SB2026103136 - Ubuntu update for linux-ibm-6.8

Description

This security bulletin contains information about 364 vulnerabilities.

1) Improper locking (CVE-ID: CVE-2025-10263)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to improper memory synchronization in broadcast TLBI completion in the arm64 TLB invalidation handling when performing broadcast TLB invalidation on affected Arm CPUs. A local user can trigger affected memory access patterns to disclose sensitive information, modify data, or cause a denial of service.

The issue affects completion of memory accesses translated by an invalidated TLB entry, while TLB entries themselves are still invalidated correctly.

2) Race condition (CVE-ID: CVE-2025-10263)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to improper memory synchronization in broadcast TLB invalidation completion handling in the arm64 CPU errata handling for affected Arm CPUs when performing broadcast TLB invalidation sequences. A local user can trigger memory accesses relying on an invalidated TLB entry to disclose sensitive information, modify data, or cause a denial of service.

The issue affects only the completion of memory accesses translated by an invalidated TLB entry; the TLB entries themselves are still invalidated correctly.

3) Improper locking (CVE-ID: CVE-2025-10263)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to improper memory access ordering in arm64 TLB invalidation handling when performing broadcast TLB invalidation on affected Arm CPUs. A local user can trigger affected memory access completion conditions to disclose sensitive information, modify data, or cause a denial of service.

The issue affects only memory accesses translated by an invalidated TLB entry; TLB entries themselves are still invalidated correctly.

4) Improper locking (CVE-ID: CVE-2025-10263)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to improper synchronization in broadcast TLB invalidation handling in the arm64 TLB invalidation logic when processing TLBI and DSB sequences on affected Arm CPUs. A local user can trigger memory accesses involving translations from an invalidated TLB entry to disclose sensitive information, modify data, or cause a denial of service.

The issue affects only the completion of memory accesses translated by an invalidated TLB entry and does not prevent the actual invalidation of TLB entries.

5) Improper locking (CVE-ID: CVE-2025-10263)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper hardware synchronization in broadcast TLBI completion on affected arm64 CPUs when performing broadcast TLB invalidation. A local user can trigger memory access activity that relies on an invalidated TLB entry to cause a denial of service.

The issue affects only the completion of memory accesses translated by an invalidated TLB entry; the TLB invalidation itself still occurs correctly.

6) Race condition (CVE-ID: CVE-2025-10263)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in broadcast TLBI completion in the arm64 TLB invalidation handling when performing broadcast TLB invalidation on affected Arm CPUs. A local user can trigger memory access patterns that rely on invalidated TLB entries to cause a denial of service.

The issue affects the completion of memory accesses translated by an invalidated TLB entry, while the TLB invalidation itself still occurs correctly.

7) Race condition (CVE-ID: CVE-2025-10263)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in broadcast TLB invalidation completion handling in the arm64 CPU errata logic when performing memory accesses translated by an invalidated TLB entry after a TLBI;DSB sequence. A local user can trigger affected memory access patterns to cause a denial of service.

The issue affects certain Arm CPUs on arm64 systems and does not prevent invalidation of TLB entries themselves.

8) Improper locking (CVE-ID: CVE-2025-10263)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper hardware synchronization in arm64 TLB invalidation handling when processing broadcast TLB invalidation sequences on affected Arm CPUs. A local user can trigger memory accesses that rely on an invalidated TLB entry to cause a denial of service.

The issue affects only the completion of memory accesses translated by an invalidated TLB entry and does not affect the actual invalidation of TLB entries.

9) Race condition (CVE-ID: CVE-2025-10263)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in broadcast TLB invalidation completion handling in the arm64 TLB invalidation logic when performing memory accesses translated by an invalidated TLB entry after a TLBI;DSB sequence. A local user can trigger affected memory access patterns to cause a denial of service.

The issue affects only the completion of memory accesses translated by an invalidated TLB entry and does not prevent the actual invalidation of TLB entries.

10) Improper locking (CVE-ID: CVE-2025-10263)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory synchronization in broadcast TLB invalidation completion handling in the arm64 CPU errata logic when performing broadcast TLB invalidation on affected Arm CPUs. A local user can trigger memory access patterns that rely on invalidated TLB entries to cause a denial of service.

The issue affects only completion of memory accesses translated by an invalidated TLB entry and does not prevent the actual invalidation of TLB entries.

11) Improper access control (CVE-ID: CVE-2025-10263)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper access control in Stage 2 translation handling when invalidating translation lookaside buffer entries on affected Arm systems. A local user can trigger writes from a malicious guest after write permissions have been revoked to escalate privileges.

Only Xen on Arm in multi-core configurations is affected. The issue does not affect reads.

12) Out-of-bounds read (CVE-ID: CVE-2025-68296)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the fbcon_fb_unregistered() and do_fb_registered() functions in drivers/video/fbdev/core/fbcon.c. A local user can perform a denial of service (DoS) attack.

13) Improper locking (CVE-ID: CVE-2025-68768)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ip_expire() function in net/ipv4/ip_fragment.c. A local user can perform a denial of service (DoS) attack.

14) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2025-71289)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in attr_set_size() during file truncation when truncating files on ntfs3. A local user can truncate a file in a way that triggers an attr_set_size() failure to cause a denial of service.

The inode may be left in an inconsistent state if the error is ignored.

15) Out-of-bounds read (CVE-ID: CVE-2026-23346)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ioremap_prot() function when handling memory protection settings from user mappings. A local user can trigger access to a specially crafted user memory region to cause a kernel memory access violation, leading to a system crash.

The issue specifically affects arm64 systems where user page protection flags are incorrectly processed during physical memory access, resulting in an unreadable memory access from kernel space.

16) Race condition (CVE-ID: CVE-2026-23469)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in the drm/imagination GPU driver interrupt handling during runtime power management suspend when suspending the GPU while an IRQ handler is still running on another CPU core. A local attacker can trigger GPU activity that races with runtime suspend to cause a denial of service.

This issue can lead to kernel crashes or a kernel panic when the IRQ handler accesses GPU registers while the GPU is suspended.

17) Improper input validation (CVE-ID: CVE-2026-31420)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in br_mrp_start_test(), br_mrp_start_in_test(), and br_mrp_start_in_test_parse() when processing user-supplied netlink attributes. A local user can supply a zero interval value to cause a denial of service.

A zero interval causes delayed work to be rescheduled with no delay, creating a tight loop that allocates and transmits MRP test frames until system memory is exhausted and the kernel panics via OOM deadlock.

18) Race condition (CVE-ID: CVE-2026-31486)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in pmbus regulator operations when accessing PMBus registers and shared data. A local user can trigger concurrent regulator callbacks and voltage operations to cause a denial of service.

19) NULL pointer dereference (CVE-ID: CVE-2026-31560)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in spi-dw-dma error logging when handling an error after a transaction finishes without a current message. A local user can trigger an error condition to cause a denial of service.

20) Use-after-free (CVE-ID: CVE-2026-31663)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in xfrm_input_resume and transport_finish when processing packets after asynchronous crypto completion. A local user can trigger a race with device teardown to cause a denial of service.

21) Use-after-free (CVE-ID: CVE-2026-43116)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in netfilter ctnetlink expectation handling when processing expectation add, delete, get, or event operations. A local user can trigger access to an invalid master conntrack object to cause a denial of service.

22) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43219)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in cpsw_unregister_ports() when handling a failed register_netdev() call for the first MAC in cpsw_register_ports(). A local user can trigger an error during network device registration to cause a denial of service.

23) Improper input validation (CVE-ID: CVE-2026-43240)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ima_restore_measurement_list function when booting a second-stage kernel via kexec with a limiting command line such as "mem=". A local user can boot the second-stage kernel with a crafted limiting command line to cause a denial of service.

The issue occurs when the physical range containing the carried-over IMA measurement list falls outside truncated RAM, leading to a kernel panic.

24) Use-after-free (CVE-ID: CVE-2026-43303)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the swap subsystem when handling stale page->private values on reallocated and split pages. A local user can trigger swapoff operations after causing affected page state reuse to cause a denial of service.

The issue occurs because tail pages can retain stale page->private values after split_page(), leading swap_count_continued() to follow an invalid continuation list and access poisoned list entries.

25) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-43311)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper execution context handling in the Tegra PMC resume handler when resuming from system suspend. A local user can trigger a suspend and resume cycle to cause a kernel warning and destabilize the system.

The issue is observed on Tegra platforms during wake handling after system suspend.

26) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-43331)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of kcOV instrumentation state in machine kexec code when executing kexec on a KCOV-instrumented kernel. A local user can trigger a kexec operation to cause a denial of service.

Exploitation requires CONFIG_KEXEC and CONFIG_KCOV to be enabled simultaneously, and the issue is not relevant to 32-bit kernels.

27) Improper input validation (CVE-ID: CVE-2026-45850)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ipvs checksum validation when processing IPv6 packets with extension headers. A remote attacker can send specially crafted IPv6 packets to cause a denial of service.

28) Improper Initialization (CVE-ID: CVE-2026-45930)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in netlink ndmsg response messages when handling RTM_GETNEIGH requests. A local user can send a crafted netlink request to disclose sensitive information.

The issue affects pad bytes in the ndmsg data returned by the kernel.

29) Improper resource shutdown or release (CVE-ID: CVE-2026-46158)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mptcp path manager ADD_ADDR retransmission handling when retransmitting ADD_ADDR messages. A local user can trigger ADD_ADDR retransmissions to cause a denial of service.

30) Improper resource shutdown or release (CVE-ID: CVE-2026-46170)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mptcp path manager ADD_ADDR retransmission timer handling when processing ADD_ADDR retransmissions. A local user can trigger ADD_ADDR retransmissions to cause a system hang.

The issue occurs when the last socket reference is released from the timer handler, leading to an indefinite wait on the same timer.

31) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-46203)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access to hardware registers in cadence-quadspi driver unbind handling when unbinding the driver while the controller is runtime suspended. A local user can trigger driver unbind to cause a denial of service.

32) Use-after-free (CVE-ID: CVE-2026-46275)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the hci_uart line discipline lifecycle management when closing or initializing a Bluetooth HCI UART device. A local user can trigger a hangup or race the close and initialization paths to cause a denial of service.

The issue involves workqueue handling and teardown ordering in the close and initialization error paths.

33) Use of uninitialized resource (CVE-ID: CVE-2026-46315)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory usage in io_uring IORING_OP_WAITID result handling when copying waitid result data to userspace. A local user can trigger a wait operation that completes without reporting a child event to disclose sensitive information.

The issue occurs because stale bytes from reused io_kiocb command storage may be copied to userspace siginfo when no child event information is written.

34) Improper resource shutdown or release (CVE-ID: CVE-2026-46320)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in tap_get_user_xdp() when processing XDP frames. A local user can send a crafted short frame or trigger skb allocation failure to cause a denial of service.

Each rejected frame in a batch leaks one page-frag chunk.

35) Memory leak (CVE-ID: CVE-2026-46321)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in tun_xdp_one() in the tun driver when processing short frames through the tun and vhost-net transmit path. A local user can submit TX descriptors whose payload length is shorter than ETH_HLEN to exhaust host memory and trigger an OOM panic.

Exploitation requires the ability to open /dev/net/tun and /dev/vhost-net and to attach a tun/tap device as the vhost-net backend.

36) Memory leak (CVE-ID: CVE-2026-46322)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in tun_xdp_one() when handling a build_skb() allocation failure. A local user can trigger this error path to cause a denial of service.

The issue occurs because a page allocated for the frame is not freed on the failure path, and the per-buffer error may be discarded during batch processing.

37) Improper access control (CVE-ID: CVE-2026-52908)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain write access to memory regions that were not properly pinned as writable.

The vulnerability exists due to improper access control in RDMA memory region re-registration handling when changing IB_MR_REREG_ACCESS from read-only to read-write. A local user can re-register a memory region with writable access to gain write access to memory regions that were not properly pinned as writable.

The issue occurs when a driver reuses an existing umem during memory region re-registration.

38) Out-of-bounds read (CVE-ID: CVE-2026-52910)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the reuseport cBPF program handling in sk_reuseport_prog_free() when detaching or replacing a reuseport program while UDP packets are being processed concurrently. A local user can trigger concurrent reuseport program updates and packet transmission to cause a denial of service.

The issue occurs because the classic BPF reuseport program may be freed before RCU readers have completed.

39) Use-after-free (CVE-ID: CVE-2026-52912)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in nf_queue when reinjecting queued bridge LOCAL_IN packets. A remote attacker can trigger packet queueing and later reinjection to cause a denial of service.

The issue occurs because skb->dev can still reference a freed bridge master device while the packet remains queued.

40) NULL pointer dereference (CVE-ID: CVE-2026-52913)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the batman-adv OGMv2 handling code when processing OGM dispatch on an interface that has been disabled and lost its mesh interface association. A local user can trigger OGM processing on such an interface to cause a denial of service.

The issue occurs because an interface may be disabled after OGM processing begins, leaving its mesh interface pointer set to NULL while the code still attempts to use it.

41) Out-of-bounds read (CVE-ID: CVE-2026-52915)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hbh_mt6_check() in net/ipv6/netfilter/ip6t_hbh.c when processing user-supplied rule setup data. A local user can supply an oversized option list to cause a denial of service.

The issue is triggered because the fixed-size opts array stores at most 16 option descriptors.

42) Uncontrolled Recursion (CVE-ID: CVE-2026-52916)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in batadv_batman_skb_recv() and fragment reassembly handling in the batman-adv fragmentation component when processing nested BATADV_UNICAST_FRAG packets. A remote attacker can send a specially crafted fragmented packet to cause a denial of service.

The issue occurs when a reassembled payload is itself another BATADV_UNICAST_FRAG packet, leading to unbounded kernel stack growth until exhaustion.

43) Out-of-bounds read (CVE-ID: CVE-2026-52917)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the SCTP sock_diag dump-one path when processing an exact association lookup after taking the socket lock on a stale association. A local user can trigger a stale association lookup to disclose sensitive information.

The issue occurs when association state is reaped or detached from the endpoint while the lookup path resumes after blocking on the socket lock.

44) Race condition (CVE-ID: CVE-2026-52918)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in bt_sock_poll() and the Bluetooth accept queue when polling Bluetooth sockets. A local user can trigger concurrent socket teardown and accept queue access to cause a denial of service.

The issue occurs because the accept queue is walked without synchronization while child teardown can unlink a socket and drop its last reference.

45) Use-after-free (CVE-ID: CVE-2026-52919)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service and trigger a use-after-free.

The vulnerability exists due to a use-after-free in batadv_tp_sender_shutdown() and batadv_tp_send() in the batman-adv tp_meter component when shutting down the throughput meter sender through multiple paths. A local user can trigger timeout, cancellation, or normal completion paths to cause a denial of service and trigger a use-after-free.

The issue occurs because the sending counter can underflow to a negative value, causing the sender kernel thread to continue running after interface removal.

46) Off-by-one (CVE-ID: CVE-2026-52921)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in the netfilter ipset hash set range iteration logic when processing IPv4 ranges in hash:ip,mark, hash:ip,port, hash:ip,port,ip, and hash:ip,port,net set variants. A local user can supply a crafted range request to cause a denial of service.

A later retry may continue from an unintended position after traversal advances past the end of the requested range.

47) NULL pointer dereference (CVE-ID: CVE-2026-52922)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in batadv_dat_forward_data() when forwarding data to DHT candidates. A local attacker can trigger an allocation failure and reach unconditional dereference of a NULL skb pointer to cause a denial of service.

48) Use-after-free (CVE-ID: CVE-2026-52923)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ipc_idr_alloc() in the checkpoint/restore SysV IPC allocation path when processing a request for the next SysV IPC id. A local user can request allocation beyond the valid IPC id range to cause a denial of service.

A subsequent walk of /proc/sysvipc/shm can dereference freed memory through a stale IDR entry.

49) Improper resource shutdown or release (CVE-ID: CVE-2026-52926)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in batman-adv gateway client teardown logic when tearing down and later recreating a mesh. A local user can trigger mesh teardown to cause a denial of service.

The issue leaves stale current gateway state behind across cleanup, which can break a later mesh recreation.

50) Out-of-bounds read (CVE-ID: CVE-2026-52927)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in compat_mtw_from_user in the ebtables netfilter subsystem when converting 32-bit user-supplied extension structures to native kernel structures. A local user can provide a crafted match or target size smaller than the extension requires to disclose sensitive information.

The issue affects extensions that rely on compat_from_user callbacks, which assume they can read the required compat size.

51) NULL pointer dereference (CVE-ID: CVE-2026-52929)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null-pointer dereference in the SCTP stream scheduler state handling in net/sctp/stream.c when processing a denied ADD_OUT_STREAMS operation and a later stream re-add. A remote attacker can trigger SCTP stream reset operations that leave stale removed stream metadata behind to cause a denial of service.

The issue occurs because removed outgoing stream state is not fully rolled back, leaving scheduler-private stream metadata inconsistent for later reuse.

52) Race condition (CVE-ID: CVE-2026-52930)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in shared memory orphan cleanup in ipc/shm.c when cleaning up orphaned shared memory segments while attachment counts are updated concurrently. A local user can trigger concurrent shared memory attach and cleanup operations to cause a denial of service.

The issue occurs because shm_destroy_orphaned() may decide that an orphaned segment is unused before taking the object lock.

53) Integer overflow (CVE-ID: CVE-2026-52934)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to an integer overflow leading to an out-of-bounds write in batadv_tvlv_container_ogm_append() and batadv_tvlv_container_list_size() when processing registered TVLV containers. A local user can cause the accumulated TVLV size to exceed U16_MAX and trigger an undersized allocation to corrupt kernel memory.

54) Out-of-bounds read (CVE-ID: CVE-2026-52935)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in espintcp_sendmsg() when handling a new send while a previous partial send is still in progress. A local user can trigger a partial send and initiate another send to disclose sensitive information.

The issue occurs in the send path because a stale offset from a live partial-send state can remain attached to a new sk_msg.

55) NULL pointer dereference (CVE-ID: CVE-2026-52939)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in rds_ib_send_cqe_handler() and rds_ib_send_unmap_op() when processing an atomic cmsg over an active RDS/IB connection. A local user can send a crafted AF_RDS sendmsg() request to cause a denial of service.

On hardware that natively accepts masked atomic operations, no additional setup is required.

56) NULL pointer dereference (CVE-ID: CVE-2026-52941)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the smc_msg_event tracepoint when processing sendmsg() or recvmsg() on an SMC-D socket with the tracepoint enabled. A local user can trigger socket activity on an SMC-D socket to cause a denial of service.

Exploitation requires the tracepoint to be enabled, and the crash occurs on the first sendmsg() or recvmsg() on an affected SMC-D socket.

57) Out-of-bounds read (CVE-ID: CVE-2026-52942)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in dump_mac_header() in the netfilter nf_log syslog logger when processing an skb sent through AF_PACKET with PACKET_QDISC_BYPASS and an unset MAC header. A local user can send a specially crafted packet to disclose sensitive information.

Only skbs with an unset MAC header are affected.

58) Use-after-free (CVE-ID: CVE-2026-52943)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a use-after-free in pskb_carve_inside_header() and pskb_carve_inside_nonlinear() when copying skb_shared_info for MSG_ZEROCOPY skbs. A local user can trigger repeated zerocopy skb operations to escalate privileges.

The issue is caused by copying the destructor_arg pointer into a new skb_shared_info without incrementing the associated zerocopy reference count, which can prematurely free ubuf_info_msgzc while transmit skbs still hold live references.

59) Improper access control (CVE-ID: CVE-2026-52944)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass permission checks and modify file sparse attributes.

The vulnerability exists due to improper access control in fsctl_set_sparse() when handling FSCTL_SET_SPARSE requests. A remote user can send a crafted FSCTL_SET_SPARSE request on an opened file to bypass permission checks and modify file sparse attributes.

The issue affects both clients on read-only shares and clients on writable shares that lack FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES access.

60) Use-after-free (CVE-ID: CVE-2026-52947)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in qrtr_port_remove in the qrtr socket subsystem when handling concurrent qrtr port removal and lookup operations under RCU. A local user can trigger the race condition to cause a denial of service.

The issue arises because a socket pointer can remain reachable through the qrtr_ports XArray before the RCU grace period elapses.

61) Integer overflow (CVE-ID: CVE-2026-52948)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in the I2C_TIMEOUT ioctl handler in i2c-dev when processing a user-supplied timeout value. A local user can supply a large timeout value to cause a denial of service.

The issue can corrupt the SMBus controller state machine and leave it in an unrecoverable state.

62) NULL pointer dereference (CVE-ID: CVE-2026-53080)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the cls_fw classifier when classifying packets with an invalid old-style filter on a shared block. A local user can send crafted traffic while creating such a filter to cause a denial of service.

Exploitation requires the ability to configure traffic control filters and trigger packet classification.

63) Improper input validation (CVE-ID: CVE-2026-53131)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in netfilter Ethernet header handling when processing packets that reach ip6t_eui64, xt_mac, ipset bitmap:ip,mac, hash:ip,mac, hash:mac, or nf_log_syslog code paths without a valid Ethernet MAC header. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because these paths access eth_hdr(skb) after insufficient validation that the skb is associated with an Ethernet device and that a full MAC header is present.

64) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-53132)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in virtio_transport_inc_rx_pkt() and the virtio vsock receive queue when processing crafted packets with zero-length payloads and the VIRTIO_VSOCK_SEQ_EOM flag. A local user can send a large number of specially crafted packets to cause a denial of service.

The issue occurs because queued packets may not increase the tracked byte count, allowing the receive queue to grow excessively.

65) Integer overflow (CVE-ID: CVE-2026-53133)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in __rdma_block_iter_next() in the RDMA umem block iterator when reassembling split scatter-gather entries during IOMMU-backed mapping linearization. A local user can trigger processing of a very large mapped block to cause a denial of service.

The issue occurs for block sizes greater than or equal to 4G when a single large block is split across multiple scatter-gather entries.

66) Use of Uninitialized Variable (CVE-ID: CVE-2026-53134)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in the nft_fib IPv4/IPv6 evaluation logic when processing nftables fib expressions that use the OIFNAME result or an invalid NFTA_FIB_F_PRESENT combination. A local user can configure and trigger a crafted fib expression to disclose sensitive information.

The issue occurs because only part of the declared destination register span is written on certain evaluation paths, leaving stale kernel stack data available to a downstream expression that reads the full register span.

67) Out-of-bounds read (CVE-ID: CVE-2026-53135)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in dp_sdp_message_debugfs_write() in the AMD display debugfs interface when handling writes to the sdp_message debugfs node with a user-supplied buffer smaller than 36 bytes. A local user can provide a short user buffer to disclose sensitive information.

68) NULL pointer dereference (CVE-ID: CVE-2026-53135)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dp_sdp_message_debugfs_write() in the AMD display debugfs interface when handling writes to the sdp_message debugfs node. A local user can write to the debugfs node to cause a denial of service.

A connector may be connected but not bound to any CRTC, such as after hot-plug before the next atomic commit.

69) Heap-based buffer overflow (CVE-ID: CVE-2026-53136)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in get_integrated_info_v11() and get_integrated_info_v2_1() in the AMD display BIOS parser when parsing a malformed VBIOS during driver probe. A local user can provide a specially crafted VBIOS with oversized HDMI retimer register counts to cause a denial of service or execute arbitrary code.

Exploitation requires control over the VBIOS data consumed by the driver.

70) Out-of-bounds write (CVE-ID: CVE-2026-53137)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in mod_hdcp_read_rx_id_list() when processing a malicious HDMI HDCP 2.x repeater ReceiverID list over I2C. An attacker with physical access can provide a malicious HDMI repeater that advertises an oversized message length to cause a denial of service.

The issue occurs during HDCP 2.x repeater authentication over HDMI.

71) Out-of-bounds read (CVE-ID: CVE-2026-53138)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or disclose sensitive information.

The vulnerability exists due to an out-of-bounds read and unbounded iteration in amd display bios_parser.c and bios_parser2.c record-chain walk loops when parsing a malformed VBIOS image during probe time. An attacker with physical access can provide a crafted VBIOS image missing the terminator record to cause a denial of service or disclose sensitive information.

The issue is triggered when the VBIOS record chain lacks the 0xFF terminator record or uses a zero-sized termination condition incorrectly.

72) Improper resource shutdown or release (CVE-ID: CVE-2026-53140)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in v3d_rewrite_csd_job_wg_counts_from_indirect() when processing indirect CSD workgroup buffers with zeroed workgroup counts. A local user can trigger an early return path to cause a denial of service.

73) Heap-based buffer overflow (CVE-ID: CVE-2026-53143)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and corrupt memory.

The vulnerability exists due to a heap-based buffer overflow in the amdkfd v11 MQD manager SDMA queue checkpoint and restore handlers when processing CRIU checkpoint and restore operations for SDMA queues on GFX11. A local user can trigger checkpoint or restore of an SDMA queue to disclose sensitive information and corrupt memory.

The issue is specific to v11 SDMA queues on Navi3x during CRIU checkpoint and restore.

74) NULL pointer dereference (CVE-ID: CVE-2026-53144)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in get_queue_ids() and its callers in the amdkfd debug trap queue handling path when processing a debug trap ioctl request with num_queues greater than zero and a missing queue array pointer. A local user can supply crafted ioctl parameters to trigger a kernel panic and cause a denial of service.

The issue is triggered via kfd_ioctl_set_debug_trap().

75) Out-of-bounds read (CVE-ID: CVE-2026-53146)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tb_xdomain_copy() in the thunderbolt xdomain component when processing a short response frame. A local user can send a specially crafted short response to disclose sensitive information.

76) Out-of-bounds read (CVE-ID: CVE-2026-53147)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tb_xdp_handle_request() in the thunderbolt xdomain request handler when processing a crafted XDomain request packet that is shorter than the expected protocol-specific structure. A remote attacker can send a minimal crafted XDomain packet to disclose sensitive information.

A generic header length check can be passed even when the packet is too short for the protocol-specific structure accessed after the type cast.

77) Out-of-bounds write (CVE-ID: CVE-2026-53148)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in tb_xdp_properties_request() in the thunderbolt xdomain handler when processing a crafted XDomain response from a malicious peer. A remote attacker can send a response with a forged length field to cause memory corruption.

78) Out-of-bounds read (CVE-ID: CVE-2026-53149)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in __tb_property_parse_dir() in the thunderbolt property parser when parsing a crafted root directory property block. A local user can supply a crafted property block to cause a denial of service.

79) Out-of-bounds write (CVE-ID: CVE-2026-53150)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in tb_property_entry_valid() and the TEXT property null-termination logic in drivers/thunderbolt/property.c when parsing XDomain property entries. A local attacker can provide a crafted zero-length TEXT property entry to cause a denial of service.

80) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53154)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in mm/hugetlb.c hugetlb folio copy paths when handling failed hugetlb folio copy operations. A local user can trigger a failed UFFDIO_COPY operation or a fork-time copy-on-write path failure to cause a denial of service.

The issue can leak a reservation from a private hugetlb VMA reserve map, which may cause a later fault at the same address to take the no-reservation path and receive SIGBUS under hugetlb pool pressure.

81) Use-after-free (CVE-ID: CVE-2026-53156)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in drivers/nvmem/core.c when handling error paths and device reference release. A local user can trigger a code path that releases an nvmem device reference and then continues using the freed structure to cause a denial of service.

82) NULL pointer dereference (CVE-ID: CVE-2026-53158)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in fastrpc_rpmsg_callback() when handling a glink message before probe initialization has completed. A local attacker can trigger the callback during early channel activation to cause a denial of service.

This issue can occur during boot when the rpmsg channel becomes live before driver initialization is fully complete.

83) Integer underflow (CVE-ID: CVE-2026-53159)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt a DMA address.

The vulnerability exists due to an integer underflow in fastrpc_get_args() when processing a user-provided pointer that falls in a gap before a returned VMA. A local user can supply a crafted pointer value to corrupt a DMA address.

The corrupted DMA address is sent to the DSP.

84) Use-after-free (CVE-ID: CVE-2026-53160)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a use-after-free race in fastrpc_map_create in drivers/misc/fastrpc.c when handling concurrent MEM_UNMAP operations during map lookup and reference acquisition. A local user can trigger concurrent map operations to cause a use-after-free condition.

The issue occurs because a raw pointer is returned after releasing fl->lock and is later referenced without atomic reference acquisition under the lock.

85) Use-after-free (CVE-ID: CVE-2026-53161)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the fastrpc workqueue cleanup path when processing DSP responses during file descriptor release. A local user can trigger a race by closing the file descriptor while an in-flight DSP invocation completes to cause a denial of service.

The issue occurs because context cleanup may run in parallel with device release after the user structure has already been freed.

86) Improper access control (CVE-ID: CVE-2026-53168)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in fuse_notify_store() and fuse_notify_retrieve() when processing FUSE pagecache notification operations on directories. A remote user can issue crafted FUSE_NOTIFY_STORE or FUSE_NOTIFY_RETRIEVE operations on a directory inode to cause a denial of service.

The issue affects directory inodes that use kernel-internal pagecache storage.

87) NULL pointer dereference (CVE-ID: CVE-2026-53177)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the bnxt_io_error_detected error recovery path when handling PCIe error recovery on a closed NIC. A local user can trigger PCIe error recovery for a device whose bnapi state is not allocated to cause a denial of service.

The issue occurs because error recovery services may run on subordinate devices regardless of administrative state.

88) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53181)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in vmci_transport_recv_listen() when handling failed connection handshakes. A remote attacker can send malformed packets that trigger repeated handshake failures to cause a denial of service.

The issue can permanently prevent the listener from accepting new connections until the affected process is restarted.

89) Improper input validation (CVE-ID: CVE-2026-53182)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in nl80211_parse_rnr_elems() when parsing nested NL80211_ATTR_EMA_RNR_ELEMS input. A local user can send a specially crafted nl80211 message to cause a denial of service.

The issue is related to the element count being stored in a u8-backed cfg80211_rnr_elems::cnt field and incremented past its supported limit.

90) Resource exhaustion (CVE-ID: CVE-2026-53183)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in MPTCP DSS option handling in net/mptcp/options.c when processing incoming MPTCP traffic with out-of-order data in the MPTCP sequence space or data landing in the backlog. A remote attacker can send traffic that triggers artificial inflation of the MPTCP receive window to cause a denial of service.

The issue can allow incoming traffic to exceed the receiver rcvbuf size even when the sender is not misbehaving.

91) Type Confusion (CVE-ID: CVE-2026-53184)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a type confusion in udp_read_skb() when processing UDP packets for a socket in a sockmap with an attached SK_SKB verdict program that performs a socket lookup. A remote attacker can send a specially crafted packet to cause a denial of service.

Exploitation requires a UDP socket to be in a sockmap and the attached verdict program to call a socket-lookup helper.

92) Use-after-free (CVE-ID: CVE-2026-53185)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in zram_bvec_write_partial() when processing partial writes for ZRAM_WB slots. A local user can trigger an asynchronous backing device read and subsequent access to a freed page to cause a denial of service.

The issue occurs because the read operation may still be in flight when the buffer page is freed.

93) Out-of-bounds read (CVE-ID: CVE-2026-53186)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in srp_process_rsp() when processing a crafted SRP_RSP response from an SRP target. A remote user can send a specially crafted SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len value to cause a denial of service.

Exploitation requires that the initiator is logged into a malicious or compromised SRP target on the InfiniBand or RoCE fabric.

94) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-53190)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in virtio_gpu_dma_fence_wait() when handling fence wait errors inside dma_fence_unwrap_for_each(). A local user can trigger an error during fence waiting to cause a denial of service.

95) Out-of-bounds write (CVE-ID: CVE-2026-53194)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in klsi_105_prepare_write_buffer() when processing writes to the tty device. A local user can write bulk_out_size or more bytes to the tty to cause a denial of service.

The issue is triggered when the write fifo holds at least the full bulk-out buffer size, causing data to be copied starting two bytes into a 64-byte buffer.

96) Heap-based buffer overflow (CVE-ID: CVE-2026-53195)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in build_i2c_fw_hdr() in the io_ti USB serial driver when parsing a crafted firmware file. A local user can supply a firmware image with an oversized Length field to cause a denial of service.

The issue arises because the Length field from the firmware image is not validated against the available destination buffer space before copying.

97) Heap-based buffer overflow (CVE-ID: CVE-2026-53196)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in get_manuf_info() in the io_ti USB serial driver when processing a crafted USB device EEPROM descriptor. An attacker with physical access can connect a malicious USB device with a forged Size field to trigger the overflow and cause a denial of service or execute arbitrary code.

The out-of-bounds access is compounded because a checksum routine also iterates over the device-controlled length after the EEPROM data is read.

98) Use-after-free (CVE-ID: CVE-2026-53198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in smb2_cancel in ksmbd when handling a second SMB2_CANCEL for the same AsyncId after cancellation of a deferred byte-range lock. A remote user can send specially crafted SMB2_CANCEL requests to cause a denial of service.

Exploitation requires authentication to the SMB service and involves a deferred SMB2_LOCK request that blocks.

99) Memory corruption (CVE-ID: CVE-2026-53199)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory access in netvsc_copy_to_send_buf() when copying skb fragments into the VMBus send buffer. A local user can trigger packet transmission with page-backed fragments to cause a denial of service.

The issue occurs on 32-bit x86 systems with CONFIG_HIGHMEM enabled when fragment pages reside above the LOWMEM boundary, and the fault happens on the transmit softirq path.

100) Stack-based buffer overflow (CVE-ID: CVE-2026-53202)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in the ivpu_ipc_receive function when processing firmware-supplied IPC message data. A local user can supply a crafted data_size value to trigger an oversized memcpy operation and execute arbitrary code.

Exploitation requires control over firmware-supplied message data.

101) Out-of-bounds read (CVE-ID: CVE-2026-53205)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the firmware log buffer handling in drivers/accel/ivpu/ivpu_fw_log.c when processing firmware-supplied log indices. A local user can supply invalid read or write indices to trigger out-of-bounds buffer access and cause a denial of service.

Exploitation requires firmware to provide invalid log buffer index values.

102) Improper input validation (CVE-ID: CVE-2026-53208)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in l2cap_sig_channel() when processing oversized Bluetooth BR/EDR signaling packets. A remote attacker can send a specially crafted fixed-channel CID 0x0001 packet containing many L2CAP_ECHO_REQ commands to cause a denial of service.

Exploitation is possible by a Bluetooth BR/EDR peer within radio range before pairing.

103) Stack-based buffer overflow (CVE-ID: CVE-2026-53209)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in hci_adv_bcast_annoucement() when rebuilding Bluetooth advertising data with a prepended Broadcast Announcement. A local user can trigger handling of an oversized advertising payload to cause a denial of service.

The issue occurs when an existing advertising instance already contains the maximum extended advertising payload.

104) Memory leak (CVE-ID: CVE-2026-53210)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in register_shm_helper() in the tee shared memory registration handler when processing a TEE_IOC_SHM_REGISTER request with a zero length. A local user can send a crafted ioctl request to cause a denial of service.

The issue is triggered when struct tee_ioctl_shm_register_data specifies a length of 0.

105) Memory leak (CVE-ID: CVE-2026-53213)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of memory allocation failure in vc4 shader validation when processing crafted shader data. A local user can trigger a failed memory reallocation to cause a denial of service.

106) NULL pointer dereference (CVE-ID: CVE-2026-53214)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in cleanup_prefix_route() when handling netlink requests to delete IPv6 addresses. A local user can send a crafted netlink message to trigger the null pointer dereference and cause a denial of service.

The issue occurs when addrconf_get_prefix_route() returns the fib6_null_entry sentinel with a NULL fib6_table pointer.

107) Out-of-bounds write (CVE-ID: CVE-2026-53216)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory or cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the mvpp2 XDP receive path when processing packets with XDP tail adjustment on short RX buffers. A local user can trigger bpf_xdp_adjust_tail() on a packet to corrupt memory or cause a denial of service.

The issue occurs because the XDP frame size is initialized larger than the actual backing buffer size for short BM pool buffers.

108) Out-of-bounds read (CVE-ID: CVE-2026-53217)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to improper memory synchronization in mvpp2_rx() in the mvpp2 network driver when processing received packets on non-coherent DMA systems. A local attacker can send network traffic that triggers reception of a crafted frame to disclose sensitive information.

Only non-coherent DMA systems are affected.

109) Use of uninitialized resource (CVE-ID: CVE-2026-53218)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an uninitialized memory exposure in nft_exthdr_init and the nft_exthdr evaluation paths when processing a userspace request with the NFT_EXTHDR_F_PRESENT flag set and an invalid length value. A local user can supply a crafted netfilter expression that causes uninitialized stack data from nft_regs to be retained in registers and disclose sensitive information.

The issue occurs because the initialized register bitmap can mark more bytes as written than the evaluation paths actually store when the presence flag is used.

110) Information disclosure (CVE-ID: CVE-2026-53219)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper handling of partially failed copy_to_user operations in x_tables get-entries implementations when copying rule entries to userspace. A local user can provide a userspace buffer that faults during the initial header copy to disclose sensitive information.

On SMP kernels, the leaked value is the internal percpu counter allocation pointer. The issue affects the IPv4, IPv6, and ARP native and compat get-entries paths.

111) NULL pointer dereference (CVE-ID: CVE-2026-53220)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ebt_redirect_tg() in net/bridge/netfilter/ebt_redirect.c when reinjecting an NFQUEUE packet after bridge port state changes. A local user can remove or reassign the bridge port before reinjection to cause a denial of service.

The issue occurs if the bridge port is removed between the original hook invocation and NFQUEUE reinjection, and the device may also be moved to a different virtual device such as macvlan.

112) Improper input validation (CVE-ID: CVE-2026-53221)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause traffic to be associated with the wrong tunnel.

The vulnerability exists due to improper input validation in vti6_tnl_lookup() when matching IPv6 VTI tunnels during fallback wildcard tunnel searches. A remote attacker can send network traffic that triggers a hash collision and incorrect tunnel selection to cause traffic to be associated with the wrong tunnel.

The issue occurs because candidate tunnels in the fallback search were not verified to actually use wildcard local or remote addresses.

113) Out-of-bounds read (CVE-ID: CVE-2026-53223)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the generic timestamp cmsg path in net/socket.c when processing timestamped messages for AF_PACKET sockets. A local user can send or receive crafted packets on an AF_PACKET socket to disclose sensitive information.

Exploitation requires timestamping to be enabled, and information disclosure can occur when SO_RXQ_OVFL is enabled and a non-linear skb is processed.

114) NULL pointer dereference (CVE-ID: CVE-2026-53227)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an invalid pointer dereference in the openvswitch datapath flow command handler when handling crafted flow set operations after a reply skb allocation failure. A local user can trigger the error-handling path to cause a denial of service.

115) Improper resource shutdown or release (CVE-ID: CVE-2026-53229)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in mlx5e_xmit_xdp_buff() in the mlx5 XDP transmit path when handling XDP_TX transmission failures in the XSK branch. A local user can trigger an XDP_TX transmit failure to cause a denial of service.

The issue occurs when sq->xmit_xdp_frame() returns false, such as when the XDPSQ is full, leaving DMA mappings and xdp_frame objects unreleased.

116) Out-of-bounds read (CVE-ID: CVE-2026-53230)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in mlx5_query_nic_vport_mac_list when querying a VF vport MAC list with a larger configured maximum than the PF capability-based buffer size. A local user can configure or trigger processing of a VF vport with a larger MAC list to cause a denial of service.

The issue occurs in the mlx5 driver while handling vport address list updates.

117) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53232)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the phy probing logic for the sfp upstream handling when probe failure paths are processed. A local user can trigger phy probing failure and subsequent SFP events to cause a denial of service.

The issue can leave a dangling upstream reference on the sfp-bus that may later be used during SFP events.

118) Improper access control (CVE-ID: CVE-2026-53236)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in SO_ATTACH_FILTER on TCP sockets when attaching a cBPF filter. A local user can attach a filter to leak TCP sequence and acknowledgment numbers to disclose sensitive information.

Exploitation requires access to create or control a TCP socket and use the socket option interface.

119) NULL pointer dereference (CVE-ID: CVE-2026-53237)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mvebu GPIO suspend/resume handling in drivers/gpio/gpio-mvebu.c when processing suspend and resume operations for GPIO banks without PWM functionality. A local user can trigger a suspend or resume operation to cause a denial of service.

Only GPIO banks that do not have PWM functionality are affected.

120) Out-of-bounds read (CVE-ID: CVE-2026-53238)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in netlbl_unlabel_addrinfo_get() when handling crafted Generic Netlink requests with a shorter unlabeled address mask attribute. A local user can send a specially crafted Generic Netlink request to cause a denial of service.

121) Use-after-free (CVE-ID: CVE-2026-53239)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in xfrm_policy_bysel_ctx() and inexact bin handling in the xfrm policy subsystem when processing concurrent policy deletion and hash rebuild operations. A local user can trigger a race condition to cause a denial of service.

The issue occurs because an inexact bin may be freed during a window after the policy lock is released and before pruning is performed.

122) Race condition (CVE-ID: CVE-2026-53242)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in snd_pcm_drain() when handling linked PCM streams during concurrent unlink operations. A local user can trigger concurrent drain and unlink activity to cause a denial of service.

The issue can corrupt wait queue lists and lead to a kernel panic through a NULL function pointer dereference during a subsequent wake-up.

123) Improper input validation (CVE-ID: CVE-2026-53245)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in mrp_pdu_parse_vecattr when parsing crafted MRP vector attributes in protocol data units. A remote attacker can send a specially crafted MRP packet to cause a denial of service.

The issue can be triggered when a VectorAttribute uses a zero-length value set or event counts that cross byte boundaries.

124) Improper access control (CVE-ID: CVE-2026-53249)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in ip_options_get() in net/ipv4/ip_options.c when setting IPv4 Loose Source and Record Route or Strict Source and Record Route options. A local user can set crafted IP options to force packets through attacker-controlled nodes to disclose sensitive information.

Exposure depends on network paths that support and forward these IPv4 options.

125) Improper update of reference count (CVE-ID: CVE-2026-53251)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count management in iso_conn_big_sync when handling Bluetooth ISO BIG sync operations. A local user can trigger the vulnerable code path to cause a denial of service.

126) Memory leak (CVE-ID: CVE-2026-53252)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in bt_host_release() when handling failed Bluetooth HCI device initialization before hci_register_dev() completes. A local user can trigger device initialization failures to cause a denial of service.

The issue occurs because the unregistered device cleanup path bypasses hci_release_dev(), leaving the SRCU structure allocated in hci_alloc_dev() uncleared.

127) Out-of-bounds read (CVE-ID: CVE-2026-53253)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in bnep_rx_frame() and bnep_rx_control() in the BNEP packet parser when processing short BNEP frames. A remote attacker can send a specially crafted short BNEP SDU to cause a denial of service.

The issue is triggered by malformed control packets with missing fixed fields or an empty control payload.

128) Out-of-bounds read (CVE-ID: CVE-2026-53254)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the Bluetooth RFCOMM MCC handlers when processing truncated MCC frames from a remote Bluetooth device. A remote attacker can send specially crafted truncated MCC frames to cause a denial of service.

The issue affects the RFCOMM MCC handling paths including rfcomm_recv_mcc(), rfcomm_recv_pn(), rfcomm_recv_rpn(), rfcomm_recv_rls(), and rfcomm_recv_msc().

129) Out-of-bounds read (CVE-ID: CVE-2026-53255)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the tlv_data_is_valid() advertising data parser in net/bluetooth/mgmt.c when processing a crafted MGMT_OP_ADD_ADVERTISING request. A local user can send a specially crafted advertising data field to disclose sensitive information.

The issue is triggered when a malformed field length byte appears at the end of the supplied buffer.

130) Use-after-free (CVE-ID: CVE-2026-53256)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in rfcomm_connect_ind() and rfcomm_get_sock_by_channel() when handling RFCOMM connection indications for a listener socket during a concurrent close. A remote attacker can trigger a race condition to cause a denial of service.

The issue occurs in the Linux kernel Bluetooth RFCOMM socket handling path when a listener socket is closed while a child socket is being queued, and KASAN reported the resulting slab-use-after-free in lock_sock_nested().

131) Memory leak (CVE-ID: CVE-2026-53261)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in devlink_free() when freeing an unregistered devlink instance with a nested relation. A local user can trigger a probe failure after creating such a relation to cause a denial of service.

This can occur when a child devlink is linked to its parent before registration and the probe later fails.

132) Use-after-free (CVE-ID: CVE-2026-53262)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in pppol2tp_ioctl() when processing ioctl requests while a concurrent socket close frees the associated l2tp_session after a controllable sleep during copy_from_user(). A local user can trigger a userfaultfd-assisted page fault sleep and race a socket close to dereference a stale session pointer to cause a denial of service or execute arbitrary code.

Exploitation requires local access to issue the ioctl and induce the race condition.

133) Off-by-one (CVE-ID: CVE-2026-53263)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an off-by-one error in lowpan_iphc_mcast_ctx_addr_compress() when compressing multicast context addresses. A remote attacker can send network traffic that triggers the vulnerable compression path to disclose sensitive information.

Uninitialized kernel stack memory may be transmitted over the network via lowpan_push_hc_data().

134) Use-after-free (CVE-ID: CVE-2026-53264)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the net/sched action lifecycle handling in act_api when NEWTFILTER and DELFILTER are run concurrently. A local user can trigger concurrent filter operations to cause a denial of service.

The issue arises from a race between action lookup and action deletion under RCU-protected access.

135) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-53265)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a check-then-act race condition in smq_invalidate_mapping() in the dm-cache-policy-smq component when invalidating cache blocks concurrently. A local user can trigger concurrent invalidation operations to cause a denial of service.

The issue can corrupt the SMQ queues or hash table and may result in a double free condition.

136) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53266) Exploited

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory handling in the ebtables SNAT target ARP sender hardware address rewrite in net/bridge/netfilter/ebt_snat.c when processing ARP packets in bridge netfilter hooks. A local user can trigger ARP sender hardware address rewriting on a crafted nonlinear skb to cause a denial of service.

Exploitation requires the ARP sender hardware address rewrite path to be reached with a nonlinear skb fragment backed by a splice-imported file page.

137) Stack-based buffer overflow (CVE-ID: CVE-2026-53267)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a stack-based buffer overflow in nft_ct_get_eval and nft_ct_get_fast_eval in the netfilter nft_ct subsystem when processing a crafted nftables rule that uses a template conntrack object. A local user can create a crafted rule sequence to cause memory corruption.

The issue is triggered when a conntrack template created by a preceding expression is treated as a real conntrack entry by a subsequent expression on the same skb.

138) Out-of-bounds read (CVE-ID: CVE-2026-53268)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the conntrack_irc helper when parsing IRC DCC commands. A remote attacker can send specially crafted IRC traffic to cause a denial of service.

139) Race condition (CVE-ID: CVE-2026-53269)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the synproxy hook reference counting logic in netfilter when concurrently adding the first iptables target or nftables expression. A local user can trigger concurrent registration or teardown operations to cause a denial of service.

The issue affects on-demand netfilter hook registration performed by the SYNPROXY infrastructure from both iptables and nftables frontends.

140) Use-after-free (CVE-ID: CVE-2026-53270)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the IPVS scheduler handling in ip_vs_edit_service() when editing a service and unbinding the old scheduler. A local privileged user can trigger service reconfiguration while packets are being scheduled to cause a denial of service.

The issue occurs because packets may continue using the old scheduler after its scheduling data has been freed following an RCU grace period.

141) Use-after-free (CVE-ID: CVE-2026-53273)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the optee supplicant request handling in drivers/tee/optee/supp.c when a client exits before the supplicant finishes processing its request. A local user can trigger a race condition to cause a denial of service.

The issue occurs because the request can be freed by the client while its request ID remains referenced on the supplicant path.

142) Improper locking (CVE-ID: CVE-2026-53274)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a logic flaw in __smc_setsockopt() when copying user-supplied socket option data while holding the socket lock. A local user can pass a userfaultfd-monitored or FUSE-backed memory page as the optval argument to cause a denial of service.

Exploitation can keep the socket lock held indefinitely and, when combined with asynchronous tear-down operations such as shutdown(), can exhaust kernel worker threads and trigger the hung task watchdog.

143) Use-after-free (CVE-ID: CVE-2026-53275)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in __mld_query_work in net/ipv6/mcast.c when processing crafted MLD queries. A remote attacker can send a specially crafted MLD query packet to cause a denial of service.

The issue occurs because a pointer to the multicast group address is dereferenced after skb header reallocation following pskb_may_pull() calls.

144) Integer overflow (CVE-ID: CVE-2026-53329)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in dal_vector_reserve() in the AMD display vector implementation when resizing a vector buffer. A local user can trigger allocation size wraparound to cause a denial of service.

Successful exploitation can lead to a heap overflow on subsequent vector appends.

145) Improper locking (CVE-ID: CVE-2026-53331)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in qcom_slim_ngd_ssr_pdr_notify() and slim_report_absent() when processing SSR/PDR down notifications. A local user can trigger the vulnerable locking sequence to cause a denial of service.

The issue arises from inconsistent lock ordering between ctrl->tx_lock and ctrl->lock, creating a possible deadlock.

146) Use of Uninitialized Variable (CVE-ID: CVE-2026-53332)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use of uninitialized data in the qcom-ngd-ctrl driver when callbacks are triggered during NGD driver probing before device initialization completes. A local attacker can trigger parallel remoteproc startup or hardware interrupt handling to cause a denial of service.

The issue can prevent affected boards from booting.

147) Infinite loop (CVE-ID: CVE-2026-53336)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in the onie-tlv nvmem layout driver when parsing EEPROM entries with unknown types. A local attacker can provide a crafted EEPROM image containing a vendor-specific or otherwise unknown TLV entry to cause a denial of service.

148) NULL pointer dereference (CVE-ID: CVE-2026-53337)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in bond_do_ioctl() when handling bonding ioctl requests with a non-existent slave interface name. A local privileged user can send a bonding ioctl request referencing a non-existent slave interface to cause a denial of service.

The issue is reachable from userspace through the bonding ioctl interface.

149) NULL pointer dereference (CVE-ID: CVE-2026-53339)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in cci_remove() in the i2c-qcom-cci driver when removing or unbinding the driver on systems where only one I2C master is initialized. A local user can trigger device unbinding or driver removal to cause a denial of service.

Only systems where the Qualcomm CCI controller exposes two I2C masters but only one master is enabled are affected.

150) Memory corruption (CVE-ID: CVE-2026-53343)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper memory access in __switch_to() when performing a dummy read from the KASAN VMAP stack shadow. A local attacker can trigger execution on an affected ARM system to cause a denial of service.

Only ARM systems with CONFIG_KASAN_VMALLOC and CONFIG_VMAP_STACK enabled are affected, and the issue can cause an alignment exception before reaching init.

151) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-53345)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a warning condition in KVM memory dirty page tracking in virt/kvm/kvm_main.c when destroying a vCPU after certain SEV-ES VM-Exits without a subsequent KVM_RUN. A local user can trigger this condition to cause a denial of service.

The issue occurs in SEV-ES guest scenarios where KVM retains a writable mapping of a guest page across an exit to userspace.

152) Use of uninitialized resource (CVE-ID: CVE-2026-53347)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to access of uninitialized data in the virtio-gpu driver removal path when removing or unbinding the driver with KMS disabled. A local user can trigger driver removal or unbinding to cause a denial of service.

Only configurations where the virtio-gpu driver is built with KMS disabled are affected.

153) Use-after-free (CVE-ID: CVE-2026-53349)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in netfilter nf_conntrack expectation handling when processing an expected connection after a NAT helper module has been unloaded. A local privileged user can unload a NAT helper module while live expectations remain and then trigger the expected connection to cause a denial of service.

Reaching the vulnerable state requires CAP_SYS_MODULE in the initial user namespace to remove a NAT helper that still has live expectations.

154) NULL pointer dereference (CVE-ID: CVE-2026-53350)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in wm_adsp_control_remove() when removing firmware controls. A local user can trigger removal of a control without associated private control data to cause a denial of service.

The issue occurs for controls where private data is not created, including SYSTEM controls and controls hidden by a codec driver's control_add() callback.

155) Race condition (CVE-ID: CVE-2026-53352)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in zap_other_threads() when handling a concurrent execve() during a pending group stop. A local user can trigger this race to cause a denial of service.

The issue occurs when a multithreaded process receives a stop signal while one thread concurrently calls execve().

156) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-53353)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a missing internal state in hsr_addr_is_self() when processing packets during device teardown. A local user can send packets through an HSR device during the teardown window to cause a kernel warning.

The issue occurs in a window where the device remains discoverable after self_node has been cleared.

157) Race condition (CVE-ID: CVE-2026-53354)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in broadcast TLBI completion handling in the arm64 CPU errata logic when performing broadcast TLB invalidation on affected Arm CPUs. A local user can trigger memory management activity to cause a denial of service.

The issue affects completion of memory accesses translated by an invalidated TLB entry, while TLB invalidation itself still occurs correctly.

158) Use-after-free (CVE-ID: CVE-2026-53355)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the rds ib connection teardown path when unwinding a failed queue pair setup. A local user can trigger a setup failure after allocating the send ring to cause a denial of service.

The issue occurs when rds_ib_setup_qp() fails after allocating i_sends but before allocating i_recvs, leaving a stale pointer that may be treated as a live allocation during a later shutdown pass.

159) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2026-53356)

CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose or modify unintended memory contents.

The vulnerability exists due to improper pointer handling in i915_gem_object_pread_phys and i915_gem_object_pwrite_phys in the i915 GEM physical buffer object handling code when processing pread or pwrite operations with a non-zero offset. A local user can supply crafted offset values to access the wrong parts of a physical buffer object to disclose or modify unintended memory contents.

The issue affects physical buffer objects on impacted platforms using overlay or cursor planes with physical mapping.

160) Use-after-free (CVE-ID: CVE-2026-53357)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in l2cap_sock_cleanup_listen() and bt_accept_dequeue() in the Bluetooth L2CAP socket handling code when racing listen socket cleanup with a concurrent HCI disconnect. A local user can trigger a listen/close versus HCI-disconnect race to cause a denial of service.

The issue occurs during cleanup of not-yet-accepted child sockets on a listening socket.

161) Improper locking (CVE-ID: CVE-2026-53358)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in l2cap_sock_cleanup_listen() when cleaning up listening L2CAP channels. A local user can trigger a race condition to cause a denial of service.

The issue involves incorrect lock ordering between conn->lock, chan->lock, and sk_lock during Bluetooth L2CAP channel cleanup.

162) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-63867)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause inconsistent MPTCP receiver window signaling.

The vulnerability exists due to a time-of-check time-of-use race in the MPTCP DSS option handling in net/mptcp/options.c when processing and emitting MPTCP acknowledgments on outgoing packets. A remote attacker can trigger packet processing that causes inconsistent ack_seq values to be used to confuse the peer.

The issue arises because the MPTCP-level ack_seq was accessed locklessly multiple times, allowing different values to be used for the DSS data acknowledgment and the announced receive window within the same packet.

163) Integer underflow (CVE-ID: CVE-2026-63868)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an unsigned integer underflow in garp_pdu_parse_attr in the GARP receive-side attribute parser when parsing crafted GARP attributes. A remote attacker can send crafted Join or Leave events to cause a denial of service.

The issue can cause received GARP events for common attributes, such as GVRP VLAN registration attributes, to be ignored.

164) Out-of-bounds write (CVE-ID: CVE-2026-63869)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds shift in ieee80211_parse_tx_radiotap() when parsing the radiotap header of an injected frame. A local user can supply a crafted frame from userspace to cause a denial of service.

The issue is triggered by the IEEE80211_RADIOTAP_ANTENNA value being used directly as a shift count, and larger antenna indices cannot be represented by the 2-bit bitmap.

165) Use of uninitialized resource (CVE-ID: CVE-2026-63870)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in lowpan_xmit() in the ieee802154 6LoWPAN transmit path when processing a non-IPv6 packet queued for transmission on a 6LoWPAN interface. A local user can queue a non-IPv6 packet for transmission to cause a denial of service.

The issue occurs because address information in skb headroom may remain uninitialized and is later copied and used by the transmit path.

166) Race condition (CVE-ID: CVE-2026-63871)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in Bluetooth ISO socket handling in net/bluetooth/iso.c when calling hci_get_route() on iso_pi socket fields without holding the socket lock. A local user can trigger concurrent connect() or setsockopt() operations on the same socket to cause a denial of service.

The issue was reported by KCSAN as a data race during Bluetooth ISO connection and listening operations.

167) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-63875)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cache invalidation in arm64 TLB flushing logic when unsharing PMD tables. A local user can trigger PMD table unsharing to cause a denial of service.

The issue can leave a stale PMD page table entry in the walk cache, which may result in incorrect page table walks.

168) NULL pointer dereference (CVE-ID: CVE-2026-63876)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the zs serial driver during serial port initialization when initializing the first serial port. A local user can trigger driver initialization to cause a denial of service.

The issue can crash the kernel during system bootstrap on affected DECstation systems.

169) NULL pointer dereference (CVE-ID: CVE-2026-63877)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the dz serial driver when initializing the first serial port. A local attacker can trigger serial port initialization to cause a denial of service.

The crash occurs because a pointer derived from a null parent-device pointer is dereferenced during early system bootstrap.

170) Integer overflow (CVE-ID: CVE-2026-63881)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in get_queue_ids() in the amdkfd kfd debugger when processing a user-supplied queue ID array. A local user can supply crafted queue count values to cause a denial of service.

The issue affects 32-bit size_t builds.

171) NULL pointer dereference (CVE-ID: CVE-2026-63882)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in svm_range_set_attr in the amdkfd SVM subsystem when handling a kfd_ioctl_svm call without a prior kfd_ioctl_acquire_vm call. A local user can invoke the affected ioctl sequence to cause a denial of service.

172) Integer underflow (CVE-ID: CVE-2026-63883)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose stale buffer data.

The vulnerability exists due to an integer underflow in qcom_geni_serial_handle_tx_dma() when handling a DMA completion interrupt after uart_flush_buffer() resets the transmit buffer. A local user can trigger a flush before DMA completion is processed to disclose stale buffer data.

The issue is caused by a race condition between transmit buffer flushing and delayed DMA completion handling.

173) Use-after-free (CVE-ID: CVE-2026-63884)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the i915 TTM object purge logic when purging an object during eviction after validating buffer object placement. A local user can trigger the purge path through crafted GPU memory management operations to cause a denial of service.

The issue was reported under heavy use on DG2 systems and occurs because the associated i915 TTM page vector container may be replaced while the object is still busy.

174) Heap-based buffer overflow (CVE-ID: CVE-2026-63886)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in chap_server_compute_hash() in the iSCSI target CHAP authentication handling when processing a specially crafted base64-encoded CHAP_R response. A remote user can send a specially crafted CHAP authentication response to cause a denial of service.

The issue affects the BASE64 CHAP_R decoding path; the mutual CHAP CHAP_C decoding path is not affected.

175) Heap-based buffer overflow (CVE-ID: CVE-2026-63887)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in iscsi_encode_text_output() when processing iSCSI login text parameters. A remote attacker can send a specially crafted login request with many minimal key-value pairs to cause a denial of service.

The issue can be triggered by expansion of unknown keys into larger "NotUnderstood" response records during login negotiation.

176) Double free (CVE-ID: CVE-2026-63888)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a double free in iscsit_handle_text_cmd() when handling a Text PDU with a bad DataDigest on connections using ErrorRecoveryLevel greater than 0. A remote user can send a specially crafted text request to cause a denial of service.

On hardened kernels the flaw can trigger a remote kernel BUG(), while on non-hardened kernels it can corrupt the slab freelist. A follow-up Text Request on the same ITT or session teardown can free the same pointer again.

177) Out-of-bounds read (CVE-ID: CVE-2026-63888)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in iscsit_handle_text_cmd() when processing Text PDUs with DataDigest enabled. A remote user can send a specially crafted text request to cause a denial of service.

The issue is triggered when DataDigest is negotiated for the connection.

178) Integer overflow (CVE-ID: CVE-2026-63889)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop caused by an integer truncation error in the FPIN pname walker in scsi_transport_fc when processing a crafted FPIN ELS frame. A remote attacker can send a crafted Fibre Channel fabric frame to cause a denial of service.

Exploitation requires the ability to inject Fibre Channel fabric traffic to an lpfc or qla2xxx Linux initiator, such as from a compromised switch or fabric controller, or from a same-zone N_Port on a fabric that permits source spoofing.

179) Improper input validation (CVE-ID: CVE-2026-63890)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in fcoe_ctlr_recv_clr_vlink() in drivers/scsi/fcoe/fcoe_ctlr.c when processing FIP CVL frames. A remote attacker can send a crafted FIP CVL frame with a zero-length non-critical descriptor to cause a denial of service.

Exploitation is limited to an unauthenticated layer 2 peer on the FCoE control VLAN and can block subsequent FIP frames on the affected controller.

180) Uncontrolled Recursion (CVE-ID: CVE-2026-63891)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in __tb_property_parse_dir() in the thunderbolt property parser when processing a crafted PROPERTIES_REQUEST control-plane exchange containing chained DIRECTORY entries with a back-reference loop. A remote attacker can send crafted XDomain property data to cause a denial of service.

The issue can be triggered by an untrusted XDomain peer such as a cable, dock, in-line inspector, or adjacent host.

181) Out-of-bounds read (CVE-ID: CVE-2026-63892)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read and integer underflow in __tb_property_parse_dir() in the thunderbolt property parser when parsing a crafted non-root property directory with dir_len less than 4. A local user can provide crafted property data to trigger out-of-bounds memory access and cause a denial of service.

The issue affects the non-root parsing path, where a short directory length can cause a UUID copy to read past the end of the property block and can also cause entry walking to continue out of bounds until the kernel oopses.

182) Integer overflow (CVE-ID: CVE-2026-63893)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer overflow leading to an out-of-bounds read in tb_property_entry_valid() in the thunderbolt property parser when processing a crafted XDomain property block from a peer device. A remote attacker can send crafted property entries with wrapped value and length fields to disclose sensitive information.

For TEXT-typed entries using the "deviceid" or "vendorid" keys, leaked data may be exposed through the per-XDomain sysfs device_name or vendor_name attributes. The disclosed data is NUL-bounded and the attacker controls an offset rather than an absolute address.

183) Out-of-bounds read (CVE-ID: CVE-2026-63895)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ffs_ep0_read() in the FunctionFS gadget implementation when handling a short ep0 control-OUT read. A local privileged user can trigger a short control-OUT transfer and read back uninitialized kernel heap memory to disclose sensitive information.

The issue is reachable through the FunctionFS device node and requires access to the privileged gadget daemon context. Reproducing the condition also requires bypassing normal host-side checks that usually reject short-wLength control-OUT requests before they reach the gadget.

184) Integer overflow (CVE-ID: CVE-2026-63896)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow leading to an out-of-bounds write in the WebUSB GET_URL handler in composite_setup() when processing a crafted USB SETUP packet. A remote attacker can send a specially crafted USB request to cause a denial of service.

Exploitation is possible against gadgets with webusb/use=1 and a landing page configured.

185) Out-of-bounds read (CVE-ID: CVE-2026-63897)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the mct_u232 USB serial driver interrupt-in transfer handler when processing short interrupt-in transfers. A local user can trigger the driver to process a specially crafted short interrupt-in packet to disclose sensitive information.

The issue can lead to stale or uninitialized slab data being exposed to user space.

186) Out-of-bounds write (CVE-ID: CVE-2026-63898)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the mct_u232 USB serial driver when handling a malicious USB device that reports a smaller endpoint maximum packet size than expected. An attacker with physical access can connect a specially crafted USB device to cause memory corruption.

187) Out-of-bounds write (CVE-ID: CVE-2026-63899)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the mxuport USB serial driver when handling a malicious USB device that reports a bulk-out endpoint max packet size smaller than eight bytes. An attacker with physical access can attach a crafted device to cause memory corruption.

188) Out-of-bounds read (CVE-ID: CVE-2026-63900)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the usa49wg indat transfer parser in drivers/usb/serial/keyspan.c when parsing malformed indat packets from a USB device. A local attacker can provide a specially crafted USB device to disclose sensitive information.

The issue can cause parsing of stale or uninitialised slab data.

189) Improper input validation (CVE-ID: CVE-2026-63901)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to improper input validation in the digi_acceleport USB serial driver when handling a malicious USB device that reports smaller bulk-out buffers than expected. An attacker with physical access can connect a crafted device to cause memory corruption.

The issue can lead to out-of-bounds memory accesses or slab corruption.

190) Out-of-bounds read (CVE-ID: CVE-2026-63902)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in cypress_read_int_callback() in the cypress_m8 USB serial driver when processing malformed short interrupt packets. A local attacker can provide a specially crafted short interrupt report to cause a denial of service.

Successful interrupt transfers can complete with fewer bytes than required for the selected Cypress packet header format.

191) Out-of-bounds read (CVE-ID: CVE-2026-63903)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the belkin_sa_read_int_callback() USB serial interrupt handler when processing short successful interrupt transfers. A local attacker can trigger the driver to parse a crafted short interrupt packet to disclose sensitive information.

The issue occurs because the handler treats interrupt data as a four-byte status report and reads status fields at offsets 2 and 3 even when the completed packet is shorter.

192) Out-of-bounds read (CVE-ID: CVE-2026-63904)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the usbtmc interrupt notification handling in drivers/usb/class/usbtmc.c when processing interrupt-in notifications with an insufficient URB actual_length. A local attacker can provide a crafted USBTMC device that sends a short notification to disclose sensitive information.

The issue can also cause stale leftover data from a previous notification to be consumed.

193) Use-after-free (CVE-ID: CVE-2026-63905)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in vudc_remove() and the vudc transfer timer handling when racing device teardown with a pending or executing timer. A local user can repeatedly trigger unbind and rebind operations while the timer is active to cause a denial of service.

The issue is triggered by a race condition during the unplug or unbind path.

194) Use-after-free (CVE-ID: CVE-2026-63906)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in omap2430_probe() in the omap2430 USB driver when handling a crafted platform device state. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because a device tree node reference is released before its last access in both the success and error paths.

195) Out-of-bounds write (CVE-ID: CVE-2026-63908)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite adjacent memory.

The vulnerability exists due to an out-of-bounds write in mxt_prepare_cfg_mem in the atmel_mxt_ts driver when parsing a crafted configuration file with an object size larger than the expected object size. A local user can provide a specially crafted configuration file to overwrite adjacent memory.

The issue is caused by an incorrect boundary check on a 0-based index, which allows exactly one byte past the valid object boundary to be written.

196) Out-of-bounds read (CVE-ID: CVE-2026-63909)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in smb_check_perm_dacl() ACE-walk loops in ksmbd when processing SMB2_CREATE operations with a crafted security descriptor. A remote attacker can send a specially crafted request to disclose sensitive information.

The issue is caused by a transposed bounds check that can leave the loop guard ineffective and permit reading ace->size even when only 0 to 3 bytes remain in the ACE data.

197) Improper input validation (CVE-ID: CVE-2026-63912)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ESP out-of-place fast path in net/ipv4/esp4.c and net/ipv6/esp6.c when processing packet data with a combined aligned data length and trailer length exceeding a page. A local user can trigger this condition to cause a denial of service.

The issue affects both IPv4 and IPv6 ESP processing paths.

198) Insufficient verification of data authenticity (CVE-ID: CVE-2026-63913)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state validation in the TCP conntrack state machine in netfilter conntrack when processing a crafted SYN followed by an invalid-sequence RST packet. A remote attacker can send a specially crafted packet sequence to cause a denial of service.

The issue can prematurely terminate an active NAT entry by forcing the conntrack entry into the CLOSE state.

199) Improper access control (CVE-ID: CVE-2026-63914)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in xfrm migrate notification handling in net/xfrm/xfrm_user.c and net/key/af_key.c when broadcasting successful XFRM_MSG_MIGRATE or SADB_X_MIGRATE events across network namespaces. A local user can trigger a migration notification from a non-init network namespace to disclose sensitive information.

An IKE daemon running in the initial network namespace may receive migration notifications originating from other network namespaces, including selector, old and new endpoint addresses, and the km_address.

200) Out-of-bounds read (CVE-ID: CVE-2026-63915)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in HCP header parsing in nfc_hci_recv_from_llc() and nci_hci_data_received_cb() when processing a 0-byte HCP frame from an NFC peer. A remote attacker can send a malformed HCP frame to cause a denial of service.

A non-final fragmented 0-byte frame can also underflow the reassembly length to UINT_MAX and trigger skb_over_panic() during reassembly.

201) Out-of-bounds write (CVE-ID: CVE-2026-63916)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in wacom_hid_set_device_mode() when handling a HID feature report where HID_DG_INPUTMODE is mapped to a field other than the first one. A local user can connect or emulate a crafted device to trigger the out-of-bounds write and cause a denial of service.

The issue occurs when the first field in the feature report has a report_count smaller than the usage index of HID_DG_INPUTMODE.

202) Use-after-free (CVE-ID: CVE-2026-63917)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the vti6 tunnel handling code in net/ipv6/ip6_vti.c when changing the configuration of a vti6 device after moving it across network namespaces. A local user can move a vti6 device between namespaces and then change its link parameters to cause a denial of service.

The issue is reachable from an unprivileged user namespace and may have cross-tenant impact on container hosts.

203) Use-after-free (CVE-ID: CVE-2026-63919)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in xfrm transport-mode deferred reinjection handling in net/xfrm/xfrm_input.c when processing deferred transport reinjection callbacks that use a stored network namespace pointer. A local user can trigger deferred transport reinjection with a dangling net namespace reference to cause a denial of service.

204) Out-of-bounds read (CVE-ID: CVE-2026-63920)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ip6_datagram_recv_specific_ctl() when processing IPv6 extension headers for recvmsg control messages after the hdrlen field is modified. A local user can use an nftables payload-write expression to corrupt the extension header length and trigger copying beyond the available header data to disclose sensitive information.

Exploitation is reachable from an unprivileged user namespace.

205) Improper access control (CVE-ID: CVE-2026-63921)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to redirect packets across network namespaces.

The vulnerability exists due to improper access control in vti6_siocdevprivate() in the IPv6 VTI tunnel handling code when processing SIOCCHGTUNNEL requests on a migrated tunnel. A local user can supply tunnel parameters that collide with a tunnel in the creation namespace to redirect packets across network namespaces.

Exploitation is reachable from an unprivileged user namespace and can have cross-tenant scope on container hosts.

206) Use-after-free (CVE-ID: CVE-2026-63922)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free risk from stale pointer reuse in ip6_parse_tlv() in net/ipv6/exthdrs.c when parsing IPv6 TLVs containing the HAO option. A remote attacker can send a specially crafted IPv6 packet to cause a denial of service.

The issue occurs when handling a cloned skb where header expansion moves the skb head and invalidates the cached network header pointer.

207) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2026-63924)

CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper pointer handling in the IPv6 extension header parser in net/ipv6/exthdrs.c when processing IPv6 jumbo hop-by-hop options. A remote attacker can send a specially crafted IPv6 packet to cause a denial of service.

208) Integer overflow (CVE-ID: CVE-2026-63925)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass replay protection.

The vulnerability exists due to an integer overflow in macsec_post_decrypt() when processing a crafted replayed frame on an XPN association with a packet number of 0xffffffff. A remote attacker can replay a captured legitimate frame to bypass replay protection.

Exploitation requires capturing a legitimate frame carrying the maximum 32-bit packet number on an XPN association.

209) Incorrect calculation (CVE-ID: CVE-2026-63926)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper offset calculation in bpf_msg_push_data() in the sockmap BPF subsystem when inserting data into the middle of a scatterlist entry. A local user can trigger the inconsistent split layout to cause a denial of service.

Exploitation requires access to BPF sockmap functionality.

210) Use-after-free (CVE-ID: CVE-2026-63927)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the dwc2 USB host controller driver debug code when dequeuing a usb request block and logging its status after calling usb_hcd_giveback_urb(). A local user can trigger URB handling to cause a denial of service.

The issue occurs in debug logging within the _dwc2_hcd_urb_dequeue() path.

211) Out-of-bounds write (CVE-ID: CVE-2026-63928)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the omninet USB serial driver bulk-out buffer handling when processing a malicious USB device that reports a smaller endpoint max packet size than expected. An attacker with physical access can connect a crafted USB device to cause memory corruption.

The issue can lead to user-controlled slab corruption.

212) Use-after-free (CVE-ID: CVE-2026-63930)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in iio_hw_consumer_alloc() when cleaning up buffers in the error path. A local user can trigger the vulnerable cleanup path to cause a denial of service.

213) Division by zero (CVE-ID: CVE-2026-63931)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in the scd30_write_raw function when writing a zero fractional part to the sampling_frequency sysfs attribute. A local user can write a zero fractional value to the sampling_frequency sysfs attribute to cause a denial of service.

214) Division by zero (CVE-ID: CVE-2026-63933)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in adis16260_write_raw in the adis16260 gyroscope driver when writing a zero value to the sampling_frequency sysfs attribute. A local user can write zero to the sampling_frequency sysfs attribute to cause a denial of service.

215) Use of Uninitialized Variable (CVE-ID: CVE-2026-63934)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access of uninitialized memory in the itg3200 triggered buffer handling path when processing i2c reads for all scan channels. A local user can read data from /dev/iio:deviceX to disclose sensitive information.

The non-buffered read_raw() path is unaffected.

216) Race condition (CVE-ID: CVE-2026-63942)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the parport subsystem when port and client drivers are loaded around the same time during boot. A local user can load the lp and parport_pc modules concurrently to cause a crash.

The issue occurs because client drivers can attach to ports that are not completely initialized or are being torn down.

217) Out-of-bounds read (CVE-ID: CVE-2026-63943)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in xpadone_process_packet() when processing a crafted GIP_CMD_INPUT packet from a device. An attacker with physical access can supply a malformed controller packet with a short length to cause a denial of service.

The issue is triggered by a broken or malicious controller that controls both the reported packet length and packet contents.

218) Use-after-free (CVE-ID: CVE-2026-63944)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in hci_le_create_cis_sync in the Bluetooth HCI synchronization logic when processing concurrent Bluetooth connection state changes during LE Create CIS handling. A local user can trigger a concurrent disconnect to cause a denial of service.

The stale pointer is dereferenced after both rcu_read_lock() and hci_dev_lock(hdev) are released, and the queued cancellation path does not match the pending work item because it is queued with NULL data but dequeued with the connection pointer.

219) Race condition (CVE-ID: CVE-2026-63945)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to a null pointer dereference or use-after-free in iso_sock_clear_timer in the Bluetooth ISO socket handling code when closing a socket concurrently with connection deletion. A local user can trigger concurrent socket operations to cause a denial of service.

220) Use-after-free (CVE-ID: CVE-2026-63946)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in iso_recv_frame in the Bluetooth ISO subsystem when processing received Bluetooth ISO frames. A local user can trigger concurrent socket teardown and frame handling to cause a denial of service.

Exploitation requires a race condition between frame reception and iso_sock_kill() freeing the socket.

221) Out-of-bounds read (CVE-ID: CVE-2026-63947)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in hidp_input_report() when processing truncated Bluetooth HIDP input packets. A remote user can send a specially crafted truncated packet to disclose sensitive information.

Exploitation requires a paired Bluetooth device.

222) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-63948)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference leak in l2cap_chan_timeout() in the Bluetooth L2CAP subsystem when handling a channel timeout with a null connection pointer. A local user can trigger this condition to cause a denial of service.

223) Out-of-bounds read (CVE-ID: CVE-2026-63949)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in linedisp_display() in the line-display auxdisplay subsystem when handling a zero-byte write to the message sysfs attribute. A local user can write zero bytes to the message sysfs attribute to cause a denial of service.

On KASAN-enabled kernels, the issue triggers an out-of-bounds report and panic.

224) Improper access control (CVE-ID: CVE-2026-63952)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass write sealing protections and modify a memfd that appears to be write sealed.

The vulnerability exists due to improper access control in memfd_add_seals() in mm/memfd.c when adding SEAL_EXEC to a memfd with writable mappings. A local user can add a seal combination that implies SEAL_WRITE after the writable-mapping check to bypass write sealing protections and modify a memfd that appears to be write sealed.

The issue occurs because SEAL_EXEC implies SEAL_WRITE, but the implied seal was applied only after the check for writable mappings.

225) Improper Initialization (CVE-ID: CVE-2026-63954)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in hpfs_check_free_dnodes in fs/hpfs/alloc.c when handling a failure from hpfs_map_dnode_bitmap. A local user can trigger the error path to cause a denial of service.

226) Improper input validation (CVE-ID: CVE-2026-63956)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or corrupt memory.

The vulnerability exists due to improper input validation in the cypress_m8 USB serial driver when processing a malicious USB device with a too-small interrupt-out endpoint max packet size. An attacker with physical access can connect a specially crafted USB device to cause a denial of service or corrupt memory.

The issue can be triggered if a device reports an interrupt-out endpoint max packet size smaller than eight bytes.

227) Out-of-bounds write (CVE-ID: CVE-2026-63957)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the safe_serial USB serial driver when processing a malicious USB device that reports a bulk-out endpoint size smaller than eight bytes in safe mode. An attacker with physical access can connect a crafted USB device to cause memory corruption.

Exploitation requires the target system to interact with a malicious USB device operating in safe mode.

228) Out-of-bounds write (CVE-ID: CVE-2026-63958)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in ucsi_connector_change() when handling a crafted UCSI CCI notification with an invalid connector number. A local attacker can provide a bogus connector number to trigger work scheduling on memory past the end of the connector array to cause a denial of service.

Exploitation requires control of a buggy or malicious PPM, such as EC firmware or an attached UCSI controller on supported transports.

229) Out-of-bounds read (CVE-ID: CVE-2026-63959)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the tcpci_maxim RX message processing logic when processing a crafted USB Type-C/Power Delivery frame with a mismatched header data object count. An attacker with physical access can send a specially crafted frame to disclose sensitive information.

The issue occurs when a CRC-valid frame advertises more data objects in the header than are actually present in the message body.

230) Out-of-bounds write (CVE-ID: CVE-2026-63960)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in wcove_read_rx_buffer() when processing a crafted USB Power Delivery frame from a connected port partner. An attacker with physical access can transmit a crafted 31-byte frame to cause memory corruption.

The issue occurs on the IRQ thread stack, and the final register read may write past the end of struct pd_message.

231) Out-of-bounds read (CVE-ID: CVE-2026-63961)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the DisplayPort altmode handler when processing a malformed Status Update VDO from a connected USB Type-C device. An attacker with physical access can send a device response with an incorrect VDO count to disclose sensitive information.

The issue can cause the kernel to read uninitialized stack data and forward it elsewhere.

232) Improper input validation (CVE-ID: CVE-2026-63964)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper input validation in the do_flash() function in the ucsi_ccg driver when parsing a crafted firmware image without a ':' record header. A local privileged user can place a crafted firmware file under /lib/firmware and write to the do_flash sysfs attribute to cause a denial of service.

The issue can be triggered by an unsigned firmware blob reaching the flashing logic.

233) Use of Uninitialized Variable (CVE-ID: CVE-2026-63967)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory in the tagged FIFO buffer handling in st_lsm6dsx_buffer.c when copying FIFO sample data to userspace. A local user can read exposed uninitialized stack data to disclose sensitive information.

The issue affects the tagged FIFO path because a hole in the aligned stack structure is copied together with sample data and timestamp fields.

234) Infinite loop (CVE-ID: CVE-2026-63968)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in fib6_select_path() when walking IPv6 route sibling entries during softirq-side processing. A local attacker can trigger route processing to cause a denial of service.

The issue occurs because a detached sibling entry may still point into an old ring, preventing the walker from reaching its termination condition.

235) Infinite loop (CVE-ID: CVE-2026-63969)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a stale linked-list state in rt6_fill_node() when walking IPv6 route sibling entries during softirq-side processing. A local user can trigger route state changes to cause a CPU stall.

The issue can result in an infinite loop in the walker.

236) Race condition (CVE-ID: CVE-2026-63971)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in sctp_wait_for_connect() in the SCTP socket implementation when waiting for an association to reach established state while another thread peels off the association to a new socket. A local user can trigger association migration during this window to cause a denial of service.

Exploitation requires concurrent access from another thread while the socket lock is dropped and re-acquired.

237) NULL pointer dereference (CVE-ID: CVE-2026-63973)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mana network driver teardown path when cleaning up after a partial queue allocation failure. A local user can trigger queue allocation failure and subsequent teardown handling to cause a denial of service.

The issue can be reached through multiple teardown paths, including device removal, MTU change recovery, and internal error handling.

238) Race condition (CVE-ID: CVE-2026-63974)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in hci_dev_close_sync() in the Bluetooth HCI subsystem when closing a device during the reset path. A local user can trigger Bluetooth device reset and close operations to cause a denial of service.

239) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-63975)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of channel deletion during list iteration in l2cap_ecred_conn_rsp in the Bluetooth L2CAP subsystem when processing a crafted L2CAP credit-based connection response with an already-assigned destination CID. A remote attacker can send a specially crafted Bluetooth packet to cause a denial of service.

The issue occurs when a duplicate destination CID is received for an L2CAP extended credit based connection response.

240) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-63976)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in the Bluetooth L2CAP ECRED reconfiguration response handler when processing a replayed failure response after a successful reconfiguration. A remote attacker can replay a failure response with a stale ident value to cause a denial of service.

The issue can destroy an already-established channel by causing the kernel to match a subsequent response against a recycled ident value.

241) Improper locking (CVE-ID: CVE-2026-63980)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the net/handshake subsystem when canceling a TLS handshake from softirq context while the same lock is held in process context on the same CPU. A local user can trigger a TLS handshake cancellation race to cause a denial of service.

The issue results in a deadlock.

242) Integer overflow (CVE-ID: CVE-2026-63984)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory in a forwarded packet.

The vulnerability exists due to an integer overflow in ipv6_rpl_srh_decompress() and ipv6_rpl_srh_rcv() when processing a crafted IPv6 RPL source routing header. A remote attacker can send a specially crafted packet to corrupt memory in a forwarded packet.

The issue occurs because the computed hdrlen value can truncate to zero for a large segment count, causing the compressed header to overlap the decompressed routing data.

243) Improper input validation (CVE-ID: CVE-2026-63985)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in fallback_set_params() in the ethtool EEPROM Netlink fallback path when processing module EEPROM read parameters. A local user can supply an offset and length combination that exceeds the EEPROM bounds to cause a denial of service.

The issue affects the Netlink fallback path for reading module EEPROM and may lead to unexpected behavior in drivers or device firmware.

244) NULL pointer dereference (CVE-ID: CVE-2026-63990)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null-pointer dereference in the bonding driver when enslaving a CAN device to a bonding master. A local user can enslave a virtual CAN device to a bonding master to cause a denial of service.

The issue can be triggered with a virtual CAN device such as vxcan, and subsequent socket cleanup operations may access invalid CAN receiver state.

245) NULL pointer dereference (CVE-ID: CVE-2026-63991)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in send_mcast_pkt() in the Bluetooth 6LoWPAN subsystem when processing multicast packets. A local user can trigger a memory allocation failure that leads to dereferencing a NULL skb pointer in send_pkt() to cause a denial of service.

246) Out-of-bounds read (CVE-ID: CVE-2026-63992)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in iptunnel_pmtud_check_icmp() when processing ICMP packets without a valid transport header. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because the function may be called while the skb transport header is not set.

247) Use-after-free (CVE-ID: CVE-2026-63993)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the vxlan_xmit_one function in drivers/net/vxlan/vxlan_core.c when processing packets after skb_tunnel_check_pmtu() updates the skb head. A local user can trigger the vulnerable code path to execute arbitrary code.

248) Use-after-free (CVE-ID: CVE-2026-63994)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() when processing tunnel PMTU ICMP and ICMPv6 packet generation. A local user can trigger skb_cow() reallocation while stale network header pointers are still used to cause a denial of service.

249) Out-of-bounds read (CVE-ID: CVE-2026-64000)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in supervision frame handling in net/hsr/hsr_forward.c when processing truncated supervision frames. A remote attacker can send a specially crafted frame to cause a denial of service.

250) Use-after-free (CVE-ID: CVE-2026-64001)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in snd_pcm_oss_proc_write() and snd_pcm_oss_look_for_setup() when handling proc writes followed by a later OSS device open. A local user can trigger a proc write error that leaves a stale setup_list entry and then open an OSS device to dereference freed memory to cause a denial of service.

The issue arises because a newly allocated setup entry may be linked into setup_list before task name allocation completes.

251) Use-after-free (CVE-ID: CVE-2026-64002)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ipv4_sysctl_exit_net() when unregistering the IPv4 sysctl table while sysctl handlers may still access sysctl_local_reserved_ports. A local user can trigger access to the freed sysctl entry to cause a denial of service.

The issue affects access to /proc/sys/net/ipv4/ip_local_reserved_ports during network namespace sysctl teardown.

252) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64003)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state handling in scsi_run_host_queues() when processing requeued commands during SCSI host recovery and device removal. A local user can trigger SCSI error recovery and device removal conditions to cause a denial of service.

The issue can leave requeued requests stuck and cause the affected device removal process to hang.

253) Race condition (CVE-ID: CVE-2026-64004)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the AF_IUCV getsockopt handler when racing recvmsg() with getsockopt(SO_MSGSIZE). A local user can trigger concurrent socket operations to cause a denial of service.

The issue can lead to a NULL pointer dereference in the kernel.

254) Improper Initialization (CVE-ID: CVE-2026-64005)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the SMC hash tables in net/smc/af_smc.c when initializing the SMC subsystem. A local user can trigger use of corrupted hash list state to cause a denial of service.

The issue can occur when the hash tables are re-initialized after hash entries already exist and are in use, potentially resulting in a corrupted list.

255) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64006)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of overlapping registers in nf_tables bitwise and byteorder operations when processing crafted nf_tables register operations. A local user can create overlapping source and destination register operations to cause incorrect packet filtering behavior and a denial of service.

Exploitation requires the ability to configure nf_tables rules.

256) Use-after-free (CVE-ID: CVE-2026-64007)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption or a denial of service.

The vulnerability exists due to a use-after-free in synproxy_tstamp_adjust() in the netfilter synproxy implementation when processing crafted TCP packets that trigger header rewriting on a cloned or non-linear skb. A remote attacker can send a specially crafted packet to cause memory corruption or a denial of service.

The issue affects checksum updates after the packet buffer is made writable, which can result in a write to freed slab memory or a transmitted packet with a stale checksum.

257) Integer underflow (CVE-ID: CVE-2026-64009)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow leading to an out-of-bounds write in the esp component, specifically xfrm_state_mtu(), when processing a UDP datagram through an IPv4 ESP tunnel SA with attacker-controlled parameters. A local user can install a crafted IPv4 ESP tunnel SA and send a UDP datagram through the tunnel to cause a denial of service.

The issue involves a negative length being sign-extended to size_t before being passed to memset() in esp_output_fill_trailer().

258) Use-after-free (CVE-ID: CVE-2026-64010)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race condition in nfc_llcp_recv_cc() when processing an NFC LLCP connection acceptance packet concurrently with socket release. A local user can trigger concurrent connection handling and socket release to cause a denial of service.

The issue occurs during a connection state transition when a socket can be moved from the connecting_sockets list to the sockets list after it has already been unlinked and marked for destruction.

259) Use-after-free (CVE-ID: CVE-2026-64011)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in llcp_sock_release() when releasing an LLCP socket in connecting state. A local user can trigger socket release in that state to cause a denial of service.

260) NULL pointer dereference (CVE-ID: CVE-2026-64012)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the sch_sfb packet scheduler when dequeuing packets from child qdiscs after a peek operation. A local user can trigger network traffic processing through a crafted qdisc hierarchy to cause a denial of service.

Exploitation requires the sfb scheduler to have child qdiscs whose peek callback uses qdisc_peek_dequeued().

261) Out-of-bounds read (CVE-ID: CVE-2026-64014)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the nexio_read_data() function in the usbtouchscreen driver when processing a crafted device interrupt packet with falsified length fields. An attacker with physical access can provide a malicious USB device that reports oversized data_len and x_len values to disclose sensitive information and cause a denial of service.

Kernel memory contents may be exposed to userspace through reported ABS_X and ABS_Y input events.

262) Race condition (CVE-ID: CVE-2026-64015)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in find_key_to_update in the keyring code when looking up keys for update without holding the RCU read lock. A local user can trigger concurrent key lookup and garbage-collection activity to cause a denial of service.

The issue affects persistent key handling, which uses a different locking model.

263) Out-of-bounds read (CVE-ID: CVE-2026-64018)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in mana_hwc_rx_event_handler() when processing hardware-modifiable WQE contents from DMA-coherent memory. A local attacker can modify the derived rx_req_idx value to cause a denial of service.

In confidential VMs such as SEV-SNP and TDX, the affected DMA-coherent memory is shared unencrypted and hardware can modify WQE contents at any time.

264) Use-after-free (CVE-ID: CVE-2026-64025)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in sk_psock_verdict_data_ready in the Linux kernel BPF sockmap/skmsg handling when processing socket data with a TLS RX context present. A local user can trigger the race condition to cause a denial of service or execute arbitrary code.

Exploitation requires a socket to be inserted into a sockmap before TLS RX is configured.

265) Memory corruption (CVE-ID: CVE-2026-64026)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause pagecache corruption.

The vulnerability exists due to memory corruption in the Linux kernel RxRPC recvmsg handling when decrypting locally transmitted DATA packets processed through splice(). A local user can trigger crafted local packet handling to cause pagecache corruption.

The issue affects in-place decryption of shared packet data, and MSG_PEEK may influence which packet is decrypted and require re-decryption during subsequent recvmsg() processing.

266) Use-after-free (CVE-ID: CVE-2026-64029)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in seq_ump_process_event() and snd_rawmidi_kernel_write1() when processing sequencer events during concurrent output teardown. A local user can trigger concurrent event delivery and output close operations to cause a denial of service.

The issue arises from a race condition between the event_input path and the last output unuse path, where the rawmidi substream runtime may be freed while still in use.

267) Use-after-free (CVE-ID: CVE-2026-64032)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the bridge multicast handling in net/bridge/br_multicast.c when removing a bridge port after toggling multicast snooping states. A local user can trigger bridge port state transitions that leave a multicast context enabled on a freed bridge port to cause a denial of service.

The issue occurs when per-VLAN multicast snooping is enabled and global multicast snooping is toggled in a way that leaves both per-port and per-{port, VLAN} multicast contexts enabled on the same port.

268) Use-after-free (CVE-ID: CVE-2026-64033)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in rtrs_srv_create_path_files() cleanup logic when handling an error path during sysfs path file creation. A local user can trigger a failure in a later cleanup step to cause a denial of service.

The issue occurs before the function returns success, in a failure path where sysfs root folders may already exist and the kobject may already have been initialized.

269) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-64034)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass bounds validation.

The vulnerability exists due to a time-of-check time-of-use double-fetch in mana_hwc_rx_event_handler() and mana_hwc_handle_resp() when reading hwc_msg_id from a DMA-coherent buffer. A remote attacker can modify the DMA-visible hwc_msg_id value between reads to bypass bounds validation.

Exploitation requires hardware or a host environment able to alter shared, unencrypted DMA-coherent memory between the check and the subsequent use, such as in confidential VM environments.

270) Out-of-bounds read (CVE-ID: CVE-2026-64039)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in msm_disp_state_print_regs and related snapshot dumping logic when processing unaligned DSI register regions. A local user can trigger snapshotting of a specially positioned unaligned region to cause a denial of service.

The issue occurs because some DSI data regions are shifted by 4 bytes, causing the last registers in the region to be handled incorrectly.

271) Improper input validation (CVE-ID: CVE-2026-64046)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the net/tls plaintext scatter-gather list handling when processing TLS 1.3 records with a plain text scatter-gather list that wraps and has end = 0. A local user can trigger a chain-after-chain scatterlist layout to cause a denial of service.

The issue affects the case where the wrapping slot is reused for chaining to the content type entry, creating illegal input for the crypto subsystem.

272) Off-by-one (CVE-ID: CVE-2026-64047)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in tls_push_record() in the net/tls subsystem when chaining a wrapped sk_msg scatterlist ring. A local user can trigger the wrapped ring condition to cause a denial of service.

The issue occurs when the sk_msg scatterlist ring wraps with sg.end less than sg.start.

273) NULL pointer dereference (CVE-ID: CVE-2026-64048)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in smc_v2_determine_accepted_chid and smc_conn_create when processing a crafted SMC-Dv2 accept reply with CHID 0. A remote attacker can send a specially crafted reply to trigger a kernel fault and cause a denial of service.

Exploitation requires a malicious peer to reply to an SMC-Dv2-only proposal.

274) Use-after-free (CVE-ID: CVE-2026-64051)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in qaic_gem_object_mmap when mapping a buffer object into memory with scatter-gather segments that extend beyond the virtual memory area. A local user can trigger the mapping of an oversized buffer object to cause a denial of service.

The issue occurs because memory beyond the requested virtual memory area can remain mapped after munmap() unmaps only the virtual memory area region.

275) Improper Initialization (CVE-ID: CVE-2026-64055)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the gmac_rx() NAPI poll function when assembling packets from a ring buffer. A local user can trigger processing of fragmented packets across poll cycles to cause a denial of service.

The issue occurs when the ring buffer is completely emptied before a packet has been fully assembled.

276) Race condition (CVE-ID: CVE-2026-64056)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in gmac_rx() in the cortina gemini ethernet driver when processing fragmented packets on systems using both ethernet ports. A local user can trigger concurrent packet reception to cause a denial of service.

The issue arises because a packet assembly sk_buff was shared between the two ports.

277) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64064)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in netfs_invalidate_folio() when handling a folio that was dirtied by a streaming write and then truncated before being read via mmap(). A local user can truncate the file and trigger a subsequent mmap read to cause a kernel oops and denial of service.

Exploitation requires a local sequence involving streaming writes followed by truncation and mmap-based access.

278) Use-after-free (CVE-ID: CVE-2026-64073)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in irq_work_single() when synchronizing irq_work on PREEMPT_RT systems. A local user can trigger concurrent irq_work activity and free the work structure after BUSY is cleared to cause a denial of service.

The issue affects non-HARD irq_work processed by per-CPU kthreads on PREEMPT_RT.

279) Use of Uninitialized Variable (CVE-ID: CVE-2026-64083)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an uninitialized stack memory exposure in the adm1266 GPIO accessors when processing short block-read responses from the device. A local user can trigger a short block-read response to disclose sensitive information.

The leaked bits can reach userspace through gpiolib interfaces including sysfs and character-device ioctls.

280) Out-of-bounds write (CVE-ID: CVE-2026-64084)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and corrupt memory.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in adm1266_gpio_get_multiple() in the adm1266 PMBus driver when iterating a caller-supplied gpio mask. A local user can trigger access to bits beyond the end of the supplied mask and bits arrays to disclose sensitive information and corrupt memory.

The iteration uses a PMBus command value as the scan bound instead of the number of PDIO pins.

281) Out-of-bounds write (CVE-ID: CVE-2026-64085)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in adm1266_nvmem_read_blackbox() when processing device-supplied blackbox records. A local user can provide a device response with more than 64 bytes in a trailing record to cause a denial of service.

The issue occurs because the helper may write up to 255 bytes into a 64-byte record slot before the returned length is validated.

282) Out-of-bounds write (CVE-ID: CVE-2026-64086)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in adm1266_pmbus_block_xfer() and read_buf in the adm1266 PMBus driver when processing a max-length block read response with a PEC byte. A local user can trigger the driver to process a crafted response to cause a denial of service.

The same condition can also cause an out-of-bounds read during the subsequent PEC comparison.

283) Out-of-bounds write (CVE-ID: CVE-2026-64087)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in adm1266_nvmem_read_blackbox() when processing a malformed BLACKBOX_INFO response. A local user can provide a device response with an implausible blackbox record count to cause a denial of service.

The issue can be triggered by a non-responsive slave returning 0xff, bus corruption, or firmware bugs in the device response.

284) Use of Uninitialized Variable (CVE-ID: CVE-2026-64088)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in batadv_send_other_tt_response() and batadv_tt_prepare_tvlv_global_data() when handling tt changeset response data. A remote attacker can trigger processing of an oversized tt_buff_len value to disclose sensitive information.

The issue is caused by a signed integer field wrapping to a negative value and then being widened with sign extension, resulting in a fully allocated buffer that is only partially initialized.

285) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-64089)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an integer signedness error in batadv_send_my_tt_response() and batadv_tt_prepare_tvlv_local_data() when processing a translation table changeset length value larger than 32767. A local user can trigger the vulnerable code path to disclose sensitive information.

The issue occurs because a negative sign-extended length can cause a full-sized buffer to be allocated while only a small portion is populated, leaving the remaining bytes uninitialized.

286) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64090)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of empty vlan responses in batman-adv translation table handling when processing indirect translation table replies from the global tt state. A remote attacker can trigger indirect translation table responses containing empty vlan data to cause a denial of service.

The issue affects replies generated indirectly by another node using the global tt state rather than only direct local translation table responses.

287) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-64091)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to an out-of-bounds write in batadv_tt_prepare_tvlv_local_data in the batman-adv translation table handling when generating local TT TVLV data for reported VLANs. A local user can trigger concurrent VLAN translation table entry changes to cause a denial of service.

The issue arises from a time-of-check time-of-use condition where the number of non-empty VLANs can increase after buffer sizing but before the buffer is filled.

288) Improper resource shutdown or release (CVE-ID: CVE-2026-64092)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown handling in the batman-adv tp_meter receiver shutdown logic when stopping receiver sessions and handling timer expiration. A local user can trigger the affected code path to cause a denial of service.

The issue arises from a reference leak involving tp_vars during coordination between batadv_tp_receiver_shutdown() and batadv_tp_stop_all().

289) Race condition (CVE-ID: CVE-2026-64093)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in batman-adv tp_meter timer handling in batadv_tp_sender_cleanup() when shutting down the sender timer during cleanup. A local user can trigger timer re-arming after cleanup to cause a denial of service.

The issue occurs because the timer may be re-armed after its reference has already been released.

290) NULL pointer dereference (CVE-ID: CVE-2026-64094)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in batman-adv bridge loop avoidance claim handling in net/batman-adv/bridge_loop_avoidance.c when sending an ARP request after a primary interface is decoupled from its mesh interface. A local user can trigger this race condition to cause a denial of service.

The issue occurs when the primary hard interface is accessed without rtnl_lock held and its mesh interface pointer becomes NULL during the operation.

291) Race condition (CVE-ID: CVE-2026-64095)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the batman-adv bridge loop avoidance subsystem when handling concurrent backbone gateway state changes and request tracking. A local user can trigger concurrent operations to cause a denial of service.

The issue stems from non-atomic updates to request state and the bla.num_requests counter across multiple concurrent code paths.

292) Use-after-free (CVE-ID: CVE-2026-64096)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in batadv_mcast_purge_orig() and orig_node RCU release handling when releasing orig_node entries while concurrent RCU readers are still accessing multicast-related references. A local user can trigger concurrent access to freed entries to cause a denial of service.

The issue affects RCU-protected readers accessing references such as orig->mcast_want_all_ipv6_node after the referenced entries have been removed and freed.

293) Out-of-bounds read (CVE-ID: CVE-2026-64097)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() when parsing a malformed VBIOS GPIO pin LUT table. A local attacker can supply a crafted VBIOS image with an invalid structuresize field to disclose sensitive information.

294) Improper locking (CVE-ID: CVE-2026-64098)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() when updating planes and flushing framebuffer resources. A local user can trigger error conditions that leave the dma_resv lock unheld and then reach fence-list updates to cause a denial of service.

The issue can race with concurrent readers or writers and corrupt the dma_resv fence list. The reported trigger used fault injection on the DRM_IOCTL_MODE_CURSOR path.

295) Use-after-free (CVE-ID: CVE-2026-64099)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the v3d CPU job ioctl error path when handling CPU job submission failures. A local user can trigger an error path with crafted CPU job submissions to cause a denial of service.

The same error path can also trigger a NULL dereference and leak one sync object reference per query.

296) Integer underflow (CVE-ID: CVE-2026-64102)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service and disclose kernel memory contents.

The vulnerability exists due to an integer underflow in the Soft-iWARP receive path (siw_get_hdr/siw_tcp_rx_data) when processing a malformed iWARP FPDU with an MPA length smaller than the fixed header length for the opcode. A remote user can send a specially crafted FPDU to cause a denial of service and disclose kernel memory contents.

The issue is triggered by a malicious connected siw peer, and the negative signed length is later promoted to size_t during skb_copy_bits processing.

297) Use-after-free (CVE-ID: CVE-2026-64103)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the isci completion tasklet in the ISCI driver when removing a device or unloading the driver while queued tasklet processing is still possible. A local user can trigger device removal or driver unload to cause a denial of service.

The stale callback may dereference ihost and access ihost->smu_registers after the host lifetime ends.

298) Improper input validation (CVE-ID: CVE-2026-64106)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in vgic_its_restore_dte() when restoring an ITS Device Table Entry. A remote user can supply a restored DTE with an out-of-range Size field to cause a denial of service.

Exploitation requires the ability to restore crafted KVM ITS device state on arm64 systems.

299) Use-after-free (CVE-ID: CVE-2026-64108)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free condition in the cifs deferred file close handling when processing deferred file close work during unmount. A local user can open and close a file and trigger unmount activity to cause a denial of service.

The issue can be triggered because deferred close work may run after the filesystem is being unmounted, leading to a busy dentry warning.

300) Use-after-free (CVE-ID: CVE-2026-64109)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in unix_stream_data_wait() in net/unix/af_unix.c when processing racing recv() operations on the same AF_UNIX stream socket. A local user can trigger concurrent peek and normal receive operations to cause a denial of service.

Exploitation requires a race condition between a peeking recv() call and a normal recv() call on the same socket.

301) Improper locking (CVE-ID: CVE-2026-64111)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass security restrictions.

The vulnerability exists due to improper locking in lsm_set_self_attr() when setting a process security attribute. A local user can invoke the syscall while the process is being ptraced to bypass security restrictions.

This affects SELinux and AppArmor checks related to ptrace during security context transitions.

302) Use-after-free (CVE-ID: CVE-2026-64113)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ixgbevf_clean_rx_irq() when processing received frames that trigger VEPA multicast source pruning. A local user can trigger this code path to cause a denial of service.

The issue occurs in NAPI softirq context when a freed skb is reused on the next loop iteration because the pointer is not cleared before continuing.

303) Out-of-bounds read (CVE-ID: CVE-2026-64114)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in the raw_send_hdrinc IPv4 packet handling in the Linux kernel when processing a malformed IP_HDRINCL packet with an IPv4 header length value less than 5. A local user can send a specially crafted packet through a raw socket to cause a denial of service.

Exploitation requires CAP_NET_RAW. Triggering the reproduced crash path also requires a matching xfrm AH policy on the outgoing route, and loopback does not reach the affected path.

304) Use-after-free (CVE-ID: CVE-2026-64115)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in vmci_transport_recv_connecting_server() and vmci_transport_recv_listen() when processing a peer reset during the connection handshake. A remote attacker can send a reset packet during the handshake to cause a denial of service.

The issue is triggered by a race involving pending socket cleanup in the VMCI vsock transport.

305) NULL pointer dereference (CVE-ID: CVE-2026-64116)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ipv6_hop_ioam() when processing an IPv6 IOAM Hop-by-Hop option during concurrent interface teardown. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because IPv6 interface state can be cleared concurrently through RCU, allowing __in6_dev_get(skb->dev) to return NULL while the packet is being handled.

306) Double free (CVE-ID: CVE-2026-64118)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in qed_cid_map_free() in the QLogic qed driver context management code when handling failed CID bitmap allocations. A local user can trigger the failing allocation path to cause a denial of service.

Exploitation requires device-specific setup to reach the affected allocation failure path.

307) Out-of-bounds read (CVE-ID: CVE-2026-64121)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ifb_get_ethtool_stats in the IFB network driver when handling ethtool statistics requests on a device with more RX queues than TX queues. A local user can request ethtool statistics for a crafted asymmetric IFB device to disclose sensitive information.

Exploitation requires an IFB device configuration where the RX queue count exceeds the TX queue count.

308) Use-after-free (CVE-ID: CVE-2026-64123)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information or cause a denial of service.

The vulnerability exists due to a use-after-free in the hsr node table handling code when processing generic-netlink node-list or node-status operations concurrently with RTM_DELLINK teardown. A local user can trigger concurrent netlink operations to disclose sensitive information or cause a denial of service.

The generic-netlink reader accesses node entries under RCU and may retain a node pointer while teardown frees the same entry.

309) Improper Initialization (CVE-ID: CVE-2026-64125)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper hardware state management in bcmgenet_eee_enable_set in the Broadcom GENET network driver when enabling energy-efficient ethernet settings. A local user can enable the affected settings to cause a denial of service.

On affected systems, RX traffic can stop flowing while the link remains up, and on some boards the resulting corruption can lead to a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit.

310) Out-of-bounds read (CVE-ID: CVE-2026-64126)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the Bluetooth MGMT add_ext_adv_data() handler when processing a crafted MGMT_OP_ADD_EXT_ADV_DATA command with inconsistent length fields. A local privileged user can send a specially crafted management command to disclose sensitive information.

Exploitation requires CAP_NET_ADMIN in the initial user namespace, and exposed memory may be read back via MGMT_OP_GET_ADV_INSTANCE.

311) Information disclosure (CVE-ID: CVE-2026-64127)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an information leak caused by incorrect size and source-pointer arguments in l2cap_ecred_reconfigure() in the Bluetooth L2CAP subsystem when sending an L2CAP_ECRED_RECONFIGURE_REQ packet to a paired Bluetooth peer. A remote attacker can trigger ecred reconfiguration handling to disclose sensitive information.

The malformed packet copies bytes from kernel stack memory and can expose a kernel stack address to the peer. Exploitation requires Bluetooth connectivity with a paired peer.

312) NULL pointer dereference (CVE-ID: CVE-2026-64128)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in iso_recv() in the Bluetooth ISO subsystem when processing an ISO_END frame without a prior ISO_START on a fresh ISO connection. A remote attacker can send a specially crafted Bluetooth ISO frame sequence to cause a denial of service.

For BIS, exploitation does not require pairing and can be triggered by a broadcaster on the air.

313) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-64131)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper check for unusual or exceptional conditions in mm/memory.c unmap path when unmapping device-private or exclusive pages from private file-backed mappings. A local user can trigger memory migration and unmapping operations to cause a denial of service.

The issue can result in a kernel warning during process teardown.

314) Out-of-bounds read (CVE-ID: CVE-2026-64133)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the find_control() function in the ALSA asihpi driver when reading cached control information with an out-of-range control index. A local user can provide a crafted control index to cause a denial of service.

315) NULL pointer dereference (CVE-ID: CVE-2026-64134)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the ALSA PCM interleaved_copy() function when handling silencing operations with NULL data. A local user can trigger a crafted PCM data transfer path to cause a denial of service.

The issue is architecture-dependent and was reported to cause failures on RISC-V systems.

316) Stack-based buffer overflow (CVE-ID: CVE-2026-64135)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in adm1266_nvmem_read_blackbox() when processing an SMBus block response from a device. A local user can return a block length larger than the allocated buffer to cause a denial of service.

The issue occurs before the return-length check rejects an unexpected response.

317) Race condition (CVE-ID: CVE-2026-64136)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in smb2_find_smb_sess_tcon_unlocked() when handling SMB tree connection lookups. A local user can trigger concurrent access to corrupt tc_count handling and cause a denial of service.

318) Improper access control (CVE-ID: CVE-2026-64137)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to affect service availability.

The vulnerability exists due to improper access control in the CIFS SWN netlink notify handler when sending witness notification commands. A local user can send crafted RESOURCE_CHANGE or CLIENT_MOVE notifications to affect service availability.

The intended sender is the cifs.witness helper, but any local process could send notifications to the in-kernel witness handler.

319) Improper access control (CVE-ID: CVE-2026-64137)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the CIFS SWN generic netlink multicast group when joining the multicast group and receiving registration messages. A local user can join the CIFS_GENL_MCGRP_SWN group to disclose sensitive information.

For NTLM-authenticated mounts, exposed registration messages may include the username, domain, and password attributes copied from the CIFS session.

320) Out-of-bounds read (CVE-ID: CVE-2026-64138)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the ksmbd smbacl.c ACL inheritance logic when processing owner and group SIDs from a parent security descriptor. A remote user can provide a specially crafted parent security descriptor to cause a denial of service.

The issue occurs during ACL inheritance in ksmbd.

321) Improper resource shutdown or release (CVE-ID: CVE-2026-64144)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the btmtk USB Bluetooth driver when handling failed or killed control urbs. A local user can trigger error paths to cause a denial of service.

322) NULL pointer dereference (CVE-ID: CVE-2026-64147)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error pointers and a missing reference release in pds_core debugfs handling when performing firmware reset recovery or checking for an existing debugfs entry. A local user can trigger the vulnerable code path to cause a denial of service.

The crash condition occurs when CONFIG_DEBUG_FS is disabled.

323) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64148)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in pdsc_devcmd_wait() when handling firmware crash or command timeout conditions. A local user can trigger the vulnerable code path to cause a denial of service.

The issue causes stale success status to be returned instead of propagating an error, which can prevent proper recovery handling.

324) Unchecked Return Value (CVE-ID: CVE-2026-64153)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error codes in msm_iommu_map() in the drm/msm iommu mapping logic when mapping scatter-gather tables. A local user can trigger an error condition to cause a denial of service.

325) Improper resource shutdown or release (CVE-ID: CVE-2026-64155)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ath11k WMI WOW command handling in drivers/net/wireless/ath/ath11k/wmi.c when sending WOW host wakeup and WOW enable commands. A local user can trigger error paths to cause a denial of service.

326) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64163)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state reset in lib/tests/test_kprobes.c when running the kprobes sanity tests multiple times. A local user can trigger repeated test runs to cause a denial of service.

The issue occurs because static kprobe and kretprobe objects retain leftover address and flag data between test runs, which leads to failed re-registration and an eventual kernel crash.

327) NULL pointer dereference (CVE-ID: CVE-2026-64165)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in intcp_init_early when performing early initialization before the memory management subsystem is initialized. A local attacker can trigger the vulnerable initialization path to cause a denial of service.

The issue affects ARM Integrator/CP systems using Device Tree, and the failure may manifest as either a kernel crash or an -ENOMEM condition that prevents sched_clock_register from being called.

328) NULL pointer dereference (CVE-ID: CVE-2026-64166)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the arm_ffa bus match callback when registering a buggy FF-A driver without an id_table. A local user can register a crafted FF-A driver to cause a denial of service.

329) NULL pointer dereference (CVE-ID: CVE-2026-64168)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an error pointer dereference in the sprd spi driver probe error-handling path when handling DMA setup failure during probe. A local user can trigger a probe path that falls back from DMA to PIO mode and reaches late error handling to cause a denial of service.

The issue occurs because the driver may attempt to release DMA channels after DMA setup has failed.

330) Improper handling of exceptional conditions (CVE-ID: CVE-2026-64170)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error pointers in the spi-qup DMA initialization logic when handling DMA setup failures during driver probe. A local user can trigger a DMA setup failure and subsequent probe error or driver unbind to cause a denial of service.

The issue can lead to dereferencing an error pointer or attempting to release a DMA channel a second time.

331) Improper resource shutdown or release (CVE-ID: CVE-2026-64173)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in tracing_map_elt_free() in kernel/trace/tracing_map.c when handling allocation failures during tracing map element initialization. A local user can trigger an allocation failure path to cause a denial of service.

332) Infinite loop (CVE-ID: CVE-2026-64174)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper loop state management in cfg80211_merge_profile() when processing a specially crafted malicious beacon containing split Multi-BSSID non-transmitted BSS profile elements. A remote attacker can send a specially crafted beacon to cause a denial of service.

The issue can cause the kernel to spend excessive time in the affected function for each beacon received.

333) Improper locking (CVE-ID: CVE-2026-64177)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in pep_do_rcv() in net/phonet/pep.c when forwarding an skb to a child socket via sk_receive_skb(). A local user can trigger socket backlog processing that acquires the child socket lock with bottom halves enabled to cause a denial of service.

The issue can lead to an inconsistent lock state and a self-deadlock on the same CPU when packets are received for the same child socket.

334) Use-after-free (CVE-ID: CVE-2026-64178)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to a use-after-free in the bnep_add_connection function when reading dev->name during connection setup while a concurrent connection deletion tears down the net_device. A local privileged user can trigger concurrent bnep_add_connection and bnep_del_connection operations to disclose sensitive information.

Exploitation requires CAP_NET_ADMIN and a tight race window during net_device teardown.

335) Improper resource shutdown or release (CVE-ID: CVE-2026-64179)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ipc_imem_init() when handling error paths after ipc_protocol_init(). A local user can trigger initialization failures to cause a denial of service.

336) Improper resource shutdown or release (CVE-ID: CVE-2026-64180)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in remove_memory_blocks_and_altmaps() in mm/memory_hotplug.c when removing memory blocks and their altmaps. A local user can trigger memory block removal operations to cause a denial of service.

337) Improper resource shutdown or release (CVE-ID: CVE-2026-64182)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in memblk_nr_poison_inc() and memblk_nr_poison_sub() in drivers/base/memory.c when updating poison accounting for a memory block. A local user can trigger repeated successful memory block lookups to cause a denial of service.

338) NULL pointer dereference (CVE-ID: CVE-2026-64183)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the EFI runtime workqueue handling for ACPI PRM calls when invoking EFI runtime calls during early initialization. A local user can trigger early PRM-related runtime calls to cause a denial of service.

The issue occurs when ACPI PRM accesses happen before the EFI runtime workqueue has been allocated during system initialization.

339) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64184)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper release of a resource in damon_sysfs_memcg_path_to_id() in mm/damon/sysfs-schemes.c when iterating memory cgroups and breaking out of the mem_cgroup_iter() loop early. A local user can trigger the affected code path to cause a denial of service.

The issue results from a leaked cgroup reference because mem_cgroup_iter_break() is not called before exiting the iteration.

340) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-64185)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in sysfs_update_group() and internal_create_group() when handling updates to a named sysfs group after create_files() fails. A local user can trigger an update operation that causes file creation to fail to cause a denial of service.

The issue affects the update path for an already existing named sysfs group, which may be silently removed instead of left intact.

341) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-64214)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access of per-CPU preemption state in arch_irq_work_raise() when handling machine check exceptions in real mode. A local user can trigger a machine check exception that reaches arch_irq_work_raise() to cause a denial of service.

The issue occurs in NMI context on powerpc systems, where accessing preempt_count from real mode can fault and panic the kernel.

342) Out-of-bounds write (CVE-ID: CVE-2026-64217)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in netfs_extract_user_iter() when extracting user-supplied pages from an iov_iter. A local user can trigger an extract_pages overrun to cause memory corruption.

The issue occurs if iov_iter_extract_pages() overfills the pages array, causing excess pages to be included in the constructed iterator.

343) Use-after-free (CVE-ID: CVE-2026-64218)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in batadv_bla_purge_backbone_gw() in the bridge loop avoidance component when purging stale backbone gateway entries. A local user can trigger report_work to access freed memory to cause a denial of service.

The issue occurs when associated report_work is still running or pending during backbone gateway cleanup.

344) Out-of-bounds read (CVE-ID: CVE-2026-64219)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dc->links[] access within dc_process_dmub_aux_transfer_async() when handling a link_index value without bounds checking. A local user can supply an invalid link_index to cause a denial of service.

345) Stack-based buffer overflow (CVE-ID: CVE-2026-64219)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in dc_process_dmub_aux_transfer_async() when processing an aux transfer payload. A local user can pass a payload length greater than 16 to cause a denial of service.

346) Use of Uninitialized Variable (CVE-ID: CVE-2026-64220)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in fwnode_init() when initializing a firmware node allocated on the stack or with a non-zeroing heap allocation. A local user can trigger code paths that dereference the uninitialized secondary pointer to cause a denial of service.

The issue can occur when a temporary software node is used and its lifetime is controlled by the caller.

347) Use-after-free (CVE-ID: CVE-2026-64221)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ti-qspi driver when handling DMA setup failure during probe. A local user can trigger a DMA setup failure and subsequent use of a released DMA channel pointer to cause a denial of service.

The issue occurs when the driver falls back to PIO mode after DMA setup failure.

348) Double free (CVE-ID: CVE-2026-64222)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in otx2_pool_aq_init() and cn20k_pool_aq_init() when handling allocation or mailbox synchronization failures during pool initialization. A local user can trigger the affected error path to cause a denial of service.

Exploitation requires OcteonTX2 or CN20K hardware.

349) Out-of-bounds read (CVE-ID: CVE-2026-64225)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the cgx_speed_mbps array access in link_status_user_format() when processing firmware-reported link status values. A local user can trigger an out-of-range RESP_LINKSTAT_SPEED value to cause a denial of service.

350) Out-of-bounds read (CVE-ID: CVE-2026-64231)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in msm_disp_snapshot_add_block when dumping DSI host registers after the IO base address is adjusted by io_offset. A local user can trigger register dumping to cause a denial of service.

The issue affects DSI 6G platforms.

351) Use-after-free (CVE-ID: CVE-2026-64233)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a use-after-free.

The vulnerability exists due to a use-after-free in uvc_function_bind() and descriptor handling for extension unit list walks when binding the UVC gadget function while concurrently removing an extension unit configfs directory. A local privileged user can bind the function and race configfs extension removal to cause a use-after-free.

Exploitation requires the ability to mount configfs and write gadget UDC files.

352) NULL pointer dereference (CVE-ID: CVE-2026-64234)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dma_handle_rx() in the pch_uart driver when handling DMA receive operations after coherent DMA buffer allocation fails. A local user can trigger allocation failure conditions to cause a denial of service.

353) Out-of-bounds read (CVE-ID: CVE-2026-64237)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the elan_i2c firmware update handler when processing a crafted firmware file. A local user can provide a specially crafted firmware file to disclose sensitive information.

354) Use-after-free (CVE-ID: CVE-2026-64239)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in DAMON sysfs tried region directory handling when refreshing scheme tried region directories. A local user can repeatedly request directory refresh operations to cause a use-after-free.

The issue can be reproduced on kernels built with CONFIG_DEBUG_KOBJECT_RELEASE because delayed kobject release callbacks can leave freed region objects referenced from the linked list during directory regeneration.

355) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2026-64240)

CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper pointer handling in the igorplugusb driver when initializing a USB control request URB. A local user can connect a crafted USB device to trigger an invalid setup packet interpretation and cause a denial of service.

356) Double free (CVE-ID: CVE-2026-64242)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in net2280_probe() error handling in the net2280 usb gadget driver when probing a device. A local user can trigger the probe error path to cause a denial of service.

357) Out-of-bounds read (CVE-ID: CVE-2026-64243)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in simple_mux_control_put() when processing enumerated control values. A local user can supply an invalid enumerated item value to trigger an out-of-bounds read and cause a denial of service.

358) Out-of-bounds read (CVE-ID: CVE-2026-64518)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in tcp_ao_established_key() when processing TCP_TIME_WAIT sockets from tcp_v[46]_timewait_ack(). A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the code may access sock locking state on a timewait socket that does not contain sk_lock.

359) Out-of-bounds read (CVE-ID: CVE-2026-64524)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Hyper-V DRM protocol resolution response parser when processing a crafted SYNTHVID_RESOLUTION_RESPONSE message. A remote attacker can send a specially crafted resolution response with an oversized resolution_count value to cause a denial of service.

The issue affects the drm/hyperv code path while parsing supported display resolutions from the host.

360) Improper resource shutdown or release (CVE-ID: CVE-2026-64525)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in xfrm policy namespace cleanup handlers when cleaning up network namespaces. A local user can repeatedly create and tear down network namespaces to cause a denial of service.

The issue can cause cleanup backlogs, excessive memory growth, and memcg OOM conditions on affected systems.

361) Out-of-bounds read (CVE-ID: CVE-2026-64527)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hyperv_receive() and hyperv_receive_sub() in the Hyper-V DRM protocol handler when handling oversized or malformed VMBus packets. A remote attacker can send a specially crafted VMBus packet to cause a denial of service.

An error path may report a required packet length larger than the 16 KiB receive buffer, leading the code to use that length unsafely if forwarded for copying.

362) Out-of-bounds read (CVE-ID: CVE-2026-64527)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in hyperv_receive_sub() in the Hyper-V DRM protocol handler when processing crafted VMBus packets. A remote attacker can send a specially crafted VMBus packet to disclose sensitive information.

The issue affects completion-driving message handling and can cause residual data from a prior message to be treated as a valid response payload.

363) Improper locking (CVE-ID: CVE-2026-64528)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable() when console flow control is engaged during transmit state changes. A local user can trigger the affected serial driver code path to cause a denial of service.

The issue occurs because the code attempts to reacquire the same non-recursive spinlock while it is already held on the same CPU.

364) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-92502)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause data loss.

The vulnerability exists due to improper clearing of stale xarray tags in ext4 writeback handling when clean folios are skipped during writeback. A local privileged user can trigger writeback during a system reboot to cause data loss.

The issue occurs in ext4 data=journal mode while the superblock is being remounted read-only during reboot.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-8906-1