SB2026102145 - SUSE update for the Linux Kernel

Description

This security bulletin contains information about 510 vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2024-26730)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the nct6775_probe() function in drivers/hwmon/nct6775-core.c. A local user can perform a denial of service (DoS) attack.

2) Input validation error (CVE-ID: CVE-2025-38704)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the kernel/rcu/tree_nocb.h. A local user can perform a denial of service (DoS) attack.

3) Incomplete cleanup (CVE-ID: CVE-2026-100075)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect send queue credit accounting.

The vulnerability exists due to incomplete cleanup in the srpt_alloc_rw_ctxs() error unwind path when handling an allocation failure partway through a multi-buffer indirect descriptor. A remote attacker can trigger the error path to cause incorrect send queue credit accounting.

4) Type conversion (CVE-ID: CVE-2026-23352)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper memory management in the EFI boot services memory release mechanism when processing memory map initialization during system boot. A local attacker can trigger the early release of boot services memory before deferred memory map initialization is complete, leading to unfreed memory pages and a memory leak.

The issue specifically occurs on systems with CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled, where memblock_free_late() skips uninitialized pages, resulting in a significant memory leak—up to approximately 140MB on constrained systems like EC2 t3a.nano instances with only 512MB RAM.

5) Improper Initialization (CVE-ID: CVE-2026-31689)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in edac_mc_alloc() when handling a failed mci->pvt_info allocation. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs because put_device() may invoke the device release function before device initialization has completed.

6) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43409)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in kprobes module callback handling when removing modules after ftrace has been disabled by errors. A local user can remove a module containing kprobe probes to cause a denial of service.

The issue is triggered after ftrace has been killed due to an error condition.

7) NULL pointer dereference (CVE-ID: CVE-2026-45836)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in l2cap_sock_get_sndtimeo_cb() when handling Bluetooth L2CAP socket operations. A local user can trigger the vulnerable code path to cause a denial of service.

8) Memory leak (CVE-ID: CVE-2026-45872)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in pqi_report_phys_luns() when handling unsupported data formats or allocation failures. A local user can trigger the vulnerable error paths to cause a denial of service.

9) Improper resource shutdown or release (CVE-ID: CVE-2026-46044)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the ssif kthread cleanup logic when handling error conditions after creating the ssif kthread but before starting the ssif interface. A local user can trigger an error condition during ssif interface initialization to cause a denial of service.

10) Race condition (CVE-ID: CVE-2026-46135)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in nvmet_tcp_handle_icreq() and target-side queue teardown when processing an initialization connection request and a connection close concurrently. A remote attacker can send an initialization connection request and immediately close the connection to cause a denial of service.

The issue can lead to a second kref_put() being issued on an already released queue.

11) Out-of-bounds read (CVE-ID: CVE-2026-46149)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tg_pt_gp_members_show() when formatting and copying LUN paths to a sysfs reader. A local user can read the affected sysfs entry with a long fabric WWN value to disclose sensitive information.

When CONFIG_FORTIFY_SOURCE is enabled, exploitation triggers fortify_panic() instead of leaking adjacent stack contents.

12) Improper resource shutdown or release (CVE-ID: CVE-2026-46196)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in tracepoint_add_func() when handling tracepoint registration failures after invoking ext->regfunc(). A local user can trigger a func_add() failure during probe installation to cause a denial of service.

For syscall tracepoints, the issue can leave syscall tracing state enabled and impose persistent syscall entry and exit overhead until reboot.

13) Improper locking (CVE-ID: CVE-2026-46304)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in nvmet_ctrl_free when freeing a controller while processing nvmet-wq work items. A local user can trigger controller teardown to cause a denial of service.

The issue can lead to a possible recursive locking condition on the nvmet-wq workqueue during NVMe target controller teardown.

14) Use-after-free (CVE-ID: CVE-2026-52912)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in nf_queue when reinjecting queued bridge LOCAL_IN packets. A remote attacker can trigger packet queueing and later reinjection to cause a denial of service.

The issue occurs because skb->dev can still reference a freed bridge master device while the packet remains queued.

15) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-53061)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data loss.

The vulnerability exists due to improper state validation in the dm-cache target when resuming a preloaded table in passthrough mode while dirty mappings are present. A local user can preload and resume a crafted dm-cache table configuration to cause data loss.

Exploitation requires local access to device-mapper management and occurs when metadata updates are still ongoing during table preloading.

16) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53284)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in btrfs_write_and_wait_transaction() and the dirty_pages io tree when handling failed transaction writeback. A remote attacker can trigger write errors that cause dirty extent buffer records to be released prematurely to cause a denial of service.

The issue can leave dirty extent buffers uncleared during transaction cleanup and trigger warnings during filesystem unmount.

17) Use-after-free (CVE-ID: CVE-2026-53384)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in the 8250_dw serial driver when handling a failed clock notifier registration during device probe. A local user can trigger the error path and access the stale port slot to cause a denial of service or execute arbitrary code.

The issue occurs because the 8250 port remains registered after probe failure while its associated driver data has already been freed.

18) Race condition (CVE-ID: CVE-2026-53400)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the i2c adapter registration logic when looking up adapters by id during registration. A local user can trigger concurrent adapter lookup and registration activity to cause a denial of service.

The issue can lead to access to uninitialized adapter data, including NULL-pointer dereferences or use-after-free.

19) Integer underflow (CVE-ID: CVE-2026-63883)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose stale buffer data.

The vulnerability exists due to an integer underflow in qcom_geni_serial_handle_tx_dma() when handling a DMA completion interrupt after uart_flush_buffer() resets the transmit buffer. A local user can trigger a flush before DMA completion is processed to disclose stale buffer data.

The issue is caused by a race condition between transmit buffer flushing and delayed DMA completion handling.

20) Improper input validation (CVE-ID: CVE-2026-63890)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in fcoe_ctlr_recv_clr_vlink() in drivers/scsi/fcoe/fcoe_ctlr.c when processing FIP CVL frames. A remote attacker can send a crafted FIP CVL frame with a zero-length non-critical descriptor to cause a denial of service.

Exploitation is limited to an unauthenticated layer 2 peer on the FCoE control VLAN and can block subsequent FIP frames on the affected controller.

21) Insufficient verification of data authenticity (CVE-ID: CVE-2026-63913)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state validation in the TCP conntrack state machine in netfilter conntrack when processing a crafted SYN followed by an invalid-sequence RST packet. A remote attacker can send a specially crafted packet sequence to cause a denial of service.

The issue can prematurely terminate an active NAT entry by forcing the conntrack entry into the CLOSE state.

22) Improper input validation (CVE-ID: CVE-2026-63956)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or corrupt memory.

The vulnerability exists due to improper input validation in the cypress_m8 USB serial driver when processing a malicious USB device with a too-small interrupt-out endpoint max packet size. An attacker with physical access can connect a specially crafted USB device to cause a denial of service or corrupt memory.

The issue can be triggered if a device reports an interrupt-out endpoint max packet size smaller than eight bytes.

23) Out-of-bounds read (CVE-ID: CVE-2026-63963)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Discover Identity ACK handlers in the tcpm subsystem when processing a device-supplied VDO count. A remote attacker can provide a crafted count value to disclose sensitive information.

24) Out-of-bounds write (CVE-ID: CVE-2026-63987)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in ethnl_update_profile() in the ethtool coalesce handling code when processing a user-controlled Netlink nested attribute list for ETHTOOL_A_PROFILE_IRQ_MODERATION. A local user can send a specially crafted Netlink request with excessive nested profile entries to cause a denial of service.

The number of nested entries is entirely user-controlled, while the destination buffer is allocated for only NET_DIM_PARAMS_NUM_PROFILES entries.

25) Use-after-free (CVE-ID: CVE-2026-63993)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the vxlan_xmit_one function in drivers/net/vxlan/vxlan_core.c when processing packets after skb_tunnel_check_pmtu() updates the skb head. A local user can trigger the vulnerable code path to execute arbitrary code.

26) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64003)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state handling in scsi_run_host_queues() when processing requeued commands during SCSI host recovery and device removal. A local user can trigger SCSI error recovery and device removal conditions to cause a denial of service.

The issue can leave requeued requests stuck and cause the affected device removal process to hang.

27) Integer underflow (CVE-ID: CVE-2026-64009)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow leading to an out-of-bounds write in the esp component, specifically xfrm_state_mtu(), when processing a UDP datagram through an IPv4 ESP tunnel SA with attacker-controlled parameters. A local user can install a crafted IPv4 ESP tunnel SA and send a UDP datagram through the tunnel to cause a denial of service.

The issue involves a negative length being sign-extended to size_t before being passed to memset() in esp_output_fill_trailer().

28) Use-after-free (CVE-ID: CVE-2026-64038)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the lm90 hwmon driver when processing delayed alert and alarm work during device unbind or probe failure. A local user can trigger the affected driver teardown race to cause a denial of service.

The issue occurs in a window where the hwmon device has been unregistered and freed before the delayed works are cancelled.

29) Improper input validation (CVE-ID: CVE-2026-64046)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the net/tls plaintext scatter-gather list handling when processing TLS 1.3 records with a plain text scatter-gather list that wraps and has end = 0. A local user can trigger a chain-after-chain scatterlist layout to cause a denial of service.

The issue affects the case where the wrapping slot is reused for chaining to the content type entry, creating illegal input for the crypto subsystem.

30) Use-after-free (CVE-ID: CVE-2026-64103)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the isci completion tasklet in the ISCI driver when removing a device or unloading the driver while queued tasklet processing is still possible. A local user can trigger device removal or driver unload to cause a denial of service.

The stale callback may dereference ihost and access ihost->smu_registers after the host lifetime ends.

31) Improper resource shutdown or release (CVE-ID: CVE-2026-64173)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in tracing_map_elt_free() in kernel/trace/tracing_map.c when handling allocation failures during tracing map element initialization. A local user can trigger an allocation failure path to cause a denial of service.

32) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64205)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in i801_access() in the i2c-i801 driver when handling an error path after a failed pre-check. A local user can trigger concurrent access to the SMBus controller to cause a denial of service.

The issue occurs when the driver clears SMBus hardware status and ownership state without actually owning the controller, which can corrupt the SMBus hardware state machine and lead to a console livelock and hung task panic.

33) Race condition (CVE-ID: CVE-2026-64210)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mlx5e ICOSQ handling in the Linux kernel mlx5 driver when processing NAPI poll work during CPU affinity changes. A local user can trigger concurrent ICOSQ operations to cause a denial of service.

The issue occurs when affinity changes while XSK work remains pending.

34) Race condition (CVE-ID: CVE-2026-64213)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the lm90_alert handler when handling concurrent smbus alert events and sysfs write operations. A local user can trigger concurrent alert and sysfs write activity to cause a denial of service.

The issue can unintentionally re-enable the hardware alert line while the alarm remains active, resulting in an interrupt storm.

35) Use-after-free (CVE-ID: CVE-2026-64279)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the i2c core adapter lookup and deregistration logic when looking up an adapter by id during adapter deregistration or registration failure. A local user can trigger a race condition to cause a denial of service.

36) Integer overflow (CVE-ID: CVE-2026-64283)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass a file size check.

The vulnerability exists due to an integer overflow in the KVM guest_memfd memslot binding logic when binding a memslot to a guest_memfd file. A local user can supply a crafted offset and size combination to bypass a file size check.

The issue affects the sum of the offset and size values, where a very large offset can cause the signed 64-bit result to become negative during validation.

37) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64297)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in module decompression in kernel/module/decompress.c when processing a module for loading. A local user can trigger an allocation failure condition to cause a denial of service.

The issue can lead to a kernel oops due to a dereference of ZERO_SIZE_PTR after a failed allocation.

38) Out-of-bounds read (CVE-ID: CVE-2026-64299)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in regex_match_glob() glob matching in the tracing event filter subsystem when processing non-NUL-terminated string event fields. A local user can supply a crafted glob filter against such fields to disclose sensitive information.

One reported path reaches the issue from the xfs_lookup tracepoint, and the affected string fields may be dynamic char arrays copied without a trailing NUL byte.

39) Out-of-bounds read (CVE-ID: CVE-2026-64319)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in nvmet_auth_reply() when processing a crafted DHCHAP_REPLY message. A remote attacker can send a specially crafted authentication reply message with inconsistent hash and DH value lengths to disclose sensitive information.

Exploitation is possible pre-authentication when DH authentication is configured.

40) Out-of-bounds read (CVE-ID: CVE-2026-64320)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds heap read in nvmet_execute_disc_get_log_page() in the NVMe target discovery controller when handling a host-supplied log page offset in a Discovery Get Log Page request. A remote attacker can send a specially crafted request with an out-of-range offset to disclose sensitive information or cause a denial of service.

The issue is reachable before authentication by any TCP, RDMA, or FC peer that can reach the nvmet target.

41) Use-after-free (CVE-ID: CVE-2026-64372)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in pcc_cpufreq_do_osc() when performing two-phase _OSC negotiation through acpi_evaluate_object(). A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue also involves a double free after the stale pointer is freed again.

42) Race condition (CVE-ID: CVE-2026-64373)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in cpufreq_suspend() when rebooting the system while cpu hotplug operations run concurrently. A local user can trigger a reboot while concurrent cpu hotplug activity causes governor_data to be freed during access to cause a denial of service.

The issue can result in a kernel null pointer dereference during the reboot path because processes and kernel threads remain active.

43) Out-of-bounds write (CVE-ID: CVE-2026-64402)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in smb_sync_perf_buffer() when copying hardware trace data into perf AUX ring buffer pages. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when the SMB sink is used as a perf AUX sink.

44) NULL pointer dereference (CVE-ID: CVE-2026-64405)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in hci_abort_conn() when handling connection cancellation from the hci_rx_work() receive path. A local user can trigger a pending Bluetooth connection state to cause a denial of service.

The issue can lead to a general protection fault while a connection request is pending and hdev->sent_cmd is NULL.

45) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-64425)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in io_worker_handle_work() in io_uring/io-wq.c when processing linked work items during io_uring worker exit handling. A local user can submit linked work and trigger ring closure to cause a denial of service.

Exploitation requires a race condition where worker exit begins after the first linked item has started but before the remaining linked items are processed.

46) Use-after-free (CVE-ID: CVE-2026-64473)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in VFIO device debugfs entries when handling device unregister operations while userspace references remain open. A local user can keep references to the debugfs view during device teardown to cause a denial of service.

The issue affects diagnostic debugfs entries that may remain visible with stale inode private data during unregister.

47) Infinite loop (CVE-ID: CVE-2026-64474)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an error sentinel in vfio_mig_get_next_state() when processing blocked VFIO migration state transitions. A local user can trigger a blocked transition on a precopy-capable device to cause a denial of service.

The issue can cause the loop to spin forever while holding the driver state mutex, resulting in a soft lockup and potentially a panic if softlockup_panic is set.

48) Use-after-free (CVE-ID: CVE-2026-64475)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the VGA arbiter callback handling in vfio_pci_core_register_device() when registration of a vfio PCI device fails after VGA arbiter client initialization. A local user can trigger device registration failure and leave a stale callback referencing freed device data to cause a denial of service.

The issue occurs on the error path and depends on a stale VGA arbiter registration remaining after the vfio device state has been freed.

49) Improper Initialization (CVE-ID: CVE-2026-64476)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in vfio-pci runtime power management handling when changing the disable_idle_d3 setting for devices already bound to vfio-pci variant drivers. A local user can change the sysfs module parameter and trigger unbalanced power management operations to cause a denial of service.

The issue occurs because the setting was latched globally at module initialization rather than consistently per device, creating a window where existing bound devices could operate with inconsistent power management behavior.

50) Observable discrepancy (CVE-ID: CVE-2026-64507)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper protection against speculative execution in BPF JIT memory reuse on x86 systems when reusing JIT-compiled BPF memory under Spectre-v2 conditions. A local user can trigger BPF JIT allocation reuse to disclose sensitive information.

Only systems with BPF-JIT enabled are affected.

51) Improper locking (CVE-ID: CVE-2026-64528)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable() when console flow control is engaged during transmit state changes. A local user can trigger the affected serial driver code path to cause a denial of service.

The issue occurs because the code attempts to reacquire the same non-recursive spinlock while it is already held on the same CPU.

52) NULL pointer dereference (CVE-ID: CVE-2026-64542)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in accept_untracked_na() when handling IPv6 neighbor advertisement packets. A local user can trigger concurrent network namespace activity to cause a denial of service.

It is reachable by an unprivileged user via a network namespace.

53) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64556)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to improper state management in perf_event_remove_on_exec() and event group handling in the perf subsystem when removing events marked remove_on_exec. A local user can trigger event removal for a group leader with surviving siblings to corrupt kernel memory.

The issue occurs when a removed event is a group leader and sibling events without remove_on_exec remain active in a stale group state.

54) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64579)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in xfrm_hash_rebuild() in the xfrm policy subsystem when rebuilding policy hashes under memory pressure. A local user can trigger policy reinsertions that take the allocating inexact insertion path and cause a kernel crash.

The issue is reachable under memory pressure and can be triggered deterministically with failslab.

55) Double free (CVE-ID: CVE-2026-64580)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in xfrm6_fill_dst() when handling an error path after in6_dev_get(dev) returns NULL. A local user can trigger network operations that reach the affected code path to cause a denial of service.

The issue underflows a net_device reference count and can lead to kernel warnings while waiting for the device to become free.

56) NULL pointer dereference (CVE-ID: CVE-2026-64589)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in i2c_register_adapter in the i2c core when handling adapter registration failure. A local user can trigger adapter registration failure to cause a denial of service.

57) Deadlock (CVE-ID: CVE-2026-68096)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a recursive locking deadlock in audit_dupe_exe() in the Linux kernel audit subsystem when handling file move events for executable audit rules. A local user can move a file that matches an existing executable audit rule to cause a denial of service.

Exploitation requires an existing executable audit rule that matches the file being moved.

58) Out-of-bounds write (CVE-ID: CVE-2026-68128)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in ice_parser_profile_init when processing a crafted VIRTCHNL_OP_ADD_RSS_CFG request with an out-of-range ptype value. A remote user can send a specially crafted VIRTCHNL request to cause a denial of service.

The issue can be triggered by a malicious VF supplying a ptype value greater than or equal to 1024, which can lead to a kernel page fault.

59) NULL pointer dereference (CVE-ID: CVE-2026-68141)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in afiucv_hs_callback_syn() when handling connection requests that enter the connection-refused path after child socket allocation fails. A local user can trigger this condition to cause a denial of service.

The issue occurs because the code calls iucv_sock_kill() with a NULL child socket pointer.

60) Race condition (CVE-ID: CVE-2026-68146)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ftrace trace_parser handling in ftrace_regex_write(), ftrace_graph_write(), ftrace_regex_release(), and ftrace_graph_release() when processing concurrent writes and release operations on a shared trace file descriptor. A local user can issue concurrent operations from multiple threads to cause a denial of service.

The issue occurs when a userspace process shares an opened trace file descriptor across multiple threads, causing corruption of the parser's internal state fields.

61) Use-after-free (CVE-ID: CVE-2026-68148)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a use-after-free in find_or_insert_direct_key() when reusing cached direct keys for inodes from different super_blocks. A local user can cause different super_blocks to reference the same cached direct key to cause a use-after-free.

The issue affects the legacy fscrypt_direct_keys table used by v1 encryption policies with FSCRYPT_POLICY_FLAG_DIRECT_KEY, while the v2 policy equivalent is not affected.

62) Use-after-free (CVE-ID: CVE-2026-68198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in aggr_reset_state() in the ath6kl wireless driver when handling a race between timer callback execution and TID state teardown. A local user can trigger the race condition to cause a denial of service.

The timer callback may continue accessing rx_tid[] and stat[] fields after the associated aggr_conn structure is freed, and it can re-arm itself while the reset routine is running.

63) Improper input validation (CVE-ID: CVE-2026-68258)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in kfd CRIU restore queue handling when processing user-supplied private restore data. A local user can provide an out-of-bounds queue type or mismatched mqd_size values to cause a denial of service.

Exploitation requires access to the CRIU restore functionality in the amdkfd subsystem.

64) Out-of-bounds write (CVE-ID: CVE-2026-68264)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in xe_pt_update_ops_init() and the vm_bind path in the xe driver when retrying page table update preparation after lock contention or OOM eviction. A local user can trigger repeated retries to cause a denial of service.

The issue can corrupt SLUB-poisoned memory and lead to a subsequent use-after-free crash in xe_migrate_update_pgtables_cpu().

65) Use-after-free (CVE-ID: CVE-2026-68266)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the xe dma-buf imported buffer object handling when tearing down imported buffer objects after dma_buf_dynamic_attach() or buffer object creation fails. A local user can trigger creation of a crafted imported dma-buf buffer object to cause a denial of service.

The issue can be reached on failure paths where the buffer object already references the exporter's reservation object and that reservation object is later accessed asynchronously during delayed deletion.

66) Use-after-free (CVE-ID: CVE-2026-68273)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free and NULL pointer dereference in the amdgpu context pstate handling code when initializing or finalizing GPU contexts while stable pstate state changes are processed. A local user can create and tear down crafted contexts to cause a denial of service.

The issue arises because context pstate ownership transitions were not consistently protected by the stable_pstate_ctx_lock, and sysfs-triggered state changes can race with context handling.

67) Use-after-free (CVE-ID: CVE-2026-68290)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in rds_tcp_skbuf_handler in the RDS TCP sysctl handler when handling a concurrent sysctl write during network namespace teardown. A local user can trigger a concurrent sysctl write to cause a denial of service.

The race occurs because the network namespace is derived from a listen socket that may already have been freed.

68) Improper access control (CVE-ID: CVE-2026-68294)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass network namespace isolation.

The vulnerability exists due to improper access control in the AF_QIPCRTR socket creation logic and global QRTR state handling when creating and using QRTR sockets from a separate network namespace. A local user can create an AF_QIPCRTR socket in another network namespace and send crafted QRTR datagrams to sockets owned by a different namespace to bypass network namespace isolation.

The receiving socket may treat the message as originating from node id 1, making it indistinguishable from a legitimate local client.

69) Race condition (CVE-ID: CVE-2026-68338)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in packet_set_ring() and packet fanout hook handling in net/packet/af_packet.c when reconfiguring a packet socket ring while a network device is being unregistered. A local user can trigger ring reconfiguration during device unregister handling to cause a denial of service.

The issue occurs when a stale running state causes fanout hook re-registration after the device binding has already been invalidated.

70) Out-of-bounds read (CVE-ID: CVE-2026-68376)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in sctp_auth_get_hmac() when processing SCTP authentication parameters during association initialization. A local user can configure four HMAC identifiers to trigger memory corruption that leads to an out-of-bounds read and disclose sensitive information.

The issue stems from an undersized auth_hmacs array in struct sctp_cookie that can corrupt the adjacent auth_chunks field and cause an invalid HMAC identifier to be accepted.

71) Deadlock (CVE-ID: CVE-2026-68382)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in the GuC exec queue destruction logic in the xe drm driver when asynchronously tearing down exec queues during device cleanup. A local user can trigger asynchronous queue destruction to cause a denial of service.

The issue arises when final device reference handling occurs from a destroy worker while cleanup is draining the same workqueue.

72) Improper Initialization (CVE-ID: CVE-2026-68395)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in the sata_dwc_460ex driver interrupt handling during device probe when enabling SATA interrupts before the IRQ handler is registered. A local attacker can trigger an interrupt during probe or cause a probe failure after interrupts are unmasked to cause a denial of service.

The issue can result in a spurious interrupt storm if the controller asserts an interrupt with no registered handler.

73) NULL pointer dereference (CVE-ID: CVE-2026-68441)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in qdisc filter chain classification handling when processing TC_ACT_REDIRECT from a TC filter attached to a qdisc filter chain. A local user can trigger TC_ACT_REDIRECT, for example via an eBPF program calling bpf_redirect(), to cause a denial of service.

The issue occurs when the caller does not set up bpf_net_context, and the clsact fast path is unaffected.

74) Improper access control (CVE-ID: CVE-2026-68448)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the overlayfs copy_file_range handling in fs/overlayfs/file.c when performing cross-superblock copy operations. A local user can invoke a copy operation between different overlayfs filesystems to disclose sensitive information.

The issue occurs because read access to the source file is checked with destination overlayfs mounter credentials instead of source overlayfs mounter credentials.

75) Improper input validation (CVE-ID: CVE-2026-68451)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in cca_ecc2protkey() when processing CCA ECC private key requests. A local user can supply a crafted key token with an oversized length field to cause a denial of service.

76) Improper input validation (CVE-ID: CVE-2026-68452)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in cca_cipher2protkey() when processing CCA AES cipher key requests. A local user can supply a key token with an excessive length field to cause a denial of service.

The copy length for the CPRB parameter block is derived directly from the length field in the key token.

77) NULL pointer dereference (CVE-ID: CVE-2026-68454)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a null page reference in kvm_s390_pci_aif_enable() in the KVM s390 PCI code when registering IRQs without a summary bit specified. A local user can request IRQ registration without an AISB to cause a denial of service.

The issue is triggered when a guest enables adapter interruption forwarding without specifying a summary bit.

78) Improper input validation (CVE-ID: CVE-2026-68471)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ieee80211_mle_size_ok() and ieee80211_mle_common_size() when parsing multi-link element data. A remote attacker can send specially crafted MLE data to cause a denial of service.

The issue affects validation of advertised common information lengths for known MLE types, including Reconfiguration and Priority Access MLEs.

79) Improper input validation (CVE-ID: CVE-2026-68477)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect packet processing.

The vulnerability exists due to improper handling of ipv6 transport offsets in ipvs application and icmpv6 response processing when handling ipv6 packets with extension headers. A remote attacker can send specially crafted ipv6 traffic to cause incorrect packet processing.

The issue affects TCP application handling and ICMPv6 checksum validation in IPVS for IPv6 traffic.

80) Use-after-free (CVE-ID: CVE-2026-72012)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the osnoise tracer instance unregistration logic when unregistering an osnoise tracing instance while RCU readers are traversing the instance list. A local user can trigger instance unregistration to cause a denial of service.

81) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72017)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the macb driver transmit queue handling when closing the network device. A local user can trigger device close operations while transmit SKBs remain in flight to cause a denial of service.

The issue affects outgoing SKBs that have not yet been marked as completed and are stored in queue->tx_skb.

82) Out-of-bounds write (CVE-ID: CVE-2026-72018)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform an out-of-bounds write in kernel memory.

The vulnerability exists due to out-of-bounds write in smc_lo_move_data() when processing peer-supplied offset and size values. A remote attacker can send crafted data parameters to perform an out-of-bounds write in kernel memory.

The issue affects the software loopback implementation, which does not enforce memory region bounds like real ISM hardware.

83) Out-of-bounds read (CVE-ID: CVE-2026-72019)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in macsec_encrypt() when processing packets transmitted through the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS path with an unset MAC header. A local user can send a specially crafted packet to disclose sensitive information.

The 12-byte heap over-read may be emitted on the wire as the frame's outer source and destination MAC addresses.

84) Memory leak (CVE-ID: CVE-2026-72023)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in otx2_init_hw_resources() and the SQ resource unwind path when handling initialization failures. A local user can trigger an initialization failure to cause a denial of service.

Exploitation requires access to a system using the OcteonTX2 PF driver.

85) Out-of-bounds write (CVE-ID: CVE-2026-72025)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the monwriter misc device when reusing data buffers with a different data length. A local user can submit crafted records with a changed data length to cause memory corruption.

By default, access to the device is restricted to root-only permissions.

86) Improper access control (CVE-ID: CVE-2026-72045)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in rvu_mbox_handler_lmtst_tbl_setup() when handling mailbox requests that specify base_pcifunc. A remote user can supply a crafted base_pcifunc value to disclose sensitive information.

Exploitation requires a VF caller on cn10k hardware, and the issue is limited to redirecting LMTLINE sharing outside the caller's own PF.

87) Improper access control (CVE-ID: CVE-2026-72051)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ip6_tnl_changelink() when handling changelink requests for IPv6 tunnel devices across network namespaces. A local privileged user can send a crafted netlink changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace.

88) Improper access control (CVE-ID: CVE-2026-72052)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify tunnel link configuration across network namespaces.

The vulnerability exists due to improper access control in ip6gre_changelink() and ip6erspan_changelink() when handling changelink requests for devices and tunnel links in different network namespaces. A remote privileged user can send a crafted changelink request to modify tunnel link configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace, causing capability checks to be applied only to the device namespace.

89) Improper access control (CVE-ID: CVE-2026-72053)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify IPIP tunnel configuration in another network namespace.

The vulnerability exists due to improper access control in ipip_changelink() in net/ipv4/ipip.c when handling changelink requests for an IPIP device whose tunnel link resides in a different network namespace. A local privileged user can send a changelink request from a network namespace where they have CAP_NET_ADMIN to modify IPIP tunnel configuration in another network namespace.

The issue occurs when dev_net(dev) and the tunnel link namespace differ, such as after the device is created in or moved to a different network namespace.

90) Improper access control (CVE-ID: CVE-2026-72054)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in vti_changelink() in the ip_vti component when handling changelink requests for a tunnel whose link network namespace differs from the device network namespace. A local privileged user can send a changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the device is created in or moved to a different network namespace than the one from which the request is issued.

91) Improper access control (CVE-ID: CVE-2026-72055)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in vti6_changelink() in the ip6_vti component when handling changelink requests for a tunnel device associated with another network namespace. A local privileged user can send a changelink request from a namespace where they hold CAP_NET_ADMIN to modify tunnel configuration across network namespaces.

The issue arises when the device network namespace and the tunnel link network namespace differ.

92) Improper access control (CVE-ID: CVE-2026-72061)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ipip6_changelink() in the sit tunnel handler when handling changelink requests for a tunnel whose link network namespace differs from the device network namespace. A local privileged user can send a changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the caller has CAP_NET_ADMIN in the device network namespace but not in the tunnel link network namespace.

93) Improper locking (CVE-ID: CVE-2026-72063)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper interaction with a mutex in tegra_gpio_direction_input() and tegra_gpio_direction_output() when changing GPIO direction on shared GPIO lines. A local user can trigger GPIO direction operations while a per-line spinlock is held to cause a denial of service.

The issue can lead to sleeping in an atomic context.

94) Stack-based buffer overflow (CVE-ID: CVE-2026-72066)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in states_show() in kernel/cpu.c when generating sysfs output for CPU hotplug states. A local user can read the affected sysfs entry to cause a denial of service.

95) Use-after-free (CVE-ID: CVE-2026-72070)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in lbtf_free_adapter() when handling device removal during a firmware command timeout. A local user can trigger concurrent teardown and timer callback execution to cause a denial of service.

96) Use-after-free (CVE-ID: CVE-2026-72085)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a refcount underflow leading to use-after-free in xen-scsiback request handling when processing pvSCSI requests before command submission. A remote user can submit requests with a bad grant reference or an unknown request type to cause a denial of service.

Under panic_on_warn, triggering the refcount underflow can panic the host. The issue can also leak every command tag of a LUN session, stopping the LUN.

97) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72086)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a resource leak in scsiback_device_action() in the xen scsi backend when submitting task-management requests and handling target_submit_tmr() failures. A remote user can issue VSCSIIF_ACT_SCSI_ABORT or reset requests to cause a denial of service.

The issue affects a pvSCSI guest and can leak command tags for a LUN session, stopping the LUN, when task-management request submission fails.

98) Out-of-bounds write (CVE-ID: CVE-2026-72098)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in dm-verity fec calculation when processing erasure data during FEC decoding. A local user can trigger crafted corruption conditions to cause memory corruption.

The out-of-bounds write can occur when the erasure count exceeds the intended Reed-Solomon roots limit and the decoder writes past the end of the lambda array into the syndrome buffer.

99) Double free (CVE-ID: CVE-2026-72102)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in dm_early_create in drivers/md/dm-ioctl.c when resuming a device-mapper device after swapping in a new table. A local user can trigger a dm_resume failure to cause a denial of service.

100) Heap-based buffer overflow (CVE-ID: CVE-2026-72106)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in list_version_get_info in dm-ioctl when processing ioctl requests. A local user can send a specially crafted ioctl request to cause a denial of service.

101) Out-of-bounds read (CVE-ID: CVE-2026-72107)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dm-era writeset handling when processing I/O for tables with a non-zero start sector. A local user can trigger out-of-bounds memory access to cause a denial of service.

The issue occurs because an absolute mapped-device block number is used instead of a target-relative block number during writeset lookup.

102) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72108)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause metadata inconsistency and a denial of service.

The vulnerability exists due to improper state management in dm-thin metadata snapshot handling in drivers/md/dm-thin-metadata.c when reserving or releasing a metadata snapshot and a subsequent metadata commit fails. A local user can issue crafted dmsetup messages to trigger a commit failure and cause metadata inconsistency and a denial of service.

Exploitation requires the ability to manage a thin-pool metadata device and trigger snapshot reserve or release operations under commit-failure conditions.

103) Use-after-free (CVE-ID: CVE-2026-72125)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race in the Linux kernel CAN ISO-TP socket handling in net/can/isotp.c when releasing a socket concurrently with NETDEV_UNREGISTER. A local user can trigger concurrent socket release and device unregistration to cause a denial of service.

The issue can leave a stale CAN filter referencing a freed socket.

104) Out-of-bounds read (CVE-ID: CVE-2026-72129)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in nvmet_rdma_use_inline_sg() and inline scatterlist handling in the NVMe target RDMA component when processing host-controlled inline data with a nonzero offset. A remote user can send crafted inline data offsets and lengths to cause a denial of service.

The issue can be triggered when inline_data_size is configured larger than PAGE_SIZE, and page-spanning in-bounds ranges may also cause the scatterlist to be under-counted.

105) Heap-based buffer overflow (CVE-ID: CVE-2026-72130)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in nvmet_execute_auth_receive() and the DH-HMAC-CHAP response builders when processing AUTH_RECEIVE commands with a too-short allocation length. A remote user can send a specially crafted AUTH_RECEIVE command to cause a denial of service.

This is reachable only when in-band DH-HMAC-CHAP authentication is configured on the target.

106) Out-of-bounds read (CVE-ID: CVE-2026-72135)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and corrupt kernel memory.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in the TPM character device read path when processing positional read operations with a pending response. A local user can issue a crafted pread request with a large offset to disclose sensitive information and corrupt kernel memory.

The issue affects the sequential command/response TPM device interface after a command has left a response pending.

107) Improper access control (CVE-ID: CVE-2026-72136)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify an xfrm interface across network namespace boundaries.

The vulnerability exists due to improper access control in xfrmi_changelink() when handling changelink requests for xfrm interfaces. A local privileged user can send a changelink request from one network namespace to rewrite an interface that lives in another network namespace to modify an xfrm interface across network namespace boundaries.

The issue occurs because the capability check was performed only against dev_net(dev) and not against the interface link network namespace.

108) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72138)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in gntdev_ioctl_map_grant_ref() in the xen grant device driver when handling an ioctl request and copying the operation result to userspace. A local user can trigger a copy_to_user failure after a mapping has been added to the list to cause a denial of service.

The issue can leave a mapping in priv->maps with a dangling list entry and a leaked reference count.

109) NULL pointer dereference (CVE-ID: CVE-2026-72147)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dw_edma_pcie_probe() when binding a device dynamically via sysfs without driver data. A local user can bind a matching device entry without driver data to trigger a kernel crash and cause a denial of service.

110) Out-of-bounds write (CVE-ID: CVE-2026-72157)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to an out-of-bounds write in tbnet_poll() when processing a multi-frame ThunderboltIP packet with a peer-supplied frame_count that exceeds the fragment array capacity. A remote attacker can send a specially crafted packet with 19 or more small frames to corrupt memory.

The issue occurs because the first frame is placed in the skb linear area while subsequent frames are added as page fragments.

111) NULL pointer dereference (CVE-ID: CVE-2026-72161)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ocfs2_checkpoint_inode() when evicting cached inodes during unmount. A local user can trigger inode eviction after journal shutdown to cause a denial of service.

The issue occurs because the journal may already have been freed and set to NULL during shutdown before remaining cached inodes are evicted.

112) NULL pointer dereference (CVE-ID: CVE-2026-72163)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ocfs2_assure_trans_credits() when completing a direct write over unwritten extents after a journal abort. A local user can trigger a direct write operation and cause the kernel to panic to cause a denial of service.

Exploitation requires an ocfs2 direct I/O write path where the journal aborts during I/O completion, such as after an I/O error.

113) Improper access control (CVE-ID: CVE-2026-72164)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite file data belonging to another inode.

The vulnerability exists due to improper allocation of occupied clusters in ocfs2_move_extent() and ocfs2_probe_alloc_group() when processing a non-auto OCFS2_IOC_MOVE_EXT operation with a user-supplied physical goal. A local user can supply a crafted occupied goal value to overwrite file data belonging to another inode.

The issue occurs when the supplied goal is at the end of the target block group or when the free-run start is miscalculated.

114) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72166)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper signal handling in p9_client_rpc() in net/9p/client.c when handling P9_TFLUSH requests over an fd transport with no peer. A local user can trigger a fatal signal while a thread is blocked in the affected code path to cause a denial of service.

The issue can cause the affected task to sleep indefinitely and, in practice, can stall coredump handling in multi-threaded processes.

115) Improper update of reference count (CVE-ID: CVE-2026-72218)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper reference count management in lockd nlm_lookup_file() when handling cached file lookups after nlm_do_fopen() failure. A remote user can trigger a failed file-open operation to cause a denial of service.

The issue occurs because the file reference count is incremented but not released, preventing the file from being reaped between requests.

116) Memory leak (CVE-ID: CVE-2026-72219)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in nlm_lookup_file() when processing file handles rejected by the underlying export. A remote attacker can present crafted file handles that trigger nlm_do_fopen() failures to cause a denial of service.

Each failed open attempt leaks one newly allocated nlm_file object.

117) Memory leak (CVE-ID: CVE-2026-72224)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of allocated memory in btt_init() in the nvdimm btt subsystem when handling BTT initialization failures. A local user can trigger an initialization failure to cause a denial of service.

118) Information disclosure (CVE-ID: CVE-2026-72237)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel memory addresses.

The vulnerability exists due to improper access control in the amd_brs_match_plm() branch privilege-level filtering in the AMD BRS perf event handling code when processing user-only branch stack sampling requests. A local user can invoke perf branch sampling with PERF_SAMPLE_BRANCH_USER to disclose kernel memory addresses.

The issue affects AMD processors supporting X86_FEATURE_BRS and occurs for branch records that transition from the kernel to user space.

119) NULL pointer dereference (CVE-ID: CVE-2026-72242)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in selinux_sctp_bind_connect() when processing SCTP ASCONF operations from the softirq path. A local user can trigger the vulnerable SCTP bind or connect handling to cause a denial of service.

The issue occurs when the hook is invoked from the ASCONF softirq path, where no file reference guarantees that sk->sk_socket is non-NULL.

120) Improper access control (CVE-ID: CVE-2026-72243)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass SELinux connect-related permission checks.

The vulnerability exists due to improper access control in the SELinux socket_sendmsg() hook when using TCP Fast Open on TCP or MPTCP stream sockets. A local user can send data with MSG_FASTOPEN to bypass SELinux connect-related permission checks.

121) Improper access control (CVE-ID: CVE-2026-72247)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass connection counting limits.

The vulnerability exists due to improper access control in nf_conncount when processing connection tuples across conntrack zones. A remote attacker can send network traffic that creates connections with matching tuples in different zones to bypass connection counting limits.

The issue affects the tuple dedup logic in __nf_conncount_add(), where original-direction tuples are compared using an incorrect zone direction value.

122) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72256)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of template conntrack state in xt_cluster_mt() in the netfilter xt_cluster matcher when processing packets associated with a template conntrack. A local user can trigger packet processing that reaches xt_cluster_hash() with incomplete conntrack state to cause a denial of service.

The issue occurs when the raw table CT target attaches a template conntrack to skb->_nfct before normal conntrack processing.

123) Use-after-free (CVE-ID: CVE-2026-72282)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in kvm_io_bus_get_dev() and vgic_msi_to_its() when processing KVM MMIO bus device lookups for MSI addresses. A local user can trigger access to a matched device after the srcu lock has been dropped to cause a denial of service.

The issue occurs when the returned device matches only by address and is not the expected device type.

124) Out-of-bounds read (CVE-ID: CVE-2026-72297)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in pvc_info() when reading /proc/net/atm/pvc after storing a crafted QoS traffic_class value. A local user can supply out-of-range QoS parameters to trigger an out-of-bounds read and disclose sensitive information.

The issue is caused by invalid traffic_class values being accepted into vcc->qos during QoS validation.

125) Use-after-free (CVE-ID: CVE-2026-72299)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in TIPC enqueue tracepoint queue dumping in tipc_sk_enqueue() when dumping socket queues during message enqueue processing. A local user can trigger crafted TIPC socket activity to cause a denial of service.

The issue is reachable while the socket is owned by user context, because the held spinlock protects the backlog queue but does not serialize access to sk_receive_queue.

126) Race condition (CVE-ID: CVE-2026-72306)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in vduse_dev_msg_sync and vduse_dev_read_iter in drivers/vdpa/vdpa_user/vduse_dev.c when handling VDUSE device message processing. A local user can trigger concurrent message operations to cause a denial of service.

The issue can lead to a double list_del() crash when a timed-out message is concurrently removed.

127) Resource management error (CVE-ID: CVE-2026-72321)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in igmp_mod_timer() and igmp_stop_timer() when deleting or stopping IGMP timers during concurrent multicast group removal. A local user can trigger IGMP processing that reaches these code paths to cause a denial of service.

The issue can occur when the affected multicast list entry is accessed from an RCU reader path while the group is concurrently removed from the list.

128) Use-after-free (CVE-ID: CVE-2026-72322)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the IPv6 MLD delayed work handling in net/ipv6/mcast.c when processing incoming MLD queries during device teardown. A remote attacker can send crafted MLD query traffic to trigger a kernel panic and cause a denial of service.

The issue arises from a race condition between device destruction and packet receive processing under RCU protection.

129) Use-after-free (CVE-ID: CVE-2026-72323)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the IGMP timer callback when processing incoming IGMP queries during device teardown. A remote attacker can send a crafted IGMP query to cause a denial of service.

Exploitation requires a race between device destruction and IGMP query processing.

130) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72325)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper hardware feature state management in the amd perf events handling in arch/x86/events/amd/core.c when reloading virtualization state on PerfMonV2-capable processors. A local user can toggle SVM on a CPU with active LBR events to cause a denial of service.

The issue occurs on processors that have LBR but not BRS, where writing the deprecated BRS enable bit triggers a #GP fault.

131) Improper handling of exceptional conditions (CVE-ID: CVE-2026-72330)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of zero-length TLS application_data records in tls_sw_read_sock() when processing a specially crafted TLS record. A remote attacker can send a zero-length TLS application_data record to cause a denial of service.

Only the read_sock() path is affected.

132) Use-after-free (CVE-ID: CVE-2026-72337)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Bluetooth 6LoWPAN debugfs enable handler when processing a debugfs enable write that races with module exit. A local user can trigger an enable state change and race it with module teardown to cause a denial of service.

The issue occurs because queued work can later access stale state, including listen_chan, after the debugfs operation has returned.

133) Off-by-one (CVE-ID: CVE-2026-72339)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an off-by-one error in the qede_rx_build_skb() and qede_tpa_rx_build_skb() functions when handling a NULL return from qede_build_skb() under memory pressure. A local user can trigger memory pressure and network receive processing to cause memory corruption.

The issue can desynchronize the BD ring, which can corrupt DMA page reference counts and lead to SLUB freelist corruption.

134) Improper input validation (CVE-ID: CVE-2026-72347)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the xt_connmark CONNMARK target revision 2 handling when evaluating a rule with invalid shift parameters. A local user can install a malformed rule with a shift_bits value of 32 or more or an invalid shift_dir value to cause a denial of service.

The issue is triggered when the malformed rule is evaluated in the packet path.

135) Improper input validation (CVE-ID: CVE-2026-72348)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass packet-filtering rules.

The vulnerability exists due to improper input validation in the ip6tables ah, hbh, and rt IPv6 extension header match handlers when processing malformed IPv6 packets with advertised extension header lengths that exceed the available skb data. A remote attacker can send a specially crafted IPv6 packet to bypass packet-filtering rules.

The issue affects handling of malformed IPv6 authentication, hop-by-hop, and routing extension headers.

136) Integer overflow (CVE-ID: CVE-2026-72349)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended rate-based matching logic.

The vulnerability exists due to integer truncation in xt_rateest_mt() in netfilter xt_rateest when processing rate estimator values on high-speed links. A local user can trigger rate comparisons involving byte rates above 2^32-1 to bypass intended rate-based matching logic.

The issue occurs on links faster than approximately 34 Gbps, where the byte rate may exceed 4.3 GBps and no longer fits in 32-bit variables.

137) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-72350)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds shift operation in u32_match_it() in the xt_u32 netfilter match when evaluating a malformed u32 rule during packet processing. A local user can supply a crafted u32 rule with a shift count of 32 or more to cause a denial of service.

138) Out-of-bounds read (CVE-ID: CVE-2026-72351)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in gue_remcsum() and gue_gro_remcsum() when processing malformed GUE packets with the REMCSUM private flag set but without the required REMCSUM metadata fields. A remote attacker can send a specially crafted packet to disclose sensitive information.

The issue occurs because option validation accepts packets that contain only the private flags field even when additional REMCSUM start and offset fields are expected.

139) Integer overflow (CVE-ID: CVE-2026-72352)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in hid_bpf_get_data() in the HID-BPF subsystem when validating a caller-provided offset and size. A local user can supply a crafted offset and size combination to cause a denial of service.

Exploitation requires the ability to invoke the HID-BPF helper.

140) Improper access control (CVE-ID: CVE-2026-72379)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to create a temporary file with invalid ownership.

The vulnerability exists due to improper access control in vfs_tmpfile() when creating an O_TMPFILE on an idmapped mount that does not map the caller's fsuid or fsgid. A local user can create a temporary file on such a mount to create a temporary file with invalid ownership.

The issue affects filesystems that support idmapped mounts and implement tmpfile handling, as well as overlayfs through upper-layer tmpfile creation.

141) Use-after-free (CVE-ID: CVE-2026-72383)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in sctp_free_addr_wq() and sctp_addr_wq_timeout_handler() when handling addr_wq_timer teardown. A local attacker can trigger a race condition to cause a denial of service.

The issue arises because a timer handler may continue running after the associated wait queue has been freed.

142) NULL pointer dereference (CVE-ID: CVE-2026-72392)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fib6_walk_continue() when resuming a multi-batch IPv6 FIB dump after a concurrent table insertion changes hash-chain ordering. A remote attacker can trigger netlink dump processing to cause a denial of service.

The issue occurs because walker state can become inconsistent, with the root referencing a different table while the node still points into the previous one.

143) Improper input validation (CVE-ID: CVE-2026-72398)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to tamper with SCTP association handling and cause a denial of service.

The vulnerability exists due to improper input validation in SCTP COOKIE-ECHO processing paths when processing a cookie containing a reconstructed INIT chunk while cookie authentication is disabled. A remote attacker can send a specially crafted COOKIE-ECHO packet to tamper with SCTP association handling and cause a denial of service.

The issue only arises when cookie authentication is disabled.

144) Out-of-bounds write (CVE-ID: CVE-2026-72399)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in enetc_xdp_xmit when processing xdp_frame structures with too many fragments. A local user can provide a crafted xdp_frame with more fragments than ENETC_MAX_SKB_FRAGS to cause a denial of service.

The issue occurs because the xdp_redirect_arr array is sized to ENETC_MAX_SKB_FRAGS while an xdp_frame may contain a greater number of fragments.

145) Use-after-free (CVE-ID: CVE-2026-72404)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the TIPC UDP media bearer cleanup logic in net/tipc/udp_media.c when tearing down a bearer while concurrent transmit or receive operations are still accessing cached destinations or bearer state under RCU protection. A local attacker can trigger concurrent TIPC UDP activity during bearer cleanup to cause a denial of service.

The issue can affect concurrent transmitters through replicast destination cache access and concurrent receivers through access to the bearer structure after teardown begins.

146) Double free (CVE-ID: CVE-2026-72406)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in gem_init_one() in the sungem network driver when handling a failed register_netdev() call during device probe. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs in the probe error cleanup path for a half-registered device.

147) Memory leak (CVE-ID: CVE-2026-72413)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in SCTP INIT handling in net/sctp/sm_statefuns.c when processing INIT chunks with unrecognized parameters. A remote attacker can send a specially crafted INIT chunk to cause a denial of service.

The issue occurs when err_chunk is allocated by sctp_verify_init() and is not freed on certain error and success return paths.

148) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72421)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended unreachable routing behavior.

The vulnerability exists due to improper control flow in fib_lookup() in the IPv4 FIB lookup logic when performing route lookups with CONFIG_IP_MULTIPLE_TABLES enabled and no rule added. A local user can configure routes that trigger lookup of the merged local/main table followed by the default table to bypass intended unreachable routing behavior.

The issue occurs because an error route result from the local or main table can be overwritten by a subsequent lookup in the default table.

149) Improper resource shutdown or release (CVE-ID: CVE-2026-72425)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ice_reset_all_vfs() when resetting virtual functions with FDIR filters enabled. A local user can trigger a VF reset after enabling an FDIR filter to cause a denial of service.

The issue occurs because CTRL VSI objects are invalidated but not freed for affected virtual functions.

150) Use of Uninitialized Variable (CVE-ID: CVE-2026-72433)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in nft_meta_bridge_get_eval in nft_meta_bridge.c when evaluating the NFT_META_BRI_IIFPVID metadata expression. A local attacker can trigger processing of a bridge interface PVID query that encounters an error condition to disclose sensitive information.

151) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72434)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown of delayed work in the ipset garbage collector in netfilter when destroying a set with timeouts enabled. A local user can destroy a crafted set to cause a denial of service.

Only sets configured with timeout support are affected.

152) Use-after-free (CVE-ID: CVE-2026-72435)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ipset comment extension handling in netfilter when freeing comment extension pointers. A local user can trigger ipset comment initialization or cleanup operations to cause a denial of service.

153) Race condition (CVE-ID: CVE-2026-72436)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in netfilter ipset hash types when lockless RCU readers process set data in parallel with add, delete, or garbage-collection operations. A local user can trigger concurrent ipset operations to cause a denial of service.

The issue affects readers that are not protected by the region lock and are not in set destroy or new or temporary set creation phases.

154) Memory leak (CVE-ID: CVE-2026-72437)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in raid1_read_request() in the md/raid1 subsystem when handling retried reads with REQ_NOWAIT set and the read would block on retry. A local user can trigger this condition to cause a denial of service.

The issue occurs when a pre-allocated r1_bio already exists for the retried read and wait_read_barrier() fails.

155) Improper resource shutdown or release (CVE-ID: CVE-2026-72438)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in raid10_handle_discard() in drivers/md/raid10.c when handling discard requests and discard split allocation failures. A local user can trigger discard failure paths to cause a denial of service.

The issue is caused by missing releases of writes_pending and barrier references on certain error paths.

156) Improper resource shutdown or release (CVE-ID: CVE-2026-72439)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the raid10 write request handling in drivers/md/raid10.c when processing write requests that fail before being queued. A local user can trigger write request failure paths to cause a denial of service.

The issue occurs because certain error paths complete the bio without reaching the normal write completion path.

157) Improper resource shutdown or release (CVE-ID: CVE-2026-72440)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the raid1 write request handling in drivers/md/raid1.c when processing write requests that fail before being successfully queued. A local user can trigger write failure paths to cause a denial of service.

The issue involves leaked writes_pending and barrier references on error paths.

158) Out-of-bounds read (CVE-ID: CVE-2026-72444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized memory contents.

The vulnerability exists due to an out-of-bounds read in __skb_flow_dissect() when processing packets on non-ethernet devices with flow dissector ethernet address matching enabled. A local user can send a crafted packet through AF_PACKET to disclose uninitialized memory contents.

Exploitation requires a TUN device in L3 mode together with a multiq qdisc and a flower filter matching on eth_src.

159) Race condition (CVE-ID: CVE-2026-72447)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized kernel memory to userspace.

The vulnerability exists due to a race condition in sctp_diag endpoint dumping when traversing endpoint address lists during diagnostic dumping without holding the socket lock. A local user can trigger concurrent socket operations while requesting SCTP diagnostic endpoint data to disclose uninitialized kernel memory to userspace.

The issue occurs because address counts gathered under RCU protection can become inconsistent before the subsequent copy operation.

160) Improper resource shutdown or release (CVE-ID: CVE-2026-72448)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the otx2_free_sq_res() send-queue resource teardown logic when tearing down a send queue with timestamping enabled. A local user can trigger interface shutdown or device removal to cause a denial of service.

Only send queues using timestamping are affected.

161) Double free (CVE-ID: CVE-2026-72449)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in kfd_criu_resume_svm() when handling a second AMDKFD_IOC_CRIU_OP request from the same process via /dev/kfd. A local user can trigger repeated cleanup of freed list entries to cause a denial of service.

The issue is reachable by an unprivileged render-group user and is caused by stale list entries left in the criu_svm_metadata_list after cleanup.

162) Out-of-bounds read (CVE-ID: CVE-2026-72450)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds shift in xfrm_selector_match and address matching helpers when processing xfrm selector matching with an AF_UNSPEC selector and an oversized prefix length. A local attacker can provide a crafted selector with a mismatched family or excessive prefix length to cause a denial of service.

The issue can be triggered when an AF_UNSPEC selector is matched against an IPv4 flow while XFRM_STATE_AF_UNSPEC is set.

163) Improper resource shutdown or release (CVE-ID: CVE-2026-72459)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in aa_label_alloc() in the AppArmor label handling code when allocating a label and the proxy allocation step fails. A local user can trigger an allocation failure condition to cause a denial of service.

164) NULL pointer dereference (CVE-ID: CVE-2026-72460)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in aa_change_profile() when building a replacement label during a profile change. A local user can trigger label build failure handling to cause a denial of service.

The issue occurs in the AppArmor profile transition logic during processing of profile change requests.

165) Out-of-bounds read (CVE-ID: CVE-2026-72487)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in pci_get_rom_size in drivers/pci/rom.c when processing a broken PCI ROM image. A local user can provide a malformed ROM layout to trigger a kernel crash and cause a denial of service.

On some arm64 systems, exploitation may instead trigger an alignment fault due to unaligned IOMEM access.

166) Out-of-bounds read (CVE-ID: CVE-2026-72488)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in sdw_add_element_group_count when processing SoundWire group rate and lane entries. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the loop iterates with an index equal to the element count.

167) Race condition (CVE-ID: CVE-2026-72491)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in net/9p RDMA transport state handling in trans_rdma.c when processing RDMA connection events and receive completions concurrently with RDMA requests. A local user can trigger concurrent state transitions to corrupt the connection state machine and cause a denial of service.

The race can lead to lost state transitions during teardown and may result in use-after-free on RDMA request objects.

168) Use-after-free (CVE-ID: CVE-2026-74255)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to use-after-free in tipc_l2_send_msg() when handling TIPC layer 2 media disable operations concurrently with RCU readers. A local user can trigger concurrent access to a freed device pointer to execute arbitrary code or cause a denial of service.

The issue is caused by a race condition involving b->media_ptr and network-device lifetime management.

169) Integer overflow (CVE-ID: CVE-2026-74256)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in bpf_msg_pop_data() in the sockmap BPF message handling code when processing crafted start and len values. A local user can supply out-of-range values to trigger an out-of-bounds pop operation and cause a denial of service.

Exploitation can cause the pop loop to run past the end of the scatterlist and reach an invalid put_page() on an empty slot.

170) Use-after-free (CVE-ID: CVE-2026-74257)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in udp_bpf_recvmsg() when processing concurrent recvmsg operations on BPF-enabled UDP sockets. A local user can trigger concurrent socket receive operations to cause a denial of service.

The issue arises because sk_msg_recvmsg() accesses an ingress message under a lock but processes it without serialization, allowing multiple threads to touch the same sk_msg.

171) Improper input validation (CVE-ID: CVE-2026-74258)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in bpf_uprobe_multi_link_attach in kernel/trace/bpf_trace.c when processing user-supplied uprobe_multi array pointers. A local user can supply crafted user-space pointers to trigger a kernel fault and cause a denial of service.

The issue involves missing bounds validation with access_ok before __get_user accesses user-space data.

172) Race condition (CVE-ID: CVE-2026-74261)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ALSA sequencer FIFO handling in sound/core/seq/seq_fifo.c when resizing the FIFO while processing and relinking event cells. A local user can trigger concurrent FIFO resize and event handling operations to cause a denial of service.

The issue can leave a retired pool waiting indefinitely for stale cells to drain during pool teardown.

173) Improper Initialization (CVE-ID: CVE-2026-74267)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in sch_codel when peeking queued packets after packet drops. A local user can trigger packet drops during peek to cause a denial of service.

The issue can incorrectly invoke the parent qlen_notify callback while a packet still remains queued, which may deactivate the parent class unexpectedly.

174) Race condition (CVE-ID: CVE-2026-74268)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in tcp_set_state() and tcp_call_bpf() when force-closing a child socket whose inherited sock_ops callback flags remain set after setup failure. A remote attacker can send network traffic that triggers child socket setup failure to cause a denial of service.

The issue occurs before the child socket is ever established and affects forced-close paths that reach tcp_done() without the expected socket lock.

175) Improper access control (CVE-ID: CVE-2026-74270)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to spoof handshake completion or disrupt an in-flight handshake.

The vulnerability exists due to improper access control in handshake_nl_done_doit() and the handshake genl DONE command when submitting a DONE request for a supplied sockfd without sender authentication. A local user can send a forged DONE message with a chosen status value to spoof handshake success or tear down a legitimate handshake.

The issue affects the DONE downcall of the handshake generic netlink family, where fd lookup confirms only that a pending handshake request exists for the supplied sockfd.

176) Information disclosure (CVE-ID: CVE-2026-74278)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper exposure of sensitive information in bounce_error_event() when delivering bounce error events to a user client via snd_seq_read(). A local user can trigger delivery of a bounce error event and read the returned fixed-length event to disclose sensitive information.

The issue exposes a raw kernel heap pointer from struct snd_seq_event to userspace through copy_to_user() in the fixed-length event handling path.

177) Improper input validation (CVE-ID: CVE-2026-74281)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in tipc_update_nametbl() when processing peer-advertised PUBLICATION items. A remote attacker can send specially crafted bindings with inverted service ranges to cause a denial of service.

The issue causes unbounded binding-table memory to be leaked for the lifetime of the namespace.

178) Integer underflow (CVE-ID: CVE-2026-74282)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow in tipc_sk_conn_proto_rcv() when processing a CONN_MANAGER/CONN_ACK message. A remote attacker can send a specially crafted connection acknowledgment with an oversized ack count to cause a denial of service.

For a local connection, the connected peer socket can trigger the issue.

179) Improper access control (CVE-ID: CVE-2026-74283)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify TIPC state.

The vulnerability exists due to improper access control in TIPCv2 generic-netlink mutator operations when handling netlink administrative commands. A local user can invoke mutating netlink operations to modify TIPC state.

The issue affects commands that can change the network id and node identity, set or flush key material, and enable or disable a UDP bearer.

180) Race condition (CVE-ID: CVE-2026-74284)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the HFSC scheduler class handling in net/sched/sch_hfsc.c when dequeuing packets from a class whose child qdisc becomes empty. A local user can trigger packet processing that causes a class to be marked passive twice to cause a denial of service.

The issue can incorrectly remove a parent with still-backlogged sibling classes from the virtual time tree, causing queued traffic to stop being dequeued.

181) NULL pointer dereference (CVE-ID: CVE-2026-74286)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the PFCP netdev statistics handler when creating a PFCP rtnetlink device and requesting netdev statistics. A local user can create a PFCP rtnetlink device to trigger the NULL pointer dereference and cause a denial of service.

The issue can be triggered immediately while building the RTM_NEWLINK notification for a newly created device.

182) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-74288)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in fib_rules_dump() when dumping fib_rule entries during an RCU dump. A local user can trigger fib_rule processing involving a dying fib_rule to cause a denial of service.

183) Use-after-free (CVE-ID: CVE-2026-74289)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib_leaf_notify() and fib_info reference handling when dumping IPv4 fib_info entries under RCU during fib notifier processing. A local user can trigger network namespace cleanup or device reload operations that invoke affected fib notifier paths to cause a denial of service.

The issue was reported through the netdevsim notifier path, and IPv6 is not affected by the same condition.

184) Information disclosure (CVE-ID: CVE-2026-74290)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper exposure of sensitive information in the cls_flow classifier when processing class statistics for map mode rules with user-controlled mask, xor, rshift, addend, and divisor values. A remote user can create a tc classifier and observe the resulting classid through class statistics to disclose sensitive information.

Exploitation requires the ability to use a tc classifier in a user or network namespace.

185) Use-after-free (CVE-ID: CVE-2026-74302)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in hci_unregister_dev() when a timeout fires during device teardown. A local user can trigger device teardown and a timer callback to dereference freed memory to cause a denial of service or execute arbitrary code.

The freed memory may include the hdev->reset function pointer.

186) Deadlock (CVE-ID: CVE-2026-74307)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in EXT4_IOC_MOVE_EXT when processing a donor file descriptor that refers to a file on a different filesystem. A local user can supply a donor file from a different superblock to cause a denial of service.

Exploitation requires a concurrent filesystem freeze operation to trigger the deadlock cycle.

187) Improper input validation (CVE-ID: CVE-2026-74308)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state validation in ext4_journalled_write_end() and ext4_write_inline_data_end() when handling writes on an ext4 filesystem mounted with the data=journal option after a failed inline-data-to-extent conversion. A local user can trigger a crafted write operation to cause a denial of service.

The issue can be triggered when a previous attempt to convert inline data to an extent fails, such as due to insufficient space.

188) Use-after-free (CVE-ID: CVE-2026-74310)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in vhost_zerocopy_complete in the vhost/net subsystem when processing zerocopy TX descriptor completion callbacks for cloned skbs. A local user can trigger cloned skb completion callbacks to dereference freed ubuf state and cause a denial of service.

Exploitation requires delayed completion after backend removal while another cloned skb reference still carries the same ubuf_info.

189) Use-after-free (CVE-ID: CVE-2026-74313)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in vduse_dev_open() when opening a VDUSE device while a concurrent VDUSE_DESTROY_DEV operation removes the same device from the IDR. A local user can trigger concurrent operations on the same device to cause a denial of service.

190) Out-of-bounds write (CVE-ID: CVE-2026-74317)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a slab out-of-bounds write in __netif_set_xps_queue in the ixgbe driver when loading an XDP program that configures XDP transmit queues. A local user can load an XDP program to trigger the out-of-bounds write and cause a denial of service.

The issue occurs on E610 adapters on systems with 64 or more CPUs when the last XDP queue is configured.

191) Race condition (CVE-ID: CVE-2026-74330)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in configfs directory entry child traversal when traversing s_children lists while concurrent cursor movement or freeing can occur. A local user can trigger concurrent configfs operations to cause a denial of service.

The issue affects configfs directory handling in fs/configfs/dir.c.

192) Out-of-bounds read (CVE-ID: CVE-2026-74346)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in irdma_handle_q_mem during CQ memory registration when processing CQ page array data. A local user can trigger CQ MR registration with a crafted page layout to disclose sensitive information.

The issue affects GEN_2 hardware and later when the CQ resize feature is enabled.

193) Integer underflow (CVE-ID: CVE-2026-74349)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unintended block trimming beyond the requested range.

The vulnerability exists due to an integer underflow in ocfs2_trim_mainbm() when processing a FITRIM range shorter than a cluster. A local user can submit a specially crafted FITRIM range to cause unintended block trimming beyond the requested range.

The issue occurs on filesystems where the cluster size is larger than the block size.

194) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74356)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in vhost_get_avail_idx in the vhost subsystem when handling available ring entries with mergeable buffers enabled. A local user can trigger repeated processing of available entries to cause a denial of service.

The issue can lead to a host livelock when the guest is not making progress and notifications are re-enabled while entries remain in the ring.

195) Use-after-free (CVE-ID: CVE-2026-74359)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in configfs_lookup() when handling subsequent getdents(2) operations in a directory after inode allocation failure. A local user can trigger inode allocation failure and then access the affected directory to cause a denial of service.

The issue occurs because a dangling pointer remains in the configfs_dirent structure and is later dereferenced to obtain an inode number.

196) Use-after-free (CVE-ID: CVE-2026-74363)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bpffs inode handling when a concurrent unlinkat() drops the last inode reference during RCU path walking. A local user can trigger concurrent path operations to cause a denial of service.

The issue occurs because inode fields and the cached symlink body may still be accessed during RCU pathwalk after the inode is freed.

197) Race condition (CVE-ID: CVE-2026-74365)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause silent data corruption.

The vulnerability exists due to a race condition in BTT lane acquisition in the Linux kernel nvdimm BTT subsystem when handling BTT I/O. A local user can trigger concurrent use of the same lane to cause silent data corruption.

The issue occurs because BTT lanes became preemptible while the recursion model still relied on a per-CPU recursion count, allowing another task on the same CPU to bypass locking and use the same lane concurrently.

198) Deadlock (CVE-ID: CVE-2026-74375)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in md_handle_request() and the raid1/raid10 read error recovery path when resubmitting a split md cloned bio while the array is suspended. A local user can trigger read error recovery to cause a denial of service.

The issue occurs because an md cloned bio already holds an active_io reference before another reference is attempted.

199) Improper resource shutdown or release (CVE-ID: CVE-2026-74376)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the md/raid10 discard handling logic when reusing an r10bio for discard operations. A local user can trigger discard operations on a reused r10bio to cause a denial of service.

The issue occurs when a discard reuses an r10bio that was previously used for a read, leaving read_slot non-negative and causing cleanup to skip releasing the replacement bio.

200) Out-of-bounds read (CVE-ID: CVE-2026-74377)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in rxe_resp_check_length() and copy_data() when processing a receive WQE from a shared queue buffer mapped into userspace. A local user can modify WQE fields such as num_sge or sge entries during processing to cause an out-of-bounds read.

The issue affects the non-SRQ queue pair receive path.

201) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74378)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a heap-based buffer overflow.

The vulnerability exists due to a time-of-check time-of-use race in get_srq_wqe() when copying a work queue element from a shared receive queue buffer mapped into userspace. A local user can modify num_sge between validation and size calculation to cause a heap-based buffer overflow.

The issue arises because the num_sge field is read twice from shared userspace-accessible memory.

202) Uncontrolled Recursion (CVE-ID: CVE-2026-74382)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in cls_bpf_offload_cmd() in the cls_bpf traffic control offload path when processing a filter replace operation and attempting rollback after repeated tc_setup_cb_replace() failures. A local user can trigger repeated rollback failures to cause a denial of service.

The issue can exhaust kernel stack space during rollback handling, and it is not limited to netdevsim.

203) Out-of-bounds write (CVE-ID: CVE-2026-74384)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the nvme multipath namespace head flexible array member current_path[] when handling sparse NUMA node IDs during namespace path revalidation. A local user can trigger nvme multipath operations on a system with sparse NUMA node IDs to cause a denial of service.

Only systems using nvme multipath on architectures where NUMA node IDs are sparse are affected.

204) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74385)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper exception handling in nvmet_tcp_tls_handshake_done when completing a TCP/TLS handshake. A remote attacker can trigger a failure in nvmet_tcp_set_queue_sock to cause a denial of service.

The issue can occur if the socket is not in TCP_ESTABLISHED state, leading to queue and socket leakage.

205) Improper resource shutdown or release (CVE-ID: CVE-2026-74386)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in nvmet_tcp_alloc_queue() in the NVMe target TCP component when handling connection closure during queue allocation. A remote attacker can repeatedly open and close connections to cause a denial of service.

The issue occurs on an error path where the page fragment cache reference held by queue->pf_cache is not released, leading to a page leak over time.

206) Use-after-free (CVE-ID: CVE-2026-74388)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ALSA OSS sequencer event handling logic when processing SysEx data embedded in MIDI events and dispatching a pending event after a sequencer port is closed concurrently. A local user can send crafted MIDI bytes that produce a pending SysEx event with a stale pointer to cause a denial of service.

The issue occurs during concurrent port closure before deferred event dispatch.

207) Logging of Excessive Data (CVE-ID: CVE-2026-74389)

CWE-ID: CWE-779 - Logging of Excessive Data

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper restriction of excessive logging in the hns roce rdma driver command error handling path when command mailbox failures are repeatedly triggered during hardware context operations. A local user can trigger repeated command failures to cause a denial of service.

The issue can lead to log flooding after command mailbox failures and may result in a system crash when the hardware is abnormal.

208) Out-of-bounds write (CVE-ID: CVE-2026-74390)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to out-of-bounds write in irdma_copy_user_pgaddrs when processing user-supplied RDMA memory registration data with lvl set to 0. A local user can provide a umem with more DMA blocks than the supplied page count to cause a denial of service or execute arbitrary code.

The issue affects the lvl==0 case that uses the fixed-size iwmr->pgaddrmem array for QP, CQ, and SRQ rings.

209) Stack-based buffer overflow (CVE-ID: CVE-2026-74391)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in synthetic field helpers in kernel/trace/trace_events_hist.c when constructing synthetic variable names and generated histogram commands from long key lists, field names, or saved filters. A local user can supply crafted tracing inputs to cause a denial of service.

The issue occurs in tracing functionality while building fixed-size MAX_FILTER_STR_VAL staging buffers.

210) Improper resource shutdown or release (CVE-ID: CVE-2026-74397)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in mlx5_ib_alloc_transport_domain() when handling transport-domain allocation failures during loopback enablement. A local user can trigger an error path that leaks a transport domain to cause a denial of service.

The issue affects the IB/mlx5 driver in the Linux kernel.

211) Race condition (CVE-ID: CVE-2026-74398)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in addrconf_dad_failure in the IPv6 address configuration subsystem when handling duplicate address detection failure processing concurrently with IPv6 address deletion. A local attacker can trigger concurrent state transitions to cause a denial of service.

The issue can lead to a general protection fault when a deleted IPv6 address entry is processed a second time through scheduled DAD work.

212) NULL pointer dereference (CVE-ID: CVE-2026-74406)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in vxlan_gro_prepare_receive() when processing packets during GRO handling. A local attacker can trigger concurrent socket state changes to cause a denial of service.

213) Race condition (CVE-ID: CVE-2026-74440)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read or write memory being moved.

The vulnerability exists due to a race condition in xe_exec_ioctl() when scheduling user jobs that use external buffer objects mapped by the VM without waiting on their dma-resv KERNEL fences. A local user can submit a job using an external buffer object while a kernel operation on that buffer object is still in flight to read or write memory being moved.

Long-running mode is excluded from this behavior.

214) Out-of-bounds write (CVE-ID: CVE-2026-74443)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify authenticated command fields.

The vulnerability exists due to an out-of-bounds write in vmw_cmd_dma() in the vmwgfx command verifier when processing a dma command with an undersized header body size. A local user can submit a specially crafted command to modify authenticated command fields.

The issue arises from a suffix pointer underflow that can clobber fields in a previously relocated command in the device-visible command stream.

215) Out-of-bounds read (CVE-ID: CVE-2026-74444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in vmw_cmd_draw() when processing a user-supplied command stream containing an undersized DRAW_PRIMITIVES header. A local user can supply a crafted command stream to disclose sensitive information.

The issue is triggered when header->size is smaller than the command body size, causing an unsigned subtraction to wrap and a subsequent bounds check to be bypassed.

216) Division by zero (CVE-ID: CVE-2026-74449)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to divide-by-zero in calculate_mcache_setting in the AMD display driver when processing a zero-area viewport. A local user can trigger display mode handling with a degenerate viewport to cause a denial of service.

The issue can also cause an underflow on the num_mcaches value.

217) Use-after-free (CVE-ID: CVE-2026-74450)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the amdgpu pp_table sysfs handling when copying the power table after dropping adev->pm.mutex. A local user can trigger a concurrent pp_table write during the copy to cause a denial of service.

The issue arises because a driver-owned power table pointer is returned and later used by the sysfs path after the mutex is released.

218) Improper input validation (CVE-ID: CVE-2026-74453)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in validate_tile_binning_config when processing tile binning configurations with oversized tile state arrays. A local user can submit a crafted tile binning configuration that leaves no room for the tile allocation pool to cause a denial of service.

The tile state data array size is derived from tile count fields and shares the same buffer slot with the tile allocation pool.

219) Improper Initialization (CVE-ID: CVE-2026-74453)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the vc4 tile state data array handling when submitting crafted tile binning configurations. A local user can submit a crafted job that reuses stale tile state data to cause a denial of service.

The issue can result in invalid command streams, invalid primitive streams, and GPU hangs.

220) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-74464)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in ovs_flow_key_update() handling within net/openvswitch/actions.c when processing connection tracking actions on a packet whose flow key becomes invalid and unparseable. A local user can trigger flow key update failure with a specially crafted packet and action sequence to cause a denial of service.

This requires the packet to become unparseable after actions are applied to a previously parseable skb.

221) Use-after-free (CVE-ID: CVE-2026-74465)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the openvswitch meter handling code when processing crafted netlink requests through the uAPI. A local user can trigger meter attach failure conditions and concurrently access the freed meter to cause a denial of service.

Exploitation is possible with a custom application using the uAPI, while the issue is not triggered in the typical ovs-vswitchd usage pattern described in the advisory.

222) Improper access control (CVE-ID: CVE-2026-74467)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to invoke private ioctl commands.

The vulnerability exists due to improper access control in qeth_siocdevprivate when handling SIOCDEVPRIVATE ioctl commands. A local user can invoke private ioctl commands to invoke private ioctl commands.

The issue affects the SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT commands.

223) Out-of-bounds write (CVE-ID: CVE-2026-74469)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in SCTP sock_diag when processing a diagnostic dump after adding many unique peer transports. A local user can add unique peer addresses until the 16-bit transport_count wraps and trigger a diagnostic dump to cause a denial of service.

The issue occurs when the association accumulates 65,536 unique peer transports, causing transport_count to wrap to zero while peer addresses are still copied from transport_addr_list.

224) Use-after-free (CVE-ID: CVE-2026-74471)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in trace_module_add_events() and the tracing subsystem when handling failed event registration during module loading. A local user can load a module that triggers event registration failure and subsequently access tracefs or tracing operations to cause a denial of service.

Exploitation requires a module loading scenario in which event registration fails and the module memory is later freed, leaving a stale trace_event_call pointer in trace_event_file.

225) Out-of-bounds read (CVE-ID: CVE-2026-74473)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in route_shortcircuit() in drivers/net/vxlan/vxlan_core.c when processing packets with a non-linear buffer layout. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because the network header may not be fully pulled into the linear buffer before ip_hdr(skb)->daddr or ipv6_hdr(skb)->daddr is dereferenced.

226) Race condition (CVE-ID: CVE-2026-74475)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in route_shortcircuit() in the VXLAN implementation when processing neighbour hardware addresses. A local attacker can trigger concurrent updates to cause a denial of service.

227) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-74476)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of non-linear skb fragment metadata in veth_convert_skb_to_xdp_buff() when processing frag_list skbs before exposing them to XDP. A local user can trigger processing of a crafted non-linear skb with frag_list data to cause a denial of service.

The issue can lead to a crash in memcpy() from __xsk_rcv() in AF_XDP copy mode.

228) Use-after-free (CVE-ID: CVE-2026-74479)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the pktgen proc entry handling in net/core/pktgen.c when concurrently removing and renaming pktgen devices. A local user can trigger a race condition involving proc_remove() on a stale proc_dir_entry to cause a denial of service.

The issue occurs because pktgen_change_name() and pktgen_remove_device() access the same proc entry with inconsistent locking, and exploitation requires winning a race between those paths.

229) Use-after-free (CVE-ID: CVE-2026-74480)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in br_multicast_leave_group() in the bridge multicast handling code when processing fast-leave operations on port groups. A local user can trigger deletion of a matching port group to cause a denial of service.

The issue can occur when multicast-to-unicast had been enabled, allowing multiple port groups for the same port and group with different source MAC addresses, and is later disabled so entries are matched by port only.

230) Out-of-bounds read (CVE-ID: CVE-2026-74485)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the binfmt_misc registration parser when processing a crafted registration string with a flag character used as the field delimiter. A remote attacker can submit a specially crafted registration string to disclose sensitive information.

The issue is reachable by unprivileged users in a user namespace through binfmt_misc mounts.

231) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74487)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in binfmt_misc when removing an entry registered with the MISC_FMT_OPEN_FILE flag. A local user can register and remove such an entry to cause a denial of service.

The issue leaves the interpreter inode with a permanently negative write count until the inode is evicted from the inode cache, causing subsequent write attempts to fail with ETXTBSY.

232) Use-after-free (CVE-ID: CVE-2026-74490)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tipc_poll() trace queue dumping when walking live socket queue members from an unlocked poll context. A local user can trigger polling while queue entries are concurrently dequeued and freed to cause a denial of service.

The issue occurs in the TIPC socket trace path during queue state dumping.

233) Use-after-free (CVE-ID: CVE-2026-74492)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in mtype_add() when processing packet-side add operations during ipset table resizing. A remote user can trigger xt_SET --add-set ... --exist updates to cause a denial of service.

The issue occurs when a replacement-table entry and an old-table entry temporarily share the same comment pointer during resize and backlog replay, leading to a stale pointer dereference in strlen().

234) Use-after-free (CVE-ID: CVE-2026-74493)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __smc_lgr_terminate() in the SMC networking subsystem when terminating a link group while a concurrent close unregisters a connection. A local user can trigger overlapping close and link group termination operations to cause a denial of service.

The issue is caused by a race condition involving socket reference handling for a connection stored in lgr->conns_all.

235) Use-after-free (CVE-ID: CVE-2026-74513)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in dibs loopback DMB handling in drivers/dibs/dibs_loopback.c when performing concurrent loopback attach, detach, or unregister operations. A local user can trigger racing reference count operations on a dmb_node to cause a denial of service.

The issue arises from a race window between hash table lookup and refcount operations on dmb_node.

236) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74515)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state validation in kvm_s390_pci_aif_enable() when handling repeated requests to enable adapter interrupt forwarding for the same zPCI device. A local user can issue the ioctl multiple times to cause a denial of service.

The issue can also overwrite and leak resources if the operation is invoked repeatedly for the same device.

237) Deadlock (CVE-ID: CVE-2026-74523)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a deadlock in the qede recovery path when handling a TX timeout on a qede NIC with VXLAN/GENEVE tunnel ports configured. A local attacker can trigger a TX timeout condition to cause a denial of service.

The issue can wedge the rtnetlink control plane of the whole machine while the node may still answer ping.

238) Use-after-free (CVE-ID: CVE-2026-74533)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free race condition in the Bluetooth ISO connection handling in net/bluetooth/iso.c when processing Bluetooth ISO data and connection teardown. A local user can trigger concurrent access to hci_conn->iso_data to cause a denial of service or execute arbitrary code.

The issue involves unsynchronized access to hci_conn->iso_data during iso_recv(), iso_conn_put(), iso_conn_add(), and iso_conn_free().

239) Double free (CVE-ID: CVE-2026-74534)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in net/bluetooth/iso.c when deleting Bluetooth ISO connections concurrently. A local user can trigger a race condition to cause a denial of service.

The issue arises from a race between iso_conn_del() and iso_chan_del() in the Bluetooth ISO subsystem.

240) Use-after-free (CVE-ID: CVE-2026-74535)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free and deadlock condition in iso_sock_timeout in the Bluetooth ISO subsystem when handling socket timeout work concurrently with connection deletion or synchronously disabling delayed work while holding the socket lock. A local user can trigger socket timeout handling and connection teardown to cause a denial of service.

The issue involves a race between timeout processing and connection deletion in Bluetooth ISO sockets.

241) Improper resource shutdown or release (CVE-ID: CVE-2026-74536)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in iso_sock_kill() and ISO socket handling in net/bluetooth/iso.c when releasing and deleting Bluetooth ISO sockets concurrently. A local user can trigger concurrent socket release and connection deletion to cause a denial of service.

The issue results in a leaked socket reference because cleanup may be skipped and the socket destructor may never be called.

242) Improper locking (CVE-ID: CVE-2026-74538)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in iso_connect_ind when handling Bluetooth ISO connection indication events. A local user can trigger a race condition to cause a denial of service.

The issue occurs because iso_pi(sk)->conn may be accessed after the socket has transitioned away from the LISTEN or CONNECT states.

243) Use-after-free (CVE-ID: CVE-2026-74540)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in l2cap_le_connect_rsp() in the Bluetooth L2CAP subsystem when handling a crafted LE connect response during channel processing. A remote attacker can trigger a remote disconnect race to cause a denial of service.

244) Use-after-free (CVE-ID: CVE-2026-74541)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Bluetooth ISO socket handling code when disconnecting an ISO connection and later releasing the socket. A local user can trigger connection teardown that leaves a stale iso_data pointer to cause a denial of service.

245) Memory corruption (CVE-ID: CVE-2026-74551)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to improper memory alignment in the nzxt-smart2 driver output buffer when sending output reports through the USB HID core for DMA. A local user can trigger device operations such as setting a fan speed or updating the interval to cause memory corruption.

This issue affects systems with non-coherent CPU architectures such as ARM or MIPS, where the corruption is immediate and deterministic due to cacheline sharing with adjacent variables.

246) Out-of-bounds read (CVE-ID: CVE-2026-74553)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the nct6775_probe function in the nct6775-core hwmon driver when probing NCT6116 hardware. A local attacker can trigger driver initialization to cause a denial of service.

The issue is caused by using the size of the NCT6106 temperature register array for NCT6116 even though NCT6116 only provides three temperature source and temperature source configuration registers.

247) Race condition (CVE-ID: CVE-2026-74555)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the libsas resume handling for hisi_sas controllers when resuming the host adapter while disks are still waking up. A local user can trigger a suspend and resume sequence to cause a denial of service.

The issue can result in I/O failures and disks being disabled during resume.

248) Out-of-bounds read (CVE-ID: CVE-2026-74557)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in iscsi_scsi_cmd_rsp() when processing a target-supplied SCSI Response sense data segment. A remote attacker can send a crafted SCSI Response with a malformed sense length field to disclose sensitive information.

The over-read can copy up to two bytes of stale conn->data contents into the command's sense buffer, which is returned to userspace.

249) Use of uninitialized resource (CVE-ID: CVE-2026-74564)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uninitialized memory access in xt_hashlimit when processing hashlimit rule configuration with inconsistent XT_HASHLIMIT_RATE_MATCH usage for the same hashtable. A local user can create specially crafted netfilter rules to cause a denial of service.

The issue arises when different rules referring to the same hashtable use conflicting rate match semantics, and revision values less than 3 are also affected when the flag is used.

250) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-74579)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause incorrect netfilter payload offload matching.

The vulnerability exists due to undefined shift behavior in nft_payload_offload_mask() in net/netfilter/nft_payload.c when building an offload match mask for a payload expression that covers only part of a header field. A local privileged user can configure a crafted nftables payload rule with a partial header field match to cause incorrect netfilter payload offload matching.

The issue occurs for partial field matches such as a partial IPv6 address match where the match length is shorter than the header field length.

251) Improper access control (CVE-ID: CVE-2026-74580)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory outside the intended IOTLB-mapped region.

The vulnerability exists due to improper access control in the vhost vring metadata cache in drivers/vhost/vhost.c when reconfiguring vring addresses or vring size through vhost ioctls while a device IOTLB is attached. A local user can issue crafted vring reconfiguration ioctls after populating the metadata cache to access memory outside the intended IOTLB-mapped region.

The issue occurs because stale cached metadata mappings may continue to be used after live vring reconfiguration, causing subsequent used ring updates or descriptor fetches to use translations based on the old mapping.

252) Use-after-free (CVE-ID: CVE-2026-74586)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in SCTP ASCONF handling when processing an authenticated ASCONF chunk that adds and removes a peer transport in the same chunk. A remote user can send a specially crafted authenticated ASCONF message to cause a denial of service.

The issue occurs because a stale new_transport pointer can be used when a queued HEARTBEAT is later processed during local address replacement.

253) Use-after-free (CVE-ID: CVE-2026-74588)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in __sctp_outq_flush_rtx() and SCTP transport tracking when processing SCTP SACKs after transport removal. A remote user can send crafted SCTP control traffic to cause a denial of service.

Exploitation requires an SCTP association peer to trigger transport removal through ASCONF Delete-IP and then send a SACK that reneges on the TSN.

254) Use-after-free (CVE-ID: CVE-2026-74589)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tcp_bpf_send_verdict() and tcp_bpf_sendmsg_redir() when processing concurrent sendmsg() operations with a cached redirect verdict. A local user can trigger concurrent socket send operations to cause a denial of service.

The issue occurs when apply_bytes keeps the cached verdict active, allowing one thread to release the redirect socket reference while another thread still uses a stale pointer.

255) Improper Initialization (CVE-ID: CVE-2026-74592)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass integrity measurement and appraisal of truncated files.

The vulnerability exists due to improper state management in the integrity measurement architecture truncate hook handling when truncation is requested for a regular file. A local user can truncate a file to bypass integrity measurement and appraisal of truncated files.

The issue affects files whose IMA action cache flags are not reset after content changes caused by truncation.

256) Use-after-free (CVE-ID: CVE-2026-74594)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in kernel/sched/psi.c when destroying PSI cgroup triggers concurrently with scheduling poll work. A local user can trigger a race that leaves a poll timer pending on freed memory to cause a denial of service.

The issue occurs because a timer may be re-armed during teardown and later execute poll_timer_fn() after the associated group has been freed.

257) Improper access control (CVE-ID: CVE-2026-74595)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass owner checks and set an encryption policy on a file.

The vulnerability exists due to improper access control in fscrypt_ioctl_set_policy() when handling ioctl requests on idmapped mounts. A local user can issue a crafted ioctl on an idmapped mount to bypass owner checks and set an encryption policy on a file.

The issue occurs because the check uses the unmapped on-disk owner rather than the mapped owner on mounts that support idmapping.

258) Out-of-bounds write (CVE-ID: CVE-2026-74597)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to an out-of-bounds write in ip6ip6_err() and the IPv6 ICMP error reply path when processing a quoted inner IPv6 packet after cloning an outer IPv6 ICMP error skb with stale inet6_skb_parm metadata. A remote attacker can send a specially crafted IPv6 packet to corrupt memory.

Exploitation requires the outer packet to carry a Home Address Option and a malformed inner destination-options header.

259) Out-of-bounds read (CVE-ID: CVE-2026-74598)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rt6_route_rcv() when processing a crafted IPv6 Router Advertisement containing a malformed Route Information option. A remote attacker can send a specially crafted Router Advertisement to disclose sensitive information.

When additional options follow the malformed Route Information option, data from the next option can be incorporated into the installed route and become visible to userspace.

260) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74600)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of special zero mappings in page_table_check in mm/page_table_check.c when processing user page-table mappings. A local user can populate enough zero mappings to overflow file_map_count and trigger the existing BUG_ON() to cause a denial of service.

The issue affects both the PTE path with the shared zero page and the PMD path with huge zero mappings.

261) Race condition (CVE-ID: CVE-2026-74601)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ring_buffer_swap_cpu() when swapping per-cpu ring buffers during an active write operation. A local user can trigger a buffer swap at a moment when the committing counter temporarily drops to zero to cause a denial of service.

The issue can lead to an inconsistent buffer state and trigger the RB_WARN_ON in rb_commit().

262) Out-of-bounds read (CVE-ID: CVE-2026-74603)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the ptp ocp devlink board id reporting logic when processing a non-NUL-terminated EEPROM board ID field. A local user can trigger reporting of the board ID to disclose sensitive information.

The issue occurs because the EEPROM board ID is a fixed 13-byte field that is not guaranteed to contain a NUL terminator.

263) Use-after-free (CVE-ID: CVE-2026-74608)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in cifs_try_adding_channels() when handling channel addition failures during concurrent interface list refresh. A local user can trigger the race condition to cause a denial of service.

The issue occurs on the failure path after channel creation fails and concurrent interface list refresh removes the remaining list reference.

264) Use-after-free (CVE-ID: CVE-2026-74609)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tipc_node_link_down() in the TIPC subsystem when handling link-down events and bearer disable operations concurrently. A local user can trigger a race condition that frees a link object while it is still being dereferenced to cause a denial of service.

The issue can result in both a use-after-free read in tipc_link_is_establishing() and a use-after-free write via tipc_link_reset() during the establishing branch.

265) Out-of-bounds read (CVE-ID: CVE-2026-74612)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information to userspace.

The vulnerability exists due to an out-of-bounds read in veth_xdp_rcv_skb() when processing an skb after XDP fragment area adjustment. A local user can run an XDP program that shrinks the fragment area to disclose sensitive information to userspace.

The issue can expose skb metadata including fragment state and a kernel pointer, and was observed on the UDP receive path.

266) Use-after-free (CVE-ID: CVE-2026-74615)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in the vxlan ageing timer handling in drivers/net/vxlan/vxlan_core.c when changing link ageing settings on a device that is down. A remote user can create and delete a VXLAN device in a new user and network namespace to cause a denial of service.

The affected operations are network-namespace scoped.

267) Out-of-bounds write (CVE-ID: CVE-2026-74616)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in xdpf_clone() and the XDP-to-skb conversion path when converting crafted cloned XDP frames into sk_buffs. A local user can trigger conversion of a crafted clone that overlaps skb_shared_info tailroom to cause memory corruption.

268) Improper resource shutdown or release (CVE-ID: CVE-2026-74622)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in aq_ring_rx_deinit() in the atlantic network driver when deinitializing receive rings. A local user can trigger interface teardown while buffers have been consumed but not yet refilled to cause a denial of service.

The issue occurs because receive buffers in the gap between sw_tail and sw_head can retain live pages and DMA mappings that are not released during ring deinitialization.

269) Memory leak (CVE-ID: CVE-2026-74625)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in nf_ct_bridge_pre() when processing non-IPv4 and non-IPv6 Ethernet frames after a bridge nftables ct zone set rule has attached a conntrack template. A remote attacker can send specially crafted non-IP traffic to cause a denial of service.

Memory is leaked by making the existing conntrack template reference unreachable, which can exhaust slab memory.

270) Use-after-free (CVE-ID: CVE-2026-74630)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in in6_dev_get() and inet6_dev handling when processing IPv6 device state during concurrent device teardown. A local user can trigger network operations that race with device teardown to cause a denial of service or execute arbitrary code.

The issue arises from invalid reference acquisition after the object reference count has already reached zero, and the freed object may be accessed after the RCU read-side section ends.

271) Use-after-free (CVE-ID: CVE-2026-74631)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in smc_rx_splice when processing splice operations. A local user can trigger a refcount imbalance to cause a denial of service.

The issue can underflow page refcounts in the VM-backed RMB path.

272) Race condition (CVE-ID: CVE-2026-74632)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in mm/huge_memory.c when handling concurrent page faults and shrinker activity for the huge zero folio. A local user can trigger concurrent memory-management activity to cause a denial of service.

Only systems without CONFIG_PERSISTENT_HUGE_ZERO_FOLIO are affected.

273) Race condition (CVE-ID: CVE-2026-74636)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in trace event field handling in the Linux kernel tracing subsystem when loading modules and updating trace event fields concurrently. A local user can load modules concurrently to trigger a kernel panic and cause a denial of service.

Exploitation requires the ability to initiate module loading.

274) Use-after-free (CVE-ID: CVE-2026-74637)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in perf/core group handling when processing a PERF_IOC_FLAG_GROUP ioctl on a detached sibling event after CPU hotplug detachment. A local user can issue a crafted ioctl on a surviving perf event file descriptor to cause a denial of service.

The issue occurs when a sibling event is detached with DETACH_GROUP and kept alive while its group_leader pointer still references a leader that is later freed.

275) Race condition (CVE-ID: CVE-2026-74638)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the v3d drm scheduler timeout handling for V3D hardware queues when handling concurrent scheduler timeouts across queues that share a global reset. A local user can trigger queue timeouts during gpu workload execution to cause a denial of service.

The issue can leave the CL queue credit count inconsistent, resulting in a complete GPU hang and UI freeze.

276) Use of uninitialized resource (CVE-ID: CVE-2026-74659)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in br_mrp_alloc_test_skb() when constructing MRA MRP_Test frames. A remote attacker can trigger transmission of a specially crafted protocol frame to disclose sensitive information.

Three uninitialized bytes are present in each transmitted MRA MRP_Test frame because the sub-TLV length field and alignment padding are not initialized.

277) Use-after-free (CVE-ID: CVE-2026-74660)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ebt_nflog netfilter target when processing packets that match an ebtables nflog rule during concurrent unloading of the nfnetlink_log module. A local user can trigger packet logging through a crafted ebtables nflog rule to cause a denial of service.

Exploitation requires a race with module teardown while an ebtables nflog rule remains callable.

278) Uncontrolled Recursion (CVE-ID: CVE-2026-74663)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in qdisc hierarchy handling in net/sched qdisc grafting logic when creating and grafting a new child qdisc below an already deep parent. A local user can create a deeply nested qdisc hierarchy to cause a denial of service.

The issue affects the create-and-graft path that is not covered by the existing loop check.

279) Out-of-bounds read (CVE-ID: CVE-2026-74665)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in bpf_prog_run_generic_xdp() when processing generic XDP fragment adjustments on non-linear sk_buff data. A local user can trigger crafted packet handling to disclose sensitive information.

In the reproduced UDP receive path, copied data included fragment metadata and a kernel pointer, and packet payload data was displaced and truncated.

280) Race condition (CVE-ID: CVE-2026-74666)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in packet_set_ring() and pressure clearing logic in af_packet when reconfiguring the ring while packet_poll() or packet_recvmsg() accesses receive state. A local user can reconfigure the packet socket ring and trigger packet polling or receive operations to cause a denial of service.

The issue can cause __packet_rcv_has_room() to dereference stale or NULL ring storage.

281) Out-of-bounds read (CVE-ID: CVE-2026-74667)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the packet-socket transmit path in net/packet/af_packet.c when transmitting frames through the PACKET_QDISC_BYPASS path. A local user can send a specially crafted packet through a packet socket to cause a denial of service.

The issue occurs when a driver reads eth_hdr(skb) on transmit with an unset MAC header.

282) Out-of-bounds read (CVE-ID: CVE-2026-74671)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in xattr_verify() when verifying a truncated security.ima extended attribute value. A local user can provide a specially crafted truncated extended attribute to disclose sensitive information.

The issue is triggered by an integer underflow caused by mixing signed and unsigned arithmetic in the digest-length check.

283) Use-after-free (CVE-ID: CVE-2026-74688)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the SCTP control chunk handling logic when transmitting a queued HEARTBEAT ACK after the associated peer transport has been removed. A remote attacker can trigger peer transport removal while a control chunk retains a stale transport pointer to cause a denial of service.

The issue occurs when src_out_of_asoc_ok is enabled and the HEARTBEAT ACK remains queued on control_chunk_list instead of being transmitted immediately.

284) Out-of-bounds read (CVE-ID: CVE-2026-74689)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in vcc_setsockopt() when processing crafted setsockopt calls. A local user can supply a mismatched level or a shortened optlen value to trigger an out-of-bounds read and disclose sensitive information.

The issue can also be triggered if a cgroup BPF setsockopt filter shrinks optlen after entry.

285) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74696)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in TCP Fast Open listener queue accounting when migrating pending Fast Open children across SO_REUSEPORT listeners. A remote attacker can establish multiple pending Fast Open requests during listener migration to cause a denial of service.

This only occurs with SO_REUSEPORT listener migration involving still-pending TCP Fast Open children.

286) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-74697)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to improper hardware interaction in the bnxt_en AGG ring handling in the bnxt driver when processing TPA data with EOP and relaxed ordering enabled. A local user can trigger network traffic processing that causes overlapping zero padding to corrupt data.

The issue was reported on some ARM systems using 57508 (P5) chips, and it occurs when TPA is enabled.

287) Race condition (CVE-ID: CVE-2026-74700)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a race condition in net/sched/cls_api.c when handling concurrent classifier creation requests in the same chain and priority. A local user can trigger concurrent u32 and flower filter operations to cause a use-after-free.

Exploitation requires concurrent requests that race during tc_new_tfilter processing.

288) Out-of-bounds read (CVE-ID: CVE-2026-74701)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in key_extract() in the Open vSwitch flow extraction logic when processing a packet on an ARPHRD_NONE device with a user-controlled protocol field indicating Ethernet. A local user can send a specially crafted packet with an insufficient linear header to cause a denial of service.

The issue is triggered when the packet is received from devices such as TUN.

289) Use-after-free (CVE-ID: CVE-2026-74705)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in __skb_udp_tunnel_segment() in net/ipv4/udp_offload.c when processing tunnel segmentation for skb data after pulling the tunnel header into the skb head. A local attacker can trigger skb head reallocation and subsequent use of a stale UDP header pointer to cause a denial of service.

290) Out-of-bounds read (CVE-ID: CVE-2026-74710)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in AF_XDP TX metadata handling in xdp_umem_reg() when processing a registered TX metadata length smaller than 16 bytes. A local user can register a crafted TX metadata length to disclose sensitive information.

291) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-74713)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in vhost_iotlb_add_range_ctx() and related vhost IOTLB allocation paths when handling userspace- or guest-controlled IOTLB mapping requests. A local user can send crafted mapping updates that keep allocating IOTLB entries beyond the configured limit to cause a denial of service.

Non-retiring tables could continue allocating entries after reaching their configured limit, and full-range mappings are split into two IOTLB entries.

292) Improper resource shutdown or release (CVE-ID: CVE-2026-74718)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in devlink_nl_reload_doit() when handling a devlink reload request that targets a different network namespace with an action other than DRIVER_REINIT. A local user can send a specially crafted devlink reload request to cause a denial of service.

293) Memory leak (CVE-ID: CVE-2026-74719)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in smc_llc_event_handler() when handling duplicate CONFIRM_LINK or ADD_LINK_CONT messages while a local LLC flow is active and a qentry is already pending. A remote attacker can send duplicate crafted messages to cause a denial of service.

The issue affects the SMC_LLC_CONFIRM_LINK and SMC_LLC_ADD_LINK_CONT handling path, while the response direction is not affected.

294) Use-after-free (CVE-ID: CVE-2026-74725)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the enic driver teardown work handling in enic_remove() when a TX timeout fires during device removal. A local attacker can trigger a TX timeout race to cause a denial of service.

The issue is caused by a race condition in which tx_hang_reset may be scheduled after the network device has been freed.

295) Race condition (CVE-ID: CVE-2026-74726)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in bond_alb_monitor in the bonding ALB implementation when handling active slave changes under RTNL. A local user can trigger network interface state changes to cause a denial of service.

The issue can lead to a null pointer dereference and kernel panic, and in failover cases can underflow the new slave's promiscuity counter and leave it stuck in promiscuous mode.

296) Improper update of reference count (CVE-ID: CVE-2026-74735)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference counting in the l2tp seq_file handlers for /proc/net/pppol2tp and /sys/kernel/debug/l2tp/tunnels when closing the file before reading to end-of-file. A local user can close the file early to cause a denial of service.

The issue occurs because tunnel and session references kept in seq_file private iteration state are not dropped on release.

297) Out-of-bounds read (CVE-ID: CVE-2026-74737)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds memory access in the am65-cpsw-nuss packet reception path when processing RX DMA descriptor metadata containing the source tag. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because the driver uses the full 16-bit source tag as the port identifier even though only the lower 8 bits represent the MAC port ID, while the upper 8 bits are hardware-reserved and may contain arbitrary values.

298) Out-of-bounds read (CVE-ID: CVE-2026-74739)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in u32_bind_class() when processing cls_u32 walker callback entries. A local user can trigger class binding on a hash table entry that is incorrectly treated as a tc_u_knode to disclose sensitive information.

The issue occurs because u32_walk() can enumerate both tc_u_hnode and tc_u_knode objects, but the affected code unconditionally treats the callback argument as a tc_u_knode.

299) Use-after-free (CVE-ID: CVE-2026-74743)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the macvlan network device handling in drivers/net/macvlan.c when processing packets on a macvlan device backed by a lower device that requires additional headroom or tailroom. A remote attacker can send network traffic that triggers insufficient buffer space handling to execute arbitrary code.

The issue can be triggered when the lower device requires extra header or trailer space, such as with macsec, ipsec, wireguard, tunnels, or veth with rx headroom.

300) Use-after-free (CVE-ID: CVE-2026-74744)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the ipvlan network device component when handling packet header and tailroom requirements inherited from the underlying physical device. A remote attacker can trigger packet processing that causes insufficient headroom or tailroom reservation to execute arbitrary code.

The issue can occur when the underlying physical or stacked lower device requires extra headroom or tailroom for headers or trailers.

301) Out-of-bounds read (CVE-ID: CVE-2026-74752)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in SCTP COOKIE_ECHO handling when processing peer-controlled cookie AUTH fields with cookie authentication disabled. A remote attacker can send a forged cookie with a crafted RANDOM length to disclose sensitive information.

The issue is reachable when cookie authentication is disabled, and malformed AUTH parameters restored from the cookie are not validated against local backing arrays.

302) Out-of-bounds write (CVE-ID: CVE-2026-74752)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in SCTP COOKIE_ECHO handling when processing peer-controlled cookie AUTH fields with cookie authentication disabled. A remote attacker can send a forged cookie with a crafted HMAC identifier to execute arbitrary code.

The issue is reachable when cookie authentication is disabled, and malformed AUTH parameters restored from the cookie are not validated against local backing arrays.

303) Integer overflow (CVE-ID: CVE-2026-80540)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an integer overflow in the amdgpu UVD decode message handler when processing crafted decode parameters. A local user can supply a crafted pitch value to trigger the overflow and execute arbitrary code.

The issue is in the Linux kernel DRM AMDGPU UVD decode path.

304) Out-of-bounds read (CVE-ID: CVE-2026-80557)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, execute arbitrary code, or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in decode_watchers() when processing a crafted obj_list_watch_response_t reply with struct_len set to 0. A remote attacker can send a specially crafted OSD response to disclose sensitive information, execute arbitrary code, or cause a denial of service.

Exploitation requires a malicious or compromised OSD and can be triggered when a kernel client invokes CEPH_OSD_OP_LIST_WATCHERS.

305) Out-of-bounds write (CVE-ID: CVE-2026-80580)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the fbdev sysfs mode output handling in drivers/video/fbdev/core/fbsysfs.c when processing a long modelist for sysfs output. A local user can trigger sysfs mode listing with a sufficiently long modelist to execute arbitrary code.

306) Improper Initialization (CVE-ID: CVE-2026-80585)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and corrupt integrity.

The vulnerability exists due to improper state management in mptcp_fastopen_subflow_synack_set_params() and check_fully_established() when processing data-less TCP Fast Open SYN packets with a valid cookie. A remote attacker can send a specially crafted SYN packet to cause a denial of service and corrupt integrity.

The issue occurs when a valid-cookie SYN carries no data, leaving the receive queue empty and stale MPTFO state behind.

307) Missing initialization of resource (CVE-ID: CVE-2026-80586)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, corrupt data, or cause a denial of service.

The vulnerability exists due to improper state reset in MPTCP DSS option parsing in net/mptcp/options.c when processing malformed DSS options with an unexpected size. A remote attacker can send crafted MPTCP packets to disclose sensitive information, corrupt data, or cause a denial of service.

The issue can occur when a malformed DSS option is followed by another DSS option or MPC plus data, causing inconsistent state or access to uninitialized data.

308) Use-after-free (CVE-ID: CVE-2026-80589)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in disk_release in the block layer when handling a probe failure for a disk that issued I/O before add_disk(). A remote attacker can trigger a failed disk initialization sequence that leaves a queue timeout timer pending to execute arbitrary code.

The issue can occur when a disk probe fails before the disk is added, including cases involving NVMe namespace initialization.

309) Out-of-bounds read (CVE-ID: CVE-2026-80603)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect connection tracking state.

The vulnerability exists due to an out-of-bounds read in the parse_dcc() function in nf_conntrack_irc when parsing DCC command data without a newline present. A remote attacker can send specially crafted IRC DCC command data to cause incorrect connection tracking state.

The stray read may consume an uninitialized or stale byte, which can lead to an incorrect DCC IP address or port being recorded in the conntrack expectation.

310) Use-after-free (CVE-ID: CVE-2026-80613)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a use-after-free in the veth XDP enablement error-handling logic when rolling back queue initialization after failed XDP rxq registration. A local user can trigger XDP enablement failure to cause a use-after-free.

The issue occurs because a previously added NAPI structure is left dangling in the device NAPI list and may later corrupt reallocated memory during device teardown.

311) Out-of-bounds write (CVE-ID: CVE-2026-80629)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the octeontx2-af NPC MCAM entry-to-counter mapping logic when handling MCAM entry and counter mapping for reserved entries. A local user can trigger allocation and mapping of a reserved MCAM entry counter to cause a denial of service.

The issue is triggered by AF-reserved MCAM rules such as CPT second-pass entries.

312) Out-of-bounds read (CVE-ID: CVE-2026-80631)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in lzo_decompress_bio() in the Btrfs LZO decompression logic when processing a crafted compressed extent. A local attacker can supply a crafted compressed segment length that extends beyond the compressed input to cause a denial of service.

313) NULL pointer dereference (CVE-ID: CVE-2026-80646)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in __in6_dev_stats_get() when processing an skb for an l3 master device whose original physical device has been unregistered. A local user can trigger this condition to cause a denial of service.

314) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-80647)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of completion callbacks in the hns roce completion queue handling logic when processing direct mode completion queues during driver reset. A local user can trigger a driver reset with a direct mode cq present to cause a denial of service.

The issue is triggered specifically when a completion queue is allocated in direct polling mode and the device reset path invokes the completion handler unexpectedly.

315) Link following (CVE-ID: CVE-2026-80663)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite an attacker-chosen file.

The vulnerability exists due to improper link resolution in isst-daemon pidfile handling when opening a pidfile from a fixed path under /tmp. A local user can pre-create a symlink at that path to overwrite an attacker-chosen file.

The issue occurs when a daemon instance is run as root.

316) NULL pointer dereference (CVE-ID: CVE-2026-80664)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in xt_nat SNAT and DNAT target handlers when installing an unsupported-family compat rule through nft_compat. A local user can instantiate a bridge-family compat rule to cause a denial of service.

The issue is triggered in nf_nat_setup_info() because the handlers assume IP-family conntrack state is present.

317) Improper locking (CVE-ID: CVE-2026-80667)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in mlx5_mpesw_work() when handling a missing devcom component. A local user can trigger the affected work path to cause a denial of service.

The issue can cause a caller waiting on mpesww->comp to block indefinitely.

318) NULL pointer dereference (CVE-ID: CVE-2026-80679)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dasd_release_space() in drivers/s390/block/dasd_ioctl.c when handling a release space operation on a DASD device. A local user can trigger the vulnerable code path to cause a denial of service.

319) Use-after-free (CVE-ID: CVE-2026-80681)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in vxlan_xmit() in drivers/net/vxlan/vxlan_core.c when processing packets through route_shortcircuit(). A local user can trigger skb head reallocation and subsequent dereference of a stale ethernet header pointer to cause a denial of service.

320) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80686)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of non-present page table entries in migrate_vma_collect_pmd() when processing page migration entries. A local user can trigger page migration involving non-present PTEs to cause a denial of service.

The issue can also result in incorrect dirty folio accounting.

321) Out-of-bounds write (CVE-ID: CVE-2026-80693)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service or corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in idpf_get_reg_intr_vecs() when processing a VIRTCHNL2_OP_ALLOC_VECTORS reply. A remote user can return a crafted reply whose per-chunk num_vectors sum exceeds num_allocated_vectors to cause a denial of service or corrupt kernel memory.

Exploitation requires control of the control plane, such as a PF or hypervisor device model, that provides the vector allocation reply.

322) Use-after-free (CVE-ID: CVE-2026-80714)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ipvs connection handling logic when binding synced connections to a destination. A local user can trigger creation and expiry of a crafted synced connection state to cause a denial of service.

The issue occurs when a synced connection inherits the one-packet flag after it is already hashed, which can leave stale hash nodes pointing to a freed struct ip_vs_conn.

323) Improper locking (CVE-ID: CVE-2026-80715)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in igc_down() when tearing down an AF_XDP zero-copy application abruptly. A local user can abruptly terminate an AF_XDP zero-copy application to cause a denial of service.

The issue occurs because NAPI keeps polling and the network interface may never go down.

324) Use-after-free (CVE-ID: CVE-2026-80716)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in snd_pcm_drain() and snd_pcm_unlink() in the ALSA PCM subsystem when unlinking a drained or draining linked stream while a drain wait is pending. A local user can trigger stream unlinking to cause a denial of service.

The issue occurs when group membership changes during the wait and the wait ends by signal or timeout, leaving an on-stack wait entry queued on a sleep list.

325) Use-after-free (CVE-ID: CVE-2026-80721)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Bluetooth ISO socket handling in net/bluetooth/iso.c when deleting an ISO connection. A local user can trigger connection deletion while ISO sockets still access a dangling hcon reference to cause a denial of service.

The issue is related to races involving ISO connection teardown and stale hcon references.

326) Out-of-bounds read (CVE-ID: CVE-2026-80722)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in mac80211 TWT setup handling when processing a received S1G TWT setup frame. A remote attacker can send a specially crafted TWT setup frame with an individual agreement and a truncated parameters block to cause a denial of service.

Broadcast agreements are rejected locally after accessing only req_type.

327) Out-of-bounds write (CVE-ID: CVE-2026-80725)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in skb_gro_receive() and IPv6 GRO completion handling when processing crafted packets for BIG TCP aggregation beyond 64KB. A local user can inject specially crafted frames to cause memory corruption.

Exploitation requires access to inject crafted frames through AF_PACKET, and the issue is limited to older stable branches rather than mainline 7.0 and later.

328) Out-of-bounds write (CVE-ID: CVE-2026-80731)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in dev_validate_header when validating short link-layer headers after a network device's hard_header_len increases. A local privileged user can trigger zero-padding of a short link-layer header to cause memory corruption.

The affected path is limited to variable-length layer-2 protocols where the header length is at least min_header_len but shorter than hard_header_len.

329) Use-after-free (CVE-ID: CVE-2026-80737)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in the AMBA PL011 serial driver's DMA shutdown handling when DMA activity is being terminated. A local user can trigger DMA shutdown while TX callbacks or RX polling remain active to cause memory corruption.

330) Deadlock (CVE-ID: CVE-2026-80739)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper lock management in mlx5e_tc_del_flow() when deleting a peer TC flow after lower-level FDB flow creation fails. A local privileged user can configure a traffic-control flower filter that creates a peer flow to cause a denial of service.

331) Out-of-bounds read (CVE-ID: CVE-2026-80747)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to improper bounds checking in the AMD KFD CRAT parser when parsing a malformed CRAT table with an oversized subtype length field. A local user can supply a malformed CRAT table with an oversized subtype length field to read memory out of bounds.

332) NULL pointer dereference (CVE-ID: CVE-2026-80756)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in selinux_policy_cancel() when writing a policy during an initial SELinux policy load that fails while building the selinuxfs tree. A local user can write policy data to /sys/fs/selinux/load to cause a denial of service.

333) Out-of-bounds read (CVE-ID: CVE-2026-80779)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds read in the Ionic network driver RX queue initialization logic when initializing a dedicated hardware timestamp receive queue. A local user can trigger XDP_TX processing on the affected receive queue to cause memory corruption.

The dedicated hardware timestamp receive queue does not have a corresponding normal transmit queue partner.

334) Use-after-free (CVE-ID: CVE-2026-80785)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to store a stale pointer to freed memory in fb_info->mode.

The vulnerability exists due to a use-after-free race condition in the fbdev mode sysfs handlers in drivers/video/fbdev/core/fbsysfs.c when concurrently accessing mode sysfs attributes while the modelist is replaced. A local user can race mode sysfs reads or writes with modelist replacement to store a stale pointer to freed memory in fb_info->mode.

335) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-80789)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in nvmet_tcp_map_data() when processing write commands containing non-inline transport SGL data-block descriptors. A remote attacker can submit a crafted NVMe/TCP command with an oversized SGL length to cause a denial of service.

For write commands, the target waits for host data after issuing an R2T response.

336) Infinite loop (CVE-ID: CVE-2026-80793)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of the effective MTU in ip_do_fragment() when fragmenting IPv4 packets with an effective MTU smaller than the IPv4 header length plus 8 bytes. A remote attacker can send a packet requiring fragmentation over an affected route or device to cause a denial of service.

The issue can occur while forwarding packets to a device with an MTU of 20 bytes.

337) Out-of-bounds read (CVE-ID: CVE-2026-80799)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory or cause a denial of service.

The vulnerability exists due to improper bounds checking and integer wraparound in the nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() functions when processing remote LLCP general bytes. A remote attacker can send malformed TLV data to trigger out-of-bounds reads or infinite parsing loops.

338) Out-of-bounds read (CVE-ID: CVE-2026-80805)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in xfs_attr3_leaf_verify_entry() when validating crafted XFS attribute entries. A local user can provide a crafted name index to read out-of-bounds memory.

339) Out-of-bounds read (CVE-ID: CVE-2026-80836)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in virtio_crypto_dataq_akcipher_callback() when handling a device-reported akcipher response length. A local user can cause a virtio crypto backend to report an oversized result length to disclose sensitive information.

340) Out-of-bounds write (CVE-ID: CVE-2026-80840)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds write.

The vulnerability exists due to improper initialization of the IPv4 control block in the IPv6 Segment Routing decapsulation path when processing a specially crafted IPv6 packet containing an encapsulated IPv4 TCP SYN packet. A remote attacker can send a specially crafted packet with controlled IPv6 extension-header and IPv4 option data to cause an out-of-bounds write.

341) Use-after-free (CVE-ID: CVE-2026-80841)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in AF_PACKET TX_RING handling when closing a socket or replacing a transmit ring while transmit skbs remain pending. A local user can close a socket or replace a transmit ring while transmit skbs remain pending to cause a denial of service.

The issue is limited to vmalloc-backed transmit-ring blocks.

342) Use-after-free (CVE-ID: CVE-2026-80842)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the Linux bridge multicast handling for master VLANs when processing IGMP traffic during master VLAN teardown. A remote attacker can send IGMP traffic to the bridge device while a master VLAN is being removed to cause memory corruption.

343) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-80844)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of routing header segments_left values in ipv6_rearrange_rthdr() when processing raw IPv6 HDRINCL packets with a segments_left value larger than the number of addresses described by hdrlen. A local user can send a crafted packet with an oversized segments_left value to cause an out-of-bounds memory access.

344) NULL pointer dereference (CVE-ID: CVE-2026-80846)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the handle_esp function when processing queued ESP-in-TCP data after its ingress device has been removed. A remote attacker can send ESP-in-TCP records to cause a denial of service.

The condition can occur during veth or network namespace teardown.

345) Division by zero (CVE-ID: CVE-2026-80847)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a divide-by-zero error in tcp_select_initial_window() when processing route-derived advertised MSS values. A local user can configure a route with a too-small RTAX_ADVMSS value to cause a denial of service.

The default advertised MSS path is also affected when the effective advertised MSS is reduced by the route MTU and min_adv_mss.

346) Use-after-free (CVE-ID: CVE-2026-80848)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the espintcp_close routine when closing espintcp sockets while queued reinjection work is running. A local user can race socket closure against queued reinjection work to trigger a use-after-free condition.

347) Out-of-bounds write (CVE-ID: CVE-2026-80852)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in tls_append_frag() in the TLS device offload implementation when repeatedly splicing small amounts of data into a TLS_TX_ZEROCOPY_RO socket using SPLICE_F_MORE and MSG_MORE. A local user can cause the fragment count to exceed the maximum array bound to cause a denial of service.

The vulnerable path requires TLS device offload support.

348) Out-of-bounds write (CVE-ID: CVE-2026-80863)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in free_rd_atomic_resources() in the RXE RDMA driver when modifying a queue pair's max_dest_rd_atomic setting. A local user can modify a queue pair's max_dest_rd_atomic setting to cause a denial of service.

349) Use-after-free (CVE-ID: CVE-2026-80864)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the RDMA/rxe responder resource handling when modifying IB_QP_MAX_DEST_RD_ATOMIC while the responder task is active. A local user can race the freeing and reallocation of rd_atomic resources to cause a denial of service.

350) Improper input validation (CVE-ID: CVE-2026-80865)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an invalid user-space pointer to be accessed.

The vulnerability exists due to improper input validation in the copy_user_syms function when processing a user-space pointer array. A local user can provide a user-space pointer array without prior range validation to cause an invalid user-space pointer to be accessed.

351) Race condition (CVE-ID: CVE-2026-80880)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a race condition.

The vulnerability exists due to a race condition in implicit ODP memory region re-registration when reregistering an implicit ODP memory region without specifying a translation. A local user can reregister an implicit ODP memory region to trigger a race condition.

The race involves implicit child mkeys accessing the memory region's protection domain.

352) Integer overflow (CVE-ID: CVE-2026-80909)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an integer overflow during minimum DPB size calculation.

The vulnerability exists due to improper validation of the H.265 reference count in the AMDGPU UVD message decoder when decoding UVD messages. A local user can submit a UVD message with an invalid number of H.265 references to cause an integer overflow during minimum DPB size calculation.

353) Use-after-free (CVE-ID: CVE-2026-80932)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to improper workqueue synchronization in virtio_vsock_remove() when removing a virtio vsock device. A local user can trigger device removal while dependent work items are queued to cause a use-after-free condition.

The race involves tx_work, send_pkt_work, and rx_work.

354) Use-after-free (CVE-ID: CVE-2026-80947)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the rtl8xxxu RX URB workqueue teardown when a device is disconnected during active receive traffic. An attacker with physical access can disconnect the device during active receive traffic to trigger a use-after-free.

355) Out-of-bounds read (CVE-ID: CVE-2026-80976)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to stale IPv6 control block state in the decap_and_validate() function of the seg6 local processing component when processing a decapsulated IPv6 packet through an End.DX6 or End.DT6 route. A local user can install a local SID and inject a crafted outer IPv6 packet to cause an out-of-bounds read.

The outer packet contains Hop-by-Hop and Destination Options headers followed by an SRH and a minimal inner IPv6 packet.

356) Use-after-free (CVE-ID: CVE-2026-80979)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the SMC connection teardown handling for DMB-nocopy buffers when a receive tasklet is re-armed after a connection is freed. A remote attacker can cause the receive tasklet to access a freed send buffer to cause a denial of service.

Only SMCD links supporting DMB-nocopy are affected.

357) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-80983)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in smc_switch_conns() when handling connection switches during SMC link failover. A local user can initiate a connection switch during link failover to cause a denial of service.

The target link must go down or the connection must be killed while the switch is in progress.

358) NULL pointer dereference (CVE-ID: CVE-2026-80984)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the SMC-D teardown path when an SMC-D link group terminates while a socket is waiting during teardown. A local user can trigger the teardown race to cause a denial of service.

359) Integer underflow (CVE-ID: CVE-2026-81000)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write packet data outside allocated memory.

The vulnerability exists due to an integer underflow in TUN and TAP interface handling in tun_get_user() when processing an oversized headroom request propagated by an OVS port. A local user can configure an OVS port to propagate an oversized headroom request to a TUN or TAP device to write packet data outside allocated memory.

360) Use-after-free (CVE-ID: CVE-2026-81001)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sl_sync() in the SLIP driver when opening a SLIP line discipline concurrently with SLIP device teardown. A local user can trigger a race between SLIP device opening and teardown to cause a denial of service.

361) Configuration (CVE-ID: CVE-2026-89448)

CWE-ID: CWE-16 - Configuration

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause access control services to remain disabled while the IOMMU is forced on.

The vulnerability exists due to improper configuration handling in detect_intel_iommu() when tboot forces the IOMMU on after ACS was not requested. A local privileged user can configure the system to disable ACS to cause access control services to remain disabled while the IOMMU is forced on.

362) Race condition (CVE-ID: CVE-2026-89451)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in iommu SVA handle initialization when concurrently binding and unbinding an SVA device. A local user can race SVA device binding and unbinding operations to cause a denial of service.

363) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89453)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to failure to release a PCI device reference in iommu_call_iopf_notifier() when handling PPR faults. A local user can trigger PPR fault handling to cause a denial of service.

364) NULL pointer dereference (CVE-ID: CVE-2026-89477)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in SCTP stream reconfiguration request handling when processing specially crafted SCTP RECONF chunks. A remote attacker can send a specially crafted SCTP RECONF packet to cause a denial of service.

A RECONF chunk containing incoming SSN reset, outgoing SSN reset, and response parameters, or two RECONF chunks in one packet, can trigger the issue.

365) Use-after-free (CVE-ID: CVE-2026-89479)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access freed memory.

The vulnerability exists due to use-after-free in the SCTP endpoint receive loop when processing a specially crafted SCTP packet containing bundled chunks. A remote attacker can send an SCTP packet that deletes an association before subsequent chunks are processed to access freed memory.

Exploitation requires the packet to be processed from the socket backlog in task context.

366) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-89480)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper validation of the received data length in the NVMe/TCP host driver when processing a short C2HData PDU from an NVMe/TCP controller. A remote attacker can respond to a read request with fewer bytes than requested to disclose sensitive information.

367) Improper input validation (CVE-ID: CVE-2026-89481)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in nvme_tcp_handle_r2t() when processing an R2T request for a read command. A remote attacker can send an R2T request for a read command to disclose sensitive information.

The disclosed read destination buffer may contain stale kernel data.

368) Out-of-bounds write (CVE-ID: CVE-2026-89482)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of C2HData requests in the NVMe/TCP receive path when handling C2HData for a WRITE_ZEROES command with a residual iterator on the same tag. A remote attacker can send a C2HData request to trigger a wild memory write and cause a denial of service.

369) Use-after-free (CVE-ID: CVE-2026-89485)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the lockd nlm_traverse_files() file traversal routine when a concurrent nlm_release_file() frees the saved next file while nlm_file_mutex is dropped. A local user can trigger concurrent file release during file traversal to trigger a use-after-free condition.

370) Race condition (CVE-ID: CVE-2026-89508)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in ucma_set_ib_path() when concurrently handling SET_OPTION requests and context migration. A local user can trigger a race condition to cause a denial of service.

A bound and address-resolved cm_id and an RDMA device are required.

371) Use-after-free (CVE-ID: CVE-2026-89510)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a use-after-free condition.

The vulnerability exists due to a race condition in the RDMA/cxgb4 device removal and registration work handling when removing an RDMA device while registration work is pending or running. A local privileged user can remove the device while the registration work accesses the device object to cause a use-after-free condition.

372) NULL pointer dereference (CVE-ID: CVE-2026-89511)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the qede driver's TPA fragment processing when handling TPA continuation fragments under memory pressure. A remote attacker can send network traffic that is processed as TPA continuation fragments during memory pressure to cause a denial of service.

373) Out-of-bounds read (CVE-ID: CVE-2026-89525)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in udf_get_pblock_virt15() when processing a crafted UDF image. A local user can mount a crafted UDF image to cause a denial of service.

The issue affects UDF 1.50 virtual partition mappings that use a VAT.

374) Memory leak (CVE-ID: CVE-2026-89531)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the svcrdma handle_connect_req() connection handler when transport allocation fails while processing connection requests. A remote attacker can send repeated connection attempts during memory pressure to cause a denial of service.

375) Out-of-bounds read (CVE-ID: CVE-2026-89532)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow resulting in an out-of-bounds read in the pcl_for_each_segment macro when processing a Write or Reply chunk with zero segments. A remote attacker can send a crafted Write or Reply chunk advertising zero segments to cause a denial of service.

The transport must have negotiated Send-With-Invalidate.

376) Integer underflow (CVE-ID: CVE-2026-89533)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer underflow in svc_rdma_read_chunk_range() when processing a Read chunk segment list with crafted offsets and lengths. A remote attacker can submit a crafted Read chunk to cause a denial of service.

377) Use-after-free (CVE-ID: CVE-2026-89536)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a use-after-free in SUNRPC client TLS handshake handling when cancellation loses a race with completion of a TLS handshake callback. A local user can interrupt or time out a synchronous TLS handshake wait while the completion callback is in flight to cause a use-after-free condition.

378) Improper input validation (CVE-ID: CVE-2026-89538)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in gss_krb5_unwrap_v2() when processing Kerberos v2 wrap tokens with oversized extra count fields. A remote user can send a malformed Kerberos v2 wrap token to cause a denial of service.

The token must be encrypted using a valid GSS context.

379) Memory leak (CVE-ID: CVE-2026-89539)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in gssx_dec_option_array() when processing a reply containing duplicate CREDS_VALUE options. A remote attacker can send a crafted reply containing duplicate CREDS_VALUE options to cause a denial of service.

380) Race condition (CVE-ID: CVE-2026-89540)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to an initialization race condition in the use-gss-proxy proc entry initialization when writing to the newly published proc entry before gssp_lock is initialized. A local user can win the initialization race and write to the proc entry to cause a resource leak.

The race window can widen when the auth_rpcgss module is loaded for live network namespaces.

381) Out-of-bounds read (CVE-ID: CVE-2026-89541)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to improper length validation in gss_unwrap_resp_priv() when processing a crafted RPCSEC_GSS reply. A remote attacker can return a crafted RPCSEC_GSS reply from a krb5p NFS server to read out-of-bounds memory.

382) Out-of-bounds read (CVE-ID: CVE-2026-89542)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper length validation in gss_krb5_unwrap_v2() and its rotation helpers when processing a short or malformed GSS token. A remote user can provide a token shorter than the required header or with a declared length exceeding the buffer bounds to cause a denial of service.

The flawed length arithmetic can result in an out-of-bounds read, an unsigned underflow during cleanup, or a divide-by-zero during buffer rotation.

383) NULL pointer dereference (CVE-ID: CVE-2026-89544)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the SUNRPC gssx XDR option-array decoder when handling an allocation failure while decoding an option array. A local user can trigger the decoder's error path to cause a denial of service.

The affected error paths also include a group_info reference-count leak and a latent use-after-free condition.

384) Unchecked Return Value (CVE-ID: CVE-2026-89547)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory.

The vulnerability exists due to unchecked return values in the SUNRPC RPC service pool counter initialization in __svc_create() when starting an RPC service while per-CPU counter allocation fails. A local privileged user can start an RPC service under allocation failure conditions to corrupt kernel memory.

Exploitation requires memory pressure or fault injection during RPC server startup; a remote peer cannot induce the failed allocation state on its own.

385) Use-after-free (CVE-ID: CVE-2026-89548)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper synchronization in the SUNRPC cache cleanup routine when tearing down a network namespace. A local user can cause cache_clean() to access a freed cache_detail to trigger a use-after-free condition.

386) Division by zero (CVE-ID: CVE-2026-89550)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in svcauth_gss_unwrap_priv() when handling a crafted short krb5 token. A remote user can send a crafted token that triggers a division by zero to cause a denial of service.

The issue affects krb5 v2 contexts.

387) Integer underflow (CVE-ID: CVE-2026-89551)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause downstream XDR decoders to use an incorrect stream bound.

The vulnerability exists due to an integer underflow in xdr_buf_trim() when processing GSS Kerberos v2 data whose recorded buffer length is smaller than the associated I/O vector lengths. A remote attacker can cause xdr_buf_trim() to consume more bytes than buf->len records to cause downstream XDR decoders to use an incorrect stream bound.

388) Use-after-free (CVE-ID: CVE-2026-89564)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to improper socket reference management in IPv4 and IPv6 multicast forwarding paths when processing non-locally deliverable multicast packets. A remote attacker can send a non-locally deliverable multicast packet to trigger a use-after-free.

Exploitation requires the associated prefetched socket to be destroyed before the socket buffer is freed.

389) Use-after-free (CVE-ID: CVE-2026-89569)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access freed RFCOMM session and data link connection objects.

The vulnerability exists due to use-after-free in the RFCOMM security confirmation handler rfcomm_security_cfm() when processing Bluetooth security confirmations concurrently with RFCOMM session teardown. A remote attacker can trigger the concurrent processing to access freed RFCOMM session and data link connection objects.

390) Out-of-bounds write (CVE-ID: CVE-2026-89580)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write out of bounds.

The vulnerability exists due to a race condition in __bpf_get_stack when a preemptible BPF program accesses a reused per-CPU callchain buffer. A local user can execute a preemptible BPF program to write out of bounds.

The issue can affect non-sleepable raw tracepoint programs on PREEMPT kernels.

391) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-89603)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute system calls prohibited by a seccomp filter.

The vulnerability exists due to a race condition in syscall_trace_enter() when a thread is stopped for ptrace while another thread installs a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC. A local user can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC while another thread is stopped for ptrace to execute system calls prohibited by the filter.

The system call number may be modified during ptrace handling.

392) Improper locking (CVE-ID: CVE-2026-89609)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a race condition.

The vulnerability exists due to improper locking in ecryptfs_exorcise_daemon() when cleaning queued messages from a dying daemon. A local user can move queued message contexts to the free list without holding the required global list lock to trigger a race condition.

393) Out-of-bounds read (CVE-ID: CVE-2026-89631)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the CIFSTCon() SMB client tree connect response parser when processing a tree connect response with a byte count smaller than two. A remote attacker can send a malformed tree connect response to disclose sensitive information.

Disclosed bytes are exposed through /proc/fs/cifs/DebugData.

394) Use-after-free (CVE-ID: CVE-2026-89636)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in the SMB client DFS cache's free_tgts() function when using ce->tgthint after its target entries have been freed. A local user can trigger use of the stale target cache hint to cause a use-after-free.

395) Improper Preservation of Permissions (CVE-ID: CVE-2026-89638)

CWE-ID: CWE-281 - Improper preservation of permissions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper preservation of permissions in the cifs_setattr_unix() and cifs_setattr_nounix() routines when processing writes to files with setuid or setgid bits set. A local user can write to such a file and retain its setuid or setgid bits on the server to escalate privileges.

The issue occurs when the mount stores modes on the server through cifsacl or modefromsid, SMB3.1.1 POSIX extensions, or SMB1 Unix extensions.

396) Memory leak (CVE-ID: CVE-2026-89644)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to missing release of memory after effective lifetime in btrfs_get_blocks_direct_write() when performing a direct I/O write to a NOCOW range and ordered extent allocation fails. A local user can issue a direct I/O write to a NOCOW range to cause a resource leak.

397) Use-after-free (CVE-ID: CVE-2026-89662)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the NFSD __destroy_client() function when processing DESTROY_CLIENTID requests. A remote attacker can trigger client teardown while blocked locks are reaped to cause a denial of service.

The race can result in a NULL dereference in remove_blocked_locks().

398) Use-after-free (CVE-ID: CVE-2026-89663)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the NFS server copy-notify stateid revocation logic when revoking copy-notify stateids while concurrent holders retain references. A remote attacker can trigger concurrent copy-notify stateid revocation to cause a denial of service.

The issue involves parent-stateid draining, OFFLOAD_CANCEL handling, and laundromat expiry.

399) Integer overflow (CVE-ID: CVE-2026-89665)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause improper filesystem timestamp handling.

The vulnerability exists due to an integer overflow in the NFSv2 sattr decoder in svcxdr_decode_sattr() when decoding NFSv2 SETATTR or CREATE time attributes. A remote attacker can send a crafted NFSv2 request containing an out-of-range useconds value to cause improper filesystem timestamp handling.

The overflow affects 32-bit ILP32 platforms.

400) Improper input validation (CVE-ID: CVE-2026-89671)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to remove POSIX ACLs.

The vulnerability exists due to improper input validation in nfsd3_proc_setacl() when processing NFSv3 SETACL requests with omitted ACL mask bits. A remote attacker can send a SETACL request with omitted ACL mask bits to remove POSIX ACLs.

401) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89672)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to remove POSIX ACLs.

The vulnerability exists due to improper handling of omitted ACL fields in the NFSACL v2 SETACL handler when processing SETACL requests with omitted ACL mask bits. A remote attacker can send a SETACL request with omitted ACL mask bits to remove POSIX ACLs.

A request containing only the NFS_ACL mask bit removes the directory's default ACL, while a request with a zero mask removes both ACL types.

402) Improper Handling of Length Parameter Inconsistency (CVE-ID: CVE-2026-89673)

CWE-ID: CWE-130 - Improper Handling of Length Parameter Inconsistency

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose stale reply-page content.

The vulnerability exists due to an incorrect XDR padding calculation in nfsd4_ff_encode_getdeviceinfo() when encoding flexfile GETDEVICEINFO replies. A remote attacker can send a GETDEVICEINFO request to disclose stale reply-page content.

The incorrect declared address-body length can also mis-align decoding of the subsequent version list.

403) Out-of-bounds write (CVE-ID: CVE-2026-89674)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.

The vulnerability exists due to an incorrect XDR buffer size calculation in nfsd4_ff_encode_layoutget() when encoding layoutget responses with short user or group strings and an odd-sized file handle. A remote attacker can request a layoutget operation to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.

404) Memory leak (CVE-ID: CVE-2026-89680)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in nfsd4_copy() when handling failed inter-server COPY operations. A remote attacker can trigger an inter-server COPY setup failure to cause a denial of service.

405) Race condition (CVE-ID: CVE-2026-89684)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in the NFS server copy-notification state handling when processing concurrent NFSv4.2 OFFLOAD_CANCEL requests. A remote attacker can send racing OFFLOAD_CANCEL requests to cause a denial of service.

406) Race condition (CVE-ID: CVE-2026-89686)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in nfsd4_alloc_layout_stateid when concurrently revoking a delegation and processing a LAYOUTGET request. A remote attacker can send concurrent NFS requests that trigger delegation recall and layout-state allocation to cause a denial of service.

Exploitation requires one NFS client to hold a delegation and fail to respond to its recall while another client opens the same file.

407) Missing Authorization (CVE-ID: CVE-2026-89694)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in the NFS server copy-notify state management function when processing OFFLOAD_CANCEL requests. A remote user can send an OFFLOAD_CANCEL request for another client's copy-notify stateid to cause a denial of service.

Copy-notify stateid object identifiers are allocated cyclically and are guessable.

408) NULL pointer dereference (CVE-ID: CVE-2026-89696)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the NFS server compound request dispatch loop when processing a crafted NFSv4 COMPOUND request involving an inter-SSC COPY operation. A remote attacker can send a crafted NFSv4 COMPOUND request with an operation between a foreign PUTFH and SAVEFH to cause a denial of service.

Only systems with CONFIG_NFSD_V4_2_INTER_SSC enabled are affected.

409) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89697)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a SETATTR operation without a mount write reference.

The vulnerability exists due to missing mount write reference acquisition in nfsd_proc_setattr() when processing a SETATTR request in the BOTH_TIME_SET branch. A remote attacker can submit a SETATTR request with both time attributes set to perform a SETATTR operation without a mount write reference.

410) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-89699)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in nfsd4_decode_create() when processing NFSv4 CREATE requests for symbolic links. A remote attacker can send crafted requests containing an oversized symbolic-link target length to cause a denial of service.

The allocation can persist until COMPOUND operation teardown.

411) Out-of-bounds write (CVE-ID: CVE-2026-89702)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write beyond a reserved trace ring-buffer slot or disclose prior ring-buffer contents.

The vulnerability exists due to an out-of-bounds write in the nfsd_fh_verify and nfsd_fh_verify_err tracepoints when processing NFSv2/v3-over-UDP requests. A remote attacker can send an NFS/UDP request to write a server socket address into a zero-byte trace ring-buffer slot.

When the local server address is shorter than the remote address, unwritten bytes in the oversized slot can be exposed to trace consumers.

412) Race condition (CVE-ID: CVE-2026-89704)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause silent data loss.

The vulnerability exists due to a race condition in _nfsd_copy_file_range() when processing asynchronous NFS COPY operations. A remote user can issue concurrent COPY and COMMIT or stable WRITE operations to cause silent data loss.

413) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89707)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper resource release in nfsd_cross_mnt() when handling NFS requests that result in follow_down() errors. A remote user can send NFS requests that trigger failed cross-mount operations to cause a denial of service.

The issue is reachable through nfsd_lookup_dentry or NFSv4 READDIR encoding.

414) Memory leak (CVE-ID: CVE-2026-89710)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a memory leak.

The vulnerability exists due to improper resource cleanup in pnfs_layout_process() in the NFSv4.1 pNFS implementation when processing a new layout stateid returned while a valid stateid is still held. A remote attacker can operate an NFSv4.1 server that returns a new layout stateid to cause a memory leak.

415) Use-after-free (CVE-ID: CVE-2026-89712)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in nfsd4_ssc_expire_umount() when processing concurrent NFS server operations while an expired inter-server source mount is being unmounted. A remote attacker can trigger concurrent operations that cause the expiration walk to dereference a freed nfsd4_ssc_umount_item to cause a denial of service.

416) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-89713)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to truncate append-only files.

The vulnerability exists due to a time-of-check to time-of-use race condition in nfsd_setattr() when handling SETATTR size updates for append-only files. A remote user can issue a SETATTR request that races with a concurrent append to truncate append-only files.

417) NULL pointer dereference (CVE-ID: CVE-2026-89780)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rmnet_map_deaggregate() when processing an aggregated frame containing a flow-control command. A local user can write a crafted aggregated frame to a tap device file descriptor to cause a denial of service.

Exploitation requires an rmnet link over a tap device with ingress deaggregation and ingress MAP commands enabled.

418) NULL pointer dereference (CVE-ID: CVE-2026-89784)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rpcb_register_inet4() and rpcb_register_inet6() when an in-kernel RPC service registers with the local rpcbind after an address-string allocation fails. A local user can cause an in-kernel RPC service to register with the local rpcbind to cause a denial of service.

Exploitation requires sufficient memory pressure for a small GFP_KERNEL allocation to fail.

419) Use-after-free (CVE-ID: CVE-2026-89789)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose and modify sensitive information and cause a denial of service.

The vulnerability exists due to use-after-free in the gtp_newlink() error path in drivers/net/gtp.c when handling gtp_newlink() error paths concurrently with gtp encapsulation receive operations. A local user can trigger the race condition to disclose and modify sensitive information and cause a denial of service.

420) Use-after-free (CVE-ID: CVE-2026-89899)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free race condition in cec_transmit_msg_fh in the CEC subsystem when a blocking transmit wait is interrupted by a signal. A local user can interrupt a blocking transmit wait with a signal to compromise confidentiality, integrity, and availability.

421) NULL pointer dereference (CVE-ID: CVE-2026-89912)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in vgic_its_save_ite() in the KVM arm64 vgic-its component when saving ITS tables during virtual machine migration after processing MAPD, MAPTI, and MAPC with V=0 commands. A remote attacker can issue MAPD, MAPTI, and MAPC commands with V=0 in a guest to cause a denial of service.

The command sequence is architecturally unpredictable.

422) Use-after-free (CVE-ID: CVE-2026-89913)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in vgic_v3_save_pending_tables() when saving pending tables while LPI references are concurrently released. A local user can trigger concurrent LPI reference handling to compromise confidentiality, integrity, and availability.

423) Race condition (CVE-ID: CVE-2026-89929)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper synchronization of TLB invalidation in KVM nested virtualization INVVPID emulation when a virtual machine is migrated between physical CPUs. A local user can cause L1 to migrate between physical CPUs while emulating INVVPID to compromise confidentiality, integrity, and availability.

424) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89930)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause stale TLB translations to be used.

The vulnerability exists due to failure to service queued local TLB flush requests in KVM nVMX nested VM-entry handling when a nested VM entry fails after switching to the L2 context. A remote attacker can change L2's VPID and trigger a failed nested VM entry to cause stale TLB translations to be used.

425) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89931)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause vmcs12 pages to be double-mapped.

The vulnerability exists due to improper state management in KVM nVMX nested VM-Exit handling when emulating a nested VM-Exit. A local user can trigger a nested VM-Exit without the pending request being cleared to cause vmcs12 pages to be double-mapped.

The condition can occur if KVM exits VM-Enter without processing the request before emulating VMLAUNCH or VMRESUME.

426) Improper Enforcement of Behavioral Workflow (CVE-ID: CVE-2026-89968)

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of protocol state in nvmet_tcp_handle_h2c_data_pdu() when processing an unsolicited H2CData PDU before transmitting a requested data transfer (R2T). A remote attacker can send an H2CData PDU for a write command before the R2T is transmitted to cause a denial of service.

The affected subsystem must be configured with allow_any_host.

427) Use-after-free (CVE-ID: CVE-2026-89970)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper synchronization of delayed work in the NVMe target authentication submission queue teardown logic when an authentication timeout callback runs during submission queue teardown. A remote attacker can cause the authentication timeout work to race with submission queue teardown to compromise confidentiality, integrity, and availability.

428) Improper access control (CVE-ID: CVE-2026-89984)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel addresses.

The vulnerability exists due to improper privilege-level validation in the intel_pmu_lbr_filter() LBR stack filtering function when filtering sampled LBR entries for user-only branch stacks. A local user can request a user-only branch stack through perf to disclose kernel addresses.

The issue affects systems where architectural LBR lacks CPL filtering support.

429) Use-after-free (CVE-ID: CVE-2026-90003)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code, disclose sensitive information, or cause a denial of service.

The vulnerability exists due to a use-after-free in the futex requeue priority-inheritance handling when racing an early waiter wakeup with a priority-inheritance futex requeue. A local user can trigger FUTEX_CMP_REQUEUE_PI operations to access a waiter's stack-allocated futex queue after the waiter returns from the system call.

Exploitation is limited to systems using PREEMPT_RT.

430) Incorrect calculation (CVE-ID: CVE-2026-90047)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt VRAM allocations and cause a denial of service.

The vulnerability exists due to improper rounding of the flat CCS storage offset in get_flat_ccs_offset() in the drm/xe VRAM management code when allocating VRAM. A local user can trigger allocation of VRAM that includes compression hardware storage to corrupt VRAM allocations and cause a denial of service.

431) Memory leak (CVE-ID: CVE-2026-90065)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in IPPROTO_SMC socket initialization when socket creation fails after initialization. A local user can repeatedly create failing IPPROTO_SMC sockets to cause a denial of service.

Exploitation requires the ability to attach a deny-all BPF_CGROUP_INET_SOCK_CREATE program to the user's own cgroup.

432) Integer overflow (CVE-ID: CVE-2026-90074)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to signed integer overflow in the fq_pie queuing discipline when initializing the default quantum from a device MTU. A local privileged user can configure a device with a huge MTU to cause a denial of service.

Exploitation requires CAP_NET_ADMIN in a user namespace and a device whose MTU plus hard header length causes psched_mtu() to wrap into the sign bit.

433) Improper input validation (CVE-ID: CVE-2026-90088)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in rfcomm_apply_pn() when processing remote parameter negotiation frames. A remote attacker can send a parameter negotiation frame with an MTU value of zero to cause a denial of service.

434) Improper resource shutdown or release (CVE-ID: CVE-2026-90097)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper cleanup of uninitialized resources in the VMBus module exit function when unloading the VMBus module on a non-nested root partition. A local privileged user can unload the VMBus module to cause a denial of service.

435) Access of Uninitialized Pointer (CVE-ID: CVE-2026-90104)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uninitialized pointer in the NFSv4.1 callback sequence argument decoder when handling NFSv4.1 callback sequence arguments containing an empty referring call list. A remote attacker can send a crafted NFSv4.1 callback request to cause a denial of service.

436) NULL pointer dereference (CVE-ID: CVE-2026-90149)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the NFSv4 flexfiles data server session and error-handling paths when processing I/O for NFSv4.0 data servers. A remote user can perform I/O operations against an NFSv4.0 flexfiles data server to cause a denial of service.

NFSv4.0 data server clients do not maintain sessions.

437) Use-after-free (CVE-ID: CVE-2026-90151)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the NFSv4 callback identifier IDR when an NFSv4.0 callback lookup occurs after a client allocation failure. A remote attacker can trigger an NFSv4.0 callback lookup using the stale callback identifier to trigger a use-after-free.

Exploitation requires an NFSv4.0 client allocation to fail after a callback identifier has been allocated.

438) Incomplete cleanup (CVE-ID: CVE-2026-90182)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incomplete cleanup of delay state in the blk-iocost policy-data free handler when freeing I/O cost policy data after a block cgroup enters a delay state. A local user can trigger policy-data cleanup after the delay state is set to cause a denial of service.

The stale congestion state applies to every task in the affected block cgroup and its descendants.

439) Incomplete cleanup (CVE-ID: CVE-2026-90183)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cleanup of delay state in the blk-iolatency io.latency policy data when freeing policy data for a collaterally throttled cgroup. A local user can trigger freeing of the affected policy data to cause a denial of service.

440) Use-after-free (CVE-ID: CVE-2026-90198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in snd_card_do_free() when a managed sound card is unbound while an application retains an open file descriptor. A local user can close the open file descriptor while the managed sound card is being unbound to trigger a use-after-free.

441) Memory corruption (CVE-ID: CVE-2026-90203)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of a negative block offset in squashfs_copy_data() when reading a crafted file from a mounted crafted Squashfs filesystem. A local user can read a crafted file with a negative offset to cause an out-of-bounds memory access.

Mounting the crafted Squashfs filesystem requires CAP_SYS_ADMIN.

442) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-90218)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper handling of an error condition in the RDMA connection manager addr_handler() function when asynchronous address resolution fails to acquire an RDMA device. A local user can initiate asynchronous address resolution for which RDMA device acquisition fails to trigger a kernel warning.

443) NULL pointer dereference (CVE-ID: CVE-2026-90228)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in nvmet_execute_identify_ns_zns() when processing a host-supplied Identify command with CNS 05h and CSI 02h targeting a file-backed namespace. A remote attacker can send a crafted Identify command targeting a file-backed namespace to cause a denial of service.

The issue is reachable only when CONFIG_BLK_DEV_ZONED is enabled.

444) Use-after-free (CVE-ID: CVE-2026-90240)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the IOMMU to access freed memory.

The vulnerability exists due to improper context-cache invalidation in the Intel VT-d IOMMU context-cache invalidation logic when tearing down DMA aliases. A local user can trigger teardown of a device with DMA aliases to cause the IOMMU to access freed memory.

In scalable mode, a stale cached context entry can continue to reference a freed PASID directory.

445) Use-after-free (CVE-ID: CVE-2026-90241)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the IOMMU to access freed memory.

The vulnerability exists due to a use-after-free in Intel VT-d scalable-mode context handling when a device probe failure occurs partway through DMA alias processing. A local user can trigger a probe failure after context entries have been programmed to cause the IOMMU to access freed memory.

446) Race condition (CVE-ID: CVE-2026-90243)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause spurious faults or unpredictable behavior.

The vulnerability exists due to a race condition in copied_context_tear_down() in the Intel VT-d IOMMU driver when tearing down copied context entries. A local user can trigger teardown of a copied context entry while its Present bit remains set to cause spurious faults or unpredictable behavior.

On IOMMUs without coherent access to the context table, a zeroed entry may not be visible to hardware when invalidation is submitted.

447) Use-after-free (CVE-ID: CVE-2026-90255)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to use-after-free in Bluetooth hci_conn SCO setup handling when queued synchronous setup work accesses a connection after it is freed. A local user can trigger queued SCO setup work that accesses a freed connection to cause a use-after-free condition.

Queued context entries can be canceled before execution, including when the controller is unregistered.

448) Incorrect calculation (CVE-ID: CVE-2026-90259)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect freeing of reserved qgroup data.

The vulnerability exists due to an incorrect length calculation in qgroup_free_reserved_data() when freeing reserved qgroup data. A local user can trigger reserved-data range processing to cause incorrect freeing of reserved qgroup data.

449) Improper access control (CVE-ID: CVE-2026-90263)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify POSIX ACLs on a read-only Btrfs filesystem.

The vulnerability exists due to improper access control in the btrfs_set_acl POSIX ACL-setting path when setting a POSIX ACL on a Btrfs filesystem whose read-only property is enabled. A local user can set a POSIX ACL to modify POSIX ACLs on a read-only Btrfs filesystem.

450) Deadlock (CVE-ID: CVE-2026-90265)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock ordering in btrfs defragmentation when reserving delayed-allocation space while holding dirty and locked folios and an extent-range lock. A local user can perform filesystem operations that trigger btrfs defragmentation to cause a denial of service.

The deadlock was observed with autodefrag and flushoncommit enabled.

451) Use-after-free (CVE-ID: CVE-2026-90292)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to improper reference counting in the RDMA/siw siw_accept() function when handling a userspace-supplied queue pair that is already in the RTS state. A local user can supply such a queue pair to cause a use-after-free condition.

452) Race condition (CVE-ID: CVE-2026-90293)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in the iSER target login receive-buffer handling when processing a SCSI command before the final Login Response. A remote attacker can send a SCSI command before receiving the final Login Response to cause a denial of service.

453) Race condition (CVE-ID: CVE-2026-90294)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in iSER target login-response handling when an initiator submits a SCSI command immediately after receiving the final Login Response. A remote attacker can send a specially timed SCSI command to cause a denial of service.

454) Out-of-bounds read (CVE-ID: CVE-2026-90307)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the SRP response-processing handlers when processing truncated SRP requests. A remote attacker can send a crafted truncated SRP_CRED_REQ or SRP_AER_REQ to disclose sensitive information.

Exploitation requires an SRP target to advertise a small max_ti_iu_len value during login.

455) Use-after-free (CVE-ID: CVE-2026-90308)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in RDMA/erdma QP handling when AE QP fatal events or iWARP CM paths process QPs concurrently with QP destruction. A local user can cause a QP to be destroyed while AE or CM processing is in progress to cause a denial of service.

456) Use-after-free (CVE-ID: CVE-2026-90309)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the ERDMA completion queue handling when EQ handlers invoke completion or error callbacks after a completion queue has been destroyed. A local user can race completion queue destruction with EQ event processing to cause a denial of service.

457) Stack-based buffer overflow (CVE-ID: CVE-2026-90358)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite adjacent stack slots.

The vulnerability exists due to a stack-based buffer overflow in the x86 BPF trampoline register save area when handling a 128-bit scalar function argument. A local user can trigger a BPF trampoline with a 128-bit scalar argument to overwrite adjacent stack slots.

458) Unchecked Return Value (CVE-ID: CVE-2026-90388)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an IOMMU mapping to be attempted after an allocation failure.

The vulnerability exists due to improper check of an allocation return value in iommu_dma_alloc when executing the non-blocking, non-coherent allocation path. A local user can invoke the affected allocation path during an allocation failure to cause an IOMMU mapping to be attempted after an allocation failure.

The affected path requires CONFIG_DMA_DIRECT_REMAP and non-coherent allocation.

459) Out-of-bounds read (CVE-ID: CVE-2026-90413)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the iSER login PDU handling code when processing a login PDU whose declared data segment length exceeds the received payload length. A remote attacker can send a crafted login PDU with an oversized declared data segment length to read out-of-bounds memory.

The issue can be triggered before authentication.

460) Out-of-bounds read (CVE-ID: CVE-2026-90414)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause an out-of-bounds read and write heap contents beyond the receive descriptor to backing storage.

The vulnerability exists due to missing validation of the declared data segment length in isert_recv_done() when processing iSER/iSCSI PDUs. A remote user can send a PDU that declares a data segment larger than the received data to cause an out-of-bounds read and write heap contents beyond the receive descriptor to backing storage.

Exploitation requires the full feature phase and negotiated parameters that permit unsolicited or immediate data.

461) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90415)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the RDMA/cxgb4 write_tpt_entry() function when programming a TPT entry. A local user can trigger a failed TPT entry write to cause a denial of service.

462) Double free (CVE-ID: CVE-2026-90417)

CWE-ID: CWE-415 - Double Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a double free.

The vulnerability exists due to improper memory management in the RDMA/cxgb4 memory-registration error handling when processing DMA memory-region registration errors. A local user can trigger error handling to cause a double free.

463) Use-after-free (CVE-ID: CVE-2026-90426)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race condition in tegra241_cmdqv_remove() and tegra241_cmdqv_isr() when handling an error interrupt while VINTFs are being torn down. A local user can cause an error interrupt to be handled during VINTF teardown to cause a denial of service.

464) Use of Uninitialized Variable (CVE-ID: CVE-2026-90428)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to use of an uninitialized resource in the Tegra241 CMDQV error interrupt handler when handling a latched error interrupt after a kexec. A local privileged user can initiate a kexec while CMDQV is enabled with a latched error to cause a denial of service.

465) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90434)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust buffer-head resources.

The vulnerability exists due to failure to release a buffer-head reference in zisofs_fill_pages() when successfully reading compressed block pointer tables. A local user can cause zisofs_fill_pages() to read compressed block pointer tables to exhaust buffer-head resources.

466) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-92495)

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain unintended write access to DBR or toggle pages.

The vulnerability exists due to improper permission assignment in bnxt_re_mmap when changing a read-only DBR or toggle page mapping to writable with mprotect. A local user can retain VM_MAYWRITE on the mapping to gain unintended write access to DBR or toggle pages.

467) Race condition (CVE-ID: CVE-2026-92500)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or data loss.

The vulnerability exists due to a race condition in ext4 inline-data write handling when a concurrent page fault converts inline data to an extent between write preparation and completion. A local user can perform a buffered write that races with inline-data conversion to cause a denial of service or data loss.

468) Deadlock (CVE-ID: CVE-2026-92503)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an ABBA deadlock in ext4_xattr_inode_cache_find() when concurrently exercising extended-attribute workloads. A local user can issue concurrent extended-attribute operations to cause a denial of service.

The issue occurs when the ea_inode mount/format option is in use.

469) Use-after-free (CVE-ID: CVE-2026-92507)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially trigger a use-after-free.

The vulnerability exists due to use-after-free in ib_dealloc_pd_user() RDMA resource tracking when accessing a protection domain through the netlink path during its destruction. A local user can access a protection domain through the netlink path while it is being destroyed to potentially trigger a use-after-free.

470) Use-after-free (CVE-ID: CVE-2026-92508)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in the RDMA/core ib_free_cq() completion queue destruction function when accessing a completion queue through the netlink path while it is being destroyed. A local user can access a completion queue through netlink during its destruction to trigger a use-after-free condition.

471) Use-after-free (CVE-ID: CVE-2026-92509)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in counter_release() in the RDMA core counter handling when processing netlink access to a counter during its destruction. A local user can access a counter through the netlink path while it is being released to trigger a use-after-free condition.

472) Use-after-free (CVE-ID: CVE-2026-92510)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the SRQ resource-tracking lifecycle in ib_destroy_srq_user() when accessing a shared receive queue through the netlink path during destruction. A local user can access a shared receive queue that remains accessible through restrack while its vendor-specific resources are being released to trigger a use-after-free.

473) Use-after-free (CVE-ID: CVE-2026-92511)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in ib_destroy_cq_user() when accessing a completion queue through the netlink path during its destruction. A local user can access a completion queue through netlink while it is being destroyed to trigger a use-after-free condition.

474) Use-after-free (CVE-ID: CVE-2026-92512)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel crash.

The vulnerability exists due to use-after-free in ib_query_qp() when querying a queue pair through the RDMA netlink flow while the queue pair is being destroyed. A local user can send a netlink request to query the queue pair during its destruction to cause a kernel crash.

475) Use-after-free (CVE-ID: CVE-2026-92514)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ERDMA completion event queue tasklet when removing an ERDMA device. A local user can trigger device removal while a previously scheduled completion event queue tasklet is pending to cause a denial of service.

476) Out-of-bounds read (CVE-ID: CVE-2026-92523)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to improper input validation in nldev_stat_set_counter_dynamic_doit when processing nested RDMA_NLDEV_ATTR_STAT_HWCOUNTERS netlink attributes. A local user can provide a nested attribute containing a child payload shorter than a u32 to perform an out-of-bounds read.

477) Out-of-bounds read (CVE-ID: CVE-2026-92525)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in copy_data() when processing a user-supplied work queue element. A local user can post a work queue element with an out-of-range cur_sge or oversized num_sge to cause a denial of service.

478) Unchecked Return Value (CVE-ID: CVE-2026-93037)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause improper processing of a request.

The vulnerability exists due to an unchecked return value in the set_txreq_header_ahg() function when initializing an accelerated header generation transmit request. A local user can submit a request for which sdma_txinit_ahg() fails to cause improper processing of a request.

479) Memory leak (CVE-ID: CVE-2026-93102)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the hfi1 init_one() cleanup path when hfi1_init() or hfi1_register_ib_device() fails after RX support allocation. A local user can trigger a late probe failure to cause a denial of service.

480) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-93103)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an allocation failure in hfi1_free_devdata() when allocating a unit ID for an HFI1 device. A local user can cause unit ID allocation to fail to cause a denial of service.

The issue occurs when cleanup runs before the device has been inserted into the unit table.

481) Use-after-free (CVE-ID: CVE-2026-93104)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to returning a dangling pointer in rvt_alloc_device when allocating a port array. A local user can trigger a port-array allocation failure to cause a use-after-free.

482) Race condition (CVE-ID: CVE-2026-93107)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service and corrupt data.

The vulnerability exists due to a race condition in the RDMA RXE responder state machine's do_complete function when a queue pair enters the error state while completing a received packet. A remote attacker can send a packet while a disconnect races with receive processing to cause a denial of service and corrupt data.

483) Race condition (CVE-ID: CVE-2026-93108)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper synchronization in the IPoIB module teardown path when unloading the module while RCU callbacks remain pending. A local privileged user can initiate module teardown before queued RCU callbacks complete to cause a denial of service.

The condition can also occur after client registration failure removes already-added devices and queues callbacks.

484) Use-after-free (CVE-ID: CVE-2026-93109)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a failure to wait for queued RCU callbacks in mlx5_ib module teardown when closing a DevX event file or detaching auxiliary driver devices. A local user can close a DevX event file to cause a denial of service.

The issue can also occur during registration error unwinding after driver registration attaches existing devices before failing.

485) Use-after-free (CVE-ID: CVE-2026-93110)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free condition in the RDMA core ib_core cleanup routine when unloading the ib_core module after RCU callbacks have been queued. A local privileged user can cause queued callbacks to invoke unloaded module code to cause a denial of service.

Exploitation requires RCU callbacks queued by put_gid_ndev() before module unloading.

486) Use-after-free (CVE-ID: CVE-2026-93154)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing reference counting in the Intel irdma driver's user ring memory-region handling when deregistering a memory region backing QP, CQ, or SRQ rings. A local user can deregister a memory region associated with a user ring to cause a denial of service.

487) Use-after-free (CVE-ID: CVE-2026-93207)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access freed memory.

The vulnerability exists due to a use-after-free condition in svcauth_gss_decode_credbody() when processing malformed RPC GSS credential bodies. A remote attacker can send a malformed RPC GSS credential to access freed memory.

The credential storage is reused across requests, allowing a dangling context-data pointer to be paired with a stale length after request pages are released.

488) NULL pointer dereference (CVE-ID: CVE-2026-93212)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in nfsd_file_net_dispose() when draining the filecache disposal list during per-network teardown. A local user can trigger per-network teardown while the disposal list contains more than eight entries to cause a denial of service.

489) Out-of-bounds read (CVE-ID: CVE-2026-93264)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory registration to be rejected.

The vulnerability exists due to an incorrect chunk length calculation in the EFA RDMA driver's pbl_chunk_list_create function when registering a memory region whose PBL page count is a multiple of 510. A local user can register such a memory region to cause memory registration to be rejected.

The issue can also result in an out-of-bounds access to the chunks array.

490) Deadlock (CVE-ID: CVE-2026-93269)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock ordering in ext4_ext_migrate when invoking the ext4 extent migration ioctl. A local user can trigger concurrent inode eviction and writeback operations to cause a denial of service.

491) Race condition (CVE-ID: CVE-2026-93782)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write response data to an unrelated userspace object.

The vulnerability exists due to a race condition in vhost-scsi ioctl handling when replacing the memory table while commands are in flight. A local user can submit commands and issue VHOST_SET_MEM_TABLE to write response data to an unrelated userspace object.

492) Race condition (CVE-ID: CVE-2026-93794)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause punched file ranges to be incorrectly reported as allocated data.

The vulnerability exists due to improper synchronization in the SMB client smb3_punch_hole function when punching a hole after a large buffered write. A local user can perform a large buffered write followed by a hole-punch operation to cause punched file ranges to be incorrectly reported as allocated data.

493) Double free (CVE-ID: CVE-2026-93810)

CWE-ID: CWE-415 - Double Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a double free.

The vulnerability exists due to a double fput in error handling in cachefiles_create_tmpfile() when the cache does not support read_iter and write_iter. A local user can trigger this error-handling path to cause a double free.

494) Out-of-bounds read (CVE-ID: CVE-2026-93813)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Btrfs INODE_REF item handler when processing a crafted Btrfs image. A local user can provide a crafted Btrfs image with an oversized INODE_REF name length to cause a denial of service.

495) Use-after-free (CVE-ID: CVE-2026-93826)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to use-after-free in hidpp_connect_event() when input device registration fails. A local user can trigger a HID++ connection event after input device registration fails to cause a use-after-free condition.

496) Race condition (CVE-ID: CVE-2026-93829)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a race condition in cifsd demultiplex thread creation when initializing tcp_ses. A local privileged user can trigger the race during CIFS session creation to cause a denial of service.

497) Integer underflow (CVE-ID: CVE-2026-97413)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds memory access.

The vulnerability exists due to integer underflow in the rtrs-srv process_read and process_write functions when processing a network-supplied RDMA message with usr_len greater than off. A remote attacker can send a crafted RDMA message with usr_len greater than off to cause an out-of-bounds memory access.

498) Integer overflow (CVE-ID: CVE-2026-97421)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect page-size selection.

The vulnerability exists due to integer overflow in ib_umem_find_best_pgsz() in the RDMA/umem subsystem when handling a virtual address and length. A local user can provide values that trigger boundary conditions to cause incorrect page-size selection.

The issue is especially important on 32-bit systems.

499) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-97477)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the RDMA counter allocation and binding routine alloc_and_bind() when handling repeated RDMA queue pair bind failures. A local user can repeatedly trigger queue pair bind failures to cause a denial of service.

500) Missing Authorization (CVE-ID: CVE-2026-97505)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing authorization in the __resource_resize_store() function when writing to a resourceN_resize sysfs attribute. A local user can resize a PCI BAR to cause a denial of service.

501) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-97557)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper reference count management in cifs_queue_oplock_break() when queueing oplock-break work. A remote attacker can trigger repeated oplock breaks while prior work remains queued to cause a denial of service.

The issue can be triggered when interacting with a slow-responding server.

502) Memory corruption (CVE-ID: CVE-2026-97934)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of placeholder stacktrace fields in trace event histogram processing when parsing a histogram trigger with a STACKTRACE key. A local user can configure a histogram trigger using the STACKTRACE key and generate a trace event to cause a denial of service.

503) Use-after-free (CVE-ID: CVE-2026-97940)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service, disclose sensitive information, or modify information.

The vulnerability exists due to a use-after-free in the IPv6 FIB route iterator walker handling when stopping an IPv6 route iterator while routes are deleted. A local user can trigger a race that leaves a freed walker on the IPv6 FIB walker list to cause a denial of service, disclose sensitive information, or modify information.

The same stop helper is used by /proc/net/ipv6_route and the BPF IPv6 route iterator.

504) NULL pointer dereference (CVE-ID: CVE-2026-97947)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the __amd_smn_rw() function when SMN read or write operations are attempted after amd_smn_init() fails. A local user can trigger SMN read or write operations to cause a denial of service.

505) Use-after-free (CVE-ID: CVE-2026-97950)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to use-after-free in configfs symlink handling when racing symlink creation with removal of its target directory. A local user can race symlink creation with removal of the target directory to trigger a kernel warning.

506) Memory leak (CVE-ID: CVE-2026-98003)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust memory resources.

The vulnerability exists due to a memory leak in the AMD IOMMU guest-address log buffer initialization when reinitializing GA log buffers during system resume. A local user can trigger repeated system resumes to exhaust memory resources.

The allocation occurs from a syscore resume callback while interrupts are disabled and non-boot CPUs are offline.

507) Out-of-bounds write (CVE-ID: CVE-2026-98030)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to an out-of-bounds write in bcm_sf2_cfp_rule_get_all() in the Broadcom Starfighter 2 DSA driver when processing ETHTOOL_GRXCLSRLALL ioctl requests with a caller-supplied rule count. A local user can request fewer rule slots than installed CFP rules to compromise confidentiality, integrity, and availability.

Exploitation requires CFP rules to have already been installed.

508) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98080)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause filesystem metadata corruption and force the filesystem read-only.

The vulnerability exists due to improper reloc root creation in the Btrfs qgroup snapshot accounting path when accounting snapshots during block-group relocation. A local user can perform Btrfs operations that account snapshots during relocation to cause filesystem metadata corruption and force the filesystem read-only.

The issue occurs on Btrfs filesystems with quotas enabled.

509) Use-after-free (CVE-ID: CVE-2026-98091)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel warning.

The vulnerability exists due to use-after-free in the btrfs device transaction update list when system chunk creation fails while creating the first metadata chunk for a sprout filesystem. A local user can create a sprout filesystem that encounters a system chunk creation failure to cause a kernel warning.

510) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-98164)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect control flow implementation in the KVM x86 MMU page-tracking logic when checking write tracking across address spaces. A local user can cause a write-tracked guest frame number to be treated as untracked and trigger a kernel BUG to cause a denial of service.

The issue occurs when system management mode uses multiple address spaces.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2026/suse-su-20264640-1/