SB2026102128 - SUSE update for the Linux Kernel

Description

This security bulletin contains information about 231 vulnerabilities.

1) Memory leak (CVE-ID: CVE-2022-50645)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the pci_get_dev_wrapper() function in drivers/edac/i10nm_base.c. A local user can perform a denial of service (DoS) attack.

2) Incomplete cleanup (CVE-ID: CVE-2026-100075)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect send queue credit accounting.

The vulnerability exists due to incomplete cleanup in the srpt_alloc_rw_ctxs() error unwind path when handling an allocation failure partway through a multi-buffer indirect descriptor. A remote attacker can trigger the error path to cause incorrect send queue credit accounting.

3) Use-after-free (CVE-ID: CVE-2026-31663)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in xfrm_input_resume and transport_finish when processing packets after asynchronous crypto completion. A local user can trigger a race with device teardown to cause a denial of service.

4) Improper resource shutdown or release (CVE-ID: CVE-2026-43428)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in usbcore when handling USB message timeouts. A local user can trigger an excessively long synchronous timeout to cause a denial of service.

Exploitation can leave a task stuck in an uninterruptible wait until the target device is unplugged.

5) NULL pointer dereference (CVE-ID: CVE-2026-45834)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in l2cap_sock_state_change_cb() when handling Bluetooth L2CAP socket state changes. A local user can trigger the vulnerable callback to cause a denial of service.

6) NULL pointer dereference (CVE-ID: CVE-2026-45836)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in l2cap_sock_get_sndtimeo_cb() when handling Bluetooth L2CAP socket operations. A local user can trigger the vulnerable code path to cause a denial of service.

7) Improper resource shutdown or release (CVE-ID: CVE-2026-46044)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the ssif kthread cleanup logic when handling error conditions after creating the ssif kthread but before starting the ssif interface. A local user can trigger an error condition during ssif interface initialization to cause a denial of service.

8) Improper resource shutdown or release (CVE-ID: CVE-2026-46196)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in tracepoint_add_func() when handling tracepoint registration failures after invoking ext->regfunc(). A local user can trigger a func_add() failure during probe installation to cause a denial of service.

For syscall tracepoints, the issue can leave syscall tracing state enabled and impose persistent syscall entry and exit overhead until reboot.

9) Improper locking (CVE-ID: CVE-2026-46304)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in nvmet_ctrl_free when freeing a controller while processing nvmet-wq work items. A local user can trigger controller teardown to cause a denial of service.

The issue can lead to a possible recursive locking condition on the nvmet-wq workqueue during NVMe target controller teardown.

10) Improper Initialization (CVE-ID: CVE-2026-46312)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization of vma flags in vb2_dma_sg_mmap() in the videobuf2 dma-sg memory-mapping path when mmap() is performed on an imported dma-buf. A local user can trigger the affected mmap operation to cause a denial of service.

The issue manifests as a kernel warning in drm_gem_mmap_obj() during mmap() of an imported dma-buf.

11) Race condition (CVE-ID: CVE-2026-52975)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a data race in the bonding 802.3ad port-to-aggregator handling code when processing netlink requests and concurrent bonding state changes. A local user can send crafted netlink messages to trigger the race and cause a denial of service.

The issue was reported by Kernel Concurrency Sanitizer and affects access to the port->aggregator pointer in the bonding subsystem.

12) Improper locking (CVE-ID: CVE-2026-53037)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper resource management in hid_post_reset() when processing a reset of a crafted USB device that includes both HID and storage or UAS components. An attacker with physical access can connect a crafted USB device to trigger a deadlock and cause a denial of service.

The issue occurs because the components can be reset only together, placing the affected code in block I/O error handling.

13) NULL pointer dereference (CVE-ID: CVE-2026-53237)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mvebu GPIO suspend/resume handling in drivers/gpio/gpio-mvebu.c when processing suspend and resume operations for GPIO banks without PWM functionality. A local user can trigger a suspend or resume operation to cause a denial of service.

Only GPIO banks that do not have PWM functionality are affected.

14) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53284)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in btrfs_write_and_wait_transaction() and the dirty_pages io tree when handling failed transaction writeback. A remote attacker can trigger write errors that cause dirty extent buffer records to be released prematurely to cause a denial of service.

The issue can leave dirty extent buffers uncleared during transaction cleanup and trigger warnings during filesystem unmount.

15) NULL pointer dereference (CVE-ID: CVE-2026-53385)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference caused by a race condition in vcs_notifier() in drivers/tty/vt/vc_screen.c when handling concurrent vcs_write operations. A local user can trigger concurrent write activity to cause a denial of service.

The issue occurs after the console lock is temporarily dropped and re-acquired, allowing the vc_data pointer to become stale before notifier processing.

16) Race condition (CVE-ID: CVE-2026-53400)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the i2c adapter registration logic when looking up adapters by id during registration. A local user can trigger concurrent adapter lookup and registration activity to cause a denial of service.

The issue can lead to access to uninitialized adapter data, including NULL-pointer dereferences or use-after-free.

17) Out-of-bounds read (CVE-ID: CVE-2026-63897)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the mct_u232 USB serial driver interrupt-in transfer handler when processing short interrupt-in transfers. A local user can trigger the driver to process a specially crafted short interrupt-in packet to disclose sensitive information.

The issue can lead to stale or uninitialized slab data being exposed to user space.

18) Out-of-bounds read (CVE-ID: CVE-2026-63900)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the usa49wg indat transfer parser in drivers/usb/serial/keyspan.c when parsing malformed indat packets from a USB device. A local attacker can provide a specially crafted USB device to disclose sensitive information.

The issue can cause parsing of stale or uninitialised slab data.

19) Out-of-bounds read (CVE-ID: CVE-2026-63902)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in cypress_read_int_callback() in the cypress_m8 USB serial driver when processing malformed short interrupt packets. A local attacker can provide a specially crafted short interrupt report to cause a denial of service.

Successful interrupt transfers can complete with fewer bytes than required for the selected Cypress packet header format.

20) Out-of-bounds read (CVE-ID: CVE-2026-63903)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the belkin_sa_read_int_callback() USB serial interrupt handler when processing short successful interrupt transfers. A local attacker can trigger the driver to parse a crafted short interrupt packet to disclose sensitive information.

The issue occurs because the handler treats interrupt data as a four-byte status report and reads status fields at offsets 2 and 3 even when the completed packet is shorter.

21) Out-of-bounds read (CVE-ID: CVE-2026-63904)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the usbtmc interrupt notification handling in drivers/usb/class/usbtmc.c when processing interrupt-in notifications with an insufficient URB actual_length. A local attacker can provide a crafted USBTMC device that sends a short notification to disclose sensitive information.

The issue can also cause stale leftover data from a previous notification to be consumed.

22) Insufficient verification of data authenticity (CVE-ID: CVE-2026-63913)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state validation in the TCP conntrack state machine in netfilter conntrack when processing a crafted SYN followed by an invalid-sequence RST packet. A remote attacker can send a specially crafted packet sequence to cause a denial of service.

The issue can prematurely terminate an active NAT entry by forcing the conntrack entry into the CLOSE state.

23) Race condition (CVE-ID: CVE-2026-63942)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the parport subsystem when port and client drivers are loaded around the same time during boot. A local user can load the lp and parport_pc modules concurrently to cause a crash.

The issue occurs because client drivers can attach to ports that are not completely initialized or are being torn down.

24) Improper input validation (CVE-ID: CVE-2026-63956)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or corrupt memory.

The vulnerability exists due to improper input validation in the cypress_m8 USB serial driver when processing a malicious USB device with a too-small interrupt-out endpoint max packet size. An attacker with physical access can connect a specially crafted USB device to cause a denial of service or corrupt memory.

The issue can be triggered if a device reports an interrupt-out endpoint max packet size smaller than eight bytes.

25) Out-of-bounds write (CVE-ID: CVE-2026-63957)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the safe_serial USB serial driver when processing a malicious USB device that reports a bulk-out endpoint size smaller than eight bytes in safe mode. An attacker with physical access can connect a crafted USB device to cause memory corruption.

Exploitation requires the target system to interact with a malicious USB device operating in safe mode.

26) Out-of-bounds read (CVE-ID: CVE-2026-63961)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the DisplayPort altmode handler when processing a malformed Status Update VDO from a connected USB Type-C device. An attacker with physical access can send a device response with an incorrect VDO count to disclose sensitive information.

The issue can cause the kernel to read uninitialized stack data and forward it elsewhere.

27) Out-of-bounds read (CVE-ID: CVE-2026-63963)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Discover Identity ACK handlers in the tcpm subsystem when processing a device-supplied VDO count. A remote attacker can provide a crafted count value to disclose sensitive information.

28) Integer underflow (CVE-ID: CVE-2026-64009)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow leading to an out-of-bounds write in the esp component, specifically xfrm_state_mtu(), when processing a UDP datagram through an IPv4 ESP tunnel SA with attacker-controlled parameters. A local user can install a crafted IPv4 ESP tunnel SA and send a UDP datagram through the tunnel to cause a denial of service.

The issue involves a negative length being sign-extended to size_t before being passed to memset() in esp_output_fill_trailer().

29) Out-of-bounds read (CVE-ID: CVE-2026-64014)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the nexio_read_data() function in the usbtouchscreen driver when processing a crafted device interrupt packet with falsified length fields. An attacker with physical access can provide a malicious USB device that reports oversized data_len and x_len values to disclose sensitive information and cause a denial of service.

Kernel memory contents may be exposed to userspace through reported ABS_X and ABS_Y input events.

30) Out-of-bounds read (CVE-ID: CVE-2026-64097)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() when parsing a malformed VBIOS GPIO pin LUT table. A local attacker can supply a crafted VBIOS image with an invalid structuresize field to disclose sensitive information.

31) Out-of-bounds read (CVE-ID: CVE-2026-64191)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in stub_xfer() in the i2c-stub driver when handling an I2C_SMBUS ioctl with I2C_SMBUS_I2C_BLOCK_DATA and an invalid block length. A local user can issue a crafted ioctl request with data->block[0] greater than 32 to cause a denial of service.

The issue affects the development and test i2c-stub driver, which is not built by default and must be loaded with a chip_addr= parameter.

32) Use-after-free (CVE-ID: CVE-2026-64279)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the i2c core adapter lookup and deregistration logic when looking up an adapter by id during adapter deregistration or registration failure. A local user can trigger a race condition to cause a denial of service.

33) Out-of-bounds read (CVE-ID: CVE-2026-64299)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in regex_match_glob() glob matching in the tracing event filter subsystem when processing non-NUL-terminated string event fields. A local user can supply a crafted glob filter against such fields to disclose sensitive information.

One reported path reaches the issue from the xfs_lookup tracepoint, and the affected string fields may be dynamic char arrays copied without a trailing NUL byte.

34) Out-of-bounds read (CVE-ID: CVE-2026-64320)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds heap read in nvmet_execute_disc_get_log_page() in the NVMe target discovery controller when handling a host-supplied log page offset in a Discovery Get Log Page request. A remote attacker can send a specially crafted request with an out-of-range offset to disclose sensitive information or cause a denial of service.

The issue is reachable before authentication by any TCP, RDMA, or FC peer that can reach the nvmet target.

35) Use-after-free (CVE-ID: CVE-2026-64342)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the iowarrior USB driver disconnect handling when processing device disconnect events with submitted write URBs still active. A local user can trigger device disconnect while write completion handling is still possible to cause a denial of service or execute arbitrary code.

Exploitation requires local access to the affected USB device interface.

36) Memory leak (CVE-ID: CVE-2026-64348)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the EHCI and FOTG210 isochronous submit handling when submitting a URB before it is linked to the endpoint queue. A local user can trigger a failed submit to cause a denial of service.

Exploitation requires access to a system using EHCI or FOTG210 USB isochronous transfers.

37) Use-after-free (CVE-ID: CVE-2026-64372)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in pcc_cpufreq_do_osc() when performing two-phase _OSC negotiation through acpi_evaluate_object(). A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue also involves a double free after the stale pointer is freed again.

38) Race condition (CVE-ID: CVE-2026-64373)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in cpufreq_suspend() when rebooting the system while cpu hotplug operations run concurrently. A local user can trigger a reboot while concurrent cpu hotplug activity causes governor_data to be freed during access to cause a denial of service.

The issue can result in a kernel null pointer dereference during the reboot path because processes and kernel threads remain active.

39) Race condition (CVE-ID: CVE-2026-64375)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a race condition in proc_pid_get_link() and proc_pid_readlink() when handling access to /proc pid link targets. A local user can trigger concurrent task state changes to disclose sensitive information.

The issue affects file descriptor-related proc links and involves ptrace_may_access() checks performed on a different task lookup than the one used for the actual access.

40) Race condition (CVE-ID: CVE-2026-64378)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb() when unmounting a filesystem while switching inode writeback state. A local user can trigger a container exit or unmount operation during concurrent writeback activity to cause a denial of service.

The issue can lead to busy inodes after unmount and a subsequent use-after-free in writeback cleanup paths.

41) Improper access control (CVE-ID: CVE-2026-64388)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass ownership and group changes.

The vulnerability exists due to improper access control in cifs_setattr_nounix() when processing chown and chgrp operations on mounts using SMB3 POSIX Extensions. A local user can change file ownership or group attributes in a way that is ignored to bypass ownership and group changes.

The issue occurs only when SMB3 POSIX Extensions are used without the relevant ACL or SID-based mount options enabled.

42) Out-of-bounds read (CVE-ID: CVE-2026-64448)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in smb2_check_message() and subsequent SMB client protocol decoders when processing crafted SMB2 responses with a data area. A remote attacker can send a specially crafted SMB server response to disclose sensitive information.

The issue is reachable during NEGOTIATE and SESSION_SETUP before the session is established, including through the SPNEGO/negTokenInit and NTLMSSP challenge decoders when mounting against a non-conforming server.

43) Out-of-bounds read (CVE-ID: CVE-2026-64496)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the iio event FIFO handling in drivers/iio/industrialio-event.c when reading from a newly created event file descriptor concurrently with FIFO reset. A local user can read from the file descriptor from another thread to disclose sensitive information.

Exploitation requires shared file descriptor table access between threads, creating a race window before the fd number is returned to userspace.

44) Out-of-bounds read (CVE-ID: CVE-2026-64540)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in genelink_rx_fixup() when processing device-supplied aggregated RX frames from a crafted GeneLink (GL620A) USB device. An attacker with physical access can provide a short URB with inconsistent packet length metadata to disclose sensitive information.

The issue can leak adjacent kernel heap contents to the network stack as soon as the USB network interface is up.

45) Double free (CVE-ID: CVE-2026-64580)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in xfrm6_fill_dst() when handling an error path after in6_dev_get(dev) returns NULL. A local user can trigger network operations that reach the affected code path to cause a denial of service.

The issue underflows a net_device reference count and can lead to kernel warnings while waiting for the device to become free.

46) Integer overflow (CVE-ID: CVE-2026-68108)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds memory access.

The vulnerability exists due to integer overflow in amdgpu_vce_ring_parse_cs() in the VCE command stream parser when processing crafted VCE command streams with oversized image dimensions. A local user can submit a specially crafted command stream to cause out-of-bounds memory access.

The issue occurs when image dimensions wrap the calculated buffer size and bypass validation before reaching the GPU firmware.

47) Use-after-free (CVE-ID: CVE-2026-68162)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the SCTP auth_enable sysctl handler when handling writes to an already opened sysctl file during network namespace teardown. A local user can write to the auth_enable sysctl entry to cause a denial of service.

The issue is exposed during initialization before the SCTP control socket exists and during teardown after the control socket has been released.

48) Out-of-bounds read (CVE-ID: CVE-2026-68184)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a stack out-of-bounds read in mmc_ioctl_cdrom_volume() when processing the CDROMVOLCTRL ioctl on drives that return a non-zero block descriptor length. A local user can invoke the CDROMVOLCTRL ioctl to disclose sensitive information.

The issue is not triggered by CDROMVOLREAD and only occurs on drives that report a non-zero block descriptor length.

49) Out-of-bounds read (CVE-ID: CVE-2026-68343)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in parse_dfs_referrals() in the SMB client DFS referral parser when processing a malformed DFS referral response with an oversized PathConsumed value. A remote attacker can send a specially crafted DFS referral response to cause an out-of-bounds read.

The issue occurs when PathConsumed is larger than the search name length used for later DFS path parsing.

50) Out-of-bounds read (CVE-ID: CVE-2026-68350)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in carl9170_tx_process_status() when processing firmware-controlled TX status entries. A local attacker can provide a crafted firmware response with an oversized hdr.ext value to disclose sensitive information.

The issue is caused by an off-by-two bounds check error that allows two extra iterations past valid _tx_status entries.

51) Out-of-bounds write (CVE-ID: CVE-2026-68365)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the io_edgeport USB serial driver ring buffer when processing interrupt-status packets that report transmit credits. A local user can provide a malicious or non-conforming USB device that returns excessive transmit credits to cause a denial of service.

Exploitation requires the system to interact with a USB serial device using the affected driver.

52) Out-of-bounds read (CVE-ID: CVE-2026-68376)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in sctp_auth_get_hmac() when processing SCTP authentication parameters during association initialization. A local user can configure four HMAC identifiers to trigger memory corruption that leads to an out-of-bounds read and disclose sensitive information.

The issue stems from an undersized auth_hmacs array in struct sctp_cookie that can corrupt the adjacent auth_chunks field and cause an invalid HMAC identifier to be accepted.

53) Use-after-free (CVE-ID: CVE-2026-68377)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tunnel_key_release_params() in net/sched/act_tunnel_key.c when handling concurrent tunnel key action processing on the datapath. A local user can trigger a race condition to cause a denial of service.

The issue arises because a reader may still access the old params structure under RCU while the associated metadata_dst is released synchronously.

54) Improper access control (CVE-ID: CVE-2026-68445)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass shader validation and execute untrusted GPU shader code.

The vulnerability exists due to improper access control in vc4_gem_object_mmap() when handling mappings of validated shader buffer objects. A local user can map a validated shader buffer object read-only and then use mprotect() to make it writable to bypass shader validation and execute untrusted GPU shader code.

The issue affects validated shader buffer objects that are initially mapped read-only but can later be upgraded to writable mappings.

55) Improper input validation (CVE-ID: CVE-2026-68477)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect packet processing.

The vulnerability exists due to improper handling of ipv6 transport offsets in ipvs application and icmpv6 response processing when handling ipv6 packets with extension headers. A remote attacker can send specially crafted ipv6 traffic to cause incorrect packet processing.

The issue affects TCP application handling and ICMPv6 checksum validation in IPVS for IPv6 traffic.

56) Integer underflow (CVE-ID: CVE-2026-68479)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow leading to out-of-bounds read and out-of-bounds write in rtlbt_parse_firmware() when parsing a malformed Bluetooth firmware patch during Bluetooth setup. A local user can supply a specially crafted firmware patch to cause a denial of service.

The issue can be triggered by a firmware patch shorter than the version field, and arithmetic wraparound may affect 32-bit architectures.

57) Out-of-bounds read (CVE-ID: CVE-2026-72019)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in macsec_encrypt() when processing packets transmitted through the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS path with an unset MAC header. A local user can send a specially crafted packet to disclose sensitive information.

The 12-byte heap over-read may be emitted on the wire as the frame's outer source and destination MAC addresses.

58) Out-of-bounds write (CVE-ID: CVE-2026-72025)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the monwriter misc device when reusing data buffers with a different data length. A local user can submit crafted records with a changed data length to cause memory corruption.

By default, access to the device is restricted to root-only permissions.

59) Improper access control (CVE-ID: CVE-2026-72051)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ip6_tnl_changelink() when handling changelink requests for IPv6 tunnel devices across network namespaces. A local privileged user can send a crafted netlink changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace.

60) Improper access control (CVE-ID: CVE-2026-72052)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify tunnel link configuration across network namespaces.

The vulnerability exists due to improper access control in ip6gre_changelink() and ip6erspan_changelink() when handling changelink requests for devices and tunnel links in different network namespaces. A remote privileged user can send a crafted changelink request to modify tunnel link configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace, causing capability checks to be applied only to the device namespace.

61) Improper access control (CVE-ID: CVE-2026-72053)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify IPIP tunnel configuration in another network namespace.

The vulnerability exists due to improper access control in ipip_changelink() in net/ipv4/ipip.c when handling changelink requests for an IPIP device whose tunnel link resides in a different network namespace. A local privileged user can send a changelink request from a network namespace where they have CAP_NET_ADMIN to modify IPIP tunnel configuration in another network namespace.

The issue occurs when dev_net(dev) and the tunnel link namespace differ, such as after the device is created in or moved to a different network namespace.

62) Improper access control (CVE-ID: CVE-2026-72054)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in vti_changelink() in the ip_vti component when handling changelink requests for a tunnel whose link network namespace differs from the device network namespace. A local privileged user can send a changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the device is created in or moved to a different network namespace than the one from which the request is issued.

63) Improper access control (CVE-ID: CVE-2026-72061)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ipip6_changelink() in the sit tunnel handler when handling changelink requests for a tunnel whose link network namespace differs from the device network namespace. A local privileged user can send a changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the caller has CAP_NET_ADMIN in the device network namespace but not in the tunnel link network namespace.

64) Stack-based buffer overflow (CVE-ID: CVE-2026-72066)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in states_show() in kernel/cpu.c when generating sysfs output for CPU hotplug states. A local user can read the affected sysfs entry to cause a denial of service.

65) Out-of-bounds write (CVE-ID: CVE-2026-72098)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in dm-verity fec calculation when processing erasure data during FEC decoding. A local user can trigger crafted corruption conditions to cause memory corruption.

The out-of-bounds write can occur when the erasure count exceeds the intended Reed-Solomon roots limit and the decoder writes past the end of the lambda array into the syndrome buffer.

66) Heap-based buffer overflow (CVE-ID: CVE-2026-72106)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in list_version_get_info in dm-ioctl when processing ioctl requests. A local user can send a specially crafted ioctl request to cause a denial of service.

67) Out-of-bounds read (CVE-ID: CVE-2026-72107)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dm-era writeset handling when processing I/O for tables with a non-zero start sector. A local user can trigger out-of-bounds memory access to cause a denial of service.

The issue occurs because an absolute mapped-device block number is used instead of a target-relative block number during writeset lookup.

68) Out-of-bounds read (CVE-ID: CVE-2026-72129)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in nvmet_rdma_use_inline_sg() and inline scatterlist handling in the NVMe target RDMA component when processing host-controlled inline data with a nonzero offset. A remote user can send crafted inline data offsets and lengths to cause a denial of service.

The issue can be triggered when inline_data_size is configured larger than PAGE_SIZE, and page-spanning in-bounds ranges may also cause the scatterlist to be under-counted.

69) Out-of-bounds write (CVE-ID: CVE-2026-72157)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to an out-of-bounds write in tbnet_poll() when processing a multi-frame ThunderboltIP packet with a peer-supplied frame_count that exceeds the fragment array capacity. A remote attacker can send a specially crafted packet with 19 or more small frames to corrupt memory.

The issue occurs because the first frame is placed in the skb linear area while subsequent frames are added as page fragments.

70) NULL pointer dereference (CVE-ID: CVE-2026-72163)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ocfs2_assure_trans_credits() when completing a direct write over unwritten extents after a journal abort. A local user can trigger a direct write operation and cause the kernel to panic to cause a denial of service.

Exploitation requires an ocfs2 direct I/O write path where the journal aborts during I/O completion, such as after an I/O error.

71) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72166)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper signal handling in p9_client_rpc() in net/9p/client.c when handling P9_TFLUSH requests over an fd transport with no peer. A local user can trigger a fatal signal while a thread is blocked in the affected code path to cause a denial of service.

The issue can cause the affected task to sleep indefinitely and, in practice, can stall coredump handling in multi-threaded processes.

72) Memory leak (CVE-ID: CVE-2026-72224)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of allocated memory in btt_init() in the nvdimm btt subsystem when handling BTT initialization failures. A local user can trigger an initialization failure to cause a denial of service.

73) Improper access control (CVE-ID: CVE-2026-72243)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass SELinux connect-related permission checks.

The vulnerability exists due to improper access control in the SELinux socket_sendmsg() hook when using TCP Fast Open on TCP or MPTCP stream sockets. A local user can send data with MSG_FASTOPEN to bypass SELinux connect-related permission checks.

74) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72256)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of template conntrack state in xt_cluster_mt() in the netfilter xt_cluster matcher when processing packets associated with a template conntrack. A local user can trigger packet processing that reaches xt_cluster_hash() with incomplete conntrack state to cause a denial of service.

The issue occurs when the raw table CT target attaches a template conntrack to skb->_nfct before normal conntrack processing.

75) Resource management error (CVE-ID: CVE-2026-72321)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in igmp_mod_timer() and igmp_stop_timer() when deleting or stopping IGMP timers during concurrent multicast group removal. A local user can trigger IGMP processing that reaches these code paths to cause a denial of service.

The issue can occur when the affected multicast list entry is accessed from an RCU reader path while the group is concurrently removed from the list.

76) Use-after-free (CVE-ID: CVE-2026-72322)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the IPv6 MLD delayed work handling in net/ipv6/mcast.c when processing incoming MLD queries during device teardown. A remote attacker can send crafted MLD query traffic to trigger a kernel panic and cause a denial of service.

The issue arises from a race condition between device destruction and packet receive processing under RCU protection.

77) Improper input validation (CVE-ID: CVE-2026-72348)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass packet-filtering rules.

The vulnerability exists due to improper input validation in the ip6tables ah, hbh, and rt IPv6 extension header match handlers when processing malformed IPv6 packets with advertised extension header lengths that exceed the available skb data. A remote attacker can send a specially crafted IPv6 packet to bypass packet-filtering rules.

The issue affects handling of malformed IPv6 authentication, hop-by-hop, and routing extension headers.

78) Integer overflow (CVE-ID: CVE-2026-72349)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended rate-based matching logic.

The vulnerability exists due to integer truncation in xt_rateest_mt() in netfilter xt_rateest when processing rate estimator values on high-speed links. A local user can trigger rate comparisons involving byte rates above 2^32-1 to bypass intended rate-based matching logic.

The issue occurs on links faster than approximately 34 Gbps, where the byte rate may exceed 4.3 GBps and no longer fits in 32-bit variables.

79) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-72350)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds shift operation in u32_match_it() in the xt_u32 netfilter match when evaluating a malformed u32 rule during packet processing. A local user can supply a crafted u32 rule with a shift count of 32 or more to cause a denial of service.

80) Out-of-bounds read (CVE-ID: CVE-2026-72351)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in gue_remcsum() and gue_gro_remcsum() when processing malformed GUE packets with the REMCSUM private flag set but without the required REMCSUM metadata fields. A remote attacker can send a specially crafted packet to disclose sensitive information.

The issue occurs because option validation accepts packets that contain only the private flags field even when additional REMCSUM start and offset fields are expected.

81) Use-after-free (CVE-ID: CVE-2026-72383)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in sctp_free_addr_wq() and sctp_addr_wq_timeout_handler() when handling addr_wq_timer teardown. A local attacker can trigger a race condition to cause a denial of service.

The issue arises because a timer handler may continue running after the associated wait queue has been freed.

82) NULL pointer dereference (CVE-ID: CVE-2026-72392)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fib6_walk_continue() when resuming a multi-batch IPv6 FIB dump after a concurrent table insertion changes hash-chain ordering. A remote attacker can trigger netlink dump processing to cause a denial of service.

The issue occurs because walker state can become inconsistent, with the root referencing a different table while the node still points into the previous one.

83) Improper input validation (CVE-ID: CVE-2026-72398)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to tamper with SCTP association handling and cause a denial of service.

The vulnerability exists due to improper input validation in SCTP COOKIE-ECHO processing paths when processing a cookie containing a reconstructed INIT chunk while cookie authentication is disabled. A remote attacker can send a specially crafted COOKIE-ECHO packet to tamper with SCTP association handling and cause a denial of service.

The issue only arises when cookie authentication is disabled.

84) Double free (CVE-ID: CVE-2026-72406)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in gem_init_one() in the sungem network driver when handling a failed register_netdev() call during device probe. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs in the probe error cleanup path for a half-registered device.

85) Memory leak (CVE-ID: CVE-2026-72413)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in SCTP INIT handling in net/sctp/sm_statefuns.c when processing INIT chunks with unrecognized parameters. A remote attacker can send a specially crafted INIT chunk to cause a denial of service.

The issue occurs when err_chunk is allocated by sctp_verify_init() and is not freed on certain error and success return paths.

86) Use-after-free (CVE-ID: CVE-2026-72435)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ipset comment extension handling in netfilter when freeing comment extension pointers. A local user can trigger ipset comment initialization or cleanup operations to cause a denial of service.

87) Race condition (CVE-ID: CVE-2026-72436)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in netfilter ipset hash types when lockless RCU readers process set data in parallel with add, delete, or garbage-collection operations. A local user can trigger concurrent ipset operations to cause a denial of service.

The issue affects readers that are not protected by the region lock and are not in set destroy or new or temporary set creation phases.

88) Out-of-bounds read (CVE-ID: CVE-2026-72444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized memory contents.

The vulnerability exists due to an out-of-bounds read in __skb_flow_dissect() when processing packets on non-ethernet devices with flow dissector ethernet address matching enabled. A local user can send a crafted packet through AF_PACKET to disclose uninitialized memory contents.

Exploitation requires a TUN device in L3 mode together with a multiq qdisc and a flower filter matching on eth_src.

89) Race condition (CVE-ID: CVE-2026-72447)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized kernel memory to userspace.

The vulnerability exists due to a race condition in sctp_diag endpoint dumping when traversing endpoint address lists during diagnostic dumping without holding the socket lock. A local user can trigger concurrent socket operations while requesting SCTP diagnostic endpoint data to disclose uninitialized kernel memory to userspace.

The issue occurs because address counts gathered under RCU protection can become inconsistent before the subsequent copy operation.

90) Use-after-free (CVE-ID: CVE-2026-72463)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the xfrm async resumption handling in net/xfrm/xfrm_input.c when processing xfrm packets and resuming transport processing asynchronously. A remote attacker can send crafted traffic that triggers xfrm_rcv_cb to modify skb->dev and cause a denial of service.

The issue involves a race condition with tunnel device teardown and affects handling of both IPv4 and IPv6 transport finish paths.

91) Improper Initialization (CVE-ID: CVE-2026-74267)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in sch_codel when peeking queued packets after packet drops. A local user can trigger packet drops during peek to cause a denial of service.

The issue can incorrectly invoke the parent qlen_notify callback while a packet still remains queued, which may deactivate the parent class unexpectedly.

92) Race condition (CVE-ID: CVE-2026-74268)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in tcp_set_state() and tcp_call_bpf() when force-closing a child socket whose inherited sock_ops callback flags remain set after setup failure. A remote attacker can send network traffic that triggers child socket setup failure to cause a denial of service.

The issue occurs before the child socket is ever established and affects forced-close paths that reach tcp_done() without the expected socket lock.

93) Incorrect calculation (CVE-ID: CVE-2026-74276)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper buffer size calculation in the xilinx SPI driver FIFO size detection logic when handling SPI transactions in irq mode. A local user can trigger an SPI transaction of the assumed FIFO size or more to cause a denial of service.

The issue can cause the driver to spin in a while loop forever after one received byte is lost because the RX FIFO is smaller than the incorrectly assumed size.

94) Integer underflow (CVE-ID: CVE-2026-74282)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow in tipc_sk_conn_proto_rcv() when processing a CONN_MANAGER/CONN_ACK message. A remote attacker can send a specially crafted connection acknowledgment with an oversized ack count to cause a denial of service.

For a local connection, the connected peer socket can trigger the issue.

95) Improper access control (CVE-ID: CVE-2026-74283)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify TIPC state.

The vulnerability exists due to improper access control in TIPCv2 generic-netlink mutator operations when handling netlink administrative commands. A local user can invoke mutating netlink operations to modify TIPC state.

The issue affects commands that can change the network id and node identity, set or flush key material, and enable or disable a UDP bearer.

96) Race condition (CVE-ID: CVE-2026-74284)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the HFSC scheduler class handling in net/sched/sch_hfsc.c when dequeuing packets from a class whose child qdisc becomes empty. A local user can trigger packet processing that causes a class to be marked passive twice to cause a denial of service.

The issue can incorrectly remove a parent with still-backlogged sibling classes from the virtual time tree, causing queued traffic to stop being dequeued.

97) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-74288)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in fib_rules_dump() when dumping fib_rule entries during an RCU dump. A local user can trigger fib_rule processing involving a dying fib_rule to cause a denial of service.

98) Use-after-free (CVE-ID: CVE-2026-74289)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib_leaf_notify() and fib_info reference handling when dumping IPv4 fib_info entries under RCU during fib notifier processing. A local user can trigger network namespace cleanup or device reload operations that invoke affected fib notifier paths to cause a denial of service.

The issue was reported through the netdevsim notifier path, and IPv6 is not affected by the same condition.

99) Information disclosure (CVE-ID: CVE-2026-74290)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper exposure of sensitive information in the cls_flow classifier when processing class statistics for map mode rules with user-controlled mask, xor, rshift, addend, and divisor values. A remote user can create a tc classifier and observe the resulting classid through class statistics to disclose sensitive information.

Exploitation requires the ability to use a tc classifier in a user or network namespace.

100) Deadlock (CVE-ID: CVE-2026-74307)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in EXT4_IOC_MOVE_EXT when processing a donor file descriptor that refers to a file on a different filesystem. A local user can supply a donor file from a different superblock to cause a denial of service.

Exploitation requires a concurrent filesystem freeze operation to trigger the deadlock cycle.

101) Out-of-bounds write (CVE-ID: CVE-2026-74317)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a slab out-of-bounds write in __netif_set_xps_queue in the ixgbe driver when loading an XDP program that configures XDP transmit queues. A local user can load an XDP program to trigger the out-of-bounds write and cause a denial of service.

The issue occurs on E610 adapters on systems with 64 or more CPUs when the last XDP queue is configured.

102) Race condition (CVE-ID: CVE-2026-74330)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in configfs directory entry child traversal when traversing s_children lists while concurrent cursor movement or freeing can occur. A local user can trigger concurrent configfs operations to cause a denial of service.

The issue affects configfs directory handling in fs/configfs/dir.c.

103) Integer underflow (CVE-ID: CVE-2026-74349)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unintended block trimming beyond the requested range.

The vulnerability exists due to an integer underflow in ocfs2_trim_mainbm() when processing a FITRIM range shorter than a cluster. A local user can submit a specially crafted FITRIM range to cause unintended block trimming beyond the requested range.

The issue occurs on filesystems where the cluster size is larger than the block size.

104) Use-after-free (CVE-ID: CVE-2026-74359)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in configfs_lookup() when handling subsequent getdents(2) operations in a directory after inode allocation failure. A local user can trigger inode allocation failure and then access the affected directory to cause a denial of service.

The issue occurs because a dangling pointer remains in the configfs_dirent structure and is later dereferenced to obtain an inode number.

105) Out-of-bounds write (CVE-ID: CVE-2026-74384)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the nvme multipath namespace head flexible array member current_path[] when handling sparse NUMA node IDs during namespace path revalidation. A local user can trigger nvme multipath operations on a system with sparse NUMA node IDs to cause a denial of service.

Only systems using nvme multipath on architectures where NUMA node IDs are sparse are affected.

106) Improper resource shutdown or release (CVE-ID: CVE-2026-74386)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in nvmet_tcp_alloc_queue() in the NVMe target TCP component when handling connection closure during queue allocation. A remote attacker can repeatedly open and close connections to cause a denial of service.

The issue occurs on an error path where the page fragment cache reference held by queue->pf_cache is not released, leading to a page leak over time.

107) Race condition (CVE-ID: CVE-2026-74398)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in addrconf_dad_failure in the IPv6 address configuration subsystem when handling duplicate address detection failure processing concurrently with IPv6 address deletion. A local attacker can trigger concurrent state transitions to cause a denial of service.

The issue can lead to a general protection fault when a deleted IPv6 address entry is processed a second time through scheduled DAD work.

108) NULL pointer dereference (CVE-ID: CVE-2026-74424)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in fbcon_new_modelist() and related fbcon console handling in drivers/video/fbdev/core/fbcon.c when processing framebuffer modelist changes for a console without vc_data. A local user can trigger a modelist change on such a console to cause a denial of service.

The issue occurs when fb_display[i].mode remains set after the associated console data has been freed.

109) Out-of-bounds write (CVE-ID: CVE-2026-74443)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify authenticated command fields.

The vulnerability exists due to an out-of-bounds write in vmw_cmd_dma() in the vmwgfx command verifier when processing a dma command with an undersized header body size. A local user can submit a specially crafted command to modify authenticated command fields.

The issue arises from a suffix pointer underflow that can clobber fields in a previously relocated command in the device-visible command stream.

110) Out-of-bounds read (CVE-ID: CVE-2026-74444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in vmw_cmd_draw() when processing a user-supplied command stream containing an undersized DRAW_PRIMITIVES header. A local user can supply a crafted command stream to disclose sensitive information.

The issue is triggered when header->size is smaller than the command body size, causing an unsigned subtraction to wrap and a subsequent bounds check to be bypassed.

111) Improper input validation (CVE-ID: CVE-2026-74453)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in validate_tile_binning_config when processing tile binning configurations with oversized tile state arrays. A local user can submit a crafted tile binning configuration that leaves no room for the tile allocation pool to cause a denial of service.

The tile state data array size is derived from tile count fields and shares the same buffer slot with the tile allocation pool.

112) Improper Initialization (CVE-ID: CVE-2026-74453)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the vc4 tile state data array handling when submitting crafted tile binning configurations. A local user can submit a crafted job that reuses stale tile state data to cause a denial of service.

The issue can result in invalid command streams, invalid primitive streams, and GPU hangs.

113) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-74464)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in ovs_flow_key_update() handling within net/openvswitch/actions.c when processing connection tracking actions on a packet whose flow key becomes invalid and unparseable. A local user can trigger flow key update failure with a specially crafted packet and action sequence to cause a denial of service.

This requires the packet to become unparseable after actions are applied to a previously parseable skb.

114) Out-of-bounds write (CVE-ID: CVE-2026-74469)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in SCTP sock_diag when processing a diagnostic dump after adding many unique peer transports. A local user can add unique peer addresses until the 16-bit transport_count wraps and trigger a diagnostic dump to cause a denial of service.

The issue occurs when the association accumulates 65,536 unique peer transports, causing transport_count to wrap to zero while peer addresses are still copied from transport_addr_list.

115) Use-after-free (CVE-ID: CVE-2026-74471)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in trace_module_add_events() and the tracing subsystem when handling failed event registration during module loading. A local user can load a module that triggers event registration failure and subsequently access tracefs or tracing operations to cause a denial of service.

Exploitation requires a module loading scenario in which event registration fails and the module memory is later freed, leaving a stale trace_event_call pointer in trace_event_file.

116) Out-of-bounds read (CVE-ID: CVE-2026-74473)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in route_shortcircuit() in drivers/net/vxlan/vxlan_core.c when processing packets with a non-linear buffer layout. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because the network header may not be fully pulled into the linear buffer before ip_hdr(skb)->daddr or ipv6_hdr(skb)->daddr is dereferenced.

117) Out-of-bounds read (CVE-ID: CVE-2026-74474)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the vxlan transmit path header handling in vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get() when processing crafted socket buffers. A local user can provide a specially crafted skb layout to cause a denial of service.

The issue occurs because network-layer header availability is checked without accounting for the MAC header offset during transmit processing.

118) Race condition (CVE-ID: CVE-2026-74475)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in route_shortcircuit() in the VXLAN implementation when processing neighbour hardware addresses. A local attacker can trigger concurrent updates to cause a denial of service.

119) Use-after-free (CVE-ID: CVE-2026-74480)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in br_multicast_leave_group() in the bridge multicast handling code when processing fast-leave operations on port groups. A local user can trigger deletion of a matching port group to cause a denial of service.

The issue can occur when multicast-to-unicast had been enabled, allowing multiple port groups for the same port and group with different source MAC addresses, and is later disabled so entries are matched by port only.

120) Out-of-bounds read (CVE-ID: CVE-2026-74485)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the binfmt_misc registration parser when processing a crafted registration string with a flag character used as the field delimiter. A remote attacker can submit a specially crafted registration string to disclose sensitive information.

The issue is reachable by unprivileged users in a user namespace through binfmt_misc mounts.

121) Improper input validation (CVE-ID: CVE-2026-74497)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in snd_usb_handle_sync_urb() when processing oversized USB sync packets in implicit-feedback mode. An attacker with physical access can connect a crafted USB device that sends oversized sync packets to cause a denial of service.

122) Out-of-bounds write (CVE-ID: CVE-2026-74498)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in the ALSA USB audio endpoint DMA buffer handling in data_ep_set_params() when processing USB audio endpoints with the fill_max descriptor flag set. A local user can trigger oversized packet transfers to cause a denial of service or corrupt kernel memory.

The issue occurs because the allocated buffer size is based on the original sample-rate-derived value while transfer packets may use the larger maximum packet size.

123) Out-of-bounds write (CVE-ID: CVE-2026-74499)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or execute arbitrary code.

The vulnerability exists due to out-of-bounds write in snd_usbmidi_akai_output() when processing MIDI output for a USB device advertising a tiny bulk-OUT endpoint. An attacker with physical access can connect a crafted USB device and trigger a write to the created MIDI device node to cause a denial of service or execute arbitrary code.

The issue is caused by a signed-to-unsigned conversion in the fill-loop bound calculation, making the loop continue writing past the end of the URB transfer buffer.

124) Use-after-free (CVE-ID: CVE-2026-74512)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in audit_del_rule() when deleting audit rules while concurrent readers access RCU-visible filter lists. A local user can trigger rule deletion during concurrent access to cause a denial of service.

125) Use-after-free (CVE-ID: CVE-2026-74540)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in l2cap_le_connect_rsp() in the Bluetooth L2CAP subsystem when handling a crafted LE connect response during channel processing. A remote attacker can trigger a remote disconnect race to cause a denial of service.

126) Out-of-bounds read (CVE-ID: CVE-2026-74585)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds pointer dereference in tb_drom_parse_entry_port() in the thunderbolt DROM parser when processing a malicious or malformed Thunderbolt device DROM. An attacker with physical access can supply a crafted Thunderbolt device with an invalid dual_link_port_nr value to cause a denial of service.

The invalid pointer is stored and later dereferenced after indexing sw->ports[] beyond the configured maximum port number.

127) Use-after-free (CVE-ID: CVE-2026-74586)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in SCTP ASCONF handling when processing an authenticated ASCONF chunk that adds and removes a peer transport in the same chunk. A remote user can send a specially crafted authenticated ASCONF message to cause a denial of service.

The issue occurs because a stale new_transport pointer can be used when a queued HEARTBEAT is later processed during local address replacement.

128) Use-after-free (CVE-ID: CVE-2026-74588)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in __sctp_outq_flush_rtx() and SCTP transport tracking when processing SCTP SACKs after transport removal. A remote user can send crafted SCTP control traffic to cause a denial of service.

Exploitation requires an SCTP association peer to trigger transport removal through ASCONF Delete-IP and then send a SACK that reneges on the TSN.

129) Use-after-free (CVE-ID: CVE-2026-74589)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tcp_bpf_send_verdict() and tcp_bpf_sendmsg_redir() when processing concurrent sendmsg() operations with a cached redirect verdict. A local user can trigger concurrent socket send operations to cause a denial of service.

The issue occurs when apply_bytes keeps the cached verdict active, allowing one thread to release the redirect socket reference while another thread still uses a stale pointer.

130) Improper Initialization (CVE-ID: CVE-2026-74592)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass integrity measurement and appraisal of truncated files.

The vulnerability exists due to improper state management in the integrity measurement architecture truncate hook handling when truncation is requested for a regular file. A local user can truncate a file to bypass integrity measurement and appraisal of truncated files.

The issue affects files whose IMA action cache flags are not reset after content changes caused by truncation.

131) Out-of-bounds write (CVE-ID: CVE-2026-74597)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to an out-of-bounds write in ip6ip6_err() and the IPv6 ICMP error reply path when processing a quoted inner IPv6 packet after cloning an outer IPv6 ICMP error skb with stale inet6_skb_parm metadata. A remote attacker can send a specially crafted IPv6 packet to corrupt memory.

Exploitation requires the outer packet to carry a Home Address Option and a malformed inner destination-options header.

132) Out-of-bounds read (CVE-ID: CVE-2026-74598)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rt6_route_rcv() when processing a crafted IPv6 Router Advertisement containing a malformed Route Information option. A remote attacker can send a specially crafted Router Advertisement to disclose sensitive information.

When additional options follow the malformed Route Information option, data from the next option can be incorporated into the installed route and become visible to userspace.

133) Race condition (CVE-ID: CVE-2026-74601)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ring_buffer_swap_cpu() when swapping per-cpu ring buffers during an active write operation. A local user can trigger a buffer swap at a moment when the committing counter temporarily drops to zero to cause a denial of service.

The issue can lead to an inconsistent buffer state and trigger the RB_WARN_ON in rb_commit().

134) Use-after-free (CVE-ID: CVE-2026-74609)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tipc_node_link_down() in the TIPC subsystem when handling link-down events and bearer disable operations concurrently. A local user can trigger a race condition that frees a link object while it is still being dereferenced to cause a denial of service.

The issue can result in both a use-after-free read in tipc_link_is_establishing() and a use-after-free write via tipc_link_reset() during the establishing branch.

135) Use-after-free (CVE-ID: CVE-2026-74630)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in in6_dev_get() and inet6_dev handling when processing IPv6 device state during concurrent device teardown. A local user can trigger network operations that race with device teardown to cause a denial of service or execute arbitrary code.

The issue arises from invalid reference acquisition after the object reference count has already reached zero, and the freed object may be accessed after the RCU read-side section ends.

136) Improper input validation (CVE-ID: CVE-2026-74641)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read and write arbitrary kernel memory or cause a denial of service.

The vulnerability exists due to improper input validation in snd_us428ctls_vm_fault() and snd_usx2y_hwdep_pcm_vm_fault() when handling mmap page faults with a user-controlled page offset. A local user can supply a crafted mmap() offset to map a kernel page outside the allocated shared memory region to read and write arbitrary kernel memory or cause a denial of service.

Exploitation requires access to the hwdep node of an attached US-X2Y device, and in the us428 control path the FPGA image must be loaded through the same node first.

137) Use-after-free (CVE-ID: CVE-2026-74660)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ebt_nflog netfilter target when processing packets that match an ebtables nflog rule during concurrent unloading of the nfnetlink_log module. A local user can trigger packet logging through a crafted ebtables nflog rule to cause a denial of service.

Exploitation requires a race with module teardown while an ebtables nflog rule remains callable.

138) Uncontrolled Recursion (CVE-ID: CVE-2026-74663)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in qdisc hierarchy handling in net/sched qdisc grafting logic when creating and grafting a new child qdisc below an already deep parent. A local user can create a deeply nested qdisc hierarchy to cause a denial of service.

The issue affects the create-and-graft path that is not covered by the existing loop check.

139) Out-of-bounds read (CVE-ID: CVE-2026-74667)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the packet-socket transmit path in net/packet/af_packet.c when transmitting frames through the PACKET_QDISC_BYPASS path. A local user can send a specially crafted packet through a packet socket to cause a denial of service.

The issue occurs when a driver reads eth_hdr(skb) on transmit with an unset MAC header.

140) Out-of-bounds read (CVE-ID: CVE-2026-74671)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in xattr_verify() when verifying a truncated security.ima extended attribute value. A local user can provide a specially crafted truncated extended attribute to disclose sensitive information.

The issue is triggered by an integer underflow caused by mixing signed and unsigned arithmetic in the digest-length check.

141) Out-of-bounds write (CVE-ID: CVE-2026-74682)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the ALSA usb-audio endpoint handling code when processing inbound URBs for Type II capture formats after userspace sets hw_params on the stream. A local user can use a device advertising a Type II capture format to trigger an out-of-bounds write and cause memory corruption.

Only capture streams are affected.

142) Use-after-free (CVE-ID: CVE-2026-74688)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the SCTP control chunk handling logic when transmitting a queued HEARTBEAT ACK after the associated peer transport has been removed. A remote attacker can trigger peer transport removal while a control chunk retains a stale transport pointer to cause a denial of service.

The issue occurs when src_out_of_asoc_ok is enabled and the HEARTBEAT ACK remains queued on control_chunk_list instead of being transmitted immediately.

143) Out-of-bounds read (CVE-ID: CVE-2026-74689)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in vcc_setsockopt() when processing crafted setsockopt calls. A local user can supply a mismatched level or a shortened optlen value to trigger an out-of-bounds read and disclose sensitive information.

The issue can also be triggered if a cgroup BPF setsockopt filter shrinks optlen after entry.

144) Incorrect behavior order (CVE-ID: CVE-2026-74691)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown sequence in the thunderbolt networking teardown logic when disabling thunderbolt DMA paths during interface teardown. A local user can trigger interface teardowns to cause a denial of service.

On affected systems, repeated teardowns can eventually take the XDomain control channel down, after which the peer node disappears until the controller is power cycled.

145) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74692)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in smc_listen_out() in net/smc/af_smc.c when handling TCP connection attempts while a listener is being closed. A remote attacker can open TCP connections during the race window to cause a denial of service.

The issue can leak child smc_sock objects, their clcsock objects, and references, which can exhaust kernel memory.

146) Out-of-bounds read (CVE-ID: CVE-2026-74701)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in key_extract() in the Open vSwitch flow extraction logic when processing a packet on an ARPHRD_NONE device with a user-controlled protocol field indicating Ethernet. A local user can send a specially crafted packet with an insufficient linear header to cause a denial of service.

The issue is triggered when the packet is received from devices such as TUN.

147) Race condition (CVE-ID: CVE-2026-74726)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in bond_alb_monitor in the bonding ALB implementation when handling active slave changes under RTNL. A local user can trigger network interface state changes to cause a denial of service.

The issue can lead to a null pointer dereference and kernel panic, and in failover cases can underflow the new slave's promiscuity counter and leave it stuck in promiscuous mode.

148) Out-of-bounds read (CVE-ID: CVE-2026-74739)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in u32_bind_class() when processing cls_u32 walker callback entries. A local user can trigger class binding on a hash table entry that is incorrectly treated as a tc_u_knode to disclose sensitive information.

The issue occurs because u32_walk() can enumerate both tc_u_hnode and tc_u_knode objects, but the affected code unconditionally treats the callback argument as a tc_u_knode.

149) Use-after-free (CVE-ID: CVE-2026-74744)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the ipvlan network device component when handling packet header and tailroom requirements inherited from the underlying physical device. A remote attacker can trigger packet processing that causes insufficient headroom or tailroom reservation to execute arbitrary code.

The issue can occur when the underlying physical or stacked lower device requires extra headroom or tailroom for headers or trailers.

150) Out-of-bounds read (CVE-ID: CVE-2026-74752)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in SCTP COOKIE_ECHO handling when processing peer-controlled cookie AUTH fields with cookie authentication disabled. A remote attacker can send a forged cookie with a crafted RANDOM length to disclose sensitive information.

The issue is reachable when cookie authentication is disabled, and malformed AUTH parameters restored from the cookie are not validated against local backing arrays.

151) Out-of-bounds write (CVE-ID: CVE-2026-74752)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in SCTP COOKIE_ECHO handling when processing peer-controlled cookie AUTH fields with cookie authentication disabled. A remote attacker can send a forged cookie with a crafted HMAC identifier to execute arbitrary code.

The issue is reachable when cookie authentication is disabled, and malformed AUTH parameters restored from the cookie are not validated against local backing arrays.

152) Integer overflow (CVE-ID: CVE-2026-80540)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an integer overflow in the amdgpu UVD decode message handler when processing crafted decode parameters. A local user can supply a crafted pitch value to trigger the overflow and execute arbitrary code.

The issue is in the Linux kernel DRM AMDGPU UVD decode path.

153) Out-of-bounds read (CVE-ID: CVE-2026-80557)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, execute arbitrary code, or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in decode_watchers() when processing a crafted obj_list_watch_response_t reply with struct_len set to 0. A remote attacker can send a specially crafted OSD response to disclose sensitive information, execute arbitrary code, or cause a denial of service.

Exploitation requires a malicious or compromised OSD and can be triggered when a kernel client invokes CEPH_OSD_OP_LIST_WATCHERS.

154) Out-of-bounds read (CVE-ID: CVE-2026-80558)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, corrupt memory, or cause a denial of service.

The vulnerability exists due to out-of-bounds read in ceph_pg_to_up_acting_osds() and calc_target() when processing a corrupted osdmap containing an invalid primary_temp OSD index. A remote attacker can send a crafted osdmap with a nonexistent OSD index to trigger out-of-bounds array access to disclose sensitive information, corrupt memory, or cause a denial of service.

The issue occurs because the primary_temp OSD index was not properly validated before being used as the target OSD for a request.

155) Out-of-bounds read (CVE-ID: CVE-2026-80561)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to out-of-bounds read in decode_locker() in net/ceph/cls_lock_client.c when decoding locker data from an OSD response. A remote attacker can send a specially crafted OSD response to disclose sensitive information and cause a denial of service.

Exploitation requires a malicious or compromised OSD to interact with a kernel client issuing the lock.get_info class method, such as during RBD exclusive lock acquisition.

156) NULL pointer dereference (CVE-ID: CVE-2026-80664)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in xt_nat SNAT and DNAT target handlers when installing an unsupported-family compat rule through nft_compat. A local user can instantiate a bridge-family compat rule to cause a denial of service.

The issue is triggered in nf_nat_setup_info() because the handlers assume IP-family conntrack state is present.

157) Use-after-free (CVE-ID: CVE-2026-80681)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in vxlan_xmit() in drivers/net/vxlan/vxlan_core.c when processing packets through route_shortcircuit(). A local user can trigger skb head reallocation and subsequent dereference of a stale ethernet header pointer to cause a denial of service.

158) Out-of-bounds write (CVE-ID: CVE-2026-80731)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in dev_validate_header when validating short link-layer headers after a network device's hard_header_len increases. A local privileged user can trigger zero-padding of a short link-layer header to cause memory corruption.

The affected path is limited to variable-length layer-2 protocols where the header length is at least min_header_len but shorter than hard_header_len.

159) Out-of-bounds read (CVE-ID: CVE-2026-80747)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to improper bounds checking in the AMD KFD CRAT parser when parsing a malformed CRAT table with an oversized subtype length field. A local user can supply a malformed CRAT table with an oversized subtype length field to read memory out of bounds.

160) Use-after-free (CVE-ID: CVE-2026-80785)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to store a stale pointer to freed memory in fb_info->mode.

The vulnerability exists due to a use-after-free race condition in the fbdev mode sysfs handlers in drivers/video/fbdev/core/fbsysfs.c when concurrently accessing mode sysfs attributes while the modelist is replaced. A local user can race mode sysfs reads or writes with modelist replacement to store a stale pointer to freed memory in fb_info->mode.

161) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-80789)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in nvmet_tcp_map_data() when processing write commands containing non-inline transport SGL data-block descriptors. A remote attacker can submit a crafted NVMe/TCP command with an oversized SGL length to cause a denial of service.

For write commands, the target waits for host data after issuing an R2T response.

162) Infinite loop (CVE-ID: CVE-2026-80793)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of the effective MTU in ip_do_fragment() when fragmenting IPv4 packets with an effective MTU smaller than the IPv4 header length plus 8 bytes. A remote attacker can send a packet requiring fragmentation over an affected route or device to cause a denial of service.

The issue can occur while forwarding packets to a device with an MTU of 20 bytes.

163) Out-of-bounds read (CVE-ID: CVE-2026-80798)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read memory out of bounds.

The vulnerability exists due to insufficient length validation in the LLCP receive path when processing an LLCP PDU shorter than the LLCP header. A remote attacker can send a crafted undersized LLCP PDU to read memory out of bounds.

LLCP link activation occurs automatically after NFC-DEP.

164) Out-of-bounds read (CVE-ID: CVE-2026-80800)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in nfc_llcp_connect_sn() when processing received CONNECT and CC PDUs. A remote attacker can send a malformed NFC LLCP PDU to read out-of-bounds memory.

LLCP link activation occurs automatically after NFC-DEP.

165) Out-of-bounds write (CVE-ID: CVE-2026-80829)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in snd_usbmidi_novation_output() when handling USB MIDI output from a device with an undersized bulk OUT endpoint. An attacker with physical access can connect a malicious USB device that advertises a one-byte bulk OUT endpoint to cause memory corruption.

166) Use-after-free (CVE-ID: CVE-2026-80841)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in AF_PACKET TX_RING handling when closing a socket or replacing a transmit ring while transmit skbs remain pending. A local user can close a socket or replace a transmit ring while transmit skbs remain pending to cause a denial of service.

The issue is limited to vmalloc-backed transmit-ring blocks.

167) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-80844)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of routing header segments_left values in ipv6_rearrange_rthdr() when processing raw IPv6 HDRINCL packets with a segments_left value larger than the number of addresses described by hdrlen. A local user can send a crafted packet with an oversized segments_left value to cause an out-of-bounds memory access.

168) Division by zero (CVE-ID: CVE-2026-80847)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a divide-by-zero error in tcp_select_initial_window() when processing route-derived advertised MSS values. A local user can configure a route with a too-small RTAX_ADVMSS value to cause a denial of service.

The default advertised MSS path is also affected when the effective advertised MSS is reduced by the route MTU and min_adv_mss.

169) Out-of-bounds write (CVE-ID: CVE-2026-80852)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in tls_append_frag() in the TLS device offload implementation when repeatedly splicing small amounts of data into a TLS_TX_ZEROCOPY_RO socket using SPLICE_F_MORE and MSG_MORE. A local user can cause the fragment count to exceed the maximum array bound to cause a denial of service.

The vulnerable path requires TLS device offload support.

170) Out-of-bounds write (CVE-ID: CVE-2026-80863)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in free_rd_atomic_resources() in the RXE RDMA driver when modifying a queue pair's max_dest_rd_atomic setting. A local user can modify a queue pair's max_dest_rd_atomic setting to cause a denial of service.

171) Use-after-free (CVE-ID: CVE-2026-80864)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the RDMA/rxe responder resource handling when modifying IB_QP_MAX_DEST_RD_ATOMIC while the responder task is active. A local user can race the freeing and reallocation of rd_atomic resources to cause a denial of service.

172) Integer overflow (CVE-ID: CVE-2026-80908)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an integer overflow in DPB size calculations.

The vulnerability exists due to integer overflow in the amdgpu UVD message decoder when processing a UVD message with dimensions exceeding 4096. A local user can submit a UVD message with oversized dimensions to trigger an integer overflow in DPB size calculations.

173) Integer underflow (CVE-ID: CVE-2026-81000)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write packet data outside allocated memory.

The vulnerability exists due to an integer underflow in TUN and TAP interface handling in tun_get_user() when processing an oversized headroom request propagated by an OVS port. A local user can configure an OVS port to propagate an oversized headroom request to a TUN or TAP device to write packet data outside allocated memory.

174) Use-after-free (CVE-ID: CVE-2026-81001)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sl_sync() in the SLIP driver when opening a SLIP line discipline concurrently with SLIP device teardown. A local user can trigger a race between SLIP device opening and teardown to cause a denial of service.

175) NULL pointer dereference (CVE-ID: CVE-2026-81005)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown state management in the IPMI message handler failed-registration rollback path when asynchronous redo_bmc_reg work retries BMC device-ID probing after a failed registration. A local user can cause BMC device-ID retrieval to fail and trigger a NULL pointer dereference to cause a denial of service.

The issue occurs after the lower driver's shutdown callback has cleared the SI state machine data.

176) Configuration (CVE-ID: CVE-2026-89448)

CWE-ID: CWE-16 - Configuration

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause access control services to remain disabled while the IOMMU is forced on.

The vulnerability exists due to improper configuration handling in detect_intel_iommu() when tboot forces the IOMMU on after ACS was not requested. A local privileged user can configure the system to disable ACS to cause access control services to remain disabled while the IOMMU is forced on.

177) NULL pointer dereference (CVE-ID: CVE-2026-89477)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in SCTP stream reconfiguration request handling when processing specially crafted SCTP RECONF chunks. A remote attacker can send a specially crafted SCTP RECONF packet to cause a denial of service.

A RECONF chunk containing incoming SSN reset, outgoing SSN reset, and response parameters, or two RECONF chunks in one packet, can trigger the issue.

178) Use-after-free (CVE-ID: CVE-2026-89479)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access freed memory.

The vulnerability exists due to use-after-free in the SCTP endpoint receive loop when processing a specially crafted SCTP packet containing bundled chunks. A remote attacker can send an SCTP packet that deletes an association before subsequent chunks are processed to access freed memory.

Exploitation requires the packet to be processed from the socket backlog in task context.

179) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-89480)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper validation of the received data length in the NVMe/TCP host driver when processing a short C2HData PDU from an NVMe/TCP controller. A remote attacker can respond to a read request with fewer bytes than requested to disclose sensitive information.

180) Improper input validation (CVE-ID: CVE-2026-89481)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in nvme_tcp_handle_r2t() when processing an R2T request for a read command. A remote attacker can send an R2T request for a read command to disclose sensitive information.

The disclosed read destination buffer may contain stale kernel data.

181) Use-after-free (CVE-ID: CVE-2026-89510)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a use-after-free condition.

The vulnerability exists due to a race condition in the RDMA/cxgb4 device removal and registration work handling when removing an RDMA device while registration work is pending or running. A local privileged user can remove the device while the registration work accesses the device object to cause a use-after-free condition.

182) NULL pointer dereference (CVE-ID: CVE-2026-89511)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the qede driver's TPA fragment processing when handling TPA continuation fragments under memory pressure. A remote attacker can send network traffic that is processed as TPA continuation fragments during memory pressure to cause a denial of service.

183) Integer underflow (CVE-ID: CVE-2026-89524)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer underflow in ath6kl_cfg80211_connect_event() when handling association events with request or response lengths shorter than their fixed information element offsets. A remote attacker can trigger such an association event to disclose sensitive information.

184) Memory leak (CVE-ID: CVE-2026-89531)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the svcrdma handle_connect_req() connection handler when transport allocation fails while processing connection requests. A remote attacker can send repeated connection attempts during memory pressure to cause a denial of service.

185) Improper input validation (CVE-ID: CVE-2026-89538)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in gss_krb5_unwrap_v2() when processing Kerberos v2 wrap tokens with oversized extra count fields. A remote user can send a malformed Kerberos v2 wrap token to cause a denial of service.

The token must be encrypted using a valid GSS context.

186) Memory leak (CVE-ID: CVE-2026-89539)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in gssx_dec_option_array() when processing a reply containing duplicate CREDS_VALUE options. A remote attacker can send a crafted reply containing duplicate CREDS_VALUE options to cause a denial of service.

187) Race condition (CVE-ID: CVE-2026-89540)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to an initialization race condition in the use-gss-proxy proc entry initialization when writing to the newly published proc entry before gssp_lock is initialized. A local user can win the initialization race and write to the proc entry to cause a resource leak.

The race window can widen when the auth_rpcgss module is loaded for live network namespaces.

188) NULL pointer dereference (CVE-ID: CVE-2026-89544)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the SUNRPC gssx XDR option-array decoder when handling an allocation failure while decoding an option array. A local user can trigger the decoder's error path to cause a denial of service.

The affected error paths also include a group_info reference-count leak and a latent use-after-free condition.

189) Use-after-free (CVE-ID: CVE-2026-89548)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper synchronization in the SUNRPC cache cleanup routine when tearing down a network namespace. A local user can cause cache_clean() to access a freed cache_detail to trigger a use-after-free condition.

190) Integer underflow (CVE-ID: CVE-2026-89551)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause downstream XDR decoders to use an incorrect stream bound.

The vulnerability exists due to an integer underflow in xdr_buf_trim() when processing GSS Kerberos v2 data whose recorded buffer length is smaller than the associated I/O vector lengths. A remote attacker can cause xdr_buf_trim() to consume more bytes than buf->len records to cause downstream XDR decoders to use an incorrect stream bound.

191) Use-after-free (CVE-ID: CVE-2026-89569)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access freed RFCOMM session and data link connection objects.

The vulnerability exists due to use-after-free in the RFCOMM security confirmation handler rfcomm_security_cfm() when processing Bluetooth security confirmations concurrently with RFCOMM session teardown. A remote attacker can trigger the concurrent processing to access freed RFCOMM session and data link connection objects.

192) Out-of-bounds write (CVE-ID: CVE-2026-89580)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write out of bounds.

The vulnerability exists due to a race condition in __bpf_get_stack when a preemptible BPF program accesses a reused per-CPU callchain buffer. A local user can execute a preemptible BPF program to write out of bounds.

The issue can affect non-sleepable raw tracepoint programs on PREEMPT kernels.

193) Memory leak (CVE-ID: CVE-2026-89644)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to missing release of memory after effective lifetime in btrfs_get_blocks_direct_write() when performing a direct I/O write to a NOCOW range and ordered extent allocation fails. A local user can issue a direct I/O write to a NOCOW range to cause a resource leak.

194) Use-after-free (CVE-ID: CVE-2026-89662)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the NFSD __destroy_client() function when processing DESTROY_CLIENTID requests. A remote attacker can trigger client teardown while blocked locks are reaped to cause a denial of service.

The race can result in a NULL dereference in remove_blocked_locks().

195) Improper Handling of Length Parameter Inconsistency (CVE-ID: CVE-2026-89673)

CWE-ID: CWE-130 - Improper Handling of Length Parameter Inconsistency

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose stale reply-page content.

The vulnerability exists due to an incorrect XDR padding calculation in nfsd4_ff_encode_getdeviceinfo() when encoding flexfile GETDEVICEINFO replies. A remote attacker can send a GETDEVICEINFO request to disclose stale reply-page content.

The incorrect declared address-body length can also mis-align decoding of the subsequent version list.

196) Out-of-bounds write (CVE-ID: CVE-2026-89674)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.

The vulnerability exists due to an incorrect XDR buffer size calculation in nfsd4_ff_encode_layoutget() when encoding layoutget responses with short user or group strings and an odd-sized file handle. A remote attacker can request a layoutget operation to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.

197) Race condition (CVE-ID: CVE-2026-89686)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in nfsd4_alloc_layout_stateid when concurrently revoking a delegation and processing a LAYOUTGET request. A remote attacker can send concurrent NFS requests that trigger delegation recall and layout-state allocation to cause a denial of service.

Exploitation requires one NFS client to hold a delegation and fail to respond to its recall while another client opens the same file.

198) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89707)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper resource release in nfsd_cross_mnt() when handling NFS requests that result in follow_down() errors. A remote user can send NFS requests that trigger failed cross-mount operations to cause a denial of service.

The issue is reachable through nfsd_lookup_dentry or NFSv4 READDIR encoding.

199) Race condition (CVE-ID: CVE-2026-89752)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the memory.high and memory.max limit update handlers when concurrently updating memory cgroup limits through separate open files. A local user can lower a memory.max limit and restore it through another open file to cause a denial of service.

Exploitation requires a cgroup populated with anonymous memory and swapping disabled.

200) NULL pointer dereference (CVE-ID: CVE-2026-89784)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rpcb_register_inet4() and rpcb_register_inet6() when an in-kernel RPC service registers with the local rpcbind after an address-string allocation fails. A local user can cause an in-kernel RPC service to register with the local rpcbind to cause a denial of service.

Exploitation requires sufficient memory pressure for a small GFP_KERNEL allocation to fail.

201) Use-after-free (CVE-ID: CVE-2026-89789)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose and modify sensitive information and cause a denial of service.

The vulnerability exists due to use-after-free in the gtp_newlink() error path in drivers/net/gtp.c when handling gtp_newlink() error paths concurrently with gtp encapsulation receive operations. A local user can trigger the race condition to disclose and modify sensitive information and cause a denial of service.

202) Double free (CVE-ID: CVE-2026-89870)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a double free in zoran_exit_video_devices() when unregistering a registered video device during device teardown. A local user can trigger device teardown to cause memory corruption.

203) Integer overflow (CVE-ID: CVE-2026-89927)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow in the KVM x86 Hyper-V synthetic timer deadline calculation when programming a synthetic timer with a count value close to U64_MAX. A remote attacker can program a synthetic timer with a crafted count value to cause a denial of service.

204) Race condition (CVE-ID: CVE-2026-89929)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper synchronization of TLB invalidation in KVM nested virtualization INVVPID emulation when a virtual machine is migrated between physical CPUs. A local user can cause L1 to migrate between physical CPUs while emulating INVVPID to compromise confidentiality, integrity, and availability.

205) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89930)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause stale TLB translations to be used.

The vulnerability exists due to failure to service queued local TLB flush requests in KVM nVMX nested VM-entry handling when a nested VM entry fails after switching to the L2 context. A remote attacker can change L2's VPID and trigger a failed nested VM entry to cause stale TLB translations to be used.

206) Improper Enforcement of Behavioral Workflow (CVE-ID: CVE-2026-89968)

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of protocol state in nvmet_tcp_handle_h2c_data_pdu() when processing an unsolicited H2CData PDU before transmitting a requested data transfer (R2T). A remote attacker can send an H2CData PDU for a write command before the R2T is transmitted to cause a denial of service.

The affected subsystem must be configured with allow_any_host.

207) Improper input validation (CVE-ID: CVE-2026-90088)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in rfcomm_apply_pn() when processing remote parameter negotiation frames. A remote attacker can send a parameter negotiation frame with an MTU value of zero to cause a denial of service.

208) Access of Uninitialized Pointer (CVE-ID: CVE-2026-90104)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uninitialized pointer in the NFSv4.1 callback sequence argument decoder when handling NFSv4.1 callback sequence arguments containing an empty referring call list. A remote attacker can send a crafted NFSv4.1 callback request to cause a denial of service.

209) NULL pointer dereference (CVE-ID: CVE-2026-90149)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the NFSv4 flexfiles data server session and error-handling paths when processing I/O for NFSv4.0 data servers. A remote user can perform I/O operations against an NFSv4.0 flexfiles data server to cause a denial of service.

NFSv4.0 data server clients do not maintain sessions.

210) Use-after-free (CVE-ID: CVE-2026-90151)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the NFSv4 callback identifier IDR when an NFSv4.0 callback lookup occurs after a client allocation failure. A remote attacker can trigger an NFSv4.0 callback lookup using the stale callback identifier to trigger a use-after-free.

Exploitation requires an NFSv4.0 client allocation to fail after a callback identifier has been allocated.

211) Memory corruption (CVE-ID: CVE-2026-90203)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of a negative block offset in squashfs_copy_data() when reading a crafted file from a mounted crafted Squashfs filesystem. A local user can read a crafted file with a negative offset to cause an out-of-bounds memory access.

Mounting the crafted Squashfs filesystem requires CAP_SYS_ADMIN.

212) Out-of-bounds read (CVE-ID: CVE-2026-90223)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in nfc_llcp_recv_snl() when processing malformed SNL TLVs. A remote attacker can send a malformed SNL frame to perform an out-of-bounds read.

LLCP link activation occurs automatically after NFC-DEP.

213) Incorrect calculation (CVE-ID: CVE-2026-90259)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect freeing of reserved qgroup data.

The vulnerability exists due to an incorrect length calculation in qgroup_free_reserved_data() when freeing reserved qgroup data. A local user can trigger reserved-data range processing to cause incorrect freeing of reserved qgroup data.

214) Race condition (CVE-ID: CVE-2026-90293)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in the iSER target login receive-buffer handling when processing a SCSI command before the final Login Response. A remote attacker can send a SCSI command before receiving the final Login Response to cause a denial of service.

215) Race condition (CVE-ID: CVE-2026-90294)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in iSER target login-response handling when an initiator submits a SCSI command immediately after receiving the final Login Response. A remote attacker can send a specially timed SCSI command to cause a denial of service.

216) Out-of-bounds read (CVE-ID: CVE-2026-90307)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the SRP response-processing handlers when processing truncated SRP requests. A remote attacker can send a crafted truncated SRP_CRED_REQ or SRP_AER_REQ to disclose sensitive information.

Exploitation requires an SRP target to advertise a small max_ti_iu_len value during login.

217) Out-of-bounds read (CVE-ID: CVE-2026-90413)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the iSER login PDU handling code when processing a login PDU whose declared data segment length exceeds the received payload length. A remote attacker can send a crafted login PDU with an oversized declared data segment length to read out-of-bounds memory.

The issue can be triggered before authentication.

218) Out-of-bounds read (CVE-ID: CVE-2026-90414)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause an out-of-bounds read and write heap contents beyond the receive descriptor to backing storage.

The vulnerability exists due to missing validation of the declared data segment length in isert_recv_done() when processing iSER/iSCSI PDUs. A remote user can send a PDU that declares a data segment larger than the received data to cause an out-of-bounds read and write heap contents beyond the receive descriptor to backing storage.

Exploitation requires the full feature phase and negotiated parameters that permit unsolicited or immediate data.

219) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90415)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the RDMA/cxgb4 write_tpt_entry() function when programming a TPT entry. A local user can trigger a failed TPT entry write to cause a denial of service.

220) Double free (CVE-ID: CVE-2026-90417)

CWE-ID: CWE-415 - Double Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a double free.

The vulnerability exists due to improper memory management in the RDMA/cxgb4 memory-registration error handling when processing DMA memory-region registration errors. A local user can trigger error handling to cause a double free.

221) Out-of-bounds read (CVE-ID: CVE-2026-92525)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in copy_data() when processing a user-supplied work queue element. A local user can post a work queue element with an out-of-range cur_sge or oversized num_sge to cause a denial of service.

222) Use-after-free (CVE-ID: CVE-2026-93104)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to returning a dangling pointer in rvt_alloc_device when allocating a port array. A local user can trigger a port-array allocation failure to cause a use-after-free.

223) Race condition (CVE-ID: CVE-2026-93108)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper synchronization in the IPoIB module teardown path when unloading the module while RCU callbacks remain pending. A local privileged user can initiate module teardown before queued RCU callbacks complete to cause a denial of service.

The condition can also occur after client registration failure removes already-added devices and queues callbacks.

224) Out-of-bounds read (CVE-ID: CVE-2026-93264)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory registration to be rejected.

The vulnerability exists due to an incorrect chunk length calculation in the EFA RDMA driver's pbl_chunk_list_create function when registering a memory region whose PBL page count is a multiple of 510. A local user can register such a memory region to cause memory registration to be rejected.

The issue can also result in an out-of-bounds access to the chunks array.

225) Race condition (CVE-ID: CVE-2026-93782)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write response data to an unrelated userspace object.

The vulnerability exists due to a race condition in vhost-scsi ioctl handling when replacing the memory table while commands are in flight. A local user can submit commands and issue VHOST_SET_MEM_TABLE to write response data to an unrelated userspace object.

226) Race condition (CVE-ID: CVE-2026-93794)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause punched file ranges to be incorrectly reported as allocated data.

The vulnerability exists due to improper synchronization in the SMB client smb3_punch_hole function when punching a hole after a large buffered write. A local user can perform a large buffered write followed by a hole-punch operation to cause punched file ranges to be incorrectly reported as allocated data.

227) Race condition (CVE-ID: CVE-2026-93829)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a race condition in cifsd demultiplex thread creation when initializing tcp_ses. A local privileged user can trigger the race during CIFS session creation to cause a denial of service.

228) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-97557)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper reference count management in cifs_queue_oplock_break() when queueing oplock-break work. A remote attacker can trigger repeated oplock breaks while prior work remains queued to cause a denial of service.

The issue can be triggered when interacting with a slow-responding server.

229) Use-after-free (CVE-ID: CVE-2026-97940)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service, disclose sensitive information, or modify information.

The vulnerability exists due to a use-after-free in the IPv6 FIB route iterator walker handling when stopping an IPv6 route iterator while routes are deleted. A local user can trigger a race that leaves a freed walker on the IPv6 FIB walker list to cause a denial of service, disclose sensitive information, or modify information.

The same stop helper is used by /proc/net/ipv6_route and the BPF IPv6 route iterator.

230) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98080)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause filesystem metadata corruption and force the filesystem read-only.

The vulnerability exists due to improper reloc root creation in the Btrfs qgroup snapshot accounting path when accounting snapshots during block-group relocation. A local user can perform Btrfs operations that account snapshots during relocation to cause filesystem metadata corruption and force the filesystem read-only.

The issue occurs on Btrfs filesystems with quotas enabled.

231) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-98164)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect control flow implementation in the KVM x86 MMU page-tracking logic when checking write tracking across address spaces. A local user can cause a write-tracked guest frame number to be treated as untracked and trigger a kernel BUG to cause a denial of service.

The issue occurs when system management mode uses multiple address spaces.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2026/suse-su-20264687-1/