attacker can send specially crafted non-IP traffic to cause a denial of service.

Memory is leaked by making the existing conntrack template reference unreachable, which can exhaust slab memory.

106) Improper locking (CVE-ID: CVE-2026-74624)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper lock handling in netfilter nf_conntrack TCP and SCTP invalid-packet logging when processing invalid packets while invalid logging is routed to nfnetlink_log and conntrack export is enabled. A remote attacker can send specially crafted packets to cause a denial of service.

The issue can deadlock when invalid-packet logging re-enters conntrack netlink glue and attempts to dump the same connection tracking entry again.

107) Improper resource shutdown or release (CVE-ID: CVE-2026-74621)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the act_ct traffic control action when processing malformed fragmented IPv4 or IPv6 packets during header sanity checks. A remote attacker can send a specially crafted malformed packet to cause a denial of service.

The issue can leak one sk_buff and its associated data buffer per malformed packet, which may occur on ingress or egress paths that use the connection tracking action.

108) Out-of-bounds write (CVE-ID: CVE-2026-74616)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in xdpf_clone() and the XDP-to-skb conversion path when converting crafted cloned XDP frames into sk_buffs. A local user can trigger conversion of a crafted clone that overlaps skb_shared_info tailroom to cause memory corruption.

109) Use-after-free (CVE-ID: CVE-2026-74615)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in the vxlan ageing timer handling in drivers/net/vxlan/vxlan_core.c when changing link ageing settings on a device that is down. A remote user can create and delete a VXLAN device in a new user and network namespace to cause a denial of service.

The affected operations are network-namespace scoped.

110) Race condition (CVE-ID: CVE-2026-74614)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in virtio vsock worker handling in net/vmw_vsock/virtio_transport.c when processing virtqueue work across freeze and restore operations. A local user can trigger worker activity during suspend and restore state transitions to cause a denial of service.

The issue affects the RX, TX, and event workers when a delayed worker observes a replacement queue state while retaining a pointer to a deleted queue.

111) Use-after-free (CVE-ID: CVE-2026-74613)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in virtio_transport_rx_work in net/vmw_vsock/virtio_transport.c when processing RX work during device teardown. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can lead to a kernel panic during suspend or freeze operations when queued work continues after virtqueues have been deleted.

112) Out-of-bounds read (CVE-ID: CVE-2026-74612)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information to userspace.

The vulnerability exists due to an out-of-bounds read in veth_xdp_rcv_skb() when processing an skb after XDP fragment area adjustment. A local user can run an XDP program that shrinks the fragment area to disclose sensitive information to userspace.

The issue can expose skb metadata including fragment state and a kernel pointer, and was observed on the UDP receive path.

113) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74611)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to overwrite memory in later caller iovecs beyond the returned length.

The vulnerability exists due to an improper iterator state restoration in tls_decrypt_sw() and the TLS 1.3 zero-copy retry path when processing a TLS 1.3 control record after optimistic zero-copy decryption. A remote attacker can send a specially crafted TLS record to overwrite memory in later caller iovecs beyond the returned length.

Exploitation requires the receiver to have TLS_RX_EXPECT_NO_PAD enabled.

114) Out-of-bounds write (CVE-ID: CVE-2026-74610)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in tls_sw_sendmsg_locked() and the plaintext sk_msg ring handling in net/tls/tls_sw.c when processing sendmsg and later splice operations on a loopback TCP socket with the "tls" ULP attached. A local user can trigger the ring to appear empty after wrapping and overwrite live entries to cause a denial of service.

The issue can lead to a kernel NULL pointer dereference when a full plaintext sk_msg ring is left unpushed.

115) Use-after-free (CVE-ID: CVE-2026-74609)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tipc_node_link_down() in the TIPC subsystem when handling link-down events and bearer disable operations concurrently. A local user can trigger a race condition that frees a link object while it is still being dereferenced to cause a denial of service.

The issue can result in both a use-after-free read in tipc_link_is_establishing() and a use-after-free write via tipc_link_reset() during the establishing branch.

116) Use-after-free (CVE-ID: CVE-2026-74608)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in cifs_try_adding_channels() when handling channel addition failures during concurrent interface list refresh. A local user can trigger the race condition to cause a denial of service.

The issue occurs on the failure path after channel creation fails and concurrent interface list refresh removes the remaining list reference.

117) Race condition (CVE-ID: CVE-2026-74607)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in KVM SVM SEV handling for enc_context_owner and mirror_vms when processing KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM operations. A local user can trigger concurrent VM move, copy, or destroy operations to cause a denial of service.

The issue involves list corruption in mirror VM tracking and incorrect kvm_put_kvm() handling during VM destruction.

118) Use-after-free (CVE-ID: CVE-2026-74606)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in eventfs_remove_rec() in fs/tracefs/event_inode.c when recursively removing eventfs child entries. A local user can trigger recursive removal of crafted eventfs entries to cause a denial of service.

The issue occurs because iteration continues by reading the next list pointer from a child entry after that child has been removed and may already have been freed.

119) Race condition (CVE-ID: CVE-2026-74605)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in eventfs inode handling in fs/tracefs/event_inode.c when iterating over the SRCU-protected children list during inode freeing. A local user can trigger concurrent eventfs operations to cause a denial of service.

The issue occurs because a freed inode can be observed with its children list reused as an RCU head, causing iteration to read an invalid list target.

120) Use-after-free (CVE-ID: CVE-2026-74604)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in thermal_add_hwmon_sysfs() when handling the error path during hwmon sysfs device registration. A local user can trigger the vulnerable error-handling condition to cause a denial of service.

121) Out-of-bounds read (CVE-ID: CVE-2026-74603)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the ptp ocp devlink board id reporting logic when processing a non-NUL-terminated EEPROM board ID field. A local user can trigger reporting of the board ID to disclose sensitive information.

The issue occurs because the EEPROM board ID is a fixed 13-byte field that is not guaranteed to contain a NUL terminator.

122) Race condition (CVE-ID: CVE-2026-74601)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ring_buffer_swap_cpu() when swapping per-cpu ring buffers during an active write operation. A local user can trigger a buffer swap at a moment when the committing counter temporarily drops to zero to cause a denial of service.

The issue can lead to an inconsistent buffer state and trigger the RB_WARN_ON in rb_commit().

123) Out-of-bounds read (CVE-ID: CVE-2026-74598)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rt6_route_rcv() when processing a crafted IPv6 Router Advertisement containing a malformed Route Information option. A remote attacker can send a specially crafted Router Advertisement to disclose sensitive information.

When additional options follow the malformed Route Information option, data from the next option can be incorporated into the installed route and become visible to userspace.

124) Out-of-bounds write (CVE-ID: CVE-2026-74597)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to an out-of-bounds write in ip6ip6_err() and the IPv6 ICMP error reply path when processing a quoted inner IPv6 packet after cloning an outer IPv6 ICMP error skb with stale inet6_skb_parm metadata. A remote attacker can send a specially crafted IPv6 packet to corrupt memory.

Exploitation requires the outer packet to carry a Home Address Option and a malformed inner destination-options header.

125) Improper access control (CVE-ID: CVE-2026-74595)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass owner checks and set an encryption policy on a file.

The vulnerability exists due to improper access control in fscrypt_ioctl_set_policy() when handling ioctl requests on idmapped mounts. A local user can issue a crafted ioctl on an idmapped mount to bypass owner checks and set an encryption policy on a file.

The issue occurs because the check uses the unmapped on-disk owner rather than the mapped owner on mounts that support idmapping.

126) Use-after-free (CVE-ID: CVE-2026-74594)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in kernel/sched/psi.c when destroying PSI cgroup triggers concurrently with scheduling poll work. A local user can trigger a race that leaves a poll timer pending on freed memory to cause a denial of service.

The issue occurs because a timer may be re-armed during teardown and later execute poll_timer_fn() after the associated group has been freed.

127) Improper Initialization (CVE-ID: CVE-2026-74592)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass integrity measurement and appraisal of truncated files.

The vulnerability exists due to improper state management in the integrity measurement architecture truncate hook handling when truncation is requested for a regular file. A local user can truncate a file to bypass integrity measurement and appraisal of truncated files.

The issue affects files whose IMA action cache flags are not reset after content changes caused by truncation.

128) Race condition (CVE-ID: CVE-2026-74590)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to concurrent modification handling in bpf_get_fsverity_digest() when processing a dynptr-backed fsverity digest buffer. A local user can trigger the kfunc with a concurrently modified digest_size field to cause a denial of service.

The issue arises because the dynptr abstraction ensures memory validity but not stability of its contents during concurrent access.

129) Use-after-free (CVE-ID: CVE-2026-74589)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tcp_bpf_send_verdict() and tcp_bpf_sendmsg_redir() when processing concurrent sendmsg() operations with a cached redirect verdict. A local user can trigger concurrent socket send operations to cause a denial of service.

The issue occurs when apply_bytes keeps the cached verdict active, allowing one thread to release the redirect socket reference while another thread still uses a stale pointer.

130) Use-after-free (CVE-ID: CVE-2026-74588)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in __sctp_outq_flush_rtx() and SCTP transport tracking when processing SCTP SACKs after transport removal. A remote user can send crafted SCTP control traffic to cause a denial of service.

Exploitation requires an SCTP association peer to trigger transport removal through ASCONF Delete-IP and then send a SACK that reneges on the TSN.

131) Use-after-free (CVE-ID: CVE-2026-74587)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the SCTP ASCONF handling code when processing a delayed authenticated ASCONF-ACK after peer restart handling purges the ASCONF queue. A remote attacker can send a delayed authenticated ASCONF-ACK to cause a denial of service.

The issue occurs because a cached ASCONF chunk pointer can remain dangling while the association is still alive during peer restart handling.

132) Use-after-free (CVE-ID: CVE-2026-74586)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in SCTP ASCONF handling when processing an authenticated ASCONF chunk that adds and removes a peer transport in the same chunk. A remote user can send a specially crafted authenticated ASCONF message to cause a denial of service.

The issue occurs because a stale new_transport pointer can be used when a queued HEARTBEAT is later processed during local address replacement.

133) Use of uninitialized resource (CVE-ID: CVE-2026-74584)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the bnxt_re shared userspace page allocation in bnxt_re_alloc_ucontext() when mapping the shared page to userspace through BNXT_RE_MMAP_SH_PAGE after IB_USER_VERBS_CMD_GET_CONTEXT. A local user can perform a single mmap() on the exposed page to disclose sensitive information.

Exploitation requires access to /dev/infiniband/uverbsX on a host with a bnxt_re device.

134) Use-after-free (CVE-ID: CVE-2026-74583)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the route4 fastmap cache in the cls_route classifier when classifying packets concurrently with filter deletion or modification. A local user can trigger concurrent packet classification and filter updates to cause a denial of service.

The issue is caused by a race in which an in-flight reader can republish a stale filter pointer into the fastmap after the entry has been reset and before the deferred free completes.

135) Out-of-bounds write (CVE-ID: CVE-2026-74582)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in packet_snd() and packet_sendmsg_spkt() in the Linux kernel AF_PACKET implementation when handling non-ring send paths during concurrent device reconfiguration. A local user can send crafted packets while triggering a change in hard_header_len to cause an out-of-bounds write.

The issue affects SOCK_RAW send handling, and packet_sendmsg_spkt() is affected by the same inconsistent header length usage across allocation and packet construction.

136) Use-after-free (CVE-ID: CVE-2026-74581)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib6_rule_lookup() and fib6_rule_suppress() in the IPv6 routing rules handler when processing suppressed IPv6 route lookups. A local user can trigger route lookups involving a suppressing rule to cause a denial of service.

The issue occurs because a stale dst entry can be returned after the released route remains referenced in the lookup result.

137) Improper access control (CVE-ID: CVE-2026-74580)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory outside the intended IOTLB-mapped region.

The vulnerability exists due to improper access control in the vhost vring metadata cache in drivers/vhost/vhost.c when reconfiguring vring addresses or vring size through vhost ioctls while a device IOTLB is attached. A local user can issue crafted vring reconfiguration ioctls after populating the metadata cache to access memory outside the intended IOTLB-mapped region.

The issue occurs because stale cached metadata mappings may continue to be used after live vring reconfiguration, causing subsequent used ring updates or descriptor fetches to use translations based on the old mapping.

138) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-74579)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause incorrect netfilter payload offload matching.

The vulnerability exists due to undefined shift behavior in nft_payload_offload_mask() in net/netfilter/nft_payload.c when building an offload match mask for a payload expression that covers only part of a header field. A local privileged user can configure a crafted nftables payload rule with a partial header field match to cause incorrect netfilter payload offload matching.

The issue occurs for partial field matches such as a partial IPv6 address match where the match length is shorter than the header field length.

139) Race condition (CVE-ID: CVE-2026-74578)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose plaintext and compromise cryptographic operation integrity.

The vulnerability exists due to improper synchronization of shared cryptographic state in the AIO/async path in skcipher_recvmsg() when handling async skcipher receive operations. A local user can race an asynchronous skcipher receive operation with sendmsg(ALG_SET_IV) to disclose plaintext and compromise cryptographic operation integrity.

The described plaintext recovery applies to CTR/stream modes through IV/keystream reuse.

140) Use-after-free (CVE-ID: CVE-2026-74575)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the thunderbolt xdomain delayed work handling in tb_xdp_handle_request() and update_xdomain() when queuing delayed work concurrently with xdomain disconnect and removal. A local user can trigger crafted xdomain requests or state changes during disconnect to cause a denial of service.

The issue arises because the request handler runs on the system workqueue and is no longer serialized with the remove path.

141) Use-after-free (CVE-ID: CVE-2026-74574)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock and use-after-free in idxd_cdev_open() when handling file-device setup failures. A local user can trigger a failure during device open processing to cause a denial of service.

The issue occurs in error-handling paths that can release the last file-device reference while the workqueue lock is still held.

142) Deadlock (CVE-ID: CVE-2026-74572)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock management in btree_writepages() and check_bg_is_active() in the btrfs zoned filesystem code when writing metadata extent buffers and committing transactions. A local user can trigger metadata writeback and transaction commit activity to cause a denial of service.

The issue can occur on a zoned btrfs filesystem and may result in a deadlock between metadata writeback and transaction commit.

143) Out-of-bounds read (CVE-ID: CVE-2026-74567)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in keyring_get_key_chunk() when processing crafted colliding key descriptions through add_key(2). A local user can add a crafted pair of same-type keys whose index hashes collide to disclose sensitive information.

The issue is triggered when the lookup reaches a description-level chunk after collisions through the hash, x, type, and domain_tag chunks.

144) Use-after-free (CVE-ID: CVE-2026-74565)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in nft_object lookup handling in nf_tables when accessing objects during net namespace event processing. A local user can trigger object lookup and destruction across tables to cause a denial of service or execute arbitrary code.

The issue arises because a global object name rhltable could expose objects being dismantled from the lookup path by another existing network namespace.

145) Use of uninitialized resource (CVE-ID: CVE-2026-74564)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uninitialized memory access in xt_hashlimit when processing hashlimit rule configuration with inconsistent XT_HASHLIMIT_RATE_MATCH usage for the same hashtable. A local user can create specially crafted netfilter rules to cause a denial of service.

The issue arises when different rules referring to the same hashtable use conflicting rate match semantics, and revision values less than 3 are also affected when the flag is used.

146) Use-after-free (CVE-ID: CVE-2026-74563)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use-after-free in rds_tcp_laddr_check() and ipv6 address checking when processing a bind request with a scoped IPv6 interface. A local user can trigger a concurrent device removal condition and issue a bind operation to disclose sensitive information.

The issue is caused by dereferencing a stale net_device pointer after the RCU read-side lock is released.

147) Out-of-bounds read (CVE-ID: CVE-2026-74557)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in iscsi_scsi_cmd_rsp() when processing a target-supplied SCSI Response sense data segment. A remote attacker can send a crafted SCSI Response with a malformed sense length field to disclose sensitive information.

The over-read can copy up to two bytes of stale conn->data contents into the command's sense buffer, which is returned to userspace.

148) Memory corruption (CVE-ID: CVE-2026-74551)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to improper memory alignment in the nzxt-smart2 driver output buffer when sending output reports through the USB HID core for DMA. A local user can trigger device operations such as setting a fan speed or updating the interval to cause memory corruption.

This issue affects systems with non-coherent CPU architectures such as ARM or MIPS, where the corruption is immediate and deterministic due to cacheline sharing with adjacent variables.

149) Improper resource shutdown or release (CVE-ID: CVE-2026-74550)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown in ICMP/NDISC redirect handling when peer allocation fails under memory pressure or peer tree size caps. A remote attacker can trigger packet forwarding conditions that cause un-rate-limited ICMP/NDISC Redirect messages to be sent to cause a denial of service.

The issue affects both IPv4 and IPv6 redirect paths.

150) Out-of-bounds read (CVE-ID: CVE-2026-74549)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in nct6775_update_pwm() in the nct6775-core hwmon driver when iterating over pwm channels for nct6116 weight-control registers. A local user can trigger access to unsupported weight registers to cause a denial of service.

The issue affects nct6116 configurations where bits 3 or 4 of has_pwm are set, causing out-of-bounds values to be used as hardware register addresses for subsequent read and write operations.

151) Use-after-free (CVE-ID: CVE-2026-74548)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the forcedeth driver txrx_stats handling in nv_remove() when unregistering a network device. A local user can trigger device removal while code paths such as ndo_get_stats64, the NAPI/xmit data path, or nv_close()/drain still access freed memory to cause a denial of service.

The issue occurs because accesses to the per-CPU statistics structure may continue until network device unregistration completes.

152) Improper input validation (CVE-ID: CVE-2026-74544)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the cls_u32 packet classifier when processing a crafted filter configuration with varoffset enabled. A local user can supply an out-of-range offshift value to trigger shift-out-of-bounds behavior and cause a denial of service.

Exploitation is possible by an unprivileged user via user or network namespaces.

153) Use-after-free (CVE-ID: CVE-2026-74540)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in l2cap_le_connect_rsp() in the Bluetooth L2CAP subsystem when handling a crafted LE connect response during channel processing. A remote attacker can trigger a remote disconnect race to cause a denial of service.

154) Use-after-free (CVE-ID: CVE-2026-74537)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in iso_conn_ready in the Bluetooth ISO subsystem when handling connection ready events during a concurrent socket close. A local user can trigger a race condition to cause a denial of service.

155) Improper resource shutdown or release (CVE-ID: CVE-2026-74536)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in iso_sock_kill() and ISO socket handling in net/bluetooth/iso.c when releasing and deleting Bluetooth ISO sockets concurrently. A local user can trigger concurrent socket release and connection deletion to cause a denial of service.

The issue results in a leaked socket reference because cleanup may be skipped and the socket destructor may never be called.

156) Use-after-free (CVE-ID: CVE-2026-74535)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free and deadlock condition in iso_sock_timeout in the Bluetooth ISO subsystem when handling socket timeout work concurrently with connection deletion or synchronously disabling delayed work while holding the socket lock. A local user can trigger socket timeout handling and connection teardown to cause a denial of service.

The issue involves a race between timeout processing and connection deletion in Bluetooth ISO sockets.

157) Double free (CVE-ID: CVE-2026-74534)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in net/bluetooth/iso.c when deleting Bluetooth ISO connections concurrently. A local user can trigger a race condition to cause a denial of service.

The issue arises from a race between iso_conn_del() and iso_chan_del() in the Bluetooth ISO subsystem.

158) Use-after-free (CVE-ID: CVE-2026-74533)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free race condition in the Bluetooth ISO connection handling in net/bluetooth/iso.c when processing Bluetooth ISO data and connection teardown. A local user can trigger concurrent access to hci_conn->iso_data to cause a denial of service or execute arbitrary code.

The issue involves unsynchronized access to hci_conn->iso_data during iso_recv(), iso_conn_put(), iso_conn_add(), and iso_conn_free().

159) Use-after-free (CVE-ID: CVE-2026-74531)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in abort_conn_sync() in net/bluetooth/hci_conn.c when handling Bluetooth connection abort operations. A local user can trigger a connection abort race to cause a denial of service.

The issue is theoretical and occurs if the connection object is freed while the hci_sync task is running.

160) Use-after-free (CVE-ID: CVE-2026-74530)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in hci_connect_big_sync() callback handling in net/bluetooth/hci_sync.c when processing Bluetooth BIG sync connection operations. A local user can trigger a race condition leading to use of a freed connection object to cause a denial of service.

The issue is described as theoretical and occurs if the connection object is freed while the hci_sync task is running.

161) Improper access control (CVE-ID: CVE-2026-74527)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify shared packet kind configuration and disrupt network parsing behavior.

The vulnerability exists due to improper access control in the octeontx2-af CGX/NIX PKIND configuration logic when allocating or configuring a VF NIX logical function that shares a CGX LMAC with a PF using HiGig2 or EDSA parsing. A local user can allocate or configure a crafted VF NIX logical function to modify shared packet kind configuration and disrupt network parsing behavior.

Only CGX-mapped virtual functions sharing a LMAC with a physical function using special parse kinds are affected.

162) Deadlock (CVE-ID: CVE-2026-74523)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a deadlock in the qede recovery path when handling a TX timeout on a qede NIC with VXLAN/GENEVE tunnel ports configured. A local attacker can trigger a TX timeout condition to cause a denial of service.

The issue can wedge the rtnetlink control plane of the whole machine while the node may still answer ping.

163) Use-after-free (CVE-ID: CVE-2026-74522)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __close_file_table_ids() when tearing down a file table after logical file close and reference release across sessions. A local user can trigger cross-session file reference handling to dereference a stale pointer and cause a denial of service.

Exploitation requires another session to hold a temporary reference to the same ksmbd_file obtained through ksmbd_lookup_fd_inode().

164) Double free (CVE-ID: CVE-2026-74519)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to double free in dt_remember_or_free_map() and dt_free_map() in the pinctrl devicetree code when handling a failed dev_name duplication during map initialization. A local attacker can trigger a memory allocation failure during device binding to cause a denial of service.

Exploitation was demonstrated with failslab injection while binding a pinctrl-consuming device.

165) Use-after-free (CVE-ID: CVE-2026-74518)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in allocate_file_region_entries() when handling concurrent region cache operations on a shared resv_map. A local user can trigger concurrent region_chg()/region_add()/region_del() activity on the same shared mapping to cause a denial of service.

The issue occurs in shared hugetlbfs mappings and was observed when multiple mappers accessed the same hugetlbfs inode concurrently.

166) Improper access control (CVE-ID: CVE-2026-74516)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in x2APIC MSR interception handling in KVM SVM/AVIC when AVIC is inhibited while an L2 guest is active. A local user can run a nested guest that triggers this state to cause a denial of service.

The issue can allow an L1 guest to read much of the host APIC state, send arbitrary interrupts, and change task priority before host disruption occurs.

167) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74515)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state validation in kvm_s390_pci_aif_enable() when handling repeated requests to enable adapter interrupt forwarding for the same zPCI device. A local user can issue the ioctl multiple times to cause a denial of service.

The issue can also overwrite and leak resources if the operation is invoked repeatedly for the same device.

168) Use-after-free (CVE-ID: CVE-2026-74512)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in audit_del_rule() when deleting audit rules while concurrent readers access RCU-visible filter lists. A local user can trigger rule deletion during concurrent access to cause a denial of service.

169) Use-after-free (CVE-ID: CVE-2026-74510)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the Bluetooth management subsystem pair command handling in net/bluetooth/mgmt.c when racing pairing completion or authentication failure callbacks with a cancel pair device request. A local user can trigger concurrent pair and cancel operations to cause a denial of service or execute arbitrary code.

The issue arises from unsafe access to shared pending pairing commands on the hdev->mgmt_pending list during command cancellation and callback processing, and the race can also lead to a second list removal.

170) Use-after-free (CVE-ID: CVE-2026-74509)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth HCI advertising command-sync paths in net/bluetooth/hci_sync.c when processing advertising termination events during extended advertising, scan response, or periodic advertising data handling. A local attacker can trigger a race condition to cause a denial of service.

The issue occurs because an adv_info pointer can be retained across an HCI command wait after the associated advertising instance is removed.

171) Use of uninitialized resource (CVE-ID: CVE-2026-74508)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in hidp_recv_ctrl_frame() and hidp_recv_intr_frame() in the HIDP subsystem when processing crafted Bluetooth HIDP frames without a transaction header. A remote user can send a specially crafted empty or malformed frame to cause a denial of service.

The issue can terminate the HIDP session when a malformed lower-layer packet causes an extra byte to be consumed as a virtual cable unplug control value.

172) Out-of-bounds read (CVE-ID: CVE-2026-74507)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hidp_process_data() when processing a malformed HIDP numbered report response. A remote user can send a specially crafted Bluetooth HIDP data response to cause a denial of service.

Exploitation requires a connected HIDP peer.

173) Improper input validation (CVE-ID: CVE-2026-74497)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in snd_usb_handle_sync_urb() when processing oversized USB sync packets in implicit-feedback mode. An attacker with physical access can connect a crafted USB device that sends oversized sync packets to cause a denial of service.

174) Use-after-free (CVE-ID: CVE-2026-74496)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fou_create() and fou_from_sock() when handling concurrent socket activity after a failed FOU port creation. A local user can request local port 0 and trigger concurrent receive processing to cause a denial of service.

The issue is reachable when local port 0 is requested and the creation path fails after the object remains reachable through sk_user_data.

175) Use-after-free (CVE-ID: CVE-2026-74492)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in mtype_add() when processing packet-side add operations during ipset table resizing. A remote user can trigger xt_SET --add-set ... --exist updates to cause a denial of service.

The issue occurs when a replacement-table entry and an old-table entry temporarily share the same comment pointer during resize and backlog replay, leading to a stale pointer dereference in strlen().

176) Use-after-free (CVE-ID: CVE-2026-74490)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tipc_poll() trace queue dumping when walking live socket queue members from an unlocked poll context. A local user can trigger polling while queue entries are concurrently dequeued and freed to cause a denial of service.

The issue occurs in the TIPC socket trace path during queue state dumping.

177) Use-after-free (CVE-ID: CVE-2026-74488)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use-after-free in mwifiex_11n_dispatch_amsdu_pkt() when parsing A-MSDU TDLS frames. A remote attacker can send a specially crafted A-MSDU frame with shorter earlier subframes to disclose sensitive information.

Reaching the vulnerable path requires TDLS support in firmware and the TDLS ethertype on the subframe.

178) Out-of-bounds read (CVE-ID: CVE-2026-74485)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the binfmt_misc registration parser when processing a crafted registration string with a flag character used as the field delimiter. A remote attacker can submit a specially crafted registration string to disclose sensitive information.

The issue is reachable by unprivileged users in a user namespace through binfmt_misc mounts.

179) Use-after-free (CVE-ID: CVE-2026-74482)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __folio_split() in mm/huge_memory.c when handling a split of a shmem transparent huge page during memory failure processing and truncation. A local user can trigger the vulnerable split path to cause a denial of service.

The issue can occur when a poisoned tail beyond EOF is split while truncation and a concurrent final iput() allow the inode to be evicted and RCU-freed before i_mmap_unlock_read() is reached.

180) Use-after-free (CVE-ID: CVE-2026-74481)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in page_reporting_process and virtballoon_free_page_report when page reporting work continues during power management freeze while virtqueues are being deleted. A local user can trigger suspend or hibernation activity while freed pages are being reported to access deleted virtqueues and cause a denial of service.

The issue can be reached during S3 suspend or S4 hibernation, including cases where memory reclamation returns pages to the buddy allocator during image saving.

181) Use-after-free (CVE-ID: CVE-2026-74479)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the pktgen proc entry handling in net/core/pktgen.c when concurrently removing and renaming pktgen devices. A local user can trigger a race condition involving proc_remove() on a stale proc_dir_entry to cause a denial of service.

The issue occurs because pktgen_change_name() and pktgen_remove_device() access the same proc entry with inconsistent locking, and exploitation requires winning a race between those paths.

182) Use-after-free (CVE-ID: CVE-2026-74471)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in trace_module_add_events() and the tracing subsystem when handling failed event registration during module loading. A local user can load a module that triggers event registration failure and subsequently access tracefs or tracing operations to cause a denial of service.

Exploitation requires a module loading scenario in which event registration fails and the module memory is later freed, leaving a stale trace_event_call pointer in trace_event_file.

183) Out-of-bounds write (CVE-ID: CVE-2026-74470)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the resp_report_zones() function in the scsi_debug driver when processing a REPORT ZONES command with a crafted allocation length on 32-bit systems. A local user can send a specially crafted REPORT ZONES command to cause a denial of service.

The issue occurs when an allocation length in the 0xFFFFFFC1 through 0xFFFFFFFF range causes a zero-sized allocation to be dereferenced on 32-bit systems.

184) Out-of-bounds write (CVE-ID: CVE-2026-74469)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in SCTP sock_diag when processing a diagnostic dump after adding many unique peer transports. A local user can add unique peer addresses until the 16-bit transport_count wraps and trigger a diagnostic dump to cause a denial of service.

The issue occurs when the association accumulates 65,536 unique peer transports, causing transport_count to wrap to zero while peer addresses are still copied from transport_addr_list.

185) Improper access control (CVE-ID: CVE-2026-74467)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to invoke private ioctl commands.

The vulnerability exists due to improper access control in qeth_siocdevprivate when handling SIOCDEVPRIVATE ioctl commands. A local user can invoke private ioctl commands to invoke private ioctl commands.

The issue affects the SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT commands.

186) Use-after-free (CVE-ID: CVE-2026-74465)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the openvswitch meter handling code when processing crafted netlink requests through the uAPI. A local user can trigger meter attach failure conditions and concurrently access the freed meter to cause a denial of service.

Exploitation is possible with a custom application using the uAPI, while the issue is not triggered in the typical ovs-vswitchd usage pattern described in the advisory.

187) Use-after-free (CVE-ID: CVE-2026-74461)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the i2c-imx slave timeout handling in drivers/i2c/busses/i2c-imx.c when unregistering a slave device while a pending interrupt has already started the hrtimer. A local user can trigger the race condition to cause a denial of service.

The issue can also result in a NULL pointer dereference when the timer callback invokes the slave event handler with a NULL slave pointer.

188) Double free (CVE-ID: CVE-2026-74456)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in peak_usb_start() in the peak_usb CAN USB driver when handling a failed URB submission. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs because the transfer buffer is freed explicitly after URB submission failure and then freed again when the URB is released.

189) Out-of-bounds write (CVE-ID: CVE-2026-74454)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory and cause a denial of service.

The vulnerability exists due to an out-of-bounds write in vc4_overflow_mem_work() when handling a binner out-of-memory event. A local user can trigger a GPU job overflow to corrupt memory and cause a denial of service.

The issue arises because the GPU is authorized to DMA beyond the intended 512KB overflow slot, potentially overwriting in-flight job data and unrelated CMA memory.

190) Improper input validation (CVE-ID: CVE-2026-74453)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in validate_tile_binning_config when processing tile binning configurations with oversized tile state arrays. A local user can submit a crafted tile binning configuration that leaves no room for the tile allocation pool to cause a denial of service.

The tile state data array size is derived from tile count fields and shares the same buffer slot with the tile allocation pool.

191) Improper Initialization (CVE-ID: CVE-2026-74453)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the vc4 tile state data array handling when submitting crafted tile binning configurations. A local user can submit a crafted job that reuses stale tile state data to cause a denial of service.

The issue can result in invalid command streams, invalid primitive streams, and GPU hangs.

192) Use-after-free (CVE-ID: CVE-2026-74450)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the amdgpu pp_table sysfs handling when copying the power table after dropping adev->pm.mutex. A local user can trigger a concurrent pp_table write during the copy to cause a denial of service.

The issue arises because a driver-owned power table pointer is returned and later used by the sysfs path after the mutex is released.

193) Race condition (CVE-ID: CVE-2026-74446)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a race condition in kfd_criu_checkpoint_events() in the amdkfd event handling code when checkpointing CRIU events while concurrent event create or destroy operations occur. A local user can trigger concurrent event insertion or removal to cause a denial of service or execute arbitrary code.

Exploitation requires a second thread in the same process to race event creation or destruction with the checkpoint operation.

194) Out-of-bounds read (CVE-ID: CVE-2026-74444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in vmw_cmd_draw() when processing a user-supplied command stream containing an undersized DRAW_PRIMITIVES header. A local user can supply a crafted command stream to disclose sensitive information.

The issue is triggered when header->size is smaller than the command body size, causing an unsigned subtraction to wrap and a subsequent bounds check to be bypassed.

195) Out-of-bounds write (CVE-ID: CVE-2026-74443)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify authenticated command fields.

The vulnerability exists due to an out-of-bounds write in vmw_cmd_dma() in the vmwgfx command verifier when processing a dma command with an undersized header body size. A local user can submit a specially crafted command to modify authenticated command fields.

The issue arises from a suffix pointer underflow that can clobber fields in a previously relocated command in the device-visible command stream.

196) Use of insufficiently random values (CVE-ID: CVE-2026-74438)

CWE-ID: CWE-330 - Use of Insufficiently Random Values

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to obtain insufficiently random data.

The vulnerability exists due to improper implementation in sun4i_ss_prng_generate() in the sun4i_ss_prng rng implementation when generating random bytes through the AF_ALG "rng" algorithm interface. A local user can request random output to obtain insufficiently random data.

The function rounds the destination length down and does not wait for the hardware to be ready before reading bytes.

197) Stack-based buffer overflow (CVE-ID: CVE-2026-74438)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in sun4i_ss_prng_seed() in the sun4i_ss_prng rng implementation when processing a seed supplied through the AF_ALG "rng" algorithm interface. A local user can supply an oversized seed to trigger memory corruption and execute arbitrary code or cause a denial of service.

The vulnerable code path is described as only theoretically usable via the "rng" algorithm type of AF_ALG.

198) Improper resource shutdown or release (CVE-ID: CVE-2026-74397)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in mlx5_ib_alloc_transport_domain() when handling transport-domain allocation failures during loopback enablement. A local user can trigger an error path that leaks a transport domain to cause a denial of service.

The issue affects the IB/mlx5 driver in the Linux kernel.

199) Out-of-bounds write (CVE-ID: CVE-2026-74390)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to out-of-bounds write in irdma_copy_user_pgaddrs when processing user-supplied RDMA memory registration data with lvl set to 0. A local user can provide a umem with more DMA blocks than the supplied page count to cause a denial of service or execute arbitrary code.

The issue affects the lvl==0 case that uses the fixed-size iwmr->pgaddrmem array for QP, CQ, and SRQ rings.

200) Use-after-free (CVE-ID: CVE-2026-74388)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ALSA OSS sequencer event handling logic when processing SysEx data embedded in MIDI events and dispatching a pending event after a sequencer port is closed concurrently. A local user can send crafted MIDI bytes that produce a pending SysEx event with a stale pointer to cause a denial of service.

The issue occurs during concurrent port closure before deferred event dispatch.

201) Use-after-free (CVE-ID: CVE-2026-74387)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the ALSA sequencer MIDI output handling in sound/core/seq/seq_midi.c when processing MIDI sequencer events during concurrent output teardown. A local user can trigger concurrent event processing and output teardown to cause a denial of service or execute arbitrary code.

The issue occurs because the event_input path can keep using a stale substream or runtime after the last unuse path releases the rawmidi file.

202) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74385)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper exception handling in nvmet_tcp_tls_handshake_done when completing a TCP/TLS handshake. A remote attacker can trigger a failure in nvmet_tcp_set_queue_sock to cause a denial of service.

The issue can occur if the socket is not in TCP_ESTABLISHED state, leading to queue and socket leakage.

203) Incorrect Check of Function Return Value (CVE-ID: CVE-2026-74380)

CWE-ID: CWE-253 - Incorrect Check of Function Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error return values in pin_job() in the host1x GPU driver when mapping scatter-gather tables through the IOMMU. A local user can trigger the affected code path to cause a denial of service.

The issue involves assigning the iommu_map_sgtable() result to an incorrect integer type, which can turn error conditions into negative overflowed values.

204) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74378)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a heap-based buffer overflow.

The vulnerability exists due to a time-of-check time-of-use race in get_srq_wqe() when copying a work queue element from a shared receive queue buffer mapped into userspace. A local user can modify num_sge between validation and size calculation to cause a heap-based buffer overflow.

The issue arises because the num_sge field is read twice from shared userspace-accessible memory.

205) Out-of-bounds read (CVE-ID: CVE-2026-74377)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in rxe_resp_check_length() and copy_data() when processing a receive WQE from a shared queue buffer mapped into userspace. A local user can modify WQE fields such as num_sge or sge entries during processing to cause an out-of-bounds read.

The issue affects the non-SRQ queue pair receive path.

206) Deadlock (CVE-ID: CVE-2026-74375)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in md_handle_request() and the raid1/raid10 read error recovery path when resubmitting a split md cloned bio while the array is suspended. A local user can trigger read error recovery to cause a denial of service.

The issue occurs because an md cloned bio already holds an active_io reference before another reference is attempted.

207) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74374)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state handling in the md/raid1 and md/raid10 read request paths when processing split and resubmitted failed bios in the error path. A local user can trigger I/O that causes failed bios to be split and resubmitted to cause a denial of service.

The issue can lead to incorrect memory allocation flags being used under memory pressure, which may result in a deadlock.

208) Race condition (CVE-ID: CVE-2026-74365)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause silent data corruption.

The vulnerability exists due to a race condition in BTT lane acquisition in the Linux kernel nvdimm BTT subsystem when handling BTT I/O. A local user can trigger concurrent use of the same lane to cause silent data corruption.

The issue occurs because BTT lanes became preemptible while the recursion model still relied on a per-CPU recursion count, allowing another task on the same CPU to bypass locking and use the same lane concurrently.

209) Use-after-free (CVE-ID: CVE-2026-74363)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bpffs inode handling when a concurrent unlinkat() drops the last inode reference during RCU path walking. A local user can trigger concurrent path operations to cause a denial of service.

The issue occurs because inode fields and the cached symlink body may still be accessed during RCU pathwalk after the inode is freed.

210) Use-after-free (CVE-ID: CVE-2026-74359)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in configfs_lookup() when handling subsequent getdents(2) operations in a directory after inode allocation failure. A local user can trigger inode allocation failure and then access the affected directory to cause a denial of service.

The issue occurs because a dangling pointer remains in the configfs_dirent structure and is later dereferenced to obtain an inode number.

211) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74356)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in vhost_get_avail_idx in the vhost subsystem when handling available ring entries with mergeable buffers enabled. A local user can trigger repeated processing of available entries to cause a denial of service.

The issue can lead to a host livelock when the guest is not making progress and notifications are re-enabled while entries remain in the ring.

212) Integer underflow (CVE-ID: CVE-2026-74349)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unintended block trimming beyond the requested range.

The vulnerability exists due to an integer underflow in ocfs2_trim_mainbm() when processing a FITRIM range shorter than a cluster. A local user can submit a specially crafted FITRIM range to cause unintended block trimming beyond the requested range.

The issue occurs on filesystems where the cluster size is larger than the block size.

213) Use-after-free (CVE-ID: CVE-2026-74347)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the netfilter conntrack timeout policy handling when removing a timeout policy while conntrack entries or queued packets still reference it. A local privileged user can delete a referenced timeout policy to cause a denial of service.

Exploitation requires the ability to manage conntrack timeout policies in netfilter.

214) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74344)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in bpf_rb_root_free() and bpf rbtree node handling when removing a surviving node from a later reused rbtree root allocation. A local user can trigger reuse of a stale bpf rbtree node with retained owner and linkage state to cause a denial of service.

The issue arises when a refcounted object survives being dropped and its rb node retains stale tree linkage and an owner pointer to a freed root.

215) Heap-based buffer overflow (CVE-ID: CVE-2026-74341)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the wcn36xx HAL response dispatcher when processing an oversized firmware HAL response. A local user can provide a firmware response with an excessive length to cause a denial of service.

The copied data is firmware-controlled content written into a 4096-byte buffer.

216) Out-of-bounds read (CVE-ID: CVE-2026-74340)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the wcn36xx_smd_print_reg_info_ind function when processing a firmware PRINT_REG_INFO indication. A remote attacker can provide a firmware-controlled count value that exceeds the actual message data to disclose sensitive information.

The issue occurs because the count field is used as a loop bound for indexing a flexible regs[] array without validation against the received message length.

217) Improper input validation (CVE-ID: CVE-2026-74338)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the BPF verifier for BPF_LSM_CGROUP program loading when loading a sleepable BPF_LSM_CGROUP program through the bpf(2) interface. A local user can load a specially crafted sleepable BPF program to cause a denial of service.

The issue can be triggered by bypassing libbpf and using bpf(2) directly.

218) Race condition (CVE-ID: CVE-2026-74334)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the RDMA nldev resource tracking code when accessing memory region protection domain data during memory region re-registration. A local user can trigger concurrent memory region re-registration and netlink resource access to cause a denial of service.

The issue involves user memory regions whose protection domain pointer can change during in-place re-registration.

219) Race condition (CVE-ID: CVE-2026-74330)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in configfs directory entry child traversal when traversing s_children lists while concurrent cursor movement or freeing can occur. A local user can trigger concurrent configfs operations to cause a denial of service.

The issue affects configfs directory handling in fs/configfs/dir.c.

220) NULL pointer dereference (CVE-ID: CVE-2026-74321)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an invalid pointer dereference in __btrfs_run_delayed_refs() when processing delayed references. A local user can trigger the vulnerable code path to cause a denial of service.

221) Out-of-bounds write (CVE-ID: CVE-2026-74317)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a slab out-of-bounds write in __netif_set_xps_queue in the ixgbe driver when loading an XDP program that configures XDP transmit queues. A local user can load an XDP program to trigger the out-of-bounds write and cause a denial of service.

The issue occurs on E610 adapters on systems with 64 or more CPUs when the last XDP queue is configured.

222) Improper locking (CVE-ID: CVE-2026-74314)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to unsafe cleanup of special fields in BPF map values in array and hash map update and delete paths when recycling or replacing map values from BPF execution contexts such as NMI context. A local user can trigger map update or delete operations involving special fields to cause a denial of service.

The issue affects tracing programs because referenced kptr destructors, uptr unpinning, and graph root destruction are not generally safe in NMI context.

223) Use-after-free (CVE-ID: CVE-2026-74313)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in vduse_dev_open() when opening a VDUSE device while a concurrent VDUSE_DESTROY_DEV operation removes the same device from the IDR. A local user can trigger concurrent operations on the same device to cause a denial of service.

224) Out-of-bounds read (CVE-ID: CVE-2026-74312)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds access in vhost_vdpa_mmap() and vhost_vdpa_fault() when processing a virtqueue index from vm_pgoff. A local user can provide an out-of-range queue index to trigger driver-specific get_vq_notification() callbacks and cause a denial of service.

The issue may lead to invalid PFN remaps in the callback path.

225) Out-of-bounds read (CVE-ID: CVE-2026-74300)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in hci_read_codec_capabilities() when parsing a malformed controller response containing truncated codec capability elements. A remote attacker can send a specially crafted controller response to disclose sensitive information.

The issue occurs because the parser validates only the payload length and can record a two-byte capability after receiving only one payload byte.

226) Integer overflow (CVE-ID: CVE-2026-74297)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in set_rq_size() in the RDMA/mlx5 queue pair handling code when processing a user-provided rq_wqe_shift value. A local user can supply a crafted shift value to trigger undefined behavior and cause a denial of service.

227) Improper resource shutdown or release (CVE-ID: CVE-2026-74296)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the RDMA/mlx5 UAR deallocation logic when releasing a user access region index. A local user can trigger UAR allocation and release operations to cause a denial of service.

228) Out-of-bounds read (CVE-ID: CVE-2026-74295)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the hdac_hdmi_set_pin_port_mux() function when handling a written enumerated control value. A local user can supply an out-of-range enum value to disclose sensitive information.

229) Improper input validation (CVE-ID: CVE-2026-74294)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the AIU HDMI and internal codec mux put callbacks when processing written enumerated control values. A local user can supply an out-of-range enum value to cause a denial of service.

230) Improper input validation (CVE-ID: CVE-2026-74293)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src() in the fsl_audmix ASoC driver when handling user-provided enum control values. A local user can supply an out-of-range enum item to cause a denial of service.

The invalid value is converted before bounds checking, and the affected code paths use the converted value in a BIT() test and as an index into a transition table.

231) Out-of-bounds read (CVE-ID: CVE-2026-74292)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tegra_ahub_put_value_enum() in the tegra210 AHUB ASoC driver when processing a written enumerated control value. A local user can supply an out-of-range enum item value to disclose sensitive information.

232) Use-after-free (CVE-ID: CVE-2026-74289)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib_leaf_notify() and fib_info reference handling when dumping IPv4 fib_info entries under RCU during fib notifier processing. A local user can trigger network namespace cleanup or device reload operations that invoke affected fib notifier paths to cause a denial of service.

The issue was reported through the netdevsim notifier path, and IPv6 is not affected by the same condition.

233) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-74288)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in fib_rules_dump() when dumping fib_rule entries during an RCU dump. A local user can trigger fib_rule processing involving a dying fib_rule to cause a denial of service.

234) Improper access control (CVE-ID: CVE-2026-74283)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify TIPC state.

The vulnerability exists due to improper access control in TIPCv2 generic-netlink mutator operations when handling netlink administrative commands. A local user can invoke mutating netlink operations to modify TIPC state.

The issue affects commands that can change the network id and node identity, set or flush key material, and enable or disable a UDP bearer.

235) Integer underflow (CVE-ID: CVE-2026-74282)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow in tipc_sk_conn_proto_rcv() when processing a CONN_MANAGER/CONN_ACK message. A remote attacker can send a specially crafted connection acknowledgment with an oversized ack count to cause a denial of service.

For a local connection, the connected peer socket can trigger the issue.

236) Improper input validation (CVE-ID: CVE-2026-74281)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in tipc_update_nametbl() when processing peer-advertised PUBLICATION items. A remote attacker can send specially crafted bindings with inverted service ranges to cause a denial of service.

The issue causes unbounded binding-table memory to be leaked for the lifetime of the namespace.

237) Improper access control (CVE-ID: CVE-2026-74270)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to spoof handshake completion or disrupt an in-flight handshake.

The vulnerability exists due to improper access control in handshake_nl_done_doit() and the handshake genl DONE command when submitting a DONE request for a supplied sockfd without sender authentication. A local user can send a forged DONE message with a chosen status value to spoof handshake success or tear down a legitimate handshake.

The issue affects the DONE downcall of the handshake generic netlink family, where fd lookup confirms only that a pending handshake request exists for the supplied sockfd.

238) Race condition (CVE-ID: CVE-2026-74262)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in kcm_attach() and kcm_unattach() callback handling in net/kcm/kcmsock.c when changing lower socket callbacks concurrently. A local user can trigger concurrent callback updates and execution to cause a denial of service.

The issue can lead to stale or misdirected wakeups when callback and sk_user_data state become mismatched across CPUs.

239) Improper input validation (CVE-ID: CVE-2026-74258)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in bpf_uprobe_multi_link_attach in kernel/trace/bpf_trace.c when processing user-supplied uprobe_multi array pointers. A local user can supply crafted user-space pointers to trigger a kernel fault and cause a denial of service.

The issue involves missing bounds validation with access_ok before __get_user accesses user-space data.

240) Use-after-free (CVE-ID: CVE-2026-74257)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in udp_bpf_recvmsg() when processing concurrent recvmsg operations on BPF-enabled UDP sockets. A local user can trigger concurrent socket receive operations to cause a denial of service.

The issue arises because sk_msg_recvmsg() accesses an ingress message under a lock but processes it without serialization, allowing multiple threads to touch the same sk_msg.

241) Integer overflow (CVE-ID: CVE-2026-74256)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in bpf_msg_pop_data() in the sockmap BPF message handling code when processing crafted start and len values. A local user can supply out-of-range values to trigger an out-of-bounds pop operation and cause a denial of service.

Exploitation can cause the pop loop to run past the end of the scatterlist and reach an invalid put_page() on an empty slot.

242) NULL pointer dereference (CVE-ID: CVE-2026-72502)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in skb_segment() when processing a local TCP packet with gso_size set to 0xFFFF. A local attacker can trigger a large MTU condition that causes the MSS clamp to reach 65535 to cause a denial of service.

The issue occurs because the 0xFFFF MSS value collides with the GSO_BY_FRAGS magic value, and local TCP packets do not use frag_list.

243) Use-after-free (CVE-ID: CVE-2026-72492)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in same_client_has_lease() and smb_grant_oplock() when handling lease state for existing client oplocks during concurrent close operations. A remote user can trigger a concurrent close condition to cause a denial of service.

The issue occurs because a pointer selected from ci->m_op_list can be used after the last reference is dropped before it is dereferenced.

244) NULL pointer dereference (CVE-ID: CVE-2026-72485)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of allocation failure in coresight platform connection management functions when processing device probe data. A local user can trigger memory allocation failure during probe cleanup to cause a denial of service.

The issue occurs because cleanup code iterates connection entries up to inconsistent counter values and dereferences NULL or uninitialized pointers, leading to a kernel panic.

245) Integer overflow (CVE-ID: CVE-2026-72483)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to a shift-out-of-bounds error in max3421_hub_control() when handling a USBDEVFS_CONTROL ioctl for the root hub with a crafted wValue parameter. A local user can send a specially crafted ioctl request to corrupt kernel memory.

Exploitation requires access to the root hub device via /dev/bus/usb/.../001.

246) Out-of-bounds read (CVE-ID: CVE-2026-72480)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ams_event_to_channel() and ams_handle_event() when handling device events. A local attacker can trigger an event with a non-matching scan index to cause a denial of service.

247) Out-of-bounds read (CVE-ID: CVE-2026-72478)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in run_get_highest_vcn() when mounting an NTFS filesystem containing a crafted $LogFile UpdateMappingPairs record with unterminated mapping-pairs data. A remote attacker can provide a specially crafted filesystem image to cause a denial of service.

The issue is triggered during log replay on mount.

248) Use-after-free (CVE-ID: CVE-2026-72476)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in dma_release_channel() when releasing a dma channel. A local user can trigger the release of a channel whose device reference may already be freed to cause a denial of service.

249) Heap-based buffer overflow (CVE-ID: CVE-2026-72470)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the ntfs3 log replay scratch buffer handling in log_replay() and read_log_page() when mounting a dirty NTFS volume with an on-disk log page size larger than the initially allocated buffer. A local user can mount a specially crafted NTFS volume to cause a denial of service or execute arbitrary code.

Exploitation requires a dirty NTFS volume whose log records a larger page size than the mounting host initially allocated.

250) Use-after-free (CVE-ID: CVE-2026-72469)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in rpcrdma_cm_event_handler() and RDMA connection teardown handling in the xprtrdma component when processing an RDMA_CM_EVENT_ADDR_CHANGE event before RDMA_CM_EVENT_ESTABLISHED. A local user can trigger crafted RDMA connection state changes to cause a denial of service.

The issue occurs because an unmatched reference decrement can underflow the kref and leave disconnect handling operating on a freed endpoint.

251) Resource exhaustion (CVE-ID: CVE-2026-72464)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in rpcrdma_reply_handler() when processing malformed RPC/RDMA replies. A remote attacker can send a sustained stream of short replies or replies with an unrecognized RPC/RDMA version to cause a denial of service.

The issue can drain the client's posted Receive queue and stall the transport until reconnect.

252) NULL pointer dereference (CVE-ID: CVE-2026-72460)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in aa_change_profile() when building a replacement label during a profile change. A local user can trigger label build failure handling to cause a denial of service.

The issue occurs in the AppArmor profile transition logic during processing of profile change requests.

253) Improper resource shutdown or release (CVE-ID: CVE-2026-72459)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in aa_label_alloc() in the AppArmor label handling code when allocating a label and the proxy allocation step fails. A local user can trigger an allocation failure condition to cause a denial of service.

254) Out-of-bounds read (CVE-ID: CVE-2026-72450)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds shift in xfrm_selector_match and address matching helpers when processing xfrm selector matching with an AF_UNSPEC selector and an oversized prefix length. A local attacker can provide a crafted selector with a mismatched family or excessive prefix length to cause a denial of service.

The issue can be triggered when an AF_UNSPEC selector is matched against an IPv4 flow while XFRM_STATE_AF_UNSPEC is set.

255) Double free (CVE-ID: CVE-2026-72449)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in kfd_criu_resume_svm() when handling a second AMDKFD_IOC_CRIU_OP request from the same process via /dev/kfd. A local user can trigger repeated cleanup of freed list entries to cause a denial of service.

The issue is reachable by an unprivileged render-group user and is caused by stale list entries left in the criu_svm_metadata_list after cleanup.

256) Out-of-bounds read (CVE-ID: CVE-2026-72444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized memory contents.

The vulnerability exists due to an out-of-bounds read in __skb_flow_dissect() when processing packets on non-ethernet devices with flow dissector ethernet address matching enabled. A local user can send a crafted packet through AF_PACKET to disclose uninitialized memory contents.

Exploitation requires a TUN device in L3 mode together with a multiq qdisc and a flower filter matching on eth_src.

257) Improper resource shutdown or release (CVE-ID: CVE-2026-72440)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the raid1 write request handling in drivers/md/raid1.c when processing write requests that fail before being successfully queued. A local user can trigger write failure paths to cause a denial of service.

The issue involves leaked writes_pending and barrier references on error paths.

258) Improper resource shutdown or release (CVE-ID: CVE-2026-72438)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in raid10_handle_discard() in drivers/md/raid10.c when handling discard requests and discard split allocation failures. A local user can trigger discard failure paths to cause a denial of service.

The issue is caused by missing releases of writes_pending and barrier references on certain error paths.

259) Use-after-free (CVE-ID: CVE-2026-72435)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ipset comment extension handling in netfilter when freeing comment extension pointers. A local user can trigger ipset comment initialization or cleanup operations to cause a denial of service.

260) Use-after-free (CVE-ID: CVE-2026-72427)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the cgroup BPF effective program array handling in kernel/bpf/cgroup.c when updating or detaching BPF programs with BPF_F_PREORDER configurations. A local user can trigger incorrect effective array slot selection to cause a denial of service.

The issue occurs because preorder programs are placed at the front of the effective array, so linear traversal of the program list can select the wrong slot.

261) Improper resource shutdown or release (CVE-ID: CVE-2026-72425)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ice_reset_all_vfs() when resetting virtual functions with FDIR filters enabled. A local user can trigger a VF reset after enabling an FDIR filter to cause a denial of service.

The issue occurs because CTRL VSI objects are invalidated but not freed for affected virtual functions.

262) Out-of-bounds write (CVE-ID: CVE-2026-72423)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in conntrack lookup and allocation bpf kfunc wrappers in net/netfilter/nf_conntrack_bpf.c when handling an opts pointer with an invalid size smaller than the end of opts->error. A local user can supply a crafted opts pointer and opts__sz value to cause memory corruption.

Exploitation requires invoking the affected bpf conntrack lookup or allocation helpers with an invalid opts size.

263) Race condition (CVE-ID: CVE-2026-72420)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a data race in break_stripe_batch_list() and raid5_make_request() in the md/raid5 subsystem when handling overlapping stripe I/O requests. A local user can submit crafted I/O that triggers the R5_Overlap flag race to cause a denial of service.

The issue can leave a task waiting on a bit indefinitely.

264) Out-of-bounds read (CVE-ID: CVE-2026-72419)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in nf_nat_register_fn in the netfilter nf_nat subsystem when handling netfilter netlink requests after nf_nat_init() has failed. A local privileged user can send a specially crafted netfilter request to cause a denial of service.

The issue can occur when nf_nat_core is built in and initialization has failed, leaving an invalid nat_net pointer state for dependent modules.

265) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72418)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state handling in nf_conncount when processing early-confirmed connection tracking entries for reused TIME_WAIT sockets or similar setup packets. A remote attacker can initiate network connections that trigger miscounting to cause a denial of service.

The issue can cause valid new connections to be falsely rejected in connlimit soft-limiting scenarios.

266) Improper input validation (CVE-ID: CVE-2026-72416)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in nft_compat ebtables target validation when handling bridge table targets. A local user can use a non-bridge target in the ebtables emulation path to cause a denial of service.

267) Improper input validation (CVE-ID: CVE-2026-72410)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify NIX maximum logical function settings in an invalid state.

The vulnerability exists due to improper input validation in the devlink NIX maximum LF validation logic in rvu_devlink.c when handling devlink commands before or during NIX LF assignment. A local privileged user can issue a devlink command to modify NIX maximum LF settings in an invalid state.

The issue affects the octeontx2-af driver logic that is intended to permit resizing only before any LF attach requests from PFs and VFs and not later or concurrently.

268) Improper locking (CVE-ID: CVE-2026-72409)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the mvneta resume path when resuming the system while NAPI poll is pending after a per-CPU interrupt has been disabled. A local user can trigger a suspend and resume sequence during this condition to cause a denial of service.

This affects Marvell MPIC platforms using the mvneta driver, where the per-CPU interrupt can remain masked after resume and result in complete loss of network connectivity.

269) Double free (CVE-ID: CVE-2026-72406)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in gem_init_one() in the sungem network driver when handling a failed register_netdev() call during device probe. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs in the probe error cleanup path for a half-registered device.

270) Use-after-free (CVE-ID: CVE-2026-72405)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in udp_tunnel_nic_device_sync_work() when handling concurrent device operations. A local user can trigger concurrent device operations to cause a denial of service.

The issue arises because a second work item can remain queued while the associated structure is freed.

271) Use-after-free (CVE-ID: CVE-2026-72404)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the TIPC UDP media bearer cleanup logic in net/tipc/udp_media.c when tearing down a bearer while concurrent transmit or receive operations are still accessing cached destinations or bearer state under RCU protection. A local attacker can trigger concurrent TIPC UDP activity during bearer cleanup to cause a denial of service.

The issue can affect concurrent transmitters through replicast destination cache access and concurrent receivers through access to the bearer structure after teardown begins.

272) Out-of-bounds read (CVE-ID: CVE-2026-72400)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in seg6_validate_srh() when processing a BPF program-supplied Segment Routing Header length in the SEG6 encapsulation path. A local user can supply a crafted short SEG6 encapsulation header to disclose sensitive information.

Exploitation is reachable through the BPF SEG6 encap path, including the SEG6 local BPF END_B6 and END_B6_ENCAP actions.

273) Improper input validation (CVE-ID: CVE-2026-72397)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to send incorrect voltage commands to a PMBus device.

The vulnerability exists due to improper input validation in pmbus_data2reg_vid() in the pmbus core when converting user-supplied voltage values for PMBUS_VOUT_COMMAND. A local user can request a voltage using a non-VR11 VID mode to send incorrect voltage commands to a PMBus device.

Only drivers that select a non-VR11 VID mode and expose a regulator or hwmon vout setter are affected.

274) Use-after-free (CVE-ID: CVE-2026-72390)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the sch_teql qdisc implementation when processing concurrent modifications to the teql master slaves list during packet transmission and qdisc teardown. A local user can trigger concurrent qdisc operations to cause a denial of service.

The issue arises from a race condition across CPUs involving stale pointers retained during list traversal.

275) Use-after-free (CVE-ID: CVE-2026-72389)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the STP timer handling in the Linux kernel bridge subsystem when deleting a bridge while the topology change timer is armed on an administratively down bridge. A local user can trigger bridge topology change detection and delete the bridge to cause a denial of service.

The issue occurs because the IFF_UP check was missing in br_topology_change_detection().

276) Integer underflow (CVE-ID: CVE-2026-72382)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow in parse_dacl() in fs/smb/server/smbacl.c when processing a crafted security descriptor in SMB2_SET_INFO security information requests. A remote attacker can send a specially crafted request to cause a denial of service.

The issue can bypass the ACE count guard for undersized DACLs and trigger large temporary ACL state and pointer-array allocations.

277) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72378)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in afs_extract_vl_addrs() when parsing AFS volume location address data. A local user can trigger processing of malformed address data to cause a denial of service.

278) Improper Initialization (CVE-ID: CVE-2026-72375)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in afs_vnode lock_work handling when processing file locking operations on AFS inodes. A local user can trigger lock operations on a reused inode to cause a denial of service.

The issue can lead to kernel warnings from debug object handling, and the affected work item may still be running during inode eviction.

279) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72374)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of incomplete message parsing state in afs callback service message parsers when processing callback notification request streams. A remote attacker can send crafted callback messages with incomplete packet sequences to cause a denial of service.

The issue affects the AFS filesystem client callback service that listens through an rxrpc server for callback notifications.

280) NULL pointer dereference (CVE-ID: CVE-2026-72373)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing null pointer check in afs_break_some_callbacks() when handling callback breaks for an unknown AFS volume. A local user can trigger callback processing referencing an unknown volume to cause a denial of service.

281) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72371)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in afs_insert_volume_into_cell() when replacing an AFS volume entry in the cell volume tree. A local user can trigger volume replacement operations to cause a denial of service.

The issue can cause the old volume to be removed from the tree twice while the new volume is never removed.

282) Integer overflow (CVE-ID: CVE-2026-72369)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an integer overflow in minix_blocks_needed() in the Minix filesystem superblock handling when mounting a crafted Minix v3 filesystem image. An attacker with physical access can provide a crafted filesystem image with inode or zone counts near UINT_MAX to trigger a kernel panic.

The issue occurs because a zero bitmap block count can be accepted as valid, leading minix_fill_super() to dereference s_imap[0] or s_zmap[0] without allocated bitmap buffers.

283) Integer overflow (CVE-ID: CVE-2026-72352)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in hid_bpf_get_data() in the HID-BPF subsystem when validating a caller-provided offset and size. A local user can supply a crafted offset and size combination to cause a denial of service.

Exploitation requires the ability to invoke the HID-BPF helper.

284) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-72350)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds shift operation in u32_match_it() in the xt_u32 netfilter match when evaluating a malformed u32 rule during packet processing. A local user can supply a crafted u32 rule with a shift count of 32 or more to cause a denial of service.

285) Improper input validation (CVE-ID: CVE-2026-72347)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the xt_connmark CONNMARK target revision 2 handling when evaluating a rule with invalid shift parameters. A local user can install a malformed rule with a shift_bits value of 32 or more or an invalid shift_dir value to cause a denial of service.

The issue is triggered when the malformed rule is evaluated in the packet path.

286) Out-of-bounds write (CVE-ID: CVE-2026-72343)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in mlx5e_hv_vhca_stats_work() and mlx5e_hv_vhca_stats_create() when handling hypervisor VHCA statistics after channel initialization. A local user can trigger stats handling with an incorrectly sized buffer to cause a denial of service.

The issue can result from a zero-sized allocation that leaves the buffer pointer set to ZERO_SIZE_PTR, and may also occur across a detach and resume cycle when buffer sizing becomes smaller than the persisted channel count.

287) Race condition (CVE-ID: CVE-2026-72342)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mlx5 hv vhca stats agent registration and workqueue handling when processing asynchronous control invalidation callbacks during agent creation. A local user can trigger the vulnerable control path to cause a denial of service.

The issue can lead to a NULL function pointer invocation, timer list corruption, or a NULL pointer dereference.

288) Race condition (CVE-ID: CVE-2026-72340)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt hardware rule entries.

The vulnerability exists due to a race condition in the microchip vcap api and debugfs rule dump handling when accessing shared Super VCAP instances concurrently. A local user can trigger concurrent rule dump and rule write operations to corrupt hardware rule entries.

The issue affects sparx5 and lan969x devices where IS0 and IS2 instances share the same Super VCAP hardware block, cache, and command registers.

289) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-72338)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to perform an out-of-bounds heap write.

The vulnerability exists due to a time-of-check time-of-use race condition leading to an out-of-bounds write in the act_pedit tc offload handling when sizing and filling a flow_rule buffer during cls_flower offload processing. A local privileged user can trigger concurrent action and classifier operations to perform an out-of-bounds heap write.

The written data is attacker-controlled and can corrupt an adjacent slab object.

290) Use-after-free (CVE-ID: CVE-2026-72335)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mgmt_add_adv_patterns_monitor_complete in the Bluetooth management subsystem when handling advertisement monitor add completion after a failed MSFT offload add operation. A local user can send a crafted Bluetooth management request to trigger the use of freed memory and cause a denial of service.

The issue occurs in the queued management add flow after a monitor is inserted before the powered MSFT setup step, and it was reproduced by KASAN as a slab-use-after-free.

291) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72334)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of malformed packet sequences in the Bluetooth ISO packet reassembly logic in net/bluetooth/iso.c when processing malformed ISO_START, ISO_CONT, and ISO_END frames from a Bluetooth controller. A remote attacker can send a specially crafted sequence of malformed Bluetooth ISO frames to cause a denial of service.

The issue can lead to a kernel panic when an oversized ISO_END frame is processed, and malformed fragment sequences can also leave an unfinished receive buffer allocated.

292) Improper handling of exceptional conditions (CVE-ID: CVE-2026-72330)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of zero-length TLS application_data records in tls_sw_read_sock() when processing a specially crafted TLS record. A remote attacker can send a zero-length TLS application_data record to cause a denial of service.

Only the read_sock() path is affected.

293) Improper handling of exceptional conditions (CVE-ID: CVE-2026-72314)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in regulator_lock_two() when handling lock contention between two regulators. A local user can trigger lock contention to cause a denial of service.

This issue is exploitable in practice on MIPS systems.

294) Improper access control (CVE-ID: CVE-2026-72312)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disable the PF promiscuous and all-multicast receive rules.

The vulnerability exists due to improper access control in the nix_set_rx_mode mailbox handler when processing a VF interface request with promiscuous and all_multi flags set to false. A local user can bring up or tear down a VF interface to disable the PF promiscuous and all-multicast receive rules.

The issue occurs because the rule enable and disable APIs operate on the PF even when the mailbox request is issued through a VF interface.

295) Integer overflow (CVE-ID: CVE-2026-72310)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer overflow in smb2_ioctl_query_info() when validating a PASSTHRU_FSCTL response payload from a malicious server. A remote attacker can send a specially crafted server response to disclose sensitive information.

The out-of-bounds read occurs during a later copy_to_user() operation after a wrapped offset-plus-length check passes.

296) Improper input validation (CVE-ID: CVE-2026-72304)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in sof_ipc4_bytes_put when processing user-supplied control data. A local user can provide crafted control data with a mismatched size field to cause a denial of service.

The copy length is derived from the previously stored buffer header rather than the incoming header, which can result in truncated data or stale bytes being copied.

297) Integer overflow (CVE-ID: CVE-2026-72302)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds access.

The vulnerability exists due to integer overflow in sof_ipc3_control_update() in sound/soc/sof/ipc3-control.c when processing firmware-provided control data. A local user can provide a crafted num_elems value to trigger size miscalculation and cause an out-of-bounds access.

The issue occurs on 32-bit platforms where the size calculation can wrap to a smaller value, allowing a mismatched size check to pass before snd_sof_update_control is reached.

298) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-72301)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use flaw in sof_ipc3_bytes_put() when copying user-supplied control data. A local user can provide crafted control data with a different size than the previously stored buffer contents to cause a denial of service.

The copied length is derived from the old buffered size rather than the incoming size field.

299) Out-of-bounds read (CVE-ID: CVE-2026-72301)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in sof_ipc3_bytes_get() when handling crafted control data. A local user can provide crafted control data with an invalid size value to disclose sensitive information.

300) Integer overflow (CVE-ID: CVE-2026-72298)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow leading to out-of-bounds write in qrtr_endpoint_post() when processing a crafted incoming qrtr packet. A remote attacker can send a specially crafted packet to cause a denial of service.

Only 32-bit systems are affected; 64-bit systems are unaffected.

301) Out-of-bounds read (CVE-ID: CVE-2026-72297)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in pvc_info() when reading /proc/net/atm/pvc after storing a crafted QoS traffic_class value. A local user can supply out-of-range QoS parameters to trigger an out-of-bounds read and disclose sensitive information.

The issue is caused by invalid traffic_class values being accepted into vcc->qos during QoS validation.

302) Improper Initialization (CVE-ID: CVE-2026-72284)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the KVM x86 LAPIC PV EOI handling logic when processing PV EOI state synchronization for a vCPU after PV EOIs have been disabled. A local user can trigger this condition to cause a denial of service.

The issue results in a kernel BUG and invalid opcode exception in the KVM subsystem.

303) Use-after-free (CVE-ID: CVE-2026-72282)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in kvm_io_bus_get_dev() and vgic_msi_to_its() when processing KVM MMIO bus device lookups for MSI addresses. A local user can trigger access to a matched device after the srcu lock has been dropped to cause a denial of service.

The issue occurs when the returned device matches only by address and is not the expected device type.

304) Heap-based buffer overflow (CVE-ID: CVE-2026-72262)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to a heap-based buffer overflow and out-of-bounds read in the SOF IPC3 bytes control handling in sound/soc/sof/ipc3-control.c when processing data through the ALSA TLV kcontrol interface. A local user can send specially crafted control data to cause a denial of service or disclose sensitive information.

The issue affects the bytes_ext put and get paths, including an error-path restore operation that can write past the end of the allocated buffer.

305) Out-of-bounds write (CVE-ID: CVE-2026-72261)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in snd_sof_update_control when processing firmware-provided control data. A local user can provide inconsistent control data values to cause a denial of service.

The issue occurs because num_elems was validated against a stored size field but not against the actual ipc_control_data allocation size before memcpy.

306) NULL pointer dereference (CVE-ID: CVE-2026-72254)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the nft_fib netdev egress hook handling when evaluating a fib expression in a netdev egress base chain. A local user can create a crafted nftables rule using a fib expression on the netdev egress hook to cause a denial of service.

The issue occurs because netdev hook numbers alias NF_INET_* values, allowing an egress chain to pass validation and then fault on the transmit path when nft_in(pkt) is NULL.

307) NULL pointer dereference (CVE-ID: CVE-2026-72253)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the nf_conntrack_sip SIP helper when processing traffic with sip_external_media enabled in subsystems where routing information is unavailable. A local user can send specially crafted network traffic to cause a denial of service.

The issue affects tc ingress and openvswitch when the sip_external_media module parameter is set to 1.

308) Out-of-bounds write (CVE-ID: CVE-2026-72252)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to out-of-bounds writes in the nft_pipapo_match handling in netfilter nft_set_pipapo when processing set element insertions after a prior memory allocation failure left a cloned match in an invalid state. A local user can trigger an allocation failure and then perform a subsequent insertion in the same batch to cause memory corruption.

The issue can also affect a subsequent transaction because a bad clone may persist when the abort callback is not executed after the initial failure.

309) Incorrect calculation (CVE-ID: CVE-2026-72250)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an unset header offset in nf_ct_frag6_reasm() when processing IPv6 fragments on the NF_INET_LOCAL_OUT defragmentation path. A local user can send a specially crafted fragmented IPv6 packet to cause a denial of service.

The issue occurs because skb->mac_header may still hold the unset sentinel value when no link-layer header is present yet.

310) Improper access control (CVE-ID: CVE-2026-72247)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass connection counting limits.

The vulnerability exists due to improper access control in nf_conncount when processing connection tuples across conntrack zones. A remote attacker can send network traffic that creates connections with matching tuples in different zones to bypass connection counting limits.

The issue affects the tuple dedup logic in __nf_conncount_add(), where original-direction tuples are compared using an incorrect zone direction value.

311) Incorrect calculation (CVE-ID: CVE-2026-72244)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource allocation in the gpu buddy allocator when handling contiguous fallback allocation requests that require min_block_size alignment. A local user can trigger a misaligned allocation attempt to cause a denial of service.

312) Improper access control (CVE-ID: CVE-2026-72243)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass SELinux connect-related permission checks.

The vulnerability exists due to improper access control in the SELinux socket_sendmsg() hook when using TCP Fast Open on TCP or MPTCP stream sockets. A local user can send data with MSG_FASTOPEN to bypass SELinux connect-related permission checks.

313) NULL pointer dereference (CVE-ID: CVE-2026-72242)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in selinux_sctp_bind_connect() when processing SCTP ASCONF operations from the softirq path. A local user can trigger the vulnerable SCTP bind or connect handling to cause a denial of service.

The issue occurs when the hook is invoked from the ASCONF softirq path, where no file reference guarantees that sk->sk_socket is non-NULL.

314) Use-after-free (CVE-ID: CVE-2026-72235)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in batadv_interface_rx() in the batman-adv soft interface code when processing received packets after a potential skb reallocation. A remote attacker can send a specially crafted packet to cause a denial of service.

315) Use-after-free (CVE-ID: CVE-2026-72233)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in batman-adv BLA handling when processing crafted network packets. A local attacker can send a specially crafted packet to cause a denial of service.

316) Out-of-bounds read (CVE-ID: CVE-2026-72232)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in batadv_interface_tx() when processing a truncated packet redirected to a batadv interface through a tc filter. A local user can attach a tc filter that truncates the packet and redirects it to a batadv interface to disclose sensitive information.

Exploitation requires eBPF TC hook access.

317) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72231)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper state management in batadv_send_tt_request() in the batman-adv translation table component when handling translation table requests after send buffer allocation failure. A local attacker can trigger repeated translation table requests to cause a denial of service.

The issue can lead to request storms because information about a pending translation table request is lost after a failed send attempt.

318) Out-of-bounds read (CVE-ID: CVE-2026-72227)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the batman-adv multicast forwarding code when processing a crafted network header containing an undersized batadv_tvlv_mcast_tracker structure. A remote attacker can send a specially crafted packet to disclose sensitive information.

319) Integer underflow (CVE-ID: CVE-2026-72225)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer underflow in jbd2_journal_initialize_fast_commit() when initializing fast commit journal metadata. A local user can trigger journal initialization with crafted journal parameters to cause a denial of service.

The issue can corrupt j_last, j_fc_first, and j_free, leading to journal abort.

320) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72213)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in alloc_hugetlb_folio() when handling hugetlb cgroup reserved and non-reserved charges. A local user can trigger hugetlb folio allocation and later freeing to cause a denial of service.

The issue causes a page_counter underflow because the reserved charge path stores the wrong cgroup pointer in the folio and the reserved uncharge later decrements a counter that was never charged for that cgroup.

321) Out-of-bounds write (CVE-ID: CVE-2026-72197)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in do_action() in fs/ntfs3/fslog.c when processing a crafted NTFS image during mount. An attacker with physical access can provide a specially crafted NTFS image to cause a denial of service.

The issue is triggered in the DeleteIndexEntryAllocation case when an on-disk INDEX_BUFFER entry contains a malformed size value, causing memmove() to use an invalid length. User interaction is required to mount the crafted filesystem image.

322) Out-of-bounds write (CVE-ID: CVE-2026-72196)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in log_replay() in the ntfs3 filesystem log replay code when mounting a malformed NTFS filesystem image. A local user can supply a crafted log record header with inconsistent lcns_follow values to cause a denial of service.

The issue is triggered on the mount path during the analysis pass.

323) Integer underflow (CVE-ID: CVE-2026-72195)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an integer underflow leading to an out-of-bounds read in do_action() UpdateResidentValue handling in fs/ntfs3/fslog.c when processing a crafted on-disk NTFS log record during mount. A local user can supply a crafted filesystem image to trigger an oversized resident attribute data_size and disclose sensitive information.

The issue occurs when attr_off and redo_len from the on-disk log record make aoff + dlen smaller than data_off, causing data_size to wrap to nearly 4 GiB.

324) Out-of-bounds write (CVE-ID: CVE-2026-72181)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to memory corruption in mipsmt_sys_sched_setaffinity when copying a user-supplied CPU mask from user space with CONFIG_CPUMASK_OFFSTACK enabled. A local user can supply a crafted CPU affinity mask to cause memory corruption.

Only systems with CONFIG_CPUMASK_OFFSTACK enabled are vulnerable.

325) Race condition (CVE-ID: CVE-2026-72175)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in make_uffd_wp_huge_pte() in fs/proc/task_mmu.c when handling PAGEMAP_SCAN write-protection of a present HugeTLB PTE. A local user can trigger the race to cause a denial of service.

The issue can cause hardware Dirty or Accessed updates in the live PTE to be lost.

326) Improper Initialization (CVE-ID: CVE-2026-72172)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to uninitialized memory in struct pages for ZONE_DEVICE in mm/mm_init.c when hot-plugging DAX memory into an unoccupied subsection of an early section. A local attacker can hot-plug crafted DAX memory to cause a denial of service.

The issue occurs because the unoptimized boot memmap is reused for early sections while only a reduced number of struct pages are initialized, leaving remaining tail struct pages uninitialized.

327) Incomplete cleanup (CVE-ID: CVE-2026-72171)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cleanup in register_device() in the slram driver when handling device registration failures. A local user can trigger allocation or registration failures to cause a denial of service.

The issue occurs after a partially initialized entry has already been linked into the global device list, and a later cleanup can dereference or free invalid state from that failed entry.

328) Race condition (CVE-ID: CVE-2026-72170)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in v9fs_dec_count in the 9p filesystem inode handling code when processing unlink operations in cacheless mode. A local user can trigger heavy unlink workloads to cause a kernel warning and system instability.

Only systems using the 9p filesystem in cacheless mode are affected.

329) Out-of-bounds read (CVE-ID: CVE-2026-72165)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds access in nand_select_target() when handling an invalid chip-select target index. A local attacker can trigger the vulnerable code path with an out-of-range cs value to cause a denial of service.

330) Improper access control (CVE-ID: CVE-2026-72164)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite file data belonging to another inode.

The vulnerability exists due to improper allocation of occupied clusters in ocfs2_move_extent() and ocfs2_probe_alloc_group() when processing a non-auto OCFS2_IOC_MOVE_EXT operation with a user-supplied physical goal. A local user can supply a crafted occupied goal value to overwrite file data belonging to another inode.

The issue occurs when the supplied goal is at the end of the target block group or when the free-run start is miscalculated.

331) Out-of-bounds read (CVE-ID: CVE-2026-72162)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in ocfs2_sum_rightmost_rec when processing a corrupted inode embedded extent list from disk. A local user can provide a crafted ocfs2 filesystem image with invalid extent list metadata to cause a denial of service.

The issue is triggered when l_next_free_rec is zero or exceeds l_count in the embedded extent list of an inode.

332) Improper input validation (CVE-ID: CVE-2026-72160)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ocfs2_validate_inode_block() and ocfs2_filecheck_validate_inode_block() when processing forged OCFS2 inode metadata. A local user can provide a crafted dinode with non-canonical i_mode type bits to cause a denial of service.

The issue affects the normal read path and the online filecheck read path.

333) Out-of-bounds write (CVE-ID: CVE-2026-72157)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to an out-of-bounds write in tbnet_poll() when processing a multi-frame ThunderboltIP packet with a peer-supplied frame_count that exceeds the fragment array capacity. A remote attacker can send a specially crafted packet with 19 or more small frames to corrupt memory.

The issue occurs because the first frame is placed in the skb linear area while subsequent frames are added as page fragments.

334) Improper input validation (CVE-ID: CVE-2026-72149)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the Tegra GPC DMA driver burst size calculation when processing DMA transfer requests whose lengths are not evenly divisible by the configured maximum burst size. A local user can trigger a DMA transfer with a crafted length to cause a denial of service.

This issue can cause the DMA engine to hang with a partial burst at the end, and it was observed with PL011 UART TX DMA transfers of arbitrary lengths.

335) Race condition (CVE-ID: CVE-2026-72148)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dw_edma_v0_core_start() when concurrently starting DMA channels. A local user can trigger concurrent channel operations to cause a denial of service.

The DONE_INT_MASK and ABORT_INT_MASK registers are shared by all DMA channels, and the issue arises from a non-atomic read-modify-write sequence while updating them.

336) Improper Initialization (CVE-ID: CVE-2026-72146)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in the rz-dmac DMA driver interrupt handling path when registering interrupts before channel and driver state is fully initialized. A local attacker can trigger an interrupt during device initialization to cause a denial of service.

The interrupt handler may access an uninitialized channel base pointer and uninitialized descriptor lists.

337) Improper resource shutdown or release (CVE-ID: CVE-2026-72144)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in dell_init() in the dell-laptop driver when handling initialization errors after resource registration. A local user can trigger an initialization failure path to cause a denial of service.

The issue occurs after rfkill setup when later LED or backlight registration fails, leaving the notifier, debugfs directory, keyboard backlight LED, or optional touchpad LED registered despite initialization failure.

338) Improper access control (CVE-ID: CVE-2026-72136)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify an xfrm interface across network namespace boundaries.

The vulnerability exists due to improper access control in xfrmi_changelink() when handling changelink requests for xfrm interfaces. A local privileged user can send a changelink request from one network namespace to rewrite an interface that lives in another network namespace to modify an xfrm interface across network namespace boundaries.

The issue occurs because the capability check was performed only against dev_net(dev) and not against the interface link network namespace.

339) Out-of-bounds read (CVE-ID: CVE-2026-72135)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and corrupt kernel memory.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in the TPM character device read path when processing positional read operations with a pending response. A local user can issue a crafted pread request with a large offset to disclose sensitive information and corrupt kernel memory.

The issue affects the sequential command/response TPM device interface after a command has left a response pending.

340) Improper Initialization (CVE-ID: CVE-2026-72133)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in the spi-uniphier driver interrupt handling logic when registering an interrupt handler before initializing the associated completion. A local attacker can trigger an interrupt during driver initialization to cause a denial of service.

This may lead to complete() being called on an uninitialized completion, resulting in undefined behavior.

341) Use-after-free (CVE-ID: CVE-2026-72123)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the can bcm rx operation handling in net/can/bcm.c when tearing down bcm rx operations concurrently with packet reception and timer activity. A local user can trigger a race condition to cause a denial of service.

The issue involves a thrtimer callback dereferencing a deallocated bcm_op object after an RCU grace period elapses.

342) Race condition (CVE-ID: CVE-2026-72122)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the socket to match traffic from unintended CAN interfaces.

The vulnerability exists due to a race condition in bcm_sendmsg() in net/can/bcm.c when processing CAN BCM socket operations concurrently with device unregistration or concurrent socket binding. A local user can trigger concurrent operations on a shared socket to cause the socket to match traffic from unintended CAN interfaces.

Exploitation requires a race with concurrent bcm_notify() or bcm_connect() updates to the socket state.

343) Race condition (CVE-ID: CVE-2026-72121)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in net/can/bcm.c when updating filter and timer values concurrently with handling incoming CAN traffic. A local user can trigger concurrent bcm_rx_setup() and RX handler activity to cause a denial of service.

The issue affects concurrent access to timer, filter, and stored frame state in the broadcast manager CAN implementation.

344) Use-after-free (CVE-ID: CVE-2026-72120)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the net/can/bcm.c broadcast manager operation list handling when traversing and releasing bcm_op structures under RCU protection. A local user can trigger crafted CAN BCM socket operations to cause a denial of service.

The issue involves inconsistent RCU list operations for tx_ops and rx_ops during setup, proc traversal, and socket release.

345) Race condition (CVE-ID: CVE-2026-72119)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the net/can/bcm.c CAN BCM transmission handling when updating existing transmit operations from userspace while transmit and timeout processing occur concurrently. A local user can send crafted CAN BCM configuration data to trigger inconsistent frame or timer state and cause a denial of service.

The issue involves partially updated or unvalidated frame data being observable during concurrent transmission processing, and torn 64-bit ktime_t reads on 32-bit platforms.

346) Race condition (CVE-ID: CVE-2026-72118)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause incorrect procfs statistics output.

The vulnerability exists due to a race condition in bcm_rx_handler() and related CAN BCM statistics handling in net/can/bcm.c when processing concurrent CAN frame reception on different CPUs for the same rx operation. A local attacker can trigger concurrent CAN frame processing to cause incorrect procfs statistics output.

For rx operations subscribed on all interfaces, concurrent handling on different CPUs can cause frames_filtered to become larger than frames_abs, leading to a bogus or even negative reduction percentage in procfs.

347) Race condition (CVE-ID: CVE-2026-72117)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose incorrect interface and timestamp metadata to user space.

The vulnerability exists due to a race condition in bcm_rx_handler() when processing CAN frames for rx operations subscribed on all interfaces. A local user can trigger concurrent frame handling on different CPUs to disclose incorrect interface and timestamp metadata to user space.

The issue affects rx operations with ifindex set to 0, where the same operation is registered in the shared per-netns wildcard filter list, and torn 64-bit timestamp stores may occur on 32-bit platforms.

348) Race condition (CVE-ID: CVE-2026-72116)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the net/can/bcm.c CAN broadcast manager rx_ops handling when an RX_SETUP update races with device unregistration. A local user can perform an RX_SETUP update during concurrent device removal to cause a denial of service.

Frame delivery for the updated filter may silently stop for the affected ifindex. This does not apply to rx_ops using ifindex 0 for all CAN devices.

349) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72116)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the net/can/bcm.c CAN broadcast manager tx_ops handling when a CAN device is unregistered while cyclic transmission remains active. A local user can trigger device removal conditions for an existing operation to cause a denial of service.

The issue can leave an hrtimer re-arming indefinitely and may allow injection into a later reused ifindex until an explicit TX_SETUP update occurs.

350) Race condition (CVE-ID: CVE-2026-72115)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the can bcm rx handler when processing matching frames for an ANYDEV rx operation from multiple interfaces concurrently. A local user can trigger concurrent frame handling to cause a denial of service.

The issue affects ANYDEV rx operations with an active RX timeout and/or throttle timer, and can cause spurious RX_TIMEOUT notifications and corruption of last_frames metadata.

351) Improper input validation (CVE-ID: CVE-2026-72114)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in bcm_rx_setup() in the CAN BCM subsystem when processing RX_SETUP messages with RX_RTR_FRAME. A local user can supply a crafted RTR-reply frame with an invalid length to cause a denial of service.

The issue affects RTR replies configured through RX_SETUP and involves validation of CAN and CAN FD frame length limits.

352) Race condition (CVE-ID: CVE-2026-72113)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing device reference count in the CAN BCM socket handling code when unregistering CAN filters during concurrent device unregistration. A local user can trigger concurrent socket and device unregistration conditions to cause a denial of service.

The issue can leave a stale CAN filter pointing to a soon-to-be-freed bcm_op or socket.

353) Use-after-free (CVE-ID: CVE-2026-72110)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in task BPF storage handling in copy_process() and free_task() when handling a fork operation that aborts before task BPF storage is initialized. A local user can trigger a failed fork from a process inserted into a task storage map to cause a denial of service or execute arbitrary code.

Exploitation is reachable when the calling process has been inserted into a task storage map.

354) Improper resource shutdown or release (CVE-ID: CVE-2026-72109)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cleanup in sparx5_register_notifier_blocks() in the sparx5 switchdev component when handling initialization failures after workqueue allocation fails. A local user can trigger initialization failure conditions to cause a denial of service.

The issue leaves a switchdev blocking notifier registered on the error path.

355) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72108)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause metadata inconsistency and a denial of service.

The vulnerability exists due to improper state management in dm-thin metadata snapshot handling in drivers/md/dm-thin-metadata.c when reserving or releasing a metadata snapshot and a subsequent metadata commit fails. A local user can issue crafted dmsetup messages to trigger a commit failure and cause metadata inconsistency and a denial of service.

Exploitation requires the ability to manage a thin-pool metadata device and trigger snapshot reserve or release operations under commit-failure conditions.

356) Out-of-bounds read (CVE-ID: CVE-2026-72107)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dm-era writeset handling when processing I/O for tables with a non-zero start sector. A local user can trigger out-of-bounds memory access to cause a denial of service.

The issue occurs because an absolute mapped-device block number is used instead of a target-relative block number during writeset lookup.

357) Integer overflow (CVE-ID: CVE-2026-72105)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in create_log_context in drivers/md/dm-log.c when calculating bitmap memory size for large region_count values on 32-bit systems. A local user can trigger the vulnerable code path to cause a denial of service.

Only 32-bit systems are affected.

358) Double free (CVE-ID: CVE-2026-72102)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in dm_early_create in drivers/md/dm-ioctl.c when resuming a device-mapper device after swapping in a new table. A local user can trigger a dm_resume failure to cause a denial of service.

359) Incorrect calculation (CVE-ID: CVE-2026-72099)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper calculation in dm-integrity when processing integrity metadata tags. A local user can trigger incorrect hash offset handling to cause a denial of service.

360) Out-of-bounds read (CVE-ID: CVE-2026-72089)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in fw_log_print_lines() when processing a firmware log with a size smaller than its header. A local user can supply a crafted firmware log to cause a denial of service or disclose sensitive information.

A zero-sized log can cause callers to loop forever on the same header.

361) Use-after-free (CVE-ID: CVE-2026-72072)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in mlx5e MACsec RX offload handling when deleting and processing offloaded MACsec RX SC entries concurrently. A local user can trigger concurrent RX SC deletion and RX datapath processing to cause a denial of service.

The issue affects the RX datapath under RCU lookup and reference handling of metadata_dst objects.

362) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72067)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in cpuhp_invoke_callback() when unwinding earlier callbacks for the same hotplug state after an instance callback failure. A local user can trigger a CPU hotplug state transition failure to cause a denial of service.

363) Stack-based buffer overflow (CVE-ID: CVE-2026-72066)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in states_show() in kernel/cpu.c when generating sysfs output for CPU hotplug states. A local user can read the affected sysfs entry to cause a denial of service.

364) Improper access control (CVE-ID: CVE-2026-72061)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ipip6_changelink() in the sit tunnel handler when handling changelink requests for a tunnel whose link network namespace differs from the device network namespace. A local privileged user can send a changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the caller has CAP_NET_ADMIN in the device network namespace but not in the tunnel link network namespace.

365) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72057)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper preservation of control-buffer state in tcf_ct_handle_fragments() in the act_ct component when handling fragmented traffic through connection-tracking defragmentation. A remote attacker can send specially crafted fragmented packets to cause a denial of service.

System impact occurs when panic_on_warn is enabled.

366) Improper access control (CVE-ID: CVE-2026-72055)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in vti6_changelink() in the ip6_vti component when handling changelink requests for a tunnel device associated with another network namespace. A local privileged user can send a changelink request from a namespace where they hold CAP_NET_ADMIN to modify tunnel configuration across network namespaces.

The issue arises when the device network namespace and the tunnel link network namespace differ.

367) Improper access control (CVE-ID: CVE-2026-72054)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in vti_changelink() in the ip_vti component when handling changelink requests for a tunnel whose link network namespace differs from the device network namespace. A local privileged user can send a changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the device is created in or moved to a different network namespace than the one from which the request is issued.

368) Improper access control (CVE-ID: CVE-2026-72053)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify IPIP tunnel configuration in another network namespace.

The vulnerability exists due to improper access control in ipip_changelink() in net/ipv4/ipip.c when handling changelink requests for an IPIP device whose tunnel link resides in a different network namespace. A local privileged user can send a changelink request from a network namespace where they have CAP_NET_ADMIN to modify IPIP tunnel configuration in another network namespace.

The issue occurs when dev_net(dev) and the tunnel link namespace differ, such as after the device is created in or moved to a different network namespace.

369) Improper access control (CVE-ID: CVE-2026-72052)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify tunnel link configuration across network namespaces.

The vulnerability exists due to improper access control in ip6gre_changelink() and ip6erspan_changelink() when handling changelink requests for devices and tunnel links in different network namespaces. A remote privileged user can send a crafted changelink request to modify tunnel link configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace, causing capability checks to be applied only to the device namespace.

370) Improper access control (CVE-ID: CVE-2026-72051)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ip6_tnl_changelink() when handling changelink requests for IPv6 tunnel devices across network namespaces. A local privileged user can send a crafted netlink changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace.

371) Improper access control (CVE-ID: CVE-2026-72049)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the legacy IEEE802154_NL generic netlink LLSEC dump operations when handling LLSEC_LIST_KEY dump requests. A local user can issue a crafted generic netlink dump request to disclose sensitive information.

The issue exposes the raw 16-byte AES-128 LLSEC key bytes for any wpan netdev that has an administrator-installed LLSEC key.

372) Improper access control (CVE-ID: CVE-2026-72045)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in rvu_mbox_handler_lmtst_tbl_setup() when handling mailbox requests that specify base_pcifunc. A remote user can supply a crafted base_pcifunc value to disclose sensitive information.

Exploitation requires a VF caller on cn10k hardware, and the issue is limited to redirecting LMTLINE sharing outside the caller's own PF.

373) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-72036)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in multiq_dequeue in the sch_multiq scheduler when handling queued packets after a peek operation on a non-work-conserving child qdisc. A local user can trigger network traffic through the affected queuing path to cause a denial of service.

The issue can desynchronize the child queue length and backlog accounting and lead to a NULL pointer dereference in softirq context on egress.

374) NULL pointer dereference (CVE-ID: CVE-2026-72035)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the sch_taprio scheduler when processing ordinary egress through a non-work-conserving child qdisc after a peeked packet is orphaned and queue state is desynchronized. A local attacker can trigger network egress through a qfq child to cause a denial of service.

The issue can panic the kernel from softirq, and the qfq child can be re-entered on an emptied list.

375) Out-of-bounds read (CVE-ID: CVE-2026-72029)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read and improper validation of device-supplied offsets and lengths in mux_dl_adb_decode() in the iosm MUX downlink decoder when processing modem-supplied aggregated datagram tables in a received skb. A local attacker can provide crafted offset and length values to trigger out-of-bounds reads and an infinite loop to disclose sensitive information and cause a denial of service.

The issue can be triggered by a modem that supplies malformed table and datagram metadata after the iosm net device is up, and the loop runs in softirq while cloning the skb on each pass.

376) Race condition (CVE-ID: CVE-2026-72024)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mac802154 interface removal logic when handling asynchronous transmit completion during interface teardown. A local user can trigger interface removal while transmit completion paths access the interface list to cause a denial of service.

The issue arises because queue wake, stop, and disable paths walk local->interfaces under RCU while bulk hardware teardown removes interface entries.

377) Incorrect calculation (CVE-ID: CVE-2026-72021)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect connection state tracking.

The vulnerability exists due to improper calculation of buffer offsets in SCTP state lookup in net/netfilter/ipvs/ip_vs_proto_sctp.c when processing IPv6 SCTP packets with extension headers. A remote attacker can send a specially crafted IPv6 SCTP packet with extension headers to cause incorrect connection state tracking.

This can cause an SCTP connection to be moved to the established state before the SCTP handshake has completed, resulting in incorrect timeout handling and destination counter updates.

378) Out-of-bounds read (CVE-ID: CVE-2026-72019)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in macsec_encrypt() when processing packets transmitted through the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS path with an unset MAC header. A local user can send a specially crafted packet to disclose sensitive information.

The 12-byte heap over-read may be emitted on the wire as the frame's outer source and destination MAC addresses.

379) Use-after-free (CVE-ID: CVE-2026-72012)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the osnoise tracer instance unregistration logic when unregistering an osnoise tracing instance while RCU readers are traversing the instance list. A local user can trigger instance unregistration to cause a denial of service.

380) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72009)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the imx93-blk-ctrl power domain handling for MIPI DSI and CSI when managing shared clock and reset resources. A local user can trigger concurrent use of the DSI and CSI domains to cause a denial of service.

The issue occurs because the two domains share control bits for clock and reset, so one domain may disable a resource while the other remains active.

381) Improper Initialization (CVE-ID: CVE-2026-72005)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in rt2x00lib_probe_dev() and rt2x00lib_remove_dev() when handling probe failures before work items are initialized. A local user can trigger an early probe failure to cause a denial of service.

The issue occurs when drv_data or workqueue allocation fails before intf_work, autowakeup_work, and sleep_work have been set up.

382) Integer underflow (CVE-ID: CVE-2026-68479)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow leading to out-of-bounds read and out-of-bounds write in rtlbt_parse_firmware() when parsing a malformed Bluetooth firmware patch during Bluetooth setup. A local user can supply a specially crafted firmware patch to cause a denial of service.

The issue can be triggered by a firmware patch shorter than the version field, and arithmetic wraparound may affect 32-bit architectures.

383) Out-of-bounds read (CVE-ID: CVE-2026-68474)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in spufs_mem_mmap_access() when accessing the SPU local store through a memory-mapped area. A local user can supply a crafted offset and length to read beyond the LS_SIZE buffer and disclose sensitive information.

The issue affects 64-bit systems because the existing clamp does not properly limit access against the local store size.

384) Improper input validation (CVE-ID: CVE-2026-68471)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ieee80211_mle_size_ok() and ieee80211_mle_common_size() when parsing multi-link element data. A remote attacker can send specially crafted MLE data to cause a denial of service.

The issue affects validation of advertised common information lengths for known MLE types, including Reconfiguration and Priority Access MLEs.

385) Improper Initialization (CVE-ID: CVE-2026-68467)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the mchp23k256 SPI flash driver when probing id-table-only SPI device matches. A local user can attach or register a device that matches through the SPI id table to cause a denial of service.

The issue occurs because the driver may use incorrect chip capacity data and wrong MTD geometry for non-OF SPI modalias matches.

386) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68466)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in the lpc32xx_xmit_dma() function when waiting for DMA transfer completion. A local user can trigger a DMA completion timeout to cause a denial of service.

The timed out transfer may continue accessing the buffer after an error condition occurs.

387) NULL pointer dereference (CVE-ID: CVE-2026-68454)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a null page reference in kvm_s390_pci_aif_enable() in the KVM s390 PCI code when registering IRQs without a summary bit specified. A local user can request IRQ registration without an AISB to cause a denial of service.

The issue is triggered when a guest enables adapter interruption forwarding without specifying a summary bit.

388) Out-of-bounds read (CVE-ID: CVE-2026-68453)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the s390 zcrypt CCA token validation and handling logic when processing crafted CCA key token buffers with user-controlled length fields. A local user can provide a specially crafted key token with inconsistent length values to cause a denial of service or disclose sensitive information.

The issue involves both oversized length fields that exceed the actual buffer size and undersized length fields that can cause a buffer under-run with similar effects.

389) Improper input validation (CVE-ID: CVE-2026-68452)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in cca_cipher2protkey() when processing CCA AES cipher key requests. A local user can supply a key token with an excessive length field to cause a denial of service.

The copy length for the CPRB parameter block is derived directly from the length field in the key token.

390) Improper input validation (CVE-ID: CVE-2026-68451)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in cca_ecc2protkey() when processing CCA ECC private key requests. A local user can supply a crafted key token with an oversized length field to cause a denial of service.

391) Out-of-bounds read (CVE-ID: CVE-2026-68447)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the amdkfd CRIU checkpoint handling for the MQD control stack when copying checkpoint data to userspace. A local user can trigger a checkpoint operation with a hardware-reported control stack size larger than the allocated buffer object to disclose sensitive information.

The issue can leak kernel data from adjacent GTT memory to userspace.

392) Improper input validation (CVE-ID: CVE-2026-68446)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in vmw_gb_surface_define_internal when handling a userspace surface creation request with a crafted array_size value. A local user can submit a specially crafted request to cause a denial of service.

The array_size limit depends on which Shader Model is available.

393) Improper access control (CVE-ID: CVE-2026-68445)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass shader validation and execute untrusted GPU shader code.

The vulnerability exists due to improper access control in vc4_gem_object_mmap() when handling mappings of validated shader buffer objects. A local user can map a validated shader buffer object read-only and then use mprotect() to make it writable to bypass shader validation and execute untrusted GPU shader code.

The issue affects validated shader buffer objects that are initially mapped read-only but can later be upgraded to writable mappings.

394) Use-after-free (CVE-ID: CVE-2026-68442)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service and execute arbitrary code.

The vulnerability exists due to use-after-free in btrfs_drop_extent_map_range() and btrfs_free_extent_map() when splitting extent maps during logging. A local user can trigger crafted filesystem activity to cause a denial of service and execute arbitrary code.

The issue is caused by split extent maps incorrectly inheriting EXTENT_FLAG_LOGGING and later being freed while still linked on the inode's modified_extents list.

395) Out-of-bounds read (CVE-ID: CVE-2026-68433)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in handle_get_version_reply() in libceph when processing a truncated MON_GET_VERSION_REPLY message. A remote attacker can send a specially crafted reply to disclose sensitive information.

The issue occurs because decoding is bounded by the reused reply buffer size rather than the number of bytes actually received, allowing stale tail bytes from an earlier message to be read.

396) Improper access control (CVE-ID: CVE-2026-68432)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify VXLAN device configuration across network namespaces.

The vulnerability exists due to improper access control in vxlan_changelink() when handling changelink requests for a VXLAN device whose underlay network namespace differs from the device network namespace. A local privileged user can send a crafted changelink request to modify VXLAN device configuration across network namespaces.

The issue occurs when the caller has CAP_NET_ADMIN in the device network namespace but not in the VXLAN underlay network namespace.

397) Improper input validation (CVE-ID: CVE-2026-68425)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state validation in the kernel-handled RMPP receive processing in IB MAD handling when processing unsolicited active RMPP DATA responses. A remote attacker can send a specially crafted unmatched RMPP response to cause a denial of service.

The issue occurs because receive-side reassembly could begin before the full TID and source address were verified against an outstanding send.

398) Improper access control (CVE-ID: CVE-2026-68419)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in irdma_rereg_user_mr when re-registering non-memory regions. A local user can invoke rereg_mr on a specially registered QP, CQ, or SRQ region to cause a denial of service.

The issue affects special RDMA registrations created through a two-step userspace allocation and registration process where the region does not have a valid mkey.

399) Race condition (CVE-ID: CVE-2026-68417)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in siw_create_qp() and QP lookup handling when creating and looking up queue pairs. A local user can trigger a QPN lookup for a queue pair that is still being constructed to cause a denial of service.

The issue occurs because the queue pair can be published before its queues, completion queue pointers, state, completion object, and device list entry are fully initialized.

400) Use-after-free (CVE-ID: CVE-2026-68414)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in cfg80211_sched_scan_results_wk when processing scheduled scan result work during device unregister. A local user can trigger scheduled scan result handling during interface teardown to cause a denial of service.

The issue is caused by a race condition between the scheduled-scan result path and the unregister/free path.

401) Use-after-free (CVE-ID: CVE-2026-68409)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the mac80211 link RX stats handling in sta_remove_link() when processing concurrent link removal and RX fast-path access. A local attacker can trigger the race condition to cause a denial of service.

The issue occurs only when uses_rss is enabled, which is when pcpu_rx_stats exists.

402) Deadlock (CVE-ID: CVE-2026-68408)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in cfg80211 PMSR work handling when closing a netlink socket that owns a PMSR session concurrently with interface teardown. A local user can close the socket and trigger concurrent interface shutdown processing to cause a denial of service.

The deadlock is also reachable from cfg80211_leave_locked() when interface cleanup is performed under wiphy_lock.

403) Race condition (CVE-ID: CVE-2026-68404)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nl80211_netlink_notify() and cfg80211 wireless device autodisconnect handling when releasing a NETLINK_GENERIC socket that owns a connection. A local user can release a crafted netlink socket to cause a denial of service.

The issue occurs because autodisconnect work can be queued after teardown has cancelled pending work and after the wireless device has been removed from the device list.

404) Out-of-bounds read (CVE-ID: CVE-2026-68402)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in cfg80211_is_element_inherited() when parsing a crafted wireless frame containing a zero-length extension element. A remote attacker can send a specially crafted frame to disclose sensitive information.

The issue is triggered during element parsing when a non-inheritance context exists, such as while parsing a per-STA profile of a Multi-Link element in a (re)association response or a non-transmitted BSS profile.

405) Out-of-bounds write (CVE-ID: CVE-2026-68401)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in ffa_setup_and_transmit() in the arm_ffa firmware driver when handling malformed memory region descriptors. A local user can trigger the vulnerable code path to cause a denial of service.

The issue includes writing the reserved field out of bounds for FFA versions earlier than 1.2 and insufficient size validation before writing constituents.

406) Out-of-bounds write (CVE-ID: CVE-2026-68400)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the arm_ffa memory region descriptor handling code when calculating endpoint memory access descriptor offsets while processing memory region descriptors. A local user can trigger the vulnerable code path with a crafted descriptor layout to cause a denial of service.

The issue arises from using a default structure size instead of the descriptor's ep_mem_offset value, which can cause calculated descriptor offsets to exceed the fragment size.

407) Use-after-free (CVE-ID: CVE-2026-68399)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sk_clone() and BPF socket local storage handling when cloning sockets and an early bailout occurs before BPF storage cloning. A local user can trigger socket cloning that fails before storage initialization completes to cause a denial of service.

Only systems with BPF syscall support enabled are vulnerable.

408) Use-after-free (CVE-ID: CVE-2026-68398)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in pppol2tp_recv() and PPP channel handling when processing pppol2tp receive traffic concurrently with channel teardown. A local user can trigger concurrent receive and close operations to cause a denial of service or execute arbitrary code.

The issue is reachable by an unprivileged user and affects a channel that is bound but not attached to a PPP unit and not bridged.

409) Use-after-free (CVE-ID: CVE-2026-68397)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in afiucv_hs_rcv() and the afiucv_hs_callback_* handlers when processing AF_IUCV socket traffic. A local user can trigger a concurrent socket close to cause a denial of service.

The issue arises because the destination socket is looked up under a lock and then used after the lock is released without holding a reference.

410) Use-after-free (CVE-ID: CVE-2026-68392)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth management subsystem net/bluetooth/mgmt.c when handling unpair and disconnect operations. A local user can trigger these operations to cause a denial of service.

The issue arises from dereferencing RCU-protected connection pointers outside the required critical section.

411) Use-after-free (CVE-ID: CVE-2026-68391)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth management subsystem in net/bluetooth/mgmt.c when handling Bluetooth management operations involving pending command callbacks and connection lookups. A local user can trigger connection state changes during these operations to cause a denial of service.

The issue involves dereferencing RCU-protected hci_conn pointers outside critical sections and accessing connection state without the required device lock, which can also lead to a data race.

412) Use-after-free (CVE-ID: CVE-2026-68389)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in qca_controller_memdump() in the Qualcomm Bluetooth hci_qca driver when processing a controller-reported memdump with an invalid zero dump size. A local user can trigger a crafted invalid memdump condition to cause a denial of service.

The issue can leave memdump collection state stale and IBS disabled after the aborted dump, which may block waiters or later transmit handling.

413) Use-after-free (CVE-ID: CVE-2026-68383)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the xe GuC scheduler timeline name handling when destroying an exec queue while scheduler fences still reference the timeline name. A local user can trigger exec queue destruction while outstanding scheduler fences still reference the freed name to cause a denial of service.

The issue arises because the scheduler keeps a pointer to the timeline name after the exec queue lifetime ends, creating an RCU-lifetime mismatch.

414) Use-after-free (CVE-ID: CVE-2026-68377)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tunnel_key_release_params() in net/sched/act_tunnel_key.c when handling concurrent tunnel key action processing on the datapath. A local user can trigger a race condition to cause a denial of service.

The issue arises because a reader may still access the old params structure under RCU while the associated metadata_dst is released synchronously.

415) Out-of-bounds read (CVE-ID: CVE-2026-68376)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in sctp_auth_get_hmac() when processing SCTP authentication parameters during association initialization. A local user can configure four HMAC identifiers to trigger memory corruption that leads to an out-of-bounds read and disclose sensitive information.

The issue stems from an undersized auth_hmacs array in struct sctp_cookie that can corrupt the adjacent auth_chunks field and cause an invalid HMAC identifier to be accepted.

416) Out-of-bounds read (CVE-ID: CVE-2026-68373)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in at76_guess_freq() when processing truncated beacon or probe response frames during scanning. A remote attacker can send a specially crafted wireless management frame to disclose sensitive information.

The issue is reachable from at76_rx_tasklet() while scanning.

417) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-68371)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in the omap2430_probe() function when probing the omap2430 USB MUSB platform device. A local user can trigger the driver probe to cause a denial of service.

The issue can leave pdev->dev.of_node with an unbalanced reference count because a borrowed device tree node pointer is released incorrectly.

418) Race condition (CVE-ID: CVE-2026-68370)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dummy_hcd shared fifo_req handling when processing small IN transfers through the emulated single-request FIFO fast-path. A local user can trigger concurrent request queueing and completion handling to cause a denial of service.

The issue can overwrite the request completion function pointer while a completion callback is still running, leading to a general protection fault or page fault in dummy_timer.

419) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68354)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of fragment list boundaries in the firewire networking fragmented datagram reassembly logic when processing fragmented datagrams. A remote attacker can send specially crafted fragmented datagrams to cause a denial of service.

The issue can prevent complete datagrams from being correctly recognized during reassembly.

420) Out-of-bounds read (CVE-ID: CVE-2026-68353)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ath6kl_wmi_tx_complete_event_rx() when processing a crafted WMI TX complete event from firmware. A local user can supply an inflated num_msg field to disclose sensitive information.

The num_msg field is firmware-controlled and can cause reads of up to 1020 bytes past the WMI event buffer.

421) Out-of-bounds read (CVE-ID: CVE-2026-68352)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in ath6kl_wmi_connect_event_rx() when parsing firmware-controlled connect event information elements. A local attacker can supply crafted length fields to trigger out-of-bounds reads and disclose sensitive information.

The issue can also corrupt the wmi->is_wmm_enabled state during parsing.

422) Out-of-bounds read (CVE-ID: CVE-2026-68348)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the TAS2781 firmware parser when parsing malformed firmware description strings. A local user can supply a crafted firmware image without a NUL terminator to cause a denial of service.

The issue occurs because variable-length description strings are processed with strlen() before verifying that the terminator is present within the firmware buffer.

423) Out-of-bounds read (CVE-ID: CVE-2026-68340)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the OCC poll response parser in drivers/hwmon/occ/common.c when parsing a truncated transport response. A local user can supply a malformed poll response to cause a denial of service.

The issue occurs because the parser used the backing-array capacity instead of the current response data length as the parse boundary, and malformed-response errors were not propagated before the OCC was published as active.

424) Race condition (CVE-ID: CVE-2026-68338)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in packet_set_ring() and packet fanout hook handling in net/packet/af_packet.c when reconfiguring a packet socket ring while a network device is being unregistered. A local user can trigger ring reconfiguration during device unregister handling to cause a denial of service.

The issue occurs when a stale running state causes fanout hook re-registration after the device binding has already been invalidated.

425) Use-after-free (CVE-ID: CVE-2026-68335)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the RDS receive path when delivering an incoming message across network namespace boundaries. A local user can create network namespaces and send a crafted message to trigger a dangling connection reference and potentially execute arbitrary code.

The issue is reachable from unprivileged user namespaces using CLONE_NEWUSER and CLONE_NEWNET.

426) Race condition (CVE-ID: CVE-2026-68329)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a race condition in iommu_completion_wait() in the AMD IOMMU subsystem when handling concurrent command completion waits across multiple CPUs. A local user can trigger concurrent IOMMU command activity to cause a use-after-free condition.

The issue occurs because the code may return without waiting for previously queued commands to complete in hardware, which can leave stale translations in use while related page-table pages are freed.

427) Out-of-bounds read (CVE-ID: CVE-2026-68326)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in mwifiex_process_uap_event() and the assoc_req_ies parsing path when processing a firmware-reported uAP association event with a crafted event length. A local attacker can supply a malicious or malformed event from a mwifiex device to disclose sensitive information.

The issue can be triggered by a malicious or malfunctioning mwifiex USB, SDIO, or PCIe device while the interface is operating in AP/uAP mode. An underflow in the calculated length may also cause stale event buffer bytes to be exposed through an NL80211_CMD_NEW_STATION notification.

428) Race condition (CVE-ID: CVE-2026-68323)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in tipc_udp_rcast_add() and cleanup_bearer() in net/tipc/udp_media.c when updating the udp bearer replicast list during peer discovery and bearer cleanup. A local user can enable a TIPC bearer from an unprivileged user namespace and trigger concurrent list updates to cause a denial of service.

The issue can corrupt the kernel list structure and trigger a kernel BUG during bearer cleanup.

429) NULL pointer dereference (CVE-ID: CVE-2026-68322)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the RDS IPv6 address check logic when binding an RDS socket to an IPv6 address while IPv6 is disabled. A local user can bind an RDS socket to an IPv6 address to cause a denial of service.

The issue occurs on systems booted with the ipv6.disable=1 parameter.

430) Heap-based buffer overflow (CVE-ID: CVE-2026-68320)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in sctp_association_init and SCTP authentication chunk handling when processing endpoint authentication chunk lists containing more than 16 entries. A local user can add excessive chunk identifiers to trigger memory corruption and cause a denial of service.

431) Integer overflow (CVE-ID: CVE-2026-68315)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow in sctp_process_strreset_inreq() when processing a crafted SCTP RESET_IN_REQUEST from a peer. A remote attacker can send a specially crafted SCTP stream reset request to cause a denial of service.

Exploitation is only possible on interfaces with MTU greater than 65535, such as loopback with IPv6 jumbograms.

432) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68314)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in mctp_i3c_mod_init() in the mctp i3c driver when registering the i3c notifier and initializing existing buses before driver registration completes. A local user can trigger a driver registration failure to cause a denial of service.

The issue leaves a notifier pointing to a module that failed to load and leaks allocated bus objects.

433) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68299)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of encapsulated packet headers in vmxnet3_get_hdr_len() when processing Geneve-encapsulated packets. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue is triggered when descriptor fields describe the inner header instead of the outer header, including cases where the outer protocol is UDP or the outer and inner IP versions differ.

434) Improper input validation (CVE-ID: CVE-2026-68297)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in TIPC netlink MTU property handling when processing user-supplied MTU values through TIPC media or bearer configuration requests. A local user can supply an MTU value greater than 65535 to trigger a division by zero and cause a denial of service.

Exploitation is possible by an unprivileged user via a user namespace.

435) Improper access control (CVE-ID: CVE-2026-68294)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass network namespace isolation.

The vulnerability exists due to improper access control in the AF_QIPCRTR socket creation logic and global QRTR state handling when creating and using QRTR sockets from a separate network namespace. A local user can create an AF_QIPCRTR socket in another network namespace and send crafted QRTR datagrams to sockets owned by a different namespace to bypass network namespace isolation.

The receiving socket may treat the message as originating from node id 1, making it indistinguishable from a legitimate local client.

436) Out-of-bounds read (CVE-ID: CVE-2026-68293)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the MCIA register handling in the mlx5 driver when processing module EEPROM reads via ethtool. A local user can trigger a read of module EEPROM data to cause a denial of service.

The issue is detected on kernels built with FORTIFY_SOURCE, where it results in a kernel BUG.

437) Use-after-free (CVE-ID: CVE-2026-68290)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in rds_tcp_skbuf_handler in the RDS TCP sysctl handler when handling a concurrent sysctl write during network namespace teardown. A local user can trigger a concurrent sysctl write to cause a denial of service.

The race occurs because the network namespace is derived from a listen socket that may already have been freed.

438) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-68287)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper calculation of buffer size in net/core/drop_monitor.c when handling 64-bit drop monitor attributes on affected architectures. A local user can trigger packet report generation to cause a denial of service.

This affects 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS because 64-bit netlink attributes may require additional padding for alignment.

439) Use-after-free (CVE-ID: CVE-2026-68284)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tcp_bpf_sendmsg() when two threads send on the same socket and an error occurs after waiting for socket memory. A local user can trigger concurrent send operations to cause a denial of service.

The issue occurs in the sockmap BPF path and involves stale cork state being mistaken for a stack-local temporary message.

440) Use-after-free (CVE-ID: CVE-2026-68273)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free and NULL pointer dereference in the amdgpu context pstate handling code when initializing or finalizing GPU contexts while stable pstate state changes are processed. A local user can create and tear down crafted contexts to cause a denial of service.

The issue arises because context pstate ownership transitions were not consistently protected by the stable_pstate_ctx_lock, and sysfs-triggered state changes can race with context handling.

441) Use-after-free (CVE-ID: CVE-2026-68266)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the xe dma-buf imported buffer object handling when tearing down imported buffer objects after dma_buf_dynamic_attach() or buffer object creation fails. A local user can trigger creation of a crafted imported dma-buf buffer object to cause a denial of service.

The issue can be reached on failure paths where the buffer object already references the exporter's reservation object and that reservation object is later accessed asynchronously during delayed deletion.

442) Double free (CVE-ID: CVE-2026-68263)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in drm_sched_entity_fini() in the PowerVR DRM queue cleanup path when destroying queues after queue kill handling. A local user can trigger queue teardown in a crafted context lifecycle to cause a denial of service.

The issue is associated with a refcount underflow and use-after-free warning in the drm/imagination PowerVR driver.

443) Incorrect calculation (CVE-ID: CVE-2026-68262)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information or corrupt memory in userspace.

The vulnerability exists due to improper pointer arithmetic in pvr_set_uobj_array() when copying an array of kernel objects to a userspace array with a differing element stride. A local user can supply crafted stride values to cause later copies to read from incorrect kernel addresses or write to incorrect userspace offsets to disclose sensitive information or corrupt memory in userspace.

The issue occurs in the slow path when the userspace element size differs from the kernel object size, and padding is not cleared for each element.

444) Race condition (CVE-ID: CVE-2026-68260)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to a NULL pointer dereference in the PowerVR GPU virtual memory mapping logic when performing map or unmap operations while a find operation is in progress. A local user can issue crafted ioctl requests to trigger the NULL pointer dereference and cause a denial of service.

445) Improper input validation (CVE-ID: CVE-2026-68258)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in kfd CRIU restore queue handling when processing user-supplied private restore data. A local user can provide an out-of-bounds queue type or mismatched mqd_size values to cause a denial of service.

Exploitation requires access to the CRIU restore functionality in the amdkfd subsystem.

446) Out-of-bounds read (CVE-ID: CVE-2026-68255)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in virtio_get_edid_block() when parsing device-supplied EDID responses. A remote privileged user can supply a crafted virtio-gpu EDID response with a large reported size and high extension count to disclose sensitive information.

Exploitation requires control of a malicious virtio-gpu backend.

447) Out-of-bounds write (CVE-ID: CVE-2026-68253)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the intel_hdcp_required_content_stream function when processing HDCP content stream data. A local user can trigger a stream count overflow to cause a denial of service.

448) Use-after-free (CVE-ID: CVE-2026-68245)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in amdgpu_vm_get_task_info_pasid() when looking up task information by PASID. A local user can trigger the flawed lookup path to cause a denial of service.

449) Double free (CVE-ID: CVE-2026-68236)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in dm_update_crtc_state() in the AMD display manager when handling error paths after releasing new_stream on the skip_modeset path. A local user can trigger a later error condition after the initial release to cause a denial of service.

The issue occurs because a dangling pointer may be released again after a color management failure reaches the fail label.

450) Improper resource shutdown or release (CVE-ID: CVE-2026-68222)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in msi2500_start_streaming() and queued buffer cleanup handling when starting streaming after buffers have been queued by the vb2 framework. A local user can trigger start_streaming() error paths to cause a denial of service.

The issue occurs on multiple start_streaming() failure paths, including device disconnect, interrupted locking, USB ADC setup failure, isochronous initialization failure, and streaming command failure. In some cases, queued buffers are not returned as expected and submitted isochronous URBs may remain active without being consumable by the driver.

451) Improper input validation (CVE-ID: CVE-2026-68219)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the imx8-isi scaling configuration logic when processing crafted image scaling parameters. A local user can supply specially crafted width or height values to cause a denial of service.

The issue can cause the affected process to stop responding even when interrupted with Ctrl+C.

452) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68216)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in start_streaming() in the pwc USB camera driver when handling queued video buffers during streaming startup failure conditions. A local user can trigger a streaming startup failure to cause a denial of service.

The issue can be triggered when the USB device is already disconnected or when locking is interrupted by a signal.

453) Race condition (CVE-ID: CVE-2026-68204)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unexpected results.

The vulnerability exists due to improper state management in vivid_update_format_cap() and vivid_update_format_out() when changing CROP, COMPOSE, or SCALE capability controls after REQBUFS and before STREAMON while the queue state is not properly enforced. A local user can change these controls to cause unexpected results.

The issue affects the vivid media test driver during the window between buffer request setup and the start of streaming.

454) Use-after-free (CVE-ID: CVE-2026-68202)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ALSA sequencer queue timer handling in snd_seq_timer_delete() and related queue destruction logic when accessing /dev/snd/seq and re-opening a queue timer during queue teardown. A local user can issue crafted sequencer operations to leave a timer instance live and trigger a dereference of freed queue memory to cause a denial of service.

No queue ownership is required.

455) Out-of-bounds read (CVE-ID: CVE-2026-68199)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in aggr_recv_addba_req_evt() in the ath6kl wireless driver when processing a firmware-supplied ADDBA window size. A remote attacker can supply a crafted window size value to cause a denial of service.

The issue arises because an out-of-range window size can lead to a zero-size or overflowed allocation before subsequent memory access.

456) Out-of-bounds read (CVE-ID: CVE-2026-68196)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in wilc_parse_assoc_resp_info() in the wilc1000 driver when parsing a received association response. A remote attacker can send a specially crafted short association response frame to disclose sensitive information.

A response shorter than the 6-byte fixed header can trigger the issue, and a response shorter than four bytes may cause an out-of-bounds read of status_code at offsets 2 and 3.

457) Double free (CVE-ID: CVE-2026-68192)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in brcmf_pcie_release_scratchbuffers() when releasing scratch and ring update DMA buffers during reset and device removal. A local user can trigger repeated sequential release to cause a denial of service.

The issue occurs when reset teardown runs before device removal, causing the same DMA allocation to be freed a second time.

458) Use-after-free (CVE-ID: CVE-2026-68189)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in UUID list traversal in hci_sync.c when generating EIR data or class-of-device data during asynchronous command sync work. A local user can add and remove Bluetooth UUID entries through the management socket to cause a denial of service.

The issue is triggered by a race condition between command sync work and management socket operations.

459) Improper locking (CVE-ID: CVE-2026-68179)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in nsm_dev_ioctl() in drivers/misc/nsm.c when processing an ioctl request with an invalid user pointer during copy_from_user(). A local user can send a crafted ioctl request to cause a denial of service.

The issue is triggered on the pre-lock error path before the mutex is acquired.

460) Use-after-free (CVE-ID: CVE-2026-68178)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute code in kernel context.

The vulnerability exists due to use-after-free in the NSM misc device file operations handling in /dev/nsm when invoking ioctl on an open file descriptor after the nsm module has been unloaded. A local user can open /dev/nsm, keep the file descriptor open, and later issue an ioctl after module removal to execute code in kernel context.

The issue is exposed when the driver is built as a module and an open /dev/nsm file descriptor outlives removal of the module that provides the ioctl callbacks.

461) NULL pointer dereference (CVE-ID: CVE-2026-68157)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in get_immediate_parent() in net/ceph/osdmap.c when processing malformed CRUSH hierarchy metadata during localized read selection. A local user can trigger lookup of a parent bucket whose type has no matching entry in type_names to cause a denial of service.

The issue occurs when a parent bucket name exists in the CRUSH map but its type name metadata is missing, causing an invalid pointer to be passed to strcmp().

462) Improper input validation (CVE-ID: CVE-2026-68155)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ceph_monmap_decode() when processing a CEPH_MSG_MON_MAP monmap message. A remote attacker can send a specially crafted monmap advertising zero monitors to cause a denial of service.

The issue is triggered when the client later attempts to open a session with a monitor, causing an assertion in pick_new_mon() to fire.

463) Use-after-free (CVE-ID: CVE-2026-68153)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the monmap debugfs file handler when processing a concurrent read during client teardown. A local user can read the monmap debugfs file during teardown to cause a denial of service.

The issue is triggered by a race condition between debugfs access and ceph client teardown.

464) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68149)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended ACL handling and retain stale access control list data.

The vulnerability exists due to improper cache state handling in posix ACL caching for fuse inodes in the Linux kernel when invalidating cached ACL entries. A local user can trigger ACL updates and cache invalidation conditions to bypass intended ACL handling and retain stale access control list data.

The issue affects fuse filesystems that opt out of POSIX ACL caching when the fuse server does not negotiate POSIX ACL support.

465) Use-after-free (CVE-ID: CVE-2026-68148)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a use-after-free in find_or_insert_direct_key() when reusing cached direct keys for inodes from different super_blocks. A local user can cause different super_blocks to reference the same cached direct key to cause a use-after-free.

The issue affects the legacy fscrypt_direct_keys table used by v1 encryption policies with FSCRYPT_POLICY_FLAG_DIRECT_KEY, while the v2 policy equivalent is not affected.

466) Out-of-bounds write (CVE-ID: CVE-2026-68145)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in ifs_set_range_dirty() when processing a zero-length range. A local user can trigger a user buffer fault that results in copied == 0 during a write operation to cause a denial of service.

The issue is reachable from __iomap_write_end() when copy_folio_from_iter_atomic() returns 0 and the folio is already uptodate.

467) Race condition (CVE-ID: CVE-2026-68143)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to an out-of-bounds write and use-after-free in slip_receive_buf() and sl_realloc_bufs() when processing received SLIP data during a concurrent MTU change. A local user can trigger receive processing while racing an MTU change to cause a denial of service or execute arbitrary code.

468) Improper access control (CVE-ID: CVE-2026-68142)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify Geneve tunnel device configuration in another network namespace.

The vulnerability exists due to improper access control in geneve_changelink() when handling rtnetlink changelink requests for a Geneve device whose underlay network namespace differs from the device network namespace. A local privileged user can send a specially crafted changelink request to modify Geneve tunnel settings in the underlay network namespace.

The issue arises when the Geneve device has been created in or moved to a different network namespace than the one associated with its underlay sockets.

469) NULL pointer dereference (CVE-ID: CVE-2026-68141)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in afiucv_hs_callback_syn() when handling connection requests that enter the connection-refused path after child socket allocation fails. A local user can trigger this condition to cause a denial of service.

The issue occurs because the code calls iucv_sock_kill() with a NULL child socket pointer.

470) Use-after-free (CVE-ID: CVE-2026-68140)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the af_iucv message queue handling when processing queued message notifications after a connection is severed. A local user can trigger connection severing with queued notifications still pending and then invoke recvmsg() to cause a denial of service.

The issue occurs because queued notifications retain stale references to a freed iucv_path.

471) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68131)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of positive result codes in drivers/block/rbd.c when processing a corrupted reply to an object map update request. A remote attacker can send a corrupted reply to trigger an assertion and cause a denial of service.

The issue is triggered in the RBD object map update path for write requests.

472) Resource exhaustion (CVE-ID: CVE-2026-68129)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource handling in the gve Rx queue handling logic when processing received packets under extreme memory pressure. A local user can trigger page allocation failures that leave too few descriptors posted to hardware to cause a denial of service.

The issue can result in a permanent Rx queue stall because no receive completions are generated, preventing NAPI from being scheduled again.

473) Out-of-bounds read (CVE-ID: CVE-2026-68125)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in llsec_do_decrypt_auth() when processing crafted IEEE 802.15.4 secured frames with payloads shorter than the authentication tag. A remote attacker can send a specially crafted frame to cause a denial of service.

The crafted frame can reach the vulnerable path from an IEEE 802.15.4 peer in radio range.

474) Use-after-free (CVE-ID: CVE-2026-68121)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in pppoe_sendmsg() when handling a blocked send while a non-Ethernet port is added to an empty team device. A local user can trigger skb head reallocation and subsequent writes through a stale PPPoE header pointer to cause memory corruption.

The issue occurs because device header callbacks may reallocate the skb head and invalidate saved pointers into it.

475) Use of uninitialized resource (CVE-ID: CVE-2026-68119)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory in standalone TCP-AO response handling in tcp_v4_send_ack() and tcp_v6_send_response() when processing TCP responses with TCP-AO options whose MAC length is not four-byte aligned. A remote attacker can send packets that trigger standalone TCP responses to disclose sensitive information.

Only the one to three alignment padding bytes after the TCP-AO MAC are exposed, and the issue affects both IPv4 and IPv6 response paths.

476) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68118)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of reset packets in tcp_check_req() when processing in-window RST segments in the SYN-RECEIVED request-socket path. A remote attacker can send a specially crafted non-exact RST packet to cause a denial of service.

The issue affects connection handling before a connection is fully established.

477) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68116)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended traffic filtering.

The vulnerability exists due to improper state management in vxlan multicast database remote source list handling when replacing the source list of an existing (*, G) remote entry. A local user can trigger a failed source list replacement to bypass intended traffic filtering.

An EXCLUDE filter may start forwarding traffic that should be blocked, while an INCLUDE filter may drop traffic that should be forwarded.

478) Integer overflow (CVE-ID: CVE-2026-68108)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds memory access.

The vulnerability exists due to integer overflow in amdgpu_vce_ring_parse_cs() in the VCE command stream parser when processing crafted VCE command streams with oversized image dimensions. A local user can submit a specially crafted command stream to cause out-of-bounds memory access.

The issue occurs when image dimensions wrap the calculated buffer size and bypass validation before reaching the GPU firmware.

479) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-68107)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in the amdgpu vcn_v4_0 command submission handling in drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c when processing an indirect buffer. A local user can modify the indirect buffer between reads to cause a denial of service.

The issue affects the VCN4 encoding parameter parsing path.

480) Division by zero (CVE-ID: CVE-2026-68106)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in the amdgpu UVD H264 and H264 Perf decode paths when processing crafted frame dimensions with a width or height less than 16. A local user can submit crafted decoding parameters to cause a denial of service.

481) Use-after-free (CVE-ID: CVE-2026-68104)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the amdgpu ACP power management domain cleanup logic when removing the ACP power domain. A local user can trigger the affected cleanup path to cause a denial of service.

482) Out-of-bounds read (CVE-ID: CVE-2026-68100)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in set_ntacl_dacl() when processing a crafted security descriptor during SMB2_QUERY_INFO(SecInfo=DACL). A remote user can send a crafted SMB2_SET_INFO request containing a malformed ACE and later trigger SMB2_QUERY_INFO to disclose sensitive information.

The issue affects inodes carrying a POSIX access ACL, and the malformed security descriptor is stored raw after being accepted because parse_dacl() breaks on a bad ACE instead of returning an error.

483) Out-of-bounds read (CVE-ID: CVE-2026-68098)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in set_posix_acl_entries_dacl() in ksmbd when processing a DACL whose ACE copying stops early because size accounting overflows. A local user can provide a crafted DACL that causes the dedup walk to scan past the copied ACE array and disclose sensitive information.

The issue occurs because the dedup walk is bounded by the original NT ACE count rather than the number of ACEs actually copied into the rebuilt DACL.

484) Out-of-bounds read (CVE-ID: CVE-2026-68097)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in set_ntacl_dacl() in ksmbd when processing crafted ACE data in NT ACLs. A remote user can supply an undersized ACE with a SID sub-authority count that exceeds the declared ACE size to cause a denial of service.

The out-of-bounds access occurs later during the POSIX ACL deduplication walk after the malformed ACE has been copied.

485) Deadlock (CVE-ID: CVE-2026-68096)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a recursive locking deadlock in audit_dupe_exe() in the Linux kernel audit subsystem when handling file move events for executable audit rules. A local user can move a file that matches an existing executable audit rule to cause a denial of service.

Exploitation requires an existing executable audit rule that matches the file being moved.

486) Improper resource shutdown or release (CVE-ID: CVE-2026-68091)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in wacom_parse_and_register() in the Wacom HID driver when handling post-start probe failures. A local user can trigger a device initialization failure after HID hardware has been started to cause a denial of service.

487) Race condition (CVE-ID: CVE-2026-64600)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in xfs_reflink_fill_cow_hole and xfs_reflink_fill_delalloc in the XFS reflink code when processing direct I/O writes after cycling the ILOCK. A local user can trigger a racing direct I/O write operation to cause a denial of service.

The issue occurs because a stale data fork mapping can be used after the ILOCK is dropped and reacquired, which can result in incorrect shared-block state during copy-on-write handling.

488) Double free (CVE-ID: CVE-2026-64599)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in meson_crypto_probe() when handling a failure after partial channel list allocation during device probe. A local user can trigger the vulnerable probe path to cause a denial of service.

The issue was reproduced by forcing the second dma_alloc_attrs() call in the gxl-crypto probe path to fail after partial initialization.

489) Use-after-free (CVE-ID: CVE-2026-64585)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in esd_usb_disconnect() and unlink_all_urbs() when handling USB device disconnect events. A local user can trigger a device disconnect condition to cause a denial of service.

The issue occurs because per-netdev private data embedded in the net_device allocation is dereferenced after free during teardown.

490) Use-after-free (CVE-ID: CVE-2026-64584)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the f_midi driver work handler when handling concurrent userspace writes to an open rawmidi substream during device teardown. A local user can write to a rawmidi substream to trigger pending work on a freed midi object and cause a denial of service.

The issue occurs because the rawmidi device can remain usable by an open substream after USB endpoints have been disabled and before the final midi object reference is released.

491) Use-after-free (CVE-ID: CVE-2026-64583)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Broadcom BDC USB gadget UDC driver IRQ handler and delayed work processing when tearing down the driver during device removal. A local user can trigger a shared interrupt or delayed work execution during teardown to cause a denial of service.

The issue occurs in the window after teardown of endpoint and DMA-related structures begins while the IRQ handler remains deliverable, and delayed work may also execute after removal.

492) Use-after-free (CVE-ID: CVE-2026-64582)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in rxe_mmap in the RDMA/rxe subsystem when processing a memory mapping request concurrently with a DESTROY_CQ ioctl. A local user can trigger a race condition to cause a denial of service or execute arbitrary code.

Exploitation requires winning a narrow race window between the mmap path and concurrent object destruction.

493) Double free (CVE-ID: CVE-2026-64581)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in xfrm_user_policy() when racing a per-socket policy change with packet transmission on a connected UDP socket. A local user can trigger concurrent socket operations to cause a denial of service.

The issue is reachable by an unprivileged user via a user and network namespace.

494) Double free (CVE-ID: CVE-2026-64580)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in xfrm6_fill_dst() when handling an error path after in6_dev_get(dev) returns NULL. A local user can trigger network operations that reach the affected code path to cause a denial of service.

The issue underflows a net_device reference count and can lead to kernel warnings while waiting for the device to become free.

495) Out-of-bounds read (CVE-ID: CVE-2026-64578)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ksmbd_smb2_check_message() when processing a crafted compound SMB2 request. A remote attacker can send a specially crafted compound request with a trailing element that is too small to hold StructureSize2 to disclose sensitive information.

The issue occurs when the last compound element contains only a 64-byte SMB2 header, causing a 2-byte read at offset 64 to extend past the receive buffer.

496) Unchecked Return Value (CVE-ID: CVE-2026-64577)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of a failed buffer pull in gtp1u_send_echo_resp() in the Linux kernel GTP implementation when processing a crafted short echo request packet. A remote attacker can send a specially crafted packet to cause a kernel panic.

The issue is triggered by a 16 to 19 byte echo request that causes skb_pull_data() to fail while execution continues and skb data is moved below the buffer head.

497) Use of Uninitialized Variable (CVE-ID: CVE-2026-64576)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in nh_res_bucket_migrate() when handling rtnetlink nexthop operations. A local user can send a specially crafted netlink message to cause a denial of service.

The issue can lead to a general protection fault and kernel panic when an error path dereferences an uninitialized extack message pointer.

498) Use-after-free (CVE-ID: CVE-2026-64574)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ieee80211_if_read_link and related mac80211 link handling when reading debugfs link files after a vif link update error path leaves stale debugfs entries for newly added links. A local user can open and read a debugfs link file referencing freed memory to cause a denial of service.

The issue is triggered when drv_change_vif_links() fails after new links have been allocated and initialized.

499) Double free (CVE-ID: CVE-2026-64570)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in ieee80211_set_fils_discovery() when handling FILS discovery template updates after an allocation failure. A local user can trigger an allocation failure and cause the same object to be queued for freeing multiple times to cause a denial of service.

The issue is triggered when a later update or AP teardown re-queues an object that still points to memory already scheduled for RCU freeing.

500) Double free (CVE-ID: CVE-2026-64568)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in ieee80211_set_unsol_bcast_probe_resp() when handling updates to unsolicited broadcast probe response templates after an allocation failure. A local user can trigger a later update or AP teardown to cause a denial of service.

The issue occurs because the pointer can still reference an object already queued for RCU freeing after kzalloc() fails.

501) Out-of-bounds read (CVE-ID: CVE-2026-64567)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in io_ctl_check_crc() in the btrfs free space cache loader when loading a corrupted v1 free space cache. A local user can modify free space cache header counts to exceed the number of allocated pages to cause a denial of service.

The invalid out-of-bounds slot is treated as a struct page and can lead to a general protection fault during crc32c() processing.

502) Use-after-free (CVE-ID: CVE-2026-64563)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in rhashtable_walk_next in the rhashtable iterator logic when resuming multi-fragment rhashtable walks across walk_stop and walk_start boundaries after a table restart. A local user can trigger a stale iterator pointer dereference to cause a denial of service.

Concrete affected call paths include netlink_diag and TIPC.

503) Use-after-free (CVE-ID: CVE-2026-64560)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the posix CPU timers subsystem when handling a non-leader exec() race involving POSIX CPU timer deletion, setting, or rearming. A local user can trigger concurrent exec() and timer operations to execute arbitrary code.

The issue occurs when a TGID-targeted timer remains inherited across exec(), and can also cause user-visible transient -ESRCH errors or prevent timer rearming.

504) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64556)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to improper state management in perf_event_remove_on_exec() and event group handling in the perf subsystem when removing events marked remove_on_exec. A local user can trigger event removal for a group leader with surviving siblings to corrupt kernel memory.

The issue occurs when a removed event is a group leader and sibling events without remove_on_exec remain active in a stale group state.

505) Out-of-bounds read (CVE-ID: CVE-2026-64550)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rmnet_map_ingress_handler() and __rmnet_map_ingress_handler() when processing a crafted short MAP frame on the no-aggregation ingress path. A local user can send a specially crafted frame to disclose sensitive information.

The issue occurs when ingress deaggregation is disabled, causing packet parsing to use the on-wire packet length without verifying skb->len first.

506) Out-of-bounds read (CVE-ID: CVE-2026-64547)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in net1080_rx_fixup() when processing a crafted short frame from a malicious NetChip 1080 device. An attacker with physical access can send a frame advertising a large even packet length to cause a denial of service.

507) Out-of-bounds read (CVE-ID: CVE-2026-64546)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in drm_parse_tiled_block() when parsing a crafted DisplayID tiled-display block in EDID data. A local user can supply crafted EDID data with a truncated tiled-display block to disclose sensitive information.

The issue is triggered when the tiled-display block declares a small payload length near the end of a DisplayID extension.

508) NULL pointer dereference (CVE-ID: CVE-2026-64545)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in xdp_master_redirect() when processing XDP_TX on a bond slave during upper-master unlinking. A local user can trigger packet processing in this race window to cause a denial of service.

The issue can lead to a kernel panic when the receiving device no longer has an upper-master adjacency but is still treated as a bond slave.

509) Use-after-free (CVE-ID: CVE-2026-64543)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tipc_disc_rcv() when processing TIPC discovery messages on a UDP bearer. A local user can trigger network namespace-accessible TIPC bearer operations and send crafted traffic to cause a denial of service.

Exploitation requires CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. The affected functionality is reachable from an unprivileged user namespace because the TIPCv2 generic netlink family is netnsok and its bearer commands do not require GENL_ADMIN_PERM.

510) Out-of-bounds read (CVE-ID: CVE-2026-64540)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in genelink_rx_fixup() when processing device-supplied aggregated RX frames from a crafted GeneLink (GL620A) USB device. An attacker with physical access can provide a short URB with inconsistent packet length metadata to disclose sensitive information.

The issue can leak adjacent kernel heap contents to the network stack as soon as the USB network interface is up.

511) Stack-based buffer overflow (CVE-ID: CVE-2026-64539)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in eir_create_adv_data() in the Bluetooth EIR advertising data builder when constructing legacy advertising data for an LE-only controller. A local user can supply crafted advertising instance data to trigger a stack out-of-bounds write and cause a denial of service.

Exploitation requires CAP_NET_ADMIN and access to the legacy advertising path on an LE-only controller.

512) Out-of-bounds read (CVE-ID: CVE-2026-64536)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in is_ap_in_tkip() in drivers/staging/rtl8723bs/core/rtw_wlan_util.c when parsing information elements from network data. A remote attacker can provide a truncated or crafted information element buffer to cause a denial of service.

513) Out-of-bounds read (CVE-ID: CVE-2026-64533)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in log_replay() in fs/ntfs3 when replaying a malformed NTFS filesystem restart table. A local user can provide a specially crafted filesystem image to cause a denial of service.

The issue occurs during conversion of DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records for version 0 restart tables.

514) Out-of-bounds write (CVE-ID: CVE-2026-64532)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in do_action() in fs/ntfs3/fslog.c when processing a crafted on-disk NTFS index entry in UpdateRecordDataRoot or UpdateRecordDataAllocation. A local user can mount or otherwise supply a specially crafted NTFS image to trigger the out-of-bounds write and cause a denial of service.

The issue occurs because view.data_off and the resulting write length are not properly bounded against the NTFS_DE entry size.

515) Out-of-bounds read (CVE-ID: CVE-2026-64524)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Hyper-V DRM protocol resolution response parser when processing a crafted SYNTHVID_RESOLUTION_RESPONSE message. A remote attacker can send a specially crafted resolution response with an oversized resolution_count value to cause a denial of service.

The issue affects the drm/hyperv code path while parsing supported display resolutions from the host.

516) Out-of-bounds read (CVE-ID: CVE-2026-64496)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the iio event FIFO handling in drivers/iio/industrialio-event.c when reading from a newly created event file descriptor concurrently with FIFO reset. A local user can read from the file descriptor from another thread to disclose sensitive information.

Exploitation requires shared file descriptor table access between threads, creating a race window before the fd number is returned to userspace.

517) Use-after-free (CVE-ID: CVE-2026-64481)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the cs35l41_hda firmware load work and ALSA control handling when a firmware load is requested and queued work executes after component unbind or device removal. A local user can trigger a firmware load request and remove the component or device before the queued work runs to cause a denial of service.

Exploitation requires firmware autostart to be disabled and can occur before DSP initialization.

518) Use-after-free (CVE-ID: CVE-2026-64469)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in binder_thread_release() when releasing binder threads while transactions are being freed in parallel. A local user can trigger concurrent binder transaction activity to cause a denial of service.

The issue is caused by a race condition involving transaction stack cleanup during thread exit and parallel process teardown.

519) Use-after-free (CVE-ID: CVE-2026-64468)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in binder_free_transaction() when freeing binder transactions. A local user can trigger a race condition involving a binder transaction to cause a denial of service.

The issue occurs because the target process can be freed after its reference is read and before its inner lock is acquired.

520) Improper resource shutdown or release (CVE-ID: CVE-2026-64463)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the rt1711h_probe() TCPCI port registration handling in drivers/usb/typec/tcpm/tcpci_rt1711h.c when handling device probe failures after registering a TCPCI port. A local user can trigger a device probe failure after port registration to cause a denial of service.

The issue occurs because the TCPCI port is not unregistered when later probe steps fail.

521) Out-of-bounds read (CVE-ID: CVE-2026-64456)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the virtio-rng driver copy_data() function when processing device-reported used.len values from a virtio-rng backend. A remote attacker can provide a specially crafted length value to disclose sensitive information.

The issue can leak adjacent guest-kernel slab contents through the guest RNG and can also be observed directly via /dev/hwrng. No guest userspace interaction is required for the initial out-of-bounds read to occur.

522) Use-after-free (CVE-ID: CVE-2026-64452)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in lowpan_nhc_do_uncompression() when processing a malformed 6LoWPAN packet on an error path. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue is caused by a race condition involving descriptor unregistration and access to nhc->name outside the protection of lowpan_nhc_lock, and it can be reached through the Bluetooth 6LoWPAN L2CAP receive path.

523) Heap-based buffer overflow (CVE-ID: CVE-2026-64449)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the SLAVE-path helpers buffer_to_user() and buffer_from_user() in drivers/staging/vme_user/vme_user.c when processing read and write operations with an offset and count that exceed the fixed kern_buf size. A local user can issue crafted read or write operations to cause a denial of service or execute arbitrary code.

The issue occurs when the configured slave window exceeds the 128 KiB kern_buf allocation.

524) Out-of-bounds read (CVE-ID: CVE-2026-64448)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in smb2_check_message() and subsequent SMB client protocol decoders when processing crafted SMB2 responses with a data area. A remote attacker can send a specially crafted SMB server response to disclose sensitive information.

The issue is reachable during NEGOTIATE and SESSION_SETUP before the session is established, including through the SPNEGO/negTokenInit and NTLMSSP challenge decoders when mounting against a non-conforming server.

525) Out-of-bounds read (CVE-ID: CVE-2026-64444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in OnAssocRsp() in the rtl8723bs driver when parsing a crafted association response frame. A remote attacker can send a specially crafted association response frame to disclose sensitive information.

The issue can be triggered by a malicious access point through a truncated information element in the frame.

526) Out-of-bounds read (CVE-ID: CVE-2026-64443)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the update_beacon_info() IE parsing loop in rtl8723bs when parsing a crafted Beacon frame from a malicious access point. A remote attacker can send a specially crafted Beacon frame to disclose sensitive information.

The issue can be triggered when the last information element is truncated or when an information element declares a length that extends past the available frame data.

527) Out-of-bounds read (CVE-ID: CVE-2026-64442)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in IE parsing loops in issue_assocreq() and join_cmd_hdl() when processing AP beacon and probe-response frames with a truncated final information element. A remote attacker can send a malicious AP beacon or probe-response frame with a truncated final information element to cause a denial of service.

The issue is triggered when the stored IE data ends with an element_id byte without a following length byte.

528) Out-of-bounds write (CVE-ID: CVE-2026-64440)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in HT_caps_handler() when parsing a crafted 802.11 association response frame. A remote attacker can send a malicious access point response with an oversized HT Capabilities information element to cause memory corruption.

The issue can write beyond the fixed 26-byte HT_cap array into adjacent fields of struct mlme_ext_info.

529) Use of Uninitialized Variable (CVE-ID: CVE-2026-64436)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in pfkey_msg2xfrm_state() when processing a PF_KEY IPComp state and migrating it. A local user can add a crafted IPComp security association via PF_KEY and trigger migration to cause a denial of service.

The issue affects the PF_KEY path for IPComp states; the XFRM netlink path is not affected.

530) Race condition (CVE-ID: CVE-2026-64435)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a data race in audit_queue handling in kernel/audit.c when reading queue length concurrently with queue updates. A local user can trigger audit activity to cause a denial of service.

The issue affects multiple lockless readers of the audit queue length in the audit subsystem.

531) Out-of-bounds write (CVE-ID: CVE-2026-64432)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in log_replay in fs/ntfs3/fslog.c when mounting a crafted NTFS image and replaying the $LogFile journal. A local user can provide a specially crafted NTFS image to cause a denial of service or execute arbitrary code.

The issue can be triggered at mount time during the analysis pass when LCNs from an action log record are copied into an existing Dirty Page Table entry, and integer underflow in the target VCN delta can drive the destination index past the allocated page_lcns array.

532) Race condition (CVE-ID: CVE-2026-64430)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource access in the ntb_epf_vec_isr interrupt handler in drivers/ntb/hw/epf/ntb_hw_epf.c when handling interrupts and deriving the vector number through pci_irq_vector() in hardirq context. A local user can trigger the vulnerable interrupt handling path to cause a denial of service.

The issue can result in "scheduling while atomic" kernel splats because pci_irq_vector() reaches code that takes a mutex in hardirq context.

533) Use-after-free (CVE-ID: CVE-2026-64423)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the IGMP multicast group handling in net/ipv4/igmp.c when destroying a device while concurrent RCU readers traverse the multicast hash table. A local user can trigger multicast group membership operations and concurrent network processing to cause a denial of service.

The issue occurs because multicast group entries can remain reachable through the device multicast hash table during RCU reclamation.

534) Out-of-bounds read (CVE-ID: CVE-2026-64422)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tcp_mtu_probe() when processing an invalid net.ipv4.tcp_reordering value during MTU probing. A local user can write a negative tcp_reordering value to trigger the out-of-bounds read and disclose sensitive information.

Exploitation requires tcp_mtu_probing to be set to 2.

535) Use-after-free (CVE-ID: CVE-2026-64420)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the cros_ec device probe handling in drivers/mfd/cros_ec_dev.c when sub-drivers access platform device drvdata after probe failure. A local user can trigger a failed probe and subsequent access to a stale pointer to cause a denial of service.

The issue occurs because the stale drvdata pointer remains accessible to sub-drivers such as cros_ec_typec after the underlying cros_ec_dev structure has already been released.

536) Race condition (CVE-ID: CVE-2026-64418)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to use-after-free or double-free in shrinker_info teardown in mm/shrinker.c when handling memcg shrinker_info expansion and teardown during memory cgroup online and shrinker allocation operations. A local user can trigger concurrent memory cgroup and shrinker operations to cause a denial of service.

The issue occurs when a partially initialized or already published shrinker_info array remains visible to iteration during teardown.

537) Improper Initialization (CVE-ID: CVE-2026-64413)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the ebtables table translation logic in net/bridge/netfilter/ebtables.c when allocating and freeing the chainstack array. A local user can trigger an allocation failure during table translation to cause a denial of service.

The issue arises when a sparse cpu_possible_mask causes an uninitialized chainstack entry to be freed during cleanup.

538) Improper input validation (CVE-ID: CVE-2026-64412)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ebtables match handling code in net/bridge/netfilter/ebtables.c when processing a crafted module name. A local user can supply a non-null-terminated module name to cause a denial of service.

539) Out-of-bounds read (CVE-ID: CVE-2026-64411)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in find_table_lock() table name handling when processing a user-supplied ebtables table name through setsockopt calls. A local user can supply a non-null-terminated table name to trigger a read past the end of the name buffer and disclose sensitive information.

The issue occurs on a lookup miss when module autoload formatting uses the supplied table name.

540) Out-of-bounds read (CVE-ID: CVE-2026-64403)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in l2cap_get_conf_opt() when parsing L2CAP configuration options. A remote attacker can send a specially crafted Bluetooth L2CAP packet to cause a denial of service.

The read occurs before the malformed option is rejected, and up to 4 bytes may be read past the end of the buffer.

541) Out-of-bounds write (CVE-ID: CVE-2026-64402)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in smb_sync_perf_buffer() when copying hardware trace data into perf AUX ring buffer pages. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when the SMB sink is used as a perf AUX sink.

542) Use-after-free (CVE-ID: CVE-2026-64401)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the SMB client witness notification handling in fs/smb/client/cifs_swn.c when processing witness notifications for shared registrations. A local user can trigger notification handling involving a freed tcon pointer to cause a denial of service.

Exploitation requires a same-share second mount so that a registration remains live after the first tcon is unregistered and freed.

543) Improper access control (CVE-ID: CVE-2026-64398)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify file data without the required file write permission.

The vulnerability exists due to improper access control in smb2_ioctl() when processing FSCTL_SET_ZERO_DATA requests. A remote user can use a handle opened with only FILE_WRITE_ATTRIBUTES to zero file data and modify file contents without the required FILE_WRITE_DATA right.

The issue affects ksmbd, and the advisory states it was reproduced by an authenticated SMB client using a handle that was granted FILE_WRITE_ATTRIBUTES but not FILE_WRITE_DATA.

544) Improper access control (CVE-ID: CVE-2026-64395)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in FSCTL_DUPLICATE_EXTENTS_TO_FILE handling in ksmbd when processing duplicate extents requests. A remote user can use a source handle opened without read access to copy file contents into an attacker-readable destination to disclose sensitive information.

The issue affects the source file access check before invoking file range clone or copy operations.

545) Incorrect Implementation of Authentication Algorithm (CVE-ID: CVE-2026-64389)

CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify session key material.

The vulnerability exists due to improper authentication logic in ksmbd NTLMv2 authentication handling when processing SMB3 multichannel binding session setup requests with KEY_XCH. A remote user can send a binding session setup with a bad NT proof and KEY_XCH to modify session key material.

The issue occurs on an existing session because the failed authentication path does not expire binding sessions.

546) Improper access control (CVE-ID: CVE-2026-64388)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass ownership and group changes.

The vulnerability exists due to improper access control in cifs_setattr_nounix() when processing chown and chgrp operations on mounts using SMB3 POSIX Extensions. A local user can change file ownership or group attributes in a way that is ignored to bypass ownership and group changes.

The issue occurs only when SMB3 POSIX Extensions are used without the relevant ACL or SID-based mount options enabled.

547) Out-of-bounds read (CVE-ID: CVE-2026-64380)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in posix_info_sid_size() in the SMB client when parsing truncated POSIX SIDs. A remote attacker can send a specially crafted SMB response to cause a denial of service.

548) Improper input validation (CVE-ID: CVE-2026-64379)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify file mode bits.

The vulnerability exists due to improper input validation in parse_dacl() when processing a server-provided NFS mode SID. A remote attacker can provide crafted mode values to modify file mode bits.

The issue occurs when modefromsid is active.

549) Race condition (CVE-ID: CVE-2026-64378)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb() when unmounting a filesystem while switching inode writeback state. A local user can trigger a container exit or unmount operation during concurrent writeback activity to cause a denial of service.

The issue can lead to busy inodes after unmount and a subsequent use-after-free in writeback cleanup paths.

550) Race condition (CVE-ID: CVE-2026-64375)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a race condition in proc_pid_get_link() and proc_pid_readlink() when handling access to /proc pid link targets. A local user can trigger concurrent task state changes to disclose sensitive information.

The issue affects file descriptor-related proc links and involves ptrace_may_access() checks performed on a different task lookup than the one used for the actual access.

551) Deadlock (CVE-ID: CVE-2026-64374)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a live lock condition in the linux kernel scheduler RT_PUSH_IPI logic when handling RT task migration and repeated inter-processor interrupts on non-PREEMPT_RT systems. A local user can trigger heavy networking activity and wake RT tasks to cause a denial of service.

The issue occurs on non-PREEMPT_RT systems when softirqs execute for long periods and prevent the target CPU from returning to task context.

552) Use-after-free (CVE-ID: CVE-2026-64372)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in pcc_cpufreq_do_osc() when performing two-phase _OSC negotiation through acpi_evaluate_object(). A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue also involves a double free after the stale pointer is freed again.

553) Improper Initialization (CVE-ID: CVE-2026-64368)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in slab allocation handling in mm/slub.c when allocating kmalloc objects with zeroing enabled. A local user can trigger a memory allocation pattern that leaves part of the allocated object uninitialized to disclose sensitive information.

The issue occurs when requested-size tracking is not enabled while red zoning alone is enabled, which can break krealloc() __GFP_ZERO expectations.

554) Out-of-bounds write (CVE-ID: CVE-2026-64333)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to memory corruption in digi_write_inb_command() in the digi_acceleport usb serial driver when handling usb serial write commands while the write urb is in use. A local user can trigger a timeout or no-timeout command path to corrupt the write urb buffer to cause memory corruption.

On 32-bit systems, one corruption path is triggered by a broken jiffies comparison after several minutes of system uptime, while commands such as break control can corrupt the urb immediately when no timeout is used.

555) Out-of-bounds read (CVE-ID: CVE-2026-64324)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in udf_free_blocks() and block bitmap handling in fs/udf/balloc.c when processing crafted UDF filesystem block extents. A local user can supply a crafted filesystem and truncate a writable file on it to cause a denial of service.

On systems where active users can mount removable UDF media without administrative privileges, user interaction is not required beyond mounting the media and truncating a file.

556) Out-of-bounds read (CVE-ID: CVE-2026-64323)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in udf_load_vat() and udf_get_pblock_virt15() when mounting a crafted UDF image with a virtual (VAT) partition. A local user can provide a crafted UDF image with an oversized VAT header length to disclose sensitive information.

User interaction is required to mount the crafted filesystem image.

557) Out-of-bounds write (CVE-ID: CVE-2026-64322)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and corrupt memory.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in udf sparing table handling in fs/udf/super.c when parsing a crafted UDF image. A local user can mount or otherwise trigger processing of a specially crafted UDF image to disclose sensitive information and corrupt memory.

The issue is caused by validating reallocationTableLen as a byte count even though it is later used as an entry count for sparingEntry array access.

558) Out-of-bounds read (CVE-ID: CVE-2026-64318)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the aix partition parser when scanning the physical-partition-extent array from a crafted AIX/IBM partition table. A local user can supply a crafted block-device image to disclose sensitive information.

The issue can be triggered during partition scanning without mounting the filesystem, including when a crafted image is attached with partition scanning enabled or when a device is auto-scanned by udev.

559) Out-of-bounds read (CVE-ID: CVE-2026-64317)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Rock Ridge SL record handling in fs/isofs/rock.c when parsing a crafted ISO 9660 image containing a malformed symbolic link record. A local user can supply a crafted filesystem image to disclose sensitive information.

The issue can copy adjacent kernel memory into the symlink body returned to user space by readlink().

560) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64312)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper callback handling in the pcrypt aead fallback path in crypto/pcrypt.c when processing non-parallel fallback after padata submission returns -EBUSY. A local user can trigger asynchronous cryptographic operations that use the fallback path to cause a denial of service.

561) Out-of-bounds write (CVE-ID: CVE-2026-64304)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in qat_rsa_setkey_crt() when processing RSA CRT key components larger than half of the key size. A local user can provide a crafted RSA CRT key to cause memory corruption.

The issue occurs because CRT components are bounded by the modulus size in the generic RSA key parser, while the QAT driver allocates half-size DMA buffers for those components.

562) Out-of-bounds read (CVE-ID: CVE-2026-64299)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in regex_match_glob() glob matching in the tracing event filter subsystem when processing non-NUL-terminated string event fields. A local user can supply a crafted glob filter against such fields to disclose sensitive information.

One reported path reaches the issue from the xfs_lookup tracepoint, and the affected string fields may be dynamic char arrays copied without a trailing NUL byte.

563) Improper access control (CVE-ID: CVE-2026-64298)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass file write permission checks and truncate a file.

The vulnerability exists due to improper access control in nfs_open_permission_mask() when handling open requests with O_TRUNC on NFSv4 delegated opens. A local user can open a file with O_RDONLY | O_TRUNC to bypass file write permission checks and truncate a file.

This issue occurs when the client satisfies the OPEN locally from a cached write delegation and then sends truncation to the server using delegation state.

564) Out-of-bounds write (CVE-ID: CVE-2026-64296)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read and write.

The vulnerability exists due to an out-of-bounds write in exfat_find_dir_entry() when parsing crafted exfat directory entries containing many short name fragments. A local user can provide a crafted directory structure to cause an out-of-bounds read and write.

The issue occurs because the per-entry output pointer advances by a fixed amount while the tracked accumulated name length can remain smaller when a name fragment contains an early NUL.

565) Out-of-bounds read (CVE-ID: CVE-2026-64287)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in flush_hyp_vcpu() and the vGIC list register save and restore logic when copying host-controlled vgic_v3 state into the pKVM hyp vCPU. A local privileged user can provide a crafted used_lrs value to trigger out-of-bounds access at EL2 to cause a denial of service.

The issue affects arm64 KVM with pKVM and involves host-to-EL2 state transfer.

566) Use-after-free (CVE-ID: CVE-2026-64286)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a stale pointer in flush_hyp_vcpu() when copying the host vCPU context into the hyp private vCPU. A local user can provide a crafted __hyp_running_vcpu value to cause a denial of service.

The issue occurs on arm64 KVM with pKVM at EL2 during vCPU context handling.

567) Integer overflow (CVE-ID: CVE-2026-64283)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass a file size check.

The vulnerability exists due to an integer overflow in the KVM guest_memfd memslot binding logic when binding a memslot to a guest_memfd file. A local user can supply a crafted offset and size combination to bypass a file size check.

The issue affects the sum of the offset and size values, where a very large offset can cause the signed 64-bit result to become negative during validation.

568) Use-after-free (CVE-ID: CVE-2026-64279)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the i2c core adapter lookup and deregistration logic when looking up an adapter by id during adapter deregistration or registration failure. A local user can trigger a race condition to cause a denial of service.

569) Out-of-bounds read (CVE-ID: CVE-2026-64277)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and overwrite adjacent kernel memory.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in the synaptics-rmi4 F3A GPIO keymap handling in drivers/input/rmi4/rmi_f3a.c when processing a device that reports a gpio_count greater than the allocated keymap size. A local user can open the evdev node and invoke keymap ioctls to disclose sensitive information and overwrite adjacent kernel memory.

The information disclosure occurs through EVIOCGKEYCODE leaking adjacent slab memory to user space, while EVIOCSKEYCODE writes a caller-controlled value past the buffer.

570) Out-of-bounds read (CVE-ID: CVE-2026-64276)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in the rmi_f30_attention handler and EVIOCGKEYCODE/EVIOCSKEYCODE ioctl handling in the synaptics-rmi4 F30 driver when processing a device that reports a gpioled_count greater than 6 with GPIO support enabled. A local user can trigger the attention interrupt or use EVIOCGKEYCODE/EVIOCSKEYCODE ioctls to cause a denial of service or disclose sensitive information.

The issue occurs because the keymap allocation is smaller than the gpioled_count value used for iteration and keycode bounds.

571) Stack-based buffer overflow (CVE-ID: CVE-2026-64274)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to a stack-based out-of-bounds write in goodix_ts_read_input_report() when processing device-reported touch contact data. A remote attacker can tamper with the I2C bus or use a malicious controller to write beyond an on-stack buffer and cause memory corruption.

The issue occurs because the maximum contact count taken from a 4-bit device configuration field can exceed the number of contacts the buffer is sized to hold.

572) Out-of-bounds write (CVE-ID: CVE-2026-64273)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in iforce_process_packet() when processing a device-reported force-feedback status packet. An attacker with physical access can supply a crafted device payload with an out-of-range effect index to corrupt kernel memory.

The issue affects both USB interrupt endpoint and serio transports, and the status handling path is not gated on force-feedback support being present.

573) Memory corruption (CVE-ID: CVE-2026-64272)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory access in the mms114 touchscreen driver when processing touch data packets from MMS134S and MMS136 controllers. A local user can trigger crafted touch event data to cause a denial of service.

The issue affects handling of touch events beyond the first one because 6-byte events are parsed using 8-byte structure indexing.

574) Out-of-bounds write (CVE-ID: CVE-2026-64271)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to overwrite heap memory.

The vulnerability exists due to out-of-bounds write in the tw_interrupt() handler in drivers/input/touchscreen/touchwin.c when processing serial input from a Touchwindow peripheral. An attacker with physical access can send crafted non-zero bytes with mismatched second and third packet bytes to overwrite heap memory.

Exploitation requires a malicious, malfunctioning, or counterfeit Touchwindow peripheral.

575) Stack-based buffer overflow (CVE-ID: CVE-2026-64270)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to overwrite stack memory and cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in mms114_interrupt() when processing a device-reported packet size from the touchscreen controller over the I2C bus. A local attacker can tamper with the I2C bus or use a malicious controller to supply an oversized packet size to overwrite stack memory and cause a denial of service.

The out-of-bounds write occurs on the IRQ-thread stack and may overwrite the stack canary, saved registers, and the return address.

576) Use-after-free (CVE-ID: CVE-2026-64266)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fuse_ref_folio() in the FUSE subsystem when handling a subsequent copy chain after unlocking the request. A local user can trigger request abort and asynchronous end callback timing to cause a denial of service.

577) Use-after-free (CVE-ID: CVE-2026-64246)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in linkstation_poweroff_init() when initializing the linkstation poweroff driver. A local attacker can trigger the vulnerable initialization path to cause a denial of service.

578) Use-after-free (CVE-ID: CVE-2026-64245)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fb_find_mode() in the fbdev modedb component when processing a NULL mode option. A local user can trigger the vulnerable code path to cause a denial of service.

579) Out-of-bounds read (CVE-ID: CVE-2026-64243)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in simple_mux_control_put() when processing enumerated control values. A local user can supply an invalid enumerated item value to trigger an out-of-bounds read and cause a denial of service.

580) Double free (CVE-ID: CVE-2026-64242)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in net2280_probe() error handling in the net2280 usb gadget driver when probing a device. A local user can trigger the probe error path to cause a denial of service.

581) Use-after-free (CVE-ID: CVE-2026-64239)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in DAMON sysfs tried region directory handling when refreshing scheme tried region directories. A local user can repeatedly request directory refresh operations to cause a use-after-free.

The issue can be reproduced on kernels built with CONFIG_DEBUG_KOBJECT_RELEASE because delayed kobject release callbacks can leave freed region objects referenced from the linked list during directory regeneration.

582) Double free (CVE-ID: CVE-2026-64222)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in otx2_pool_aq_init() and cn20k_pool_aq_init() when handling allocation or mailbox synchronization failures during pool initialization. A local user can trigger the affected error path to cause a denial of service.

Exploitation requires OcteonTX2 or CN20K hardware.

583) Race condition (CVE-ID: CVE-2026-64210)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mlx5e ICOSQ handling in the Linux kernel mlx5 driver when processing NAPI poll work during CPU affinity changes. A local user can trigger concurrent ICOSQ operations to cause a denial of service.

The issue occurs when affinity changes while XSK work remains pending.

584) Use-after-free (CVE-ID: CVE-2026-64189)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in ip_set_dump_do() and ip_set_dump_done() in the ipset netfilter subsystem when handling netlink dump operations concurrently with ip_set_list resizing. A local user can trigger concurrent netlink dump and set creation operations to cause a denial of service.

The issue can lead to a general protection fault and kernel panic.

585) Use-after-free (CVE-ID: CVE-2026-64188)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in rmnet_dellink() and the rmnet endpoint handling in the Qualcomm rmnet driver when processing network packets on the receive path while an endpoint is being removed. A local user can trigger concurrent packet processing and endpoint deletion to cause a denial of service.

The stale read occurs when lockless RCU readers dereference the egress_dev pointer after the endpoint memory has been freed.

586) Use-after-free (CVE-ID: CVE-2026-64123)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information or cause a denial of service.

The vulnerability exists due to a use-after-free in the hsr node table handling code when processing generic-netlink node-list or node-status operations concurrently with RTM_DELLINK teardown. A local user can trigger concurrent netlink operations to disclose sensitive information or cause a denial of service.

The generic-netlink reader accesses node entries under RCU and may retain a node pointer while teardown frees the same entry.

587) Race condition (CVE-ID: CVE-2026-64095)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the batman-adv bridge loop avoidance subsystem when handling concurrent backbone gateway state changes and request tracking. A local user can trigger concurrent operations to cause a denial of service.

The issue stems from non-atomic updates to request state and the bla.num_requests counter across multiple concurrent code paths.

588) Out-of-bounds read (CVE-ID: CVE-2026-64036)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in the css_rstat_updated() BPF kfunc when processing a caller-provided cpu argument. A local privileged user can pass an invalid cpu value to trigger an out-of-bounds access and cause a denial of service.

Exploitation requires a BPF iter/cgroup program with CAP_BPF and CAP_PERFMON.

589) Memory corruption (CVE-ID: CVE-2026-64026)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause pagecache corruption.

The vulnerability exists due to memory corruption in the Linux kernel RxRPC recvmsg handling when decrypting locally transmitted DATA packets processed through splice(). A local user can trigger crafted local packet handling to cause pagecache corruption.

The issue affects in-place decryption of shared packet data, and MSG_PEEK may influence which packet is decrypted and require re-decryption during subsequent recvmsg() processing.

590) Use-after-free (CVE-ID: CVE-2026-64023)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the gpio aggregator lookup table handling in drivers/gpio/gpio-aggregator.c when processing concurrent lookup operations during error cleanup. A local user can trigger a race condition that causes gpiod_find() to dereference freed memory to cause a denial of service.

The issue occurs when a concurrent thread reaches gpiod_match_lookup_table() before the lookup table entry is removed.

591) Use-after-free (CVE-ID: CVE-2026-64017)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in blk-mq cached request handling in block/blk-mq.c when submitting a bio while a cached request is peeked and the task sleeps before it is removed from the plug list. A local user can trigger request handling that hits this race condition to cause a denial of service.

The issue occurs when a plug flush frees cached requests before the cached request is popped for use.

592) Integer underflow (CVE-ID: CVE-2026-64009)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow leading to an out-of-bounds write in the esp component, specifically xfrm_state_mtu(), when processing a UDP datagram through an IPv4 ESP tunnel SA with attacker-controlled parameters. A local user can install a crafted IPv4 ESP tunnel SA and send a UDP datagram through the tunnel to cause a denial of service.

The issue involves a negative length being sign-extended to size_t before being passed to memset() in esp_output_fill_trailer().

593) Improper Initialization (CVE-ID: CVE-2026-64005)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the SMC hash tables in net/smc/af_smc.c when initializing the SMC subsystem. A local user can trigger use of corrupted hash list state to cause a denial of service.

The issue can occur when the hash tables are re-initialized after hash entries already exist and are in use, potentially resulting in a corrupted list.

594) Race condition (CVE-ID: CVE-2026-64004)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the AF_IUCV getsockopt handler when racing recvmsg() with getsockopt(SO_MSGSIZE). A local user can trigger concurrent socket operations to cause a denial of service.

The issue can lead to a NULL pointer dereference in the kernel.

595) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64003)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state handling in scsi_run_host_queues() when processing requeued commands during SCSI host recovery and device removal. A local user can trigger SCSI error recovery and device removal conditions to cause a denial of service.

The issue can leave requeued requests stuck and cause the affected device removal process to hang.

596) Use-after-free (CVE-ID: CVE-2026-64002)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ipv4_sysctl_exit_net() when unregistering the IPv4 sysctl table while sysctl handlers may still access sysctl_local_reserved_ports. A local user can trigger access to the freed sysctl entry to cause a denial of service.

The issue affects access to /proc/sys/net/ipv4/ip_local_reserved_ports during network namespace sysctl teardown.

597) Improper input validation (CVE-ID: CVE-2026-63985)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in fallback_set_params() in the ethtool EEPROM Netlink fallback path when processing module EEPROM read parameters. A local user can supply an offset and length combination that exceeds the EEPROM bounds to cause a denial of service.

The issue affects the Netlink fallback path for reading module EEPROM and may lead to unexpected behavior in drivers or device firmware.

598) Race condition (CVE-ID: CVE-2026-63971)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in sctp_wait_for_connect() in the SCTP socket implementation when waiting for an association to reach established state while another thread peels off the association to a new socket. A local user can trigger association migration during this window to cause a denial of service.

Exploitation requires concurrent access from another thread while the socket lock is dropped and re-acquired.

599) Improper resource shutdown or release (CVE-ID: CVE-2026-63970)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in virtio_transport_alloc_skb() in the vsock/virtio transport when processing fixed-buffer vectored zerocopy input that hits MAX_SKB_FRAGS. A local user can trigger a partial attachment of managed fragments to cause a denial of service.

Exploitation occurs on the rollback path after io_sg_from_iter() returns -EMSGSIZE, causing an skb with managed fragment references but no bound uarg to be freed through the ordinary fragment unref path.

600) Infinite loop (CVE-ID: CVE-2026-63968)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in fib6_select_path() when walking IPv6 route sibling entries during softirq-side processing. A local attacker can trigger route processing to cause a denial of service.

The issue occurs because a detached sibling entry may still point into an old ring, preventing the walker from reaching its termination condition.

601) Improper Initialization (CVE-ID: CVE-2026-63954)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in hpfs_check_free_dnodes in fs/hpfs/alloc.c when handling a failure from hpfs_map_dnode_bitmap. A local user can trigger the error path to cause a denial of service.

602) Race condition (CVE-ID: CVE-2026-63942)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the parport subsystem when port and client drivers are loaded around the same time during boot. A local user can load the lp and parport_pc modules concurrently to cause a crash.

The issue occurs because client drivers can attach to ports that are not completely initialized or are being torn down.

603) Use-after-free (CVE-ID: CVE-2026-63930)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in iio_hw_consumer_alloc() when cleaning up buffers in the error path. A local user can trigger the vulnerable cleanup path to cause a denial of service.

604) Use-after-free (CVE-ID: CVE-2026-63927)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the dwc2 USB host controller driver debug code when dequeuing a usb request block and logging its status after calling usb_hcd_giveback_urb(). A local user can trigger URB handling to cause a denial of service.

The issue occurs in debug logging within the _dwc2_hcd_urb_dequeue() path.

605) Integer overflow (CVE-ID: CVE-2026-63925)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass replay protection.

The vulnerability exists due to an integer overflow in macsec_post_decrypt() when processing a crafted replayed frame on an XPN association with a packet number of 0xffffffff. A remote attacker can replay a captured legitimate frame to bypass replay protection.

Exploitation requires capturing a legitimate frame carrying the maximum 32-bit packet number on an XPN association.

606) Out-of-bounds read (CVE-ID: CVE-2026-63920)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ip6_datagram_recv_specific_ctl() when processing IPv6 extension headers for recvmsg control messages after the hdrlen field is modified. A local user can use an nftables payload-write expression to corrupt the extension header length and trigger copying beyond the available header data to disclose sensitive information.

Exploitation is reachable from an unprivileged user namespace.

607) Insufficient verification of data authenticity (CVE-ID: CVE-2026-63913)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state validation in the TCP conntrack state machine in netfilter conntrack when processing a crafted SYN followed by an invalid-sequence RST packet. A remote attacker can send a specially crafted packet sequence to cause a denial of service.

The issue can prematurely terminate an active NAT entry by forcing the conntrack entry into the CLOSE state.

608) Out-of-bounds read (CVE-ID: CVE-2026-63909)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in smb_check_perm_dacl() ACE-walk loops in ksmbd when processing SMB2_CREATE operations with a crafted security descriptor. A remote attacker can send a specially crafted request to disclose sensitive information.

The issue is caused by a transposed bounds check that can leave the loop guard ineffective and permit reading ace->size even when only 0 to 3 bytes remain in the ACE data.

609) Integer overflow (CVE-ID: CVE-2026-63889)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop caused by an integer truncation error in the FPIN pname walker in scsi_transport_fc when processing a crafted FPIN ELS frame. A remote attacker can send a crafted Fibre Channel fabric frame to cause a denial of service.

Exploitation requires the ability to inject Fibre Channel fabric traffic to an lpfc or qla2xxx Linux initiator, such as from a compromised switch or fabric controller, or from a same-zone N_Port on a fabric that permits source spoofing.

610) Use-after-free (CVE-ID: CVE-2026-63884)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the i915 TTM object purge logic when purging an object during eviction after validating buffer object placement. A local user can trigger the purge path through crafted GPU memory management operations to cause a denial of service.

The issue was reported under heavy use on DG2 systems and occurs because the associated i915 TTM page vector container may be replaced while the object is still busy.

611) Integer overflow (CVE-ID: CVE-2026-63881)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in get_queue_ids() in the amdkfd kfd debugger when processing a user-supplied queue ID array. A local user can supply crafted queue count values to cause a denial of service.

The issue affects 32-bit size_t builds.

612) Race condition (CVE-ID: CVE-2026-63879)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in amdgpu_hmm_range_get_pages in the AMDGPU HMM handling code when reading the notifier sequence across range processing. A local user can trigger memory invalidation during page range handling to cause a denial of service.

The issue can result in operations being performed on invalid pages.

613) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-63875)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cache invalidation in arm64 TLB flushing logic when unsharing PMD tables. A local user can trigger PMD table unsharing to cause a denial of service.

The issue can leave a stale PMD page table entry in the walk cache, which may result in incorrect page table walks.

614) Use of uninitialized resource (CVE-ID: CVE-2026-63870)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in lowpan_xmit() in the ieee802154 6LoWPAN transmit path when processing a non-IPv6 packet queued for transmission on a 6LoWPAN interface. A local user can queue a non-IPv6 packet for transmission to cause a denial of service.

The issue occurs because address information in skb headroom may remain uninitialized and is later copied and used by the transmit path.

615) Out-of-bounds write (CVE-ID: CVE-2026-63869)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds shift in ieee80211_parse_tx_radiotap() when parsing the radiotap header of an injected frame. A local user can supply a crafted frame from userspace to cause a denial of service.

The issue is triggered by the IEEE80211_RADIOTAP_ANTENNA value being used directly as a shift count, and larger antenna indices cannot be represented by the 2-bit bitmap.

616) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-63867)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause inconsistent MPTCP receiver window signaling.

The vulnerability exists due to a time-of-check time-of-use race in the MPTCP DSS option handling in net/mptcp/options.c when processing and emitting MPTCP acknowledgments on outgoing packets. A remote attacker can trigger packet processing that causes inconsistent ack_seq values to be used to confuse the peer.

The issue arises because the MPTCP-level ack_seq was accessed locklessly multiple times, allowing different values to be used for the DSS data acknowledgment and the announced receive window within the same packet.

617) Improper access control (CVE-ID: CVE-2026-63833)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper access control in the ntfs3 xattr handler when handling direct userspace writes to reserved $LX* extended attributes. A local user can set crafted $LXUID, $LXGID, $LXMOD, or $LXDEV values on a file they own to escalate privileges.

Exploitation requires a writable ntfs3 mount and relies on inode reload of WSL permission metadata into inode ownership and mode fields.

618) Use-after-free (CVE-ID: CVE-2026-63827)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in aa_replace_profiles() during rawdata_list deduplication when processing policy replacement operations. A local user can trigger AppArmor profile replacement with crafted timing to cause a denial of service.

The issue occurs because entries can remain on the rawdata list after their profile reference count has reached zero and before deferred cleanup runs.

619) Out-of-bounds write (CVE-ID: CVE-2026-63824)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a buffer overflow in keyctl_pkey_params_get_2() when processing crafted keyctl public-key operation parameters. A local user can provide a too small buffer length to cause memory corruption.

620) Use-after-free (CVE-ID: CVE-2026-63823)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in request_key_auth handling in the Linux kernel key management subsystem when processing KEYCTL_INSTANTIATE_IOV or related key instantiation and rejection paths concurrently with request_key() completion. A local user can trigger concurrent key operations to cause a denial of service.

The issue occurs because the request_key_auth payload can be freed after helper completion while another path later resumes and accesses rka->target_key.

621) Improper input validation (CVE-ID: CVE-2026-63819)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in f2fs_get_node_folio_ra() when processing a corrupted f2fs inode during filesystem mount and inode truncation. A local user can supply a crafted corrupted f2fs image to trigger a kernel panic and cause a denial of service.

The issue is triggered by an inconsistent node chain in the inode mapping table where a direct node has the same ino and nid in its footer, leading to a bug check in f2fs_do_truncate_blocks().

622) Improper access control (CVE-ID: CVE-2026-63817)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in f2fs_iget() meta inode handling when processing a corrupted directory entry with an inode number equal to max_nid while compress_cache is disabled. A local user can create a corrupted directory entry to cause a denial of service.

Only F2FS mounts with compression support present and the compress_cache mount option disabled are affected by this behavior.

623) Use-after-free (CVE-ID: CVE-2026-63816)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the f2fs garbage collection code when handling F2FS_IOC_GARBAGE_COLLECT_RANGE on a copy-on-write file. A local user can trigger garbage collection while the associated atomic inode is being evicted to cause a denial of service.

The issue involves access to atomic_inode->i_mapping without holding a reference to the atomic inode.

624) Out-of-bounds read (CVE-ID: CVE-2026-63814)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in f2fs_acl_from_disk() when parsing a malformed ACL xattr. A local user can supply a crafted ACL entry layout to trigger an out-of-bounds read and cause a denial of service.

The issue occurs because ACL_USER or ACL_GROUP entries can be placed in a slot that contains only a short ACL entry.

625) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-63812)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in __destroy_extent_node() and the f2fs extent cache when handling extent node destruction and concurrent writeback. A local user can trigger inode eviction or writeback activity to cause a kernel sanity check failure and filesystem inconsistency.

The issue can leave the cached largest extent stale after the FI_NO_EXTENT flag is set, and concurrency with writeback is involved in the affected path.

626) Release of invalid pointer or reference (CVE-ID: CVE-2026-63809)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to memory corruption in proc_sys_call_handler and __cgroup_bpf_run_filter_sysctl() when processing a sysctl write that replaces the temporary buffer. A local privileged user can write a crafted sysctl value to trigger memory corruption and cause a denial of service.

Exploitation requires access to write to a sysctl entry from a task in the target cgroup, and the fault was reproduced while writing to /proc/sys/kernel/domainname.

627) Reachable assertion (CVE-ID: CVE-2026-63806)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper handling of unaligned memory access in ioeventfd datamatch handling in KVM when processing a guest store that splits a page and targets emulated MMIO with a datamatch-enabled ioeventfd. A local user can trigger a specially crafted guest store operation to cause a denial of service.

Exploitation requires a guest configuration where the second page contains a datamatch-enabled ioeventfd at offset 0.

628) Type Confusion (CVE-ID: CVE-2026-63805)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a type confusion in nx_crypto_ctx_exit in the nx crypto driver when releasing AF_ALG-backed crypto contexts. A local user can trigger the vulnerable cleanup path to cause a denial of service.

The issue can be reached when AF_ALG is used opportunistically during local operations such as closing a socket.

629) Use-after-free (CVE-ID: CVE-2026-63803)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the hdlc ppp per-protocol timer handling when detaching the ppp protocol or re-attaching it while timers are still active. A local user can trigger protocol teardown while a timer callback is executing to cause a denial of service.

The issue affects LCP, IPCP, and IPV6CP control protocol timers embedded in the PPP state.

630) Use-after-free (CVE-ID: CVE-2026-63802)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in __blkcg_rstat_flush() when releasing multiple blkgs in the same blkcg concurrently. A local user can trigger concurrent blkg release operations to cause a denial of service.

The race occurs when one blkg removes another blkg's iostat entries via llist_del_all() while the other blkg is still being processed.

631) Out-of-bounds write (CVE-ID: CVE-2026-63794)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in sev_dbg_crypt() when processing crafted KVM SEV debug encryption requests. A local user can send a crafted ioctl request with page offsets that cause the transfer length to exceed the destination page boundary to cause memory corruption.

The issue affects the encrypt path and can overflow a single-page intermediate buffer by up to 15 bytes when the destination offset is greater than the source offset.

632) Out-of-bounds read (CVE-ID: CVE-2026-53402)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in fbcon_do_set_font() and subsequent rendering in the fbcon console subsystem when handling a failed font change rollback and later rendering user-controlled character indices. A local user can trigger a font change failure and then supply character indices greater than 255 to disclose sensitive information.

Exploitation requires a failure in the font-setting error path that leaves the console state desynchronized after vc_resize() fails.

633) Use-after-free (CVE-ID: CVE-2026-53401)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed physical memory.

The vulnerability exists due to a use-after-free in omapfb_mmap when racing a memory mapping request with OMAPFB_SETUP_PLANE and OMAPFB_SETUP_MEM operations. A local user can trigger concurrent framebuffer operations to access freed physical memory.

The issue is caused by inconsistent use of region data and map_count tracking across concurrent execution paths.

634) Race condition (CVE-ID: CVE-2026-53400)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the i2c adapter registration logic when looking up adapters by id during registration. A local user can trigger concurrent adapter lookup and registration activity to cause a denial of service.

The issue can lead to access to uninitialized adapter data, including NULL-pointer dereferences or use-after-free.

635) Memory leak (CVE-ID: CVE-2026-53397)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a memory leak in the nfsd SETACL request decoding and release handling when processing crafted NFS ACL SETACL requests. A remote user can send a specially crafted SETACL request that triggers a decode failure after partial ACL allocation to cause a denial of service.

The leaked posix_acl object remains allocated for the lifetime of the server.

636) Improper input validation (CVE-ID: CVE-2026-53392)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ff_layout_alloc_lseg() in the NFSv4 flexfiles layout handling when processing a malformed flexfiles layout body with a zero filehandle-version array count. A remote attacker can send a specially crafted flexfiles layout to cause a denial of service.

The issue can lead to a null pointer dereference and kernel panic.

637) NULL pointer dereference (CVE-ID: CVE-2026-53391)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in nfs4_decode_mp_ds_addr() when processing a crafted GETDEVICEINFO multipath-DS body containing a zero-length r_addr or r_netid value. A remote attacker can send malicious metadata server responses to cause a denial of service.

The issue is reachable from a pNFS-flexfile client mounted against a malicious or compromised metadata server.

638) Out-of-bounds read (CVE-ID: CVE-2026-53390)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in smb_check_perm_dacl() when processing a crafted security descriptor during an SMB2_CREATE access check. A remote user can store a crafted ACE via SMB2_SET_INFO to disclose sensitive information.

Exploitation is reachable on a share that uses ACL xattrs, and the malformed descriptor is processed on a subsequent access check.

639) Use-after-free (CVE-ID: CVE-2026-53389)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a use-after-free in tcp_ao_delete_key() in net/ipv4/tcp_ao.c when deleting a TCP-AO key asynchronously and later querying TCP_AO_INFO. A local user can delete a key with del_async enabled after setting it as the current or rnext key to disclose sensitive information.

The issue occurs when a key was assigned as the current or rnext key while the socket was in CLOSE state and the socket is later transitioned to LISTEN.

640) Use-after-free (CVE-ID: CVE-2026-53388)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fuse_try_move_folio() in the FUSE subsystem when moving a page cache folio during FUSE read handling. A local user can trigger a race condition to cause a denial of service.

The issue occurs because the request is not re-locked on the success path, allowing request abortion to free fuse_io_args while subsequent copy logic still accesses it.

641) Out-of-bounds read (CVE-ID: CVE-2026-53387)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the veml6075_request_measurement function when processing the VEML6075_CONF_IT register value. A local user can trigger an out-of-range index value to cause a denial of service.

Exploitation requires fault device behavior, misprogramming, or bus corruption to produce a reserved register value.

642) Improper access control (CVE-ID: CVE-2026-53383)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper access control in smb2_check_user_session() and the ksmbd compound request handling path when processing a crafted compound SMB request with a non-valid session. A remote attacker can send a specially crafted compound request to cause a denial of service.

By using SESSION_SETUP as the first compound operation and a related TREE_CONNECT request with SessionId set to ULLONG_MAX as the second operation, an in-progress session can reach a NULL pointer dereference because sess->user remains NULL.

643) Use-after-free (CVE-ID: CVE-2026-53381)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fuse_release_end() during virtiofs auto_submount unmount processing when releasing files during submount unmount after the superblock has already been destroyed. A local user can trigger submount unmount activity to cause a denial of service.

The issue affects the virtiofs auto_submounts case, where the wait counter is tracked per connection rather than per superblock.

644) Out-of-bounds write (CVE-ID: CVE-2026-53366)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in __ip_append_data() when processing IPv4 packet data on the paged allocation path. A local user can trigger the faulty length calculations to cause a denial of service.

The issue occurs because fraggap bytes copied from the previous skb are placed into the new skb linear area while the allocation size does not account for those bytes.

645) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-53365)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in virtio vsock zerocopy completion handling in net/vmw_vsock/virtio_transport_common.c when processing multi-skb MSG_ZEROCOPY sends. A local user can send a large crafted message that is fragmented into multiple skbs to cause a denial of service.

The issue can leave pinned user pages without completion notification, including when the send loop exits before the final skb is processed.

646) Out-of-bounds write (CVE-ID: CVE-2026-53362) Exploited

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in __ip6_append_data() when processing UDPv6 socket data with MSG_MORE and MSG_SPLICE_PAGES on the paged allocation path. A local user can send crafted data through a UDPv6 socket to corrupt kernel memory.

The issue occurs when fraggap is non-zero and the paged-allocation branch is taken, causing writes past skb->end into trailing skb_shared_info.

647) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2026-53356)

CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose or modify unintended memory contents.

The vulnerability exists due to improper pointer handling in i915_gem_object_pread_phys and i915_gem_object_pwrite_phys in the i915 GEM physical buffer object handling code when processing pread or pwrite operations with a non-zero offset. A local user can supply crafted offset values to access the wrong parts of a physical buffer object to disclose or modify unintended memory contents.

The issue affects physical buffer objects on impacted platforms using overlay or cursor planes with physical mapping.

648) Out-of-bounds read (CVE-ID: CVE-2026-53330)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in dp_get_eq_aux_rd_interval() when processing DisplayPort repeater capability data. A local attacker can provide crafted repeater count information to trigger an out-of-bounds read and disclose sensitive information.

The issue occurs when a sink reports 8 LTTPR repeaters, causing access beyond the declared aux_rd_interval array bounds.

649) Integer overflow (CVE-ID: CVE-2026-53329)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in dal_vector_reserve() in the AMD display vector implementation when resizing a vector buffer. A local user can trigger allocation size wraparound to cause a denial of service.

Successful exploitation can lead to a heap overflow on subsequent vector appends.

650) Use-after-free (CVE-ID: CVE-2026-53272)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in z_erofs_decompress_kickoff() when racing I/O completion with filesystem unmount. A local user can trigger the race condition to cause a denial of service.

The issue involves access to sbi->sync_decompress after the superblock information has been freed during unmount.

651) Out-of-bounds read (CVE-ID: CVE-2026-53268)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the conntrack_irc helper when parsing IRC DCC commands. A remote attacker can send specially crafted IRC traffic to cause a denial of service.

652) Stack-based buffer overflow (CVE-ID: CVE-2026-53267)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a stack-based buffer overflow in nft_ct_get_eval and nft_ct_get_fast_eval in the netfilter nft_ct subsystem when processing a crafted nftables rule that uses a template conntrack object. A local user can create a crafted rule sequence to cause memory corruption.

The issue is triggered when a conntrack template created by a preceding expression is treated as a real conntrack entry by a subsequent expression on the same skb.

653) Out-of-bounds read (CVE-ID: CVE-2026-53255)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the tlv_data_is_valid() advertising data parser in net/bluetooth/mgmt.c when processing a crafted MGMT_OP_ADD_ADVERTISING request. A local user can send a specially crafted advertising data field to disclose sensitive information.

The issue is triggered when a malformed field length byte appears at the end of the supplied buffer.

654) Out-of-bounds read (CVE-ID: CVE-2026-53253)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in bnep_rx_frame() and bnep_rx_control() in the BNEP packet parser when processing short BNEP frames. A remote attacker can send a specially crafted short BNEP SDU to cause a denial of service.

The issue is triggered by malformed control packets with missing fixed fields or an empty control payload.

655) Improper resource shutdown or release (CVE-ID: CVE-2026-53229)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in mlx5e_xmit_xdp_buff() in the mlx5 XDP transmit path when handling XDP_TX transmission failures in the XSK branch. A local user can trigger an XDP_TX transmit failure to cause a denial of service.

The issue occurs when sq->xmit_xdp_frame() returns false, such as when the XDPSQ is full, leaving DMA mappings and xdp_frame objects unreleased.

656) Out-of-bounds read (CVE-ID: CVE-2026-53223)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the generic timestamp cmsg path in net/socket.c when processing timestamped messages for AF_PACKET sockets. A local user can send or receive crafted packets on an AF_PACKET socket to disclose sensitive information.

Exploitation requires timestamping to be enabled, and information disclosure can occur when SO_RXQ_OVFL is enabled and a non-linear skb is processed.

657) Stack-based buffer overflow (CVE-ID: CVE-2026-53209)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in hci_adv_bcast_annoucement() when rebuilding Bluetooth advertising data with a prepended Broadcast Announcement. A local user can trigger handling of an oversized advertising payload to cause a denial of service.

The issue occurs when an existing advertising instance already contains the maximum extended advertising payload.

658) Out-of-bounds read (CVE-ID: CVE-2026-53205)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the firmware log buffer handling in drivers/accel/ivpu/ivpu_fw_log.c when processing firmware-supplied log indices. A local user can supply invalid read or write indices to trigger out-of-bounds buffer access and cause a denial of service.

Exploitation requires firmware to provide invalid log buffer index values.

659) Stack-based buffer overflow (CVE-ID: CVE-2026-53202)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in the ivpu_ipc_receive function when processing firmware-supplied IPC message data. A local user can supply a crafted data_size value to trigger an oversized memcpy operation and execute arbitrary code.

Exploitation requires control over firmware-supplied message data.

660) Memory corruption (CVE-ID: CVE-2026-53199)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory access in netvsc_copy_to_send_buf() when copying skb fragments into the VMBus send buffer. A local user can trigger packet transmission with page-backed fragments to cause a denial of service.

The issue occurs on 32-bit x86 systems with CONFIG_HIGHMEM enabled when fragment pages reside above the LOWMEM boundary, and the fault happens on the transmit softirq path.

661) Heap-based buffer overflow (CVE-ID: CVE-2026-53195)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in build_i2c_fw_hdr() in the io_ti USB serial driver when parsing a crafted firmware file. A local user can supply a firmware image with an oversized Length field to cause a denial of service.

The issue arises because the Length field from the firmware image is not validated against the available destination buffer space before copying.

662) Out-of-bounds write (CVE-ID: CVE-2026-53194)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in klsi_105_prepare_write_buffer() when processing writes to the tty device. A local user can write bulk_out_size or more bytes to the tty to cause a denial of service.

The issue is triggered when the write fifo holds at least the full bulk-out buffer size, causing data to be copied starting two bytes into a 64-byte buffer.

663) Use-after-free (CVE-ID: CVE-2026-53189)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __split_huge_pmd_locked() when splitting a huge PMD mapping. A local user can trigger the affected memory-management path to cause a denial of service.

The issue occurs because file/shmem RSS accounting may access freed folio state after the last folio reference is dropped.

664) Type Confusion (CVE-ID: CVE-2026-53184)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a type confusion in udp_read_skb() when processing UDP packets for a socket in a sockmap with an attached SK_SKB verdict program that performs a socket lookup. A remote attacker can send a specially crafted packet to cause a denial of service.

Exploitation requires a UDP socket to be in a sockmap and the attached verdict program to call a socket-lookup helper.

665) Use-after-free (CVE-ID: CVE-2026-53161)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the fastrpc workqueue cleanup path when processing DSP responses during file descriptor release. A local user can trigger a race by closing the file descriptor while an in-flight DSP invocation completes to cause a denial of service.

The issue occurs because context cleanup may run in parallel with device release after the user structure has already been freed.

666) Use-after-free (CVE-ID: CVE-2026-53160)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a use-after-free race in fastrpc_map_create in drivers/misc/fastrpc.c when handling concurrent MEM_UNMAP operations during map lookup and reference acquisition. A local user can trigger concurrent map operations to cause a use-after-free condition.

The issue occurs because a raw pointer is returned after releasing fl->lock and is later referenced without atomic reference acquisition under the lock.

667) Use-after-free (CVE-ID: CVE-2026-53157)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in phonet_device_destroy() when walking the per-net phonet device list with RCU readers after device removal. A local user can trigger destruction of a phonet_device while concurrent readers still hold a stale pointer to cause a denial of service.

The issue arises because the object is removed with RCU list semantics but may be freed before the RCU grace period has elapsed.

668) Use-after-free (CVE-ID: CVE-2026-53156)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in drivers/nvmem/core.c when handling error paths and device reference release. A local user can trigger a code path that releases an nvmem device reference and then continues using the freed structure to cause a denial of service.

669) Out-of-bounds read (CVE-ID: CVE-2026-53149)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in __tb_property_parse_dir() in the thunderbolt property parser when parsing a crafted root directory property block. A local user can supply a crafted property block to cause a denial of service.

670) Out-of-bounds read (CVE-ID: CVE-2026-53147)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tb_xdp_handle_request() in the thunderbolt xdomain request handler when processing a crafted XDomain request packet that is shorter than the expected protocol-specific structure. A remote attacker can send a minimal crafted XDomain packet to disclose sensitive information.

A generic header length check can be passed even when the packet is too short for the protocol-specific structure accessed after the type cast.

671) Out-of-bounds read (CVE-ID: CVE-2026-53146)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tb_xdomain_copy() in the thunderbolt xdomain component when processing a short response frame. A local user can send a specially crafted short response to disclose sensitive information.

672) Heap-based buffer overflow (CVE-ID: CVE-2026-53143)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and corrupt memory.

The vulnerability exists due to a heap-based buffer overflow in the amdkfd v11 MQD manager SDMA queue checkpoint and restore handlers when processing CRIU checkpoint and restore operations for SDMA queues on GFX11. A local user can trigger checkpoint or restore of an SDMA queue to disclose sensitive information and corrupt memory.

The issue is specific to v11 SDMA queues on Navi3x during CRIU checkpoint and restore.

673) Out-of-bounds read (CVE-ID: CVE-2026-53138)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or disclose sensitive information.

The vulnerability exists due to an out-of-bounds read and unbounded iteration in amd display bios_parser.c and bios_parser2.c record-chain walk loops when parsing a malformed VBIOS image during probe time. An attacker with physical access can provide a crafted VBIOS image missing the terminator record to cause a denial of service or disclose sensitive information.

The issue is triggered when the VBIOS record chain lacks the 0xFF terminator record or uses a zero-sized termination condition incorrectly.

674) Out-of-bounds write (CVE-ID: CVE-2026-53137)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in mod_hdcp_read_rx_id_list() when processing a malicious HDMI HDCP 2.x repeater ReceiverID list over I2C. An attacker with physical access can provide a malicious HDMI repeater that advertises an oversized message length to cause a denial of service.

The issue occurs during HDCP 2.x repeater authentication over HDMI.

675) Heap-based buffer overflow (CVE-ID: CVE-2026-53136)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in get_integrated_info_v11() and get_integrated_info_v2_1() in the AMD display BIOS parser when parsing a malformed VBIOS during driver probe. A local user can provide a specially crafted VBIOS with oversized HDMI retimer register counts to cause a denial of service or execute arbitrary code.

Exploitation requires control over the VBIOS data consumed by the driver.

676) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-52994)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass resource limit enforcement.

The vulnerability exists due to improper resource management in virtio_transport_init_zcopy_skb() when processing MSG_ZEROCOPY sends. A local user can send data using MSG_ZEROCOPY to bypass resource limit enforcement.

The issue occurs because pinned-pages accounting can use a consumed iterator count of 0 on the last skb, causing RLIMIT_MEMLOCK accounting to be skipped.

677) Use-after-free (CVE-ID: CVE-2026-52947)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in qrtr_port_remove in the qrtr socket subsystem when handling concurrent qrtr port removal and lookup operations under RCU. A local user can trigger the race condition to cause a denial of service.

The issue arises because a socket pointer can remain reachable through the qrtr_ports XArray before the RCU grace period elapses.

678) Use-after-free (CVE-ID: CVE-2026-52943)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a use-after-free in pskb_carve_inside_header() and pskb_carve_inside_nonlinear() when copying skb_shared_info for MSG_ZEROCOPY skbs. A local user can trigger repeated zerocopy skb operations to escalate privileges.

The issue is caused by copying the destructor_arg pointer into a new skb_shared_info without incrementing the associated zerocopy reference count, which can prematurely free ubuf_info_msgzc while transmit skbs still hold live references.

679) Out-of-bounds read (CVE-ID: CVE-2026-52942)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in dump_mac_header() in the netfilter nf_log syslog logger when processing an skb sent through AF_PACKET with PACKET_QDISC_BYPASS and an unset MAC header. A local user can send a specially crafted packet to disclose sensitive information.

Only skbs with an unset MAC header are affected.

680) Out-of-bounds read (CVE-ID: CVE-2026-52935)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in espintcp_sendmsg() when handling a new send while a previous partial send is still in progress. A local user can trigger a partial send and initiate another send to disclose sensitive information.

The issue occurs in the send path because a stale offset from a live partial-send state can remain attached to a new sk_msg.

681) NULL pointer dereference (CVE-ID: CVE-2026-52929)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null-pointer dereference in the SCTP stream scheduler state handling in net/sctp/stream.c when processing a denied ADD_OUT_STREAMS operation and a later stream re-add. A remote attacker can trigger SCTP stream reset operations that leave stale removed stream metadata behind to cause a denial of service.

The issue occurs because removed outgoing stream state is not fully rolled back, leaving scheduler-private stream metadata inconsistent for later reuse.

682) Out-of-bounds read (CVE-ID: CVE-2026-52927)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in compat_mtw_from_user in the ebtables netfilter subsystem when converting 32-bit user-supplied extension structures to native kernel structures. A local user can provide a crafted match or target size smaller than the extension requires to disclose sensitive information.

The issue affects extensions that rely on compat_from_user callbacks, which assume they can read the required compat size.

683) Use-after-free (CVE-ID: CVE-2026-52923)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ipc_idr_alloc() in the checkpoint/restore SysV IPC allocation path when processing a request for the next SysV IPC id. A local user can request allocation beyond the valid IPC id range to cause a denial of service.

A subsequent walk of /proc/sysvipc/shm can dereference freed memory through a stale IDR entry.

684) Out-of-bounds read (CVE-ID: CVE-2026-52917)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the SCTP sock_diag dump-one path when processing an exact association lookup after taking the socket lock on a stale association. A local user can trigger a stale association lookup to disclose sensitive information.

The issue occurs when association state is reaped or detached from the endpoint while the lookup path resumes after blocking on the socket lock.

685) Memory leak (CVE-ID: CVE-2026-46322)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in tun_xdp_one() when handling a build_skb() allocation failure. A local user can trigger this error path to cause a denial of service.

The issue occurs because a page allocated for the frame is not freed on the failure path, and the per-buffer error may be discarded during batch processing.

686) Memory leak (CVE-ID: CVE-2026-46321)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in tun_xdp_one() in the tun driver when processing short frames through the tun and vhost-net transmit path. A local user can submit TX descriptors whose payload length is shorter than ETH_HLEN to exhaust host memory and trigger an OOM panic.

Exploitation requires the ability to open /dev/net/tun and /dev/vhost-net and to attach a tun/tap device as the vhost-net backend.

687) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43022)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in hci_cmd_sync_queue_once() when queuing command items. A local user can trigger duplicate queueing conditions to cause a denial of service.

The issue can lead to resource leaks when an already queued item is not reported to the caller.

688) Type conversion (CVE-ID: CVE-2026-23265)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the f2fs file system's node footer handling when processing node pages with corrupted footers. A local user can provide a specially crafted f2fs image containing corrupted node page footers to cause a denial of service.

Exploitation requires access to a fuzzed or malicious f2fs image and the ability to trigger asynchronous node page reads, such as via f2fs_ra_node_pages(). The system must load and process the corrupted node page, which later triggers a kernel BUG during writeback.

689) Memory leak (CVE-ID: CVE-2025-37807)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the htab_is_percpu() and htab_percpu_map_gen_lookup() functions in kernel/bpf/hashtab.c. A local user can perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-8886-1