SB2026110302 - Debian update for linux

Description

This security bulletin contains information about 617 vulnerabilities.

1) Resource management error (CVE-ID: CVE-2024-58074)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the hsw_disable_crt(), hsw_post_disable_crt(), hsw_pre_pll_enable_crt(), hsw_pre_enable_crt() and hsw_enable_crt() functions in drivers/gpu/drm/i915/display/intel_crt.c. A local user can perform a denial of service (DoS) attack.

2) Memory leak (CVE-ID: CVE-2025-22109)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ax25_get_route() function in net/ax25/ax25_route.c, within the ax25_connect() function in net/ax25/af_ax25.c. A local user can perform a denial of service (DoS) attack.

3) Improper locking (CVE-ID: CVE-2025-23132)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the f2fs_sync_fs(), f2fs_remount(), limit_reserve_root(), f2fs_quota_sync(), f2fs_quota_on(), __f2fs_quota_off(), f2fs_quota_off(), f2fs_dquot_initialize(), f2fs_update_time() and kill_f2fs_super() functions in fs/f2fs/super.c, within the block_operations(), f2fs_unlock_all() and f2fs_issue_checkpoint() functions in fs/f2fs/checkpoint.c. A local user can perform a denial of service (DoS) attack.

4) Resource management error (CVE-ID: CVE-2025-23135)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the module_init() function in arch/riscv/kvm/main.c. A local user can perform a denial of service (DoS) attack.

5) Memory leak (CVE-ID: CVE-2025-37743)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ath12k_dp_mon_rx_parse_status_tlv() and ath12k_dp_mon_parse_rx_dest() functions in drivers/net/wireless/ath/ath12k/dp_mon.c. A local user can perform a denial of service (DoS) attack.

6) Buffer overflow (CVE-ID: CVE-2025-37746)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the dwc_pcie_register_dev() and dwc_pcie_pmu_probe() functions in drivers/perf/dwc_pcie_pmu.c. A local user can perform a denial of service (DoS) attack.

7) Race condition (CVE-ID: CVE-2025-37906)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the ublk_start_cancel(), ublk_uring_cmd_cancel_fn() and ublk_cancel_queue() functions in drivers/block/ublk_drv.c. A local user can escalate privileges on the system.

8) Use-after-free (CVE-ID: CVE-2025-38029)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the kasan_populate_early_vm_area_shadow() and kasan_populate_vmalloc() functions in mm/kasan/shadow.c. A local user can escalate privileges on the system.

9) Input validation error (CVE-ID: CVE-2025-38041)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the SUNXI_CCU_M_WITH_MUX_GATE(), BIT() and sun50i_h616_ccu_probe() functions in drivers/clk/sunxi-ng/ccu-sun50i-h616.c. A local user can perform a denial of service (DoS) attack.

10) Improper resource shutdown or release (CVE-ID: CVE-2025-38042)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to failure to properly release resources within the prueth_reset_rx_chan() function in drivers/net/ethernet/ti/icssg/icssg_common.c, within the am65_cpsw_destroy_rxq() and am65_cpsw_nuss_register_ndevs() functions in drivers/net/ethernet/ti/am65-cpsw-nuss.c, within the k3_udma_chan_dev_release(), k3_udma_glue_request_rx_chn_priv(), k3_udma_glue_request_remote_rx_chn_common(), EXPORT_SYMBOL_GPL() and k3_udma_glue_reset_rx_chn() functions in drivers/dma/ti/k3-udma-glue.c. A local user can perform a denial of service (DoS) attack.

11) Resource management error (CVE-ID: CVE-2025-38064)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the virtio_irq_get_affinity() and __register_virtio_driver() functions in drivers/virtio/virtio.c. A local user can perform a denial of service (DoS) attack.

12) Improper locking (CVE-ID: CVE-2025-38132)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the cscfg_remove_owned_csdev_configs() function in drivers/hwtracing/coresight/coresight-syscfg.c. A local user can perform a denial of service (DoS) attack.

13) Use-after-free (CVE-ID: CVE-2025-38137)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the EXPORT_SYMBOL_GPL() function in drivers/pci/pwrctrl/core.c. A local user can escalate privileges on the system.

14) Resource management error (CVE-ID: CVE-2025-38140)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the __bind() function in drivers/md/dm.c, within the dm_revalidate_zones() and dm_set_zones_restrictions() functions in drivers/md/dm-zone.c, within the dm_table_has_no_data_devices(), dm_table_supports_atomic_writes() and dm_table_set_restrictions() functions in drivers/md/dm-table.c. A local user can perform a denial of service (DoS) attack.

15) Use-after-free (CVE-ID: CVE-2025-38187)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the r535_gsp_rpc_push() function in drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c. A local user can escalate privileges on the system.

16) Memory leak (CVE-ID: CVE-2025-38199)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ath12k_mac_station_add() function in drivers/net/wireless/ath/ath12k/mac.c. A local user can perform a denial of service (DoS) attack.

17) Incorrect calculation (CVE-ID: CVE-2025-38207)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the init_multi_vma_prep(), vma_complete() and copy_vma() functions in mm/vma.c. A local user can perform a denial of service (DoS) attack.

18) Race condition (CVE-ID: CVE-2025-38261)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition within the SYM_FUNC_START() function in arch/riscv/kernel/entry.S, within the asm_offsets() function in arch/riscv/kernel/asm-offsets.c. A local user can perform a denial of service (DoS) attack.

19) Resource management error (CVE-ID: CVE-2025-38284)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the rtw89_pci_is_dac_compatible_bridge(), rtw89_pci_setup_mapping() and rtw89_pci_l2_hci_ldo() functions in drivers/net/wireless/realtek/rtw89/pci.c. A local user can perform a denial of service (DoS) attack.

20) Memory leak (CVE-ID: CVE-2025-38359)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the do_secure_storage_access() function in arch/s390/mm/fault.c. A local user can perform a denial of service (DoS) attack.

21) Double free (CVE-ID: CVE-2025-38421)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the amd_pmf_get_pb_data(), amd_pmf_init_smart_pc() and amd_pmf_deinit_smart_pc() functions in drivers/platform/x86/amd/pmf/tee-if.c, within the amd_pmf_set_dram_addr() and amd_pmf_remove() functions in drivers/platform/x86/amd/pmf/core.c. A local user can perform a denial of service (DoS) attack.

22) NULL pointer dereference (CVE-ID: CVE-2025-38597)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the vop2_create_crtcs() function in drivers/gpu/drm/rockchip/rockchip_drm_vop2.c. A local user can perform a denial of service (DoS) attack.

23) NULL pointer dereference (CVE-ID: CVE-2025-38605)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the u32_encode_bits() function in drivers/net/wireless/ath/ath12k/dp_tx.c. A local user can perform a denial of service (DoS) attack.

24) Out-of-bounds read (CVE-ID: CVE-2025-38636)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the kernel/trace/rv/rv_trace.h. A local user can perform a denial of service (DoS) attack.

25) Use-after-free (CVE-ID: CVE-2025-38656)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the iwl_op_mode_dvm_start() function in drivers/net/wireless/intel/iwlwifi/dvm/main.c. A local user can escalate privileges on the system.

26) Integer underflow (CVE-ID: CVE-2025-39677)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the pie_change() function in net/sched/sch_pie.c, within the hhf_change() function in net/sched/sch_hhf.c, within the fq_pie_change() function in net/sched/sch_fq_pie.c, within the fq_codel_change() function in net/sched/sch_fq_codel.c, within the fq_load_priomap() and fq_change() functions in net/sched/sch_fq.c, within the codel_change() function in net/sched/sch_codel.c. A local user can execute arbitrary code.

27) Input validation error (CVE-ID: CVE-2025-39775)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the arch_supports_page_table_move(), move_normal_pmd() and move_normal_pud() functions in mm/mremap.c. A local user can perform a denial of service (DoS) attack.

28) Improper error handling (CVE-ID: CVE-2025-39789)

CWE-ID: CWE-388 - Error Handling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the crypto_aegis128_aesni_process_ad(), crypto_aegis128_aesni_process_crypt(), crypto_aegis128_aesni_setauthsize(), crypto_aegis128_aesni_crypt(), crypto_aegis128_aesni_encrypt() and crypto_aegis128_aesni_decrypt() functions in arch/x86/crypto/aegis128-aesni-glue.c. A local user can perform a denial of service (DoS) attack.

29) Memory leak (CVE-ID: CVE-2025-39830)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the hws_pool_buddy_init() function in drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c. A local user can perform a denial of service (DoS) attack.

30) Memory leak (CVE-ID: CVE-2025-39834)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the hws_action_get_shared_stc_nic() function in drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c. A local user can perform a denial of service (DoS) attack.

31) Use-after-free (CVE-ID: CVE-2025-39859)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ptp_ocp_detach() function in drivers/ptp/ptp_ocp.c. A local user can escalate privileges on the system.

32) Buffer overflow (CVE-ID: CVE-2025-39862)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the mt7915_mac_full_reset() function in drivers/net/wireless/mediatek/mt76/mt7915/mac.c. A local user can perform a denial of service (DoS) attack.

33) Use-after-free (CVE-ID: CVE-2025-39910)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the alloc_vmap_area() and pcpu_get_vm_areas() functions in mm/vmalloc.c. A local user can escalate privileges on the system.

34) Input validation error (CVE-ID: CVE-2025-39933)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the recv_done() function in fs/smb/client/smbdirect.c. A local user can perform a denial of service (DoS) attack.

35) Improper resource shutdown or release (CVE-ID: CVE-2025-39958)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to failure to properly release resources within the get_iota_region_flag(), s390_iommu_attach_device() and s390_attach_dev_identity() functions in drivers/iommu/s390-iommu.c. A local user can perform a denial of service (DoS) attack.

36) Input validation error (CVE-ID: CVE-2025-40065)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the kvm_riscv_gstage_vmid_detect() function in arch/riscv/kvm/vmid.c. A local user can perform a denial of service (DoS) attack.

37) NULL pointer dereference (CVE-ID: CVE-2025-40086)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the drivers/gpu/drm/xe/xe_vm_types.h. A local user can perform a denial of service (DoS) attack.

38) Buffer overflow (CVE-ID: CVE-2025-40113)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the qcom_pas_load() and qcom_pas_probe() functions in drivers/remoteproc/qcom_q6v5_pas.c. A local user can perform a denial of service (DoS) attack.

39) Use-after-free (CVE-ID: CVE-2025-40130)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the include/ufs/ufshcd.h. A local user can escalate privileges on the system.

40) Resource management error (CVE-ID: CVE-2025-40136)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the hisi_qm_reset_done(), qm_unregister_abnormal_irq(), qm_register_abnormal_irq() and hisi_qm_pci_init() functions in drivers/crypto/hisilicon/qm.c. A local user can perform a denial of service (DoS) attack.

41) Use-after-free (CVE-ID: CVE-2025-40338)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the avs_soc_component_register() function in sound/soc/intel/avs/pcm.c. A local user can escalate privileges on the system.

42) Input validation error (CVE-ID: CVE-2025-40355)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the compat_only_sysfs_link_entry_to_kobj(), sysfs_group_attrs_change_owner() and sysfs_group_change_owner() functions in fs/sysfs/group.c. A local user can perform a denial of service (DoS) attack.

43) Incorrect calculation (CVE-ID: CVE-2025-68174)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the kfd_process_destroy_pdds() and kfd_create_process_device_data() functions in drivers/gpu/drm/amd/amdkfd/kfd_process.c. A local user can perform a denial of service (DoS) attack.

44) Use-after-free (CVE-ID: CVE-2025-68193)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the drivers/gpu/drm/xe/xe_guc_ct.h. A local user can escalate privileges on the system.

45) NULL pointer dereference (CVE-ID: CVE-2025-68209)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the include/linux/mlx5/cq.h. A local user can perform a denial of service (DoS) attack.

46) Improper locking (CVE-ID: CVE-2025-68236)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ufs_qcom_suspend() function in drivers/ufs/host/ufs-qcom.c. A local user can perform a denial of service (DoS) attack.

47) Input validation error (CVE-ID: CVE-2025-68318)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the CCU_GATE() function in drivers/clk/thead/clk-th1520-ap.c. A local user can perform a denial of service (DoS) attack.

48) Improper locking (CVE-ID: CVE-2025-68319)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the userdatum_value_store(), sysdata_msgid_enabled_store(), sysdata_release_enabled_store(), sysdata_taskname_enabled_store() and sysdata_cpu_nr_enabled_store() functions in drivers/net/netconsole.c. A local user can perform a denial of service (DoS) attack.

49) NULL pointer dereference (CVE-ID: CVE-2025-68353)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the vxlan_xmit_one() function in drivers/net/vxlan/vxlan_core.c. A local user can perform a denial of service (DoS) attack.

50) Use-after-free (CVE-ID: CVE-2025-68359)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the init_delayed_ref_head(), add_delayed_ref_head() and add_delayed_ref() functions in fs/btrfs/delayed-ref.c. A local user can escalate privileges on the system.

51) Resource management error (CVE-ID: CVE-2025-68360)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the include/linux/soc/mediatek/mtk_wed.h. A local user can perform a denial of service (DoS) attack.

52) NULL pointer dereference (CVE-ID: CVE-2025-68368)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mddev_clear_bitmap_ops(), mddev_init(), md_run() and __md_stop() functions in drivers/md/md.c. A local user can perform a denial of service (DoS) attack.

53) Use-after-free (CVE-ID: CVE-2025-68376)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the tmc_etr_get_sysfs_buffer() function in drivers/hwtracing/coresight/coresight-tmc-etr.c. A local user can escalate privileges on the system.

54) Memory leak (CVE-ID: CVE-2025-68729)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ath12k_hal_desc_reo_parse_err() function in drivers/net/wireless/ath/ath12k/hal_rx.c. A local user can perform a denial of service (DoS) attack.

55) Input validation error (CVE-ID: CVE-2025-68730)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ivpu_bo_unbind_all_bos_from_context(), ivpu_gem_create_object(), ivpu_gem_prime_import() and ivpu_bo_alloc() functions in drivers/accel/ivpu/ivpu_gem.c. A local user can perform a denial of service (DoS) attack.

56) Use-after-free (CVE-ID: CVE-2025-68735)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the panthor_fdinfo_gather_group_samples(), panthor_group_create(), panthor_group_destroy() and panthor_fdinfo_gather_group_mem_info() functions in drivers/gpu/drm/panthor/panthor_sched.c. A local user can escalate privileges on the system.

57) Double free (CVE-ID: CVE-2025-68745)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the drivers/scsi/qla2xxx/qla_target.h. A local user can perform a denial of service (DoS) attack.

58) NULL pointer dereference (CVE-ID: CVE-2025-68755)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the function in drivers/staging/most/i2c/i2c.c. A local user can perform a denial of service (DoS) attack.

59) Use-after-free (CVE-ID: CVE-2025-71074)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ffs_ep0_read(), ffs_epfile_io(), ffs_dmabuf_put() and ffs_epfiles_create() functions in drivers/usb/gadget/function/f_fs.c. A local user can escalate privileges on the system.

60) Improper error handling (CVE-ID: CVE-2025-71141)

CWE-ID: CWE-388 - Error Handling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the drivers/gpu/drm/tilcdc/tilcdc_drv.h. A local user can perform a denial of service (DoS) attack.

61) Resource management error (CVE-ID: CVE-2025-71227)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ieee80211_determine_chan_mode() function in net/mac80211/mlme.c. A local user can perform a denial of service (DoS) attack.

62) Race condition (CVE-ID: CVE-2025-71285)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the qrtr client driver for the IPCR DL channel when handling auto-queued RX buffers during driver probe. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can lead to a NULL pointer dereference during boot before the client driver's structures are fully initialized.

63) NULL pointer dereference (CVE-ID: CVE-2025-71313)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in epf_ntb_epc_init() and the pci endpoint ntb workqueue initialization logic when handling workqueue allocation failure. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs if alloc_workqueue() fails and queue_work() is later called with a NULL workqueue pointer.

64) Use of uninitialized resource (CVE-ID: CVE-2026-23007)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the bio_integrity_prep() function in block/bio-integrity-auto.c. A local user can perform a denial of service (DoS) attack.

65) NULL pointer dereference (CVE-ID: CVE-2026-23017)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the idpf_init_task() and idpf_init_hard_reset() functions in drivers/net/ethernet/intel/idpf/idpf_lib.c. A local user can perform a denial of service (DoS) attack.

66) Reachable assertion (CVE-ID: CVE-2026-23143)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to reachable assertion within the function in drivers/net/virtio_net.c. A local user can perform a denial of service (DoS) attack.

67) Out-of-bounds read (CVE-ID: CVE-2026-23208)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the prepare_playback_urb() function in sound/usb/pcm.c. A local user can perform a denial of service (DoS) attack.

68) Improper locking (CVE-ID: CVE-2026-23217)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the function in arch/riscv/kernel/Makefile. A local user can perform a denial of service (DoS) attack.

69) Use After Free (CVE-ID: CVE-2026-23259)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in io_uring/rw component when handling read/write requests. A local user can trigger improper cleanup of allocated iovec structures to cause a denial of service.

Exploitation requires access to the io_uring subsystem and the ability to submit read/write requests.

70) Out-of-bounds read (CVE-ID: CVE-2026-23327)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service, disclose sensitive information, and potentially execute arbitrary code.

The vulnerability exists due to improper input validation in the CXL mailbox command handler when processing user-supplied payloads. A local user can send a specially crafted raw mailbox command with an undersized payload to trigger an out-of-bounds read in the kernel, leading to memory disclosure, system crash, or potential code execution.

The issue specifically occurs in the cxl_payload_from_user_allowed() function, where the payload size is not validated before accessing its contents, resulting in a slab-out-of-bounds read during UUID comparison.

71) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-23371)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the deadline scheduler (sched/deadline) when handling priority inheritance (PI) de-boosting. A local user can manipulate scheduling parameters via sched_setscheduler() on a SCHED_DEADLINE task that holds a PI mutex, leading to missing ENQUEUE_REPLENISH flag and subsequent bandwidth accounting corruption, which may trigger a kernel warning and result in a denial of service.

Exploitation requires the ability to create and control SCHED_DEADLINE tasks and manipulate their scheduling policy while holding PI mutexes.

72) Out-of-bounds write (CVE-ID: CVE-2026-23377)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ice driver's XDP RxQ configuration when handling XDP buffer size parameters. A local user can trigger a negative tailroom condition by using the XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test with a large packet size and offset to cause a kernel panic.

The issue arises specifically from incorrect assumptions about buffer size in the frag_size field, leading to memory corruption during XDP processing.

73) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-23385)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the netfilter nf_tables component when processing set operations during a flush command. A local user can trigger a failing memory allocation that results in a kernel warning and system instability, leading to a denial of service.

The issue arises during the deactivation of a set in the preparation phase of a flush operation, where a set is cloned unnecessarily, potentially causing memory allocation failure under fault injection conditions.

74) Improper Initialization (CVE-ID: CVE-2026-23472)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization handling in handle_tx() when processing PORT_UNKNOWN serial ports. A local user can use a PORT_UNKNOWN serial port to trigger an infinite loop and cause a denial of service.

This issue occurs because write-room reporting can indicate available space while write operations return zero when the transmit buffer is NULL, which can lead to a system hang.

75) Use-after-free (CVE-ID: CVE-2026-31493)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use-after-free in admin queue completion handling when processing admin queue completions with an error. A local user can trigger an admin command completion error to disclose sensitive information.

76) Improper locking (CVE-ID: CVE-2026-31526)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause various issues.

The vulnerability exists due to improper lock state validation in process_bpf_exit_full() when handling exception exits from static BPF subprograms. A local user can trigger bpf_throw() from a static subprogram to cause various issues.

The issue occurs because exception unwinding bypasses intermediate frame cleanup, which can leave user-acquired RCU, preempt, or IRQ-related locks unreleased.

77) NULL pointer dereference (CVE-ID: CVE-2026-31562)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the mediatek dsi driver when registering the dsi drm encoder during device probe. A local user can load the vulnerable driver to cause a denial of service.

The crash occurs after acquiring the mode_config.idr_mutex, which blocks subsequent DRM operations.

78) Improper locking (CVE-ID: CVE-2026-31579)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in wg_netns_pre_exit() when handling network namespace cleanup. A local user can trigger network namespace teardown while another thread holds rtnl_mutex to cause a denial of service.

The issue can cause the cleanup path to block indefinitely, resulting in a hung task.

79) Improper locking (CVE-ID: CVE-2026-31592)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in sev_mem_enc_register_region() when handling KVM ioctls during SEV guest initialization failure paths. A local user can issue crafted ioctl calls to trigger a general protection fault and kernel crash.

The issue can occur if KVM_SEV_INIT{2} fails and KVM attempts to add to an uninitialized sev->regions_list.

80) Stack-based buffer overflow (CVE-ID: CVE-2026-31630)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in the AF_RXRPC procfs helpers when formatting socket addresses for procfs output with "%pISpc". A local user can trigger address formatting with a specially crafted IPv6 address representation to cause a denial of service.

The issue occurs because the fixed 50-byte stack buffers are too small for the longest current IPv6-with-port textual form, including certain ISATAP address formats.

81) Out-of-bounds read (CVE-ID: CVE-2026-31771)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Bluetooth HCI event handling logic when processing a short HCI event frame. A local attacker can send a specially crafted HCI event frame to cause a denial of service.

The issue occurs because wake reason storage is reached before per-event minimum payload length validation is enforced.

82) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-43009)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass BPF verifier state tracking.

The vulnerability exists due to improper state management in the BPF verifier backtrack_insn logic when processing BPF atomic fetch instructions. A local user can load a crafted BPF program to bypass BPF verifier state tracking.

The issue occurs because atomic fetch operations are not tracked correctly for precision propagation, which can cause the verifier to incorrectly treat distinct execution states as equivalent and prune branches that should remain separate.

83) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43022)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in hci_cmd_sync_queue_once() when queuing command items. A local user can trigger duplicate queueing conditions to cause a denial of service.

The issue can lead to resource leaks when an already queued item is not reported to the caller.

84) Out-of-bounds read (CVE-ID: CVE-2026-43034)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in bnxt_hwrm_func_backing_store_qcaps_v2() when processing firmware responses for backing-store capability queries. A local user can trigger the vulnerable code path to cause a denial of service.

85) Out-of-bounds read (CVE-ID: CVE-2026-43042)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in the mpls forwarding and route dump codepaths when handling concurrent platform label table resizes. A local user can trigger concurrent route operations to cause a denial of service.

The issue arises from an inconsistent view of the platform_labels and platform_label pair during a resize operation.

86) Out-of-bounds write (CVE-ID: CVE-2026-43048)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in hid_report_raw_event() when processing an incoming event buffer that is smaller than the associated report size. A local attacker can provide a crafted HID event buffer to cause a denial of service.

87) Improper Initialization (CVE-ID: CVE-2026-43053)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the XFS extended attribute dabtree inactivation logic when processing inode inactivation and log recovery. A local user can trigger a log shutdown during attribute fork inactivation to cause a denial of service.

The issue affects inodes with node-format extended attributes and can lead to metadata verification failures on the next mount during recovery processing.

88) Out-of-bounds read (CVE-ID: CVE-2026-43083)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in __ioam6_fill_trace_data() when processing packets with trace->type.bit6 set on the RX path. A local user can trigger the kernel to access an invalid transmit queue index to cause a denial of service.

The issue occurs when the ingress device has more RX queues than the egress device has TX queues.

89) NULL pointer dereference (CVE-ID: CVE-2026-43101)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in __ioam6_fill_trace_data() when processing ipv6 ioam trace data. A local user can trigger the vulnerable code path to cause a denial of service.

90) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-43118)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data corruption.

The vulnerability exists due to improper handling of inode size during log replay in btrfs inode logging and log replay code when replaying a filesystem log after specific inode operations. A local user can create and truncate a file, create a hard link or rename it, and trigger log replay to cause data corruption.

The issue occurs when an inode with a new size of 0 is later logged in exists mode, causing the preserved size from the subvolume tree to remain non-zero after replay.

91) Deadlock (CVE-ID: CVE-2026-43127)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a circular locking dependency in run_unpack_ex when handling NTFS metadata operations. A local user can trigger lock acquisition in a conflicting order to cause a denial of service.

The issue arises from an AB-BA deadlock between wnd->rw_lock and ni->file.run_lock.

92) Out-of-bounds read (CVE-ID: CVE-2026-43172)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the SMEM parsing logic when processing firmware-reported LMAC configuration data. A local user can provide crafted firmware data to cause a denial of service.

Exploitation requires the firmware to report three LMACs, a condition that does not exist in hardware.

93) Heap-based buffer overflow (CVE-ID: CVE-2026-43185)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in smb_direct_prepare_negotiation() when processing crafted SMB Direct negotiation messages. A remote attacker can send a crafted preferred_send_size value followed by a large second message to execute arbitrary code.

The issue is triggered by a signedness error that causes a malicious preferred_send_size value of 0x80000000 to be treated as smaller than max_recv_size and used to set the allowed receive size for the next message.

94) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43191)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the TMDS PHY state transition logic when disabling TMDS output. A local user can trigger display output state changes to cause a denial of service.

The issue can leave the OTG stuck, which can prevent DCHVM from acknowledging invalidations after an IOMMU watchdog timeout.

95) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43204)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in q6asm when handling DSP responses for closed data streams. A local user can trigger DSP responses associated with a closed stream to cause a denial of service.

96) Out-of-bounds read (CVE-ID: CVE-2026-43213)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds access in the rtw89_pci TX release report handling when processing an abnormal sequence number in a TX release report. A local attacker can trigger an abnormal TX release report to cause a denial of service.

The issue can lead to a kernel NULL pointer dereference.

97) Improper locking (CVE-ID: CVE-2026-43234)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state handling in the team driver when unregistering a slave network device. A local user can move a team slave device to another network namespace and delete it to cause a denial of service.

The issue can lead to a netdevice reference leak and the kernel waiting for the device to become free.

98) NULL pointer dereference (CVE-ID: CVE-2026-43263)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the wave5 decoder IRQ handler when handling concurrent decoder instance creation and destruction. A local user can trigger repeated multi-instance operations to cause a denial of service.

The issue occurs because the shared struct vpu_instance may be accessed after decoder structures are removed during interrupt handling.

99) Access of Uninitialized Pointer (CVE-ID: CVE-2026-43272)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of an uninitialized pointer in rb_meta_validate_events() when validating reader pages. A local user can trigger a reader page validation failure to cause a denial of service.

100) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43294)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in rzg2l_mipi_dsi_host_transfer() when processing MIPI-DSI commands during panel unprepare on reboot. A local user can trigger a reboot on a system using an affected panel to cause a denial of service.

Only panels that send MIPI-DSI commands in their unprepare() callback are affected.

101) Improper resource shutdown or release (CVE-ID: CVE-2026-43298)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the VCN poison irq release logic in the amdgpu driver when deinitializing a virtual function. A local user can trigger device deinitialization to cause a denial of service.

The issue occurs on VF configurations because VCN poison irq is not enabled in VCNv2.5.

102) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43299)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a read-only filesystem state in btrfs_repair_io_failure() when processing read-repair operations after the filesystem flips to read-only following a critical error. A local user can trigger the error condition to cause a denial of service.

The issue is triggered when a read repair is pending while the filesystem becomes read-only due to a critical error such as ENOSPC in a critical path.

103) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-43308)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an unexpected delayed ref type in run_one_delayed_ref() in the btrfs filesystem when processing delayed references. A local user can trigger the vulnerable code path to cause a denial of service.

104) Improper locking (CVE-ID: CVE-2026-43309)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the dm-raid target when stopping a RAID array after suspending the device tree from top to bottom and removing the top-level RAID device. A local user can stop and remove a crafted dm-raid managed array to cause a denial of service.

The issue results in an indefinite block because write-intent bitmap operations are attempted against already suspended metadata devices.

105) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43310)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the Verisilicon H.264 and HEVC decoding path when performing simultaneous decoding on g1 and g2 VPU hardware. A local user can trigger concurrent decode operations to cause a denial of service.

This issue is specific to the i.MX8MQ platform and may also produce corrupted pictures.

106) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-43311)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper execution context handling in the Tegra PMC resume handler when resuming from system suspend. A local user can trigger a suspend and resume cycle to cause a kernel warning and destabilize the system.

The issue is observed on Tegra platforms during wake handling after system suspend.

107) Improper input validation (CVE-ID: CVE-2026-43325)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper feature support validation in the iwlwifi mvm subsystem when handling 6E-related commands. A local user can trigger use of an unsupported MCC_ALLOWED_AP_TYPE_CMD path to cause a denial of service.

The issue occurs because some firmware incorrectly advertises support for the command on AX201 devices that do not support 6E, which can lead to a firmware crash.

108) NULL pointer dereference (CVE-ID: CVE-2026-43337)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dcn401_init_hw() when handling hardware initialization on the update path. A local attacker can trigger the vulnerable code path to cause a denial of service.

109) NULL pointer dereference (CVE-ID: CVE-2026-43346)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a NULL pointer in ice_ptp_setup_pf when initializing PTP support in a VFIO passthrough setup where the passed-through PF does not own the source timer. A local user can configure or use such a passthrough environment to trigger a kernel warning and cause a denial of service.

Exploitation requires a VFIO passthrough configuration in which only a PF that does not own the source timer is passed through.

110) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43352)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the DMA ring abort handling logic in the mipi-i3c-hci driver when processing DMA dequeue operations. A local user can trigger ring abort handling in an invalid ring state to cause a denial of service.

The issue can occur when the ring is already stopped, and the abort sequence may reset hardware ring pointers and disrupt controller state.

111) Race condition (CVE-ID: CVE-2026-43353)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in hci_dma_dequeue_xfer() in the mipi-i3c-hci driver when handling multiple transfer timeouts concurrently. A local user can trigger concurrent timeout conditions to cause a denial of service.

The issue occurs because parallel invocations may stop or restart the DMA ring at unexpected times while processing incomplete transfers.

112) Double free (CVE-ID: CVE-2026-43414)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in qla24xx_els_dcmd_iocb() error handling when releasing fcport references. A local user can trigger an error condition to cause a denial of service.

113) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43443)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in acp_card_rt5682_init() and acp_card_rt5682s_init() when acquiring clocks. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can lead to a kernel crash when invalid clock pointers are later dereferenced by clock core functions.

114) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43463)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error pointers in afs callers of rxrpc_kernel_lookup_peer() when handling peer lookup results. A local user can trigger code paths that cause an error pointer to be mishandled to cause a denial of service.

115) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43464)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the mlx5e RX XDP multi-buffer handling for legacy RQ when processing XDP multi-buf programs that modify the XDP buffer layout. A local user can trigger XDP actions that alter buffer fragments to cause a denial of service.

The issue can lead to a negative page fragment reference count during page release.

116) Improper update of reference count (CVE-ID: CVE-2026-43465)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference counting in the mlx5 XDP receive path when processing XDP multi-buffer packets on striding RQ. A local user can trigger XDP actions that alter the XDP buffer layout to cause a kernel warning and crash.

The issue affects multiple XDP actions, including XDP_TX, XDP_REDIRECT, XDP_PASS, and packet drops after buffer layout changes caused by bpf_xdp_pull_data() or bpf_xdp_adjust_tail().

117) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43485)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper handling of warning conditions in ACPI probes in nouveau/gsp when probing ACPI interfaces. A local attacker can trigger the vulnerable code path to cause a denial of service.

118) Improper access control (CVE-ID: CVE-2026-45932)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass permission checks.

The vulnerability exists due to improper access control in BPF_PROG_DETACH for tcx or netkit devices when detaching a program without providing a program file descriptor. A local user can invoke the detach operation without the required capability checks to bypass permission checks.

The issue occurs only when no program file descriptor is supplied to the detach operation.

119) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-45934)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of non-consecutive gaps in chunk allocation in btrfs_create_pending_block_groups() when processing DUP chunk allocation. A local user can trigger chunk allocation to cause a denial of service.

The issue can result in a transaction abort with EEXIST due to overlapping chunk maps, and forced chunk allocation is a demonstrated trigger.

120) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-45940)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of descriptor length calculation in stmmac_napi_poll_rx when processing packets with split header enabled on GMAC4 hardware. A remote attacker can send network traffic that triggers incorrect payload length handling to cause a denial of service.

The issue occurs in rare cases when the hardware does not fill buf2 of the first descriptor with payload.

121) Use-after-free (CVE-ID: CVE-2026-45956)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or potentially execute arbitrary code.

The vulnerability exists due to use-after-free in vidi_connection_ioctl() when handling ioctl requests and looking up the vidi context from incorrect driver data. A local user can trigger the vulnerable ioctl path to cause a denial of service or potentially execute arbitrary code.

The issue stems from using the exynos-drm master device driver data instead of the vidi component device context.

122) Improper resource shutdown or release (CVE-ID: CVE-2026-45961)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in gfs2_fill_super() and gfs2_make_fs_rw() when transitioning a filesystem to read-write mode and handling error paths. A local user can trigger failures during this process to cause a denial of service.

The issue involves memory leaks of created kernel threads and an allocated quota bitmap buffer during specific failure conditions.

123) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46014)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt virtual machine state handling.

The vulnerability exists due to improper state management in KVM SVM LBR MSR save and restore handling when processing userspace MSR save and restore operations. A local user can trigger incorrect handling of LBR and debug control MSRs to disrupt virtual machine state handling.

Exploitation requires access to userspace interfaces that manage virtual CPU MSR state, and LBR-related behavior depends on LBR virtualization being enabled.

124) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-46032)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in nested_svm_vmexit() in KVM nSVM when handling a nested #VMEXIT after a failure to restore the host CR3. A local user can trigger a failure while loading L1's CR3 to cause a denial of service.

The issue can leave the guest running with corrupted state after the error is ignored.

125) Improper resource shutdown or release (CVE-ID: CVE-2026-46044)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the ssif kthread cleanup logic when handling error conditions after creating the ssif kthread but before starting the ssif interface. A local user can trigger an error condition during ssif interface initialization to cause a denial of service.

126) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46059)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in KVM nSVM nested virtualization handling when processing save and restore of an L2 guest after the first nested VMRUN. A local user can trigger a nested guest state transition to cause a denial of service.

The issue occurs for guests with NRIPS disabled.

127) Off-by-one (CVE-ID: CVE-2026-46066)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in ceph_process_folio_batch() when handling encrypted CephFS writeback after bounce buffer allocation failure. A local user can write to fscrypt-enabled CephFS files under memory pressure to trigger a kernel panic and cause a denial of service.

The issue is triggered when processing a 4KiB-written/4KiB-skipped pattern and the failed folio is not contiguous with the last folio already added to the batch.

128) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46071)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in nested_svm_vmexit() and vmcb12 handling when copying last branch records. A local user can trigger a nested SVM VM exit to cause a denial of service.

The issue affects nested virtualization on AMD SVM.

129) Out-of-bounds read (CVE-ID: CVE-2026-46130)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in fec_decode_bufs() in dm-verity-fec when decoding parity bytes split across parity blocks. A local user can trigger the vulnerable code path to disclose sensitive information.

The issue occurs only for certain non-default fec_roots values and when the maximum number of buffers cannot be allocated due to low-memory conditions.

130) Improper access control (CVE-ID: CVE-2026-46148)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to interfere with SPI communications.

The vulnerability exists due to improper access control in the microchip-core-qspi driver when handling chip select lines for transfers involving multiple SPI devices. A local user can trigger access to a device attached via GPIO chip select while the built-in chip select is incorrectly asserted to interfere with SPI communications.

The issue occurs when multiple devices are attached to the QSPI controller and the built-in chip select is used alongside GPIO-based chip selects.

131) Memory leak (CVE-ID: CVE-2026-46171)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in kvm_riscv_vcpu_alloc_vector_context when allocating vector context buffers. A local user can trigger the allocation failure path to cause a denial of service.

132) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46175)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause file system inconsistency.

The vulnerability exists due to improper state management in f2fs node block migration when performing foreground garbage collection of node blocks. A local user can trigger node block migration and subsequent file system checking to cause file system inconsistency.

The issue occurs because dentry and fsync marks are not cleared during foreground garbage collection, which can cause fsck to misinterpret migrated node blocks as fsync-written data.

133) Race condition (CVE-ID: CVE-2026-46181)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in mlx4_srq_event() when handling RDMA SRQ events. A local user can trigger an event for a partially initialized srq object to cause a denial of service.

The issue can occur if an event is delivered before the srq object has finished initializing.

134) Improper resource shutdown or release (CVE-ID: CVE-2026-46228)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the ch341 spi usb driver when the driver is unbound without the device being physically disconnected. A local user can trigger driver unbind conditions to cause a denial of service.

This can occur during probe deferral or configuration changes.

135) NULL pointer dereference (CVE-ID: CVE-2026-46245)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in amdgpu_dm_hpd_init() in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c when initializing HPD interrupts for connectors without a valid dc_link. A local user can trigger handling of such a connector to cause a denial of service.

136) Uncontrolled Recursion (CVE-ID: CVE-2026-46256)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in NFS LOCALIO when triggering direct reclaim recursion into NFS via nfs_writepages. A local user can perform local NFS LOCALIO write or commit operations to cause a denial of service.

The issue occurs in loopback mount configurations where the NFS client and server are on the same system.

137) Race condition (CVE-ID: CVE-2026-46272)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the coresight tmc-etr sysfs and perf mode handling in drivers/hwtracing/coresight/coresight-tmc-etr.c when enabling sysfs mode concurrently with perf mode. A local user can trigger concurrent sysfs and perf operations to cause a denial of service.

The issue can trigger a WARN_ON() in tmc_etr_enable_hw() when sysfs buffer allocation and hardware enablement occur in separate critical regions.

138) Improper access control (CVE-ID: CVE-2026-46302)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in /sys/fs/selinux/policy when handling concurrent opens of the policy file. A local user can open the policy file and keep it open to cause a denial of service.

The issue can prevent other processes from reading the kernel policy.

139) Race condition (CVE-ID: CVE-2026-46324)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in netfilter nf_tables netlink hooks when concurrent dumpers walk hook lists during hook unregistration. A local user can trigger concurrent netlink operations to cause a denial of service.

140) Incorrect calculation (CVE-ID: CVE-2026-46325)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory address conversion in the RDMA RXE memory region handling code when processing memory regions with page sizes different from the system PAGE_SIZE. A local user can register or access a crafted memory region layout to cause a denial of service.

The issue can lead to incorrect iova-to-va translation and a kernel panic.

141) Use-after-free (CVE-ID: CVE-2026-46330)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the SMC TCP ULP support in net/smc/af_smc.c when converting an active TCP socket into an SMC socket by modifying open-file VFS structures in place. A local user can trigger the flawed socket conversion to cause a denial of service.

The issue stems from in-place modification of struct file, dentry, and inode objects that are expected to remain immutable for an open file.

142) Use of Uninitialized Variable (CVE-ID: CVE-2026-52937)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an information leak from uninitialized stack memory in tap_ioctl() when handling the SIOCGIFHWADDR ioctl request. A local user can issue a crafted ioctl request to disclose sensitive information.

The leaked data may include kernel .text and direct-map pointers, which can defeat KASLR.

143) Out-of-bounds read (CVE-ID: CVE-2026-52956)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in __ceph_x_decrypt() when processing a crafted Ceph authentication reply message. A remote attacker can send a specially crafted message frame to cause a denial of service.

The issue can be triggered when the ciphertext is too short to contain a ceph_x_encrypt_header, such as in a FRAME_TAG_AUTH_REPLY_MORE message.

144) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-52983)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the airoha network driver transmit queue handling when processing transmitted packets and completion accounting. A local user can trigger inconsistent BQL accounting to cause a denial of service.

145) Use-after-free (CVE-ID: CVE-2026-52991)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in pressure_write() in kernel/cgroup/cgroup.c when handling a write to a pressure cgroup file during concurrent cgroup file release. A local user can write crafted pressure data while racing cgroup file release to cause a denial of service.

The issue occurs because the of->priv pointer may be freed concurrently and later dereferenced.

146) Use-after-free (CVE-ID: CVE-2026-53000)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in netfilter nat hook operations when dumping active netfilter hooks from userspace or handling partial hook exposure on error paths. A local user can trigger hook inspection while freed hook operation structures are still referenced to cause a denial of service.

The issue affects nat hook registration and unregistration paths, including interaction with the nfnetlink hook dump subsystem.

147) Double free (CVE-ID: CVE-2026-53009)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in ice_xmit_frame_ring() and tx ring buffer cleanup when handling transmit error paths and interface shutdown. A local user can trigger transmit checksum or tso failure conditions and then bring the interface down to cause a denial of service.

The issue occurs because a tx_buf entry can remain marked as valid and continue to reference an skb that was already freed in the error path.

148) Race condition (CVE-ID: CVE-2026-53017)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data loss.

The vulnerability exists due to a race condition in f2fs_need_inode_block_update() and nat_entry flag handling when performing fsync on a newly created file concurrently with a checkpoint operation. A local user can trigger concurrent file and checkpoint activity to cause data loss.

The issue occurs before any checkpoint has been written for the newly created file.

149) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53018)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the f2fs garbage collection logic when processing already updated pages during garbage collection. A local user can trigger garbage collection on crafted filesystem state to cause a denial of service.

The issue was identified during fuzz testing and results in a kernel BUG triggered by reading a page that had already been marked uptodate.

150) Use-after-free (CVE-ID: CVE-2026-53024)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the greybus raw character device write handler when writing to the device after disconnect. A local user can write to the chardev after disconnect to cause a denial of service.

The issue can lead to a kernel panic.

151) Use-after-free (CVE-ID: CVE-2026-53025)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the greybus raw character device handling in drivers/staging/greybus/raw.c when closing an opened character device after the associated raw bundle has been disconnected. A local user can keep the character device open and then close it after disconnect to cause a denial of service.

Exploitation requires that the character device remain opened by an application while the associated raw bundle is disconnected.

152) Improper input validation (CVE-ID: CVE-2026-53091)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of gso packet headers in qdisc_pkt_len_segs_init() when processing malicious gso packets. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue affects the transmit path for gso packets and malformed packets may be dropped during processing.

153) Deadlock (CVE-ID: CVE-2026-53103)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in mt7925_roc_abort_sync when canceling roc_work during station removal while the work item is still running and holding dev->mt76.mutex. A local user can trigger station removal to cause a denial of service.

154) Memory leak (CVE-ID: CVE-2026-53104)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the mt76 dma rx queue cleanup logic when destroying the device during module unload. A local user can trigger device cleanup to cause a denial of service.

The issue affects MT76 rx queues, including WED RRO queues that have an associated page_pool even when not associated to a NAPI.

155) Race condition (CVE-ID: CVE-2026-53108)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in powerpc PMD huge page handling when unmapping memory during PMD page migration or device-private THP entry handling. A local user can trigger concurrent move_pages() and munmap() operations to cause a denial of service.

The issue can lead to a kernel BUG in pmdp_huge_get_and_clear_full() on powerpc/64s systems.

156) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53109)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in pte_frag_destroy when freeing cached page table fragments during process exit. A local user can trigger process exit with a crafted memory state to cause a denial of service.

The issue affects the powerpc page table fragment handling path for hash with 64K page size and can occur in a corner case involving deferred PTE table freeing in parallel with do_exit().

157) Use-after-free (CVE-ID: CVE-2026-53118)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the vdpa driver_override handling in the vDPA bus match callback when probing a driver through __driver_attach(). A local user can trigger driver matching while the driver_override field is accessed without the device lock to cause a denial of service.

The issue occurs because the bus match callback is invoked without the device lock held during this code path.

158) Integer underflow (CVE-ID: CVE-2026-53178)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an unsigned integer underflow in rtw_mlme.c when processing wireless network information elements. A remote attacker can provide a specially crafted beacon or management frame to cause a denial of service.

The issue is in the rtl8723bs staging driver during network selection and WPS/RSN information element handling.

159) Out-of-bounds read (CVE-ID: CVE-2026-53224)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in SCTP cookie processing in sctp_unpack_cookie(), sctp_process_init(), and sctp_raw_to_bind_addrs() when handling a malformed COOKIE_ECHO containing a truncated embedded INIT chunk or malformed address parameters. A remote attacker can send a specially crafted COOKIE_ECHO to cause a denial of service.

When cookie authentication is disabled, an oversized raw address list length can also be used to trigger the out-of-bounds read condition.

160) Memory leak (CVE-ID: CVE-2026-53258)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in cfg80211_scan() when handling split 6 ghz scanning failures. A local user can trigger a scan request that causes cfg80211_scan() to fail to cause a denial of service.

The issue occurs because the internal scan request is not released when scan setup fails during split 6 ghz scanning.

161) Race condition (CVE-ID: CVE-2026-53277)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in arm64 KVM page table walk handling when performing fault injection and address translation emulation. A local user can trigger page table walks without the required SRCU protection to cause a denial of service.

The issue affects calls to __kvm_at_s12() and __kvm_find_s1_desc_level() that invoke nested stage-2 and stage-1 walkers without holding kvm->srcu.

162) Use-after-free (CVE-ID: CVE-2026-53281)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a NULL pointer dereference and use-after-free in the Intel VT-d IOMMU PASID teardown logic when detaching a domain that was not attached to the IOMMU or when a PASID entry is not found. A local user can trigger teardown operations on an invalid or missing PASID association to cause a denial of service or execute arbitrary code.

The issue can also corrupt reference counts, which may prematurely drop a shared domain reference to zero for remaining active devices.

163) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53284)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in btrfs_write_and_wait_transaction() and the dirty_pages io tree when handling failed transaction writeback. A remote attacker can trigger write errors that cause dirty extent buffer records to be released prematurely to cause a denial of service.

The issue can leave dirty extent buffers uncleared during transaction cleanup and trigger warnings during filesystem unmount.

164) Resource exhaustion (CVE-ID: CVE-2026-53285)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in dcn32_enable_phantom_plane() when allocating phantom plane state during bandwidth validation. A local user can trigger allocation of a large dc_plane_state object to cause a denial of service.

The issue can lead to a kernel crash when memory allocation reaches the vmalloc path in a preemption-restricted context.

165) Improper handling of exceptional conditions (CVE-ID: CVE-2026-53292)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in pn_socket_autobind() in net/phonet/socket.c when handling socket autobind during send operations. A local user can trigger a failed bind condition that reaches a BUG_ON() assertion to cause a denial of service.

The issue is reachable from a user-triggerable path and can panic the kernel when pn_socket_bind() returns -EINVAL while the socket port remains unset.

166) NULL pointer dereference (CVE-ID: CVE-2026-53297)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mana_remove() when handling a second invocation after a failed PM resume callback. A local user can trigger device unbind after a failed resume path to cause a denial of service.

The issue occurs because a failed resume callback does not automatically unbind the driver, allowing mana_remove() to be invoked again later.

167) Resource exhaustion (CVE-ID: CVE-2026-53321)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in io_uring napi busy polling when polling for events with no events found. A local user can trigger repeated busy polling to cause a denial of service.

The issue can lead to kernel complaints about a task being stuck because the polling loop lacks conditional rescheduling.

168) Out-of-bounds read (CVE-ID: CVE-2026-53330)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in dp_get_eq_aux_rd_interval() when processing DisplayPort repeater capability data. A local attacker can provide crafted repeater count information to trigger an out-of-bounds read and disclose sensitive information.

The issue occurs when a sink reports 8 LTTPR repeaters, causing access beyond the declared aux_rd_interval array bounds.

169) Race condition (CVE-ID: CVE-2026-53368)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause file system inconsistency.

The vulnerability exists due to a race condition in f2fs nat_entry flag handling in fs/f2fs/node.c when syncing files and writing checkpoints concurrently. A local user can trigger file write, fsync, and checkpoint activity to cause file system inconsistency.

The issue can leave an inode marked with DENT_BIT_SHIFT after it has already been checkpointed, which may be detected by fsck.

170) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-53377)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper recovery handling in recover_worker in the drm/msm GPU driver when processing a hung GPU ring with no additional queued work. A local user can trigger a GPU hang to cause a denial of service.

The issue can occur when a single submitted job hangs a ring and the GPU remains in a hung state instead of being recovered.

171) Use-after-free (CVE-ID: CVE-2026-53401)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed physical memory.

The vulnerability exists due to a use-after-free in omapfb_mmap when racing a memory mapping request with OMAPFB_SETUP_PLANE and OMAPFB_SETUP_MEM operations. A local user can trigger concurrent framebuffer operations to access freed physical memory.

The issue is caused by inconsistent use of region data and map_count tracking across concurrent execution paths.

172) NULL pointer dereference (CVE-ID: CVE-2026-63811)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in f2fs atomic write handling when reading COW data during write-begin processing. A local user can update an atomic-write file in a crafted encryption-policy state to cause a denial of service.

The issue occurs when the original inode and its COW inode use different encryption contexts, causing decryption to be attempted on a folio owned by the original inode.

173) Out-of-bounds write (CVE-ID: CVE-2026-63825)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in inflate_fast() when processing IP payload compression data concurrently on multiple cpus. A local user can trigger concurrent execution of the vulnerable code path to cause a denial of service.

The issue occurs because global gcov counters can change between multiple loads during execution, producing inconsistent loop values.

174) Use-after-free (CVE-ID: CVE-2026-63832)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to memory corruption in the mt76_sta_add function when handling station addition for published wcid entries. A local user can trigger repeated station add operations to cause a denial of service.

The issue was observed as dev->sta_poll_list corruption on systems using the mt7925 driver.

175) Improper input validation (CVE-ID: CVE-2026-63853)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the VCN v4.0 encoder ring submission handling when processing command submissions with user fences. A local user can submit a crafted command stream with a user fence to cause a denial of service.

The issue affects VCN v4.0 encoder functionality, and stems from unsupported 64-bit user fence writes being accepted.

176) Out-of-bounds read (CVE-ID: CVE-2026-63857)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in airoha_dev_xmit() when processing fragmented socket buffers. A local user can trigger transmission of a crafted fragmented packet to cause a denial of service.

The unsafe read occurs during the final loop iteration when the loop index reaches the fragment count, which may trigger a page fault.

177) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-63859)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource state management in airoha_qdma_cleanup_tx_queue() when cleaning up transmit queues. A local user can trigger transmit queue cleanup in a way that leaves DMA TX descriptors and queue indexes in an inconsistent state to cause a denial of service.

The issue affects the Airoha Ethernet driver in the Linux kernel.

178) Race condition (CVE-ID: CVE-2026-63879)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in amdgpu_hmm_range_get_pages in the AMDGPU HMM handling code when reading the notifier sequence across range processing. A local user can trigger memory invalidation during page range handling to cause a denial of service.

The issue can result in operations being performed on invalid pages.

179) Use-after-free (CVE-ID: CVE-2026-63979)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the net/handshake accept-side request handling code when processing queued handshake requests during concurrent cancellation. A local user can trigger a race condition to cause a denial of service.

The issue occurs because the accept side dereferences req->hr_sk->sk_socket->file after the request is removed from the pending list, while a concurrent cancellation path can release sock->file, clear sk_socket, or free the associated struct socket.

180) Improper resource shutdown or release (CVE-ID: CVE-2026-63998)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the ethtool module flash operation handler when handling a module firmware flash request that fails validation. A local user can trigger a validation failure to cause a denial of service.

181) Memory leak (CVE-ID: CVE-2026-63999)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in rss_prepare_get() in net/ethtool/rss.c when handling a get_rxfh operation failure. A local user can trigger an error path to cause a denial of service.

182) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64006)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of overlapping registers in nf_tables bitwise and byteorder operations when processing crafted nf_tables register operations. A local user can create overlapping source and destination register operations to cause incorrect packet filtering behavior and a denial of service.

Exploitation requires the ability to configure nf_tables rules.

183) Race condition (CVE-ID: CVE-2026-64024)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to predict TCP initial sequence numbers.

The vulnerability exists due to improper state management in the Linux kernel TCP input path when processing TCP packets that transition from TIME_WAIT handling and are later dropped before request processing. A remote attacker can send packets that trigger these drop paths and then send a subsequent SYN on the same CPU to predict TCP initial sequence numbers.

The issue occurs because a non-zero TIME_WAIT-derived ISN can remain stored after several packet-drop conditions, including policy, filter, checksum, and header validation failures.

184) Out-of-bounds read (CVE-ID: CVE-2026-64036)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in the css_rstat_updated() BPF kfunc when processing a caller-provided cpu argument. A local privileged user can pass an invalid cpu value to trigger an out-of-bounds access and cause a denial of service.

Exploitation requires a BPF iter/cgroup program with CAP_BPF and CAP_PERFMON.

185) Use-after-free (CVE-ID: CVE-2026-64038)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the lm90 hwmon driver when processing delayed alert and alarm work during device unbind or probe failure. A local user can trigger the affected driver teardown race to cause a denial of service.

The issue occurs in a window where the hwmon device has been unregistered and freed before the delayed works are cancelled.

186) Memory leak (CVE-ID: CVE-2026-64060)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in netfs_write_begin() when handling an error from netfs_wait_for_read(). A local user can trigger an error condition during a write operation to cause a denial of service.

187) Improper locking (CVE-ID: CVE-2026-64068)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in netfs_retry_read_subrequests() and netfs_retry_write_stream() when retrying read and write subrequests. A local user can trigger concurrent subrequest operations to cause a denial of service.

188) Race condition (CVE-ID: CVE-2026-64076)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ebtables initialization in net/bridge/netfilter/ebtables.c when registering and exposing sockopts globally during module initialization. A local user can trigger access to the exposed sockopts during the initialization window to cause a denial of service.

189) Race condition (CVE-ID: CVE-2026-64077)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ebtables table registration and unregistration logic when handling table initialization and teardown. A local user can trigger ebtables operations to cause a denial of service.

The issue involves exposure of a partially filled table structure and unsafe teardown ordering in the bridge netfilter ebtables subsystem.

190) Race condition (CVE-ID: CVE-2026-64079)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to a NULL pointer dereference in netfilter x_tables table registration and teardown when registering tables concurrently with per-network namespace exit. A local user can trigger concurrent table registration and namespace cleanup to cause a denial of service.

The issue occurs because a table can become visible in the per-netns list before valid hook operations are assigned, allowing the pre_exit path to pass a NULL ops pointer to hook unregistration.

191) Use-after-free (CVE-ID: CVE-2026-64117)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ieee80211_invoke_fast_rx() when processing mesh forwarding in the unicast forward path. A local user can trigger mesh data handling that causes freed memory to be accessed to cause a denial of service.

The issue occurs because skb->cb storage is reused by mesh forwarding code before the caller finishes consuming the RX status, and the no-route path can free the skb before the stale status is accessed.

192) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64146)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in erofs_init_inode_xattrs() in the EROFS xattr handling code when parsing crafted filesystem metadata. A local user can trigger error paths that leak a folio reference to cause a denial of service.

The issue occurs on certain error paths after a metabuf has been acquired during inode xattr initialization.

193) Improper resource shutdown or release (CVE-ID: CVE-2026-64154)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in a6xx_gpu_init() when handling error paths after parsing the qcom,gmu phandle. A local user can trigger an error condition to cause a denial of service.

194) Incorrect calculation (CVE-ID: CVE-2026-64159)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect file reads.

The vulnerability exists due to improper handling of file size state in netfs_release_folio() when releasing a folio while uncommitted page cache data exists beyond the folio and the on-server EOF falls within that folio. A local user can trigger this condition through crafted file operations to cause incorrect file reads.

This was observed on cifs with the default cache option and no fscache.

195) Race condition (CVE-ID: CVE-2026-64190)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a race condition leading to a NULL pointer dereference in team_xmit in the Linux kernel team driver when changing team device mode concurrently with transmit activity. A local privileged user can trigger a mode change while traffic is being transmitted on the team device to cause a denial of service.

Exploitation requires the ability to perform a mode change on the team device and concurrent transmit activity.

196) Race condition (CVE-ID: CVE-2026-64213)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the lm90_alert handler when handling concurrent smbus alert events and sysfs write operations. A local user can trigger concurrent alert and sysfs write activity to cause a denial of service.

The issue can unintentionally re-enable the hardware alert line while the alarm remains active, resulting in an interrupt storm.

197) Integer overflow (CVE-ID: CVE-2026-64283)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass a file size check.

The vulnerability exists due to an integer overflow in the KVM guest_memfd memslot binding logic when binding a memslot to a guest_memfd file. A local user can supply a crafted offset and size combination to bypass a file size check.

The issue affects the sum of the offset and size values, where a very large offset can cause the signed 64-bit result to become negative during validation.

198) Improper access control (CVE-ID: CVE-2026-64388)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass ownership and group changes.

The vulnerability exists due to improper access control in cifs_setattr_nounix() when processing chown and chgrp operations on mounts using SMB3 POSIX Extensions. A local user can change file ownership or group attributes in a way that is ignored to bypass ownership and group changes.

The issue occurs only when SMB3 POSIX Extensions are used without the relevant ACL or SID-based mount options enabled.

199) Incorrect Implementation of Authentication Algorithm (CVE-ID: CVE-2026-64389)

CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify session key material.

The vulnerability exists due to improper authentication logic in ksmbd NTLMv2 authentication handling when processing SMB3 multichannel binding session setup requests with KEY_XCH. A remote user can send a binding session setup with a bad NT proof and KEY_XCH to modify session key material.

The issue occurs on an existing session because the failed authentication path does not expire binding sessions.

200) Path traversal (CVE-ID: CVE-2026-64400)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to create files or directories outside the exported share.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in __ksmbd_vfs_kern_path() when processing crafted paths with parent-directory components during caseless lookup retry. A remote user can send a specially crafted path to create files or directories outside the exported share.

The issue occurs because an -EXDEV error from path traversal detection is not handled before the caseless retry logic runs, and exploitation is limited to zero-length files or directories.

201) Improper Initialization (CVE-ID: CVE-2026-64513)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in KVM x86 LAPIC and CR8 intercept handling when updating the guest's PPR and entering a virtual machine. A local user can trigger PPR updates in a guest to cause a VM entry failure with hardware error 0x7.

This is typically exposed on older platforms or under nested virtualization on a hypervisor that does not support virtual-interrupt delivery and enforces the TPR_THRESHOLD check.

202) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68081)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the KVM nVMX nested VM-Enter handling in arch/x86/kvm/vmx/nested.c when emulating VMLAUNCH or VMRESUME with invalid guest state. A local user can repeatedly trigger failed nested VM-Enter operations to cause a denial of service.

The issue occurs when KVM synthesizes a nested VM-Exit on invalid guest state, allowing pinned vmcs12 pages or mappings to be leaked if the operation is retried.

203) NULL pointer dereference (CVE-ID: CVE-2026-68105)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the amdgpu driver KIQ ring handling when loading the driver after MES initialization fails. A local user can trigger driver loading to cause a denial of service.

The issue occurs on ASICs that use MES, where the KIQ ring is owned by MES and may be incorrectly left marked as ready after initialization failure.

204) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68211)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in dcmipp_bytecap_start_streaming() when starting video buffer streaming with an unresolved source subdevice in the media graph. A local user can trigger streaming setup in this state to cause a denial of service.

The issue occurs because queued buffers are not returned on the early error path, which can trigger a WARN_ON and leak buffers.

205) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68233)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown of a timer in vc4_bo_cache_destroy() in the vc4 BO cache when tearing down the BO cache. A local user can trigger the affected code path to cause a denial of service.

206) Improper resource shutdown or release (CVE-ID: CVE-2026-68238)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in amdgpu_acpi_vfct_bios() when fetching and processing the ACPI VFCT table. A local user can trigger repeated calls to the vulnerable function to cause a denial of service.

The issue leaks an ACPI table mapping because the reference obtained with acpi_get_table() is not released on exit paths after the table is acquired.

207) Infinite loop (CVE-ID: CVE-2026-68241)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper control of a loop in intel_dp_check_mst_status() in the i915 DisplayPort MST handling code when servicing sink-originated DP MST ESI interrupts. A local user can trigger repeated interrupt processing to cause a denial of service.

The issue can occur if the sink device remains stuck and does not clear incoming interrupts.

208) NULL pointer dereference (CVE-ID: CVE-2026-68242)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in execlists_create_virtual() in the i915 GPU driver when handling the ioctl path and sched_engine allocation fails. A local user can trigger sched_engine allocation failure through a crafted ioctl interaction to cause a denial of service.

209) Improper input validation (CVE-ID: CVE-2026-68258)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in kfd CRIU restore queue handling when processing user-supplied private restore data. A local user can provide an out-of-bounds queue type or mismatched mqd_size values to cause a denial of service.

Exploitation requires access to the CRIU restore functionality in the amdkfd subsystem.

210) NULL pointer dereference (CVE-ID: CVE-2026-68291)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the idpf driver core initialization and removal handling when allocation errors occur during initialization followed by reset or module removal. A local privileged user can trigger failed initialization and then reset or remove the module to cause a denial of service.

The issue occurs because max_vports is set before the related vports, netdevs, and vport_config buffers are successfully allocated.

211) Incorrect calculation (CVE-ID: CVE-2026-68295)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect BPF program execution.

The vulnerability exists due to improper handling of integer extension in the LoongArch BPF JIT compiler when processing signed ALU32 divide and modulo operations. A local user can load a crafted BPF program to cause incorrect BPF program execution.

The issue arises because signed ALU32 division and modulo results are sign-extended in JITted code while the verifier and interpreter model the upper 32 bits as zero.

212) Improper resource shutdown or release (CVE-ID: CVE-2026-68312)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in cifs_close_deferred_file(), cifs_close_all_deferred_files(), and cifs_close_deferred_file_under_dentry() when handling deferred close cancellation and allocation failure under memory pressure. A local user can trigger deferred close processing in low-memory conditions to cause a denial of service.

The issue occurs when cancel_delayed_work() succeeds and the subsequent allocation for local processing fails, causing a cifsFileInfo reference and an open server handle to leak.

213) Race condition (CVE-ID: CVE-2026-68323)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in tipc_udp_rcast_add() and cleanup_bearer() in net/tipc/udp_media.c when updating the udp bearer replicast list during peer discovery and bearer cleanup. A local user can enable a TIPC bearer from an unprivileged user namespace and trigger concurrent list updates to cause a denial of service.

The issue can corrupt the kernel list structure and trigger a kernel BUG during bearer cleanup.

214) Improper Initialization (CVE-ID: CVE-2026-68375)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in bnxt_aux_devices_init() and the bnxt_aux_dev_release() release callback when unwinding errors after auxiliary_device_init(). A local user can trigger an allocation failure during auxiliary device initialization to cause a denial of service.

The issue arises because the release callback may dereference or clear partially initialized state.

215) Use-after-free (CVE-ID: CVE-2026-68383)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the xe GuC scheduler timeline name handling when destroying an exec queue while scheduler fences still reference the timeline name. A local user can trigger exec queue destruction while outstanding scheduler fences still reference the freed name to cause a denial of service.

The issue arises because the scheduler keeps a pointer to the timeline name after the exec queue lifetime ends, creating an RCU-lifetime mismatch.

216) Use-after-free (CVE-ID: CVE-2026-68393)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in net/bluetooth/hci_sync.c when accessing RCU-protected Bluetooth connection objects outside the critical section. A local user can trigger concurrent connection state changes to cause a denial of service.

The issue affects Bluetooth HCI synchronization code and occurs because connection objects may be deleted concurrently before dereference is complete.

217) Use-after-free (CVE-ID: CVE-2026-68399)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sk_clone() and BPF socket local storage handling when cloning sockets and an early bailout occurs before BPF storage cloning. A local user can trigger socket cloning that fails before storage initialization completes to cause a denial of service.

Only systems with BPF syscall support enabled are vulnerable.

218) Out-of-bounds write (CVE-ID: CVE-2026-68400)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the arm_ffa memory region descriptor handling code when calculating endpoint memory access descriptor offsets while processing memory region descriptors. A local user can trigger the vulnerable code path with a crafted descriptor layout to cause a denial of service.

The issue arises from using a default structure size instead of the descriptor's ep_mem_offset value, which can cause calculated descriptor offsets to exceed the fragment size.

219) Out-of-bounds write (CVE-ID: CVE-2026-68401)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in ffa_setup_and_transmit() in the arm_ffa firmware driver when handling malformed memory region descriptors. A local user can trigger the vulnerable code path to cause a denial of service.

The issue includes writing the reserved field out of bounds for FFA versions earlier than 1.2 and insufficient size validation before writing constituents.

220) Race condition (CVE-ID: CVE-2026-68404)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nl80211_netlink_notify() and cfg80211 wireless device autodisconnect handling when releasing a NETLINK_GENERIC socket that owns a connection. A local user can release a crafted netlink socket to cause a denial of service.

The issue occurs because autodisconnect work can be queued after teardown has cancelled pending work and after the wireless device has been removed from the device list.

221) Use-after-free (CVE-ID: CVE-2026-68409)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the mac80211 link RX stats handling in sta_remove_link() when processing concurrent link removal and RX fast-path access. A local attacker can trigger the race condition to cause a denial of service.

The issue occurs only when uses_rss is enabled, which is when pcpu_rx_stats exists.

222) Memory leak (CVE-ID: CVE-2026-68412)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in cfg80211_wext_siwscan() when processing a scan request with an SSID length greater than IEEE80211_MAX_SSID_LEN. A local user can send a crafted scan request to cause a denial of service.

223) NULL pointer dereference (CVE-ID: CVE-2026-68418)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the irdma queue pair creation path when creating a queue pair with a zero user_wqe_bufs value. A local user can submit a crafted queue pair creation request to cause a denial of service.

224) Resource management error (CVE-ID: CVE-2026-68421)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources in kernel/sched/ext.c. A local user can perform a denial of service (DoS) attack.

225) Use-after-free (CVE-ID: CVE-2026-68426)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in validate_xmit_xfrm() in net/xfrm/xfrm_device.c when processing GSO segment lists with asynchronous crypto handling. A local user can trigger asynchronous processing that steals a segment and leaves a stale skb->prev pointer to cause a denial of service.

The issue occurs when a stolen segment remains referenced as the list tail and is later dereferenced by validate_xmit_skb_list().

226) NULL pointer dereference (CVE-ID: CVE-2026-68435)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of user-space pointers in machine_kexec_prepare() in arch/loongarch/kernel/machine_kexec.c when searching loaded kexec segments for the command line marker on the kexec_load(2) path. A local user can provide a crafted user-space segment buffer to trigger a kernel dereference of a user pointer and cause a denial of service.

The issue affects the LoongArch kexec_load(2) path with file_mode set to 0.

227) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-68436)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory allocation in dc_create() when initializing the AMD display manager. A local user can trigger GPU initialization so that allocation of struct dc fails and cause a denial of service.

The issue can leave the display unusable after amdgpu probe aborts during device initialization.

228) NULL pointer dereference (CVE-ID: CVE-2026-68441)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in qdisc filter chain classification handling when processing TC_ACT_REDIRECT from a TC filter attached to a qdisc filter chain. A local user can trigger TC_ACT_REDIRECT, for example via an eBPF program calling bpf_redirect(), to cause a denial of service.

The issue occurs when the caller does not set up bpf_net_context, and the clsact fast path is unaffected.

229) Out-of-bounds read (CVE-ID: CVE-2026-68447)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the amdkfd CRIU checkpoint handling for the MQD control stack when copying checkpoint data to userspace. A local user can trigger a checkpoint operation with a hardware-reported control stack size larger than the allocated buffer object to disclose sensitive information.

The issue can leak kernel data from adjacent GTT memory to userspace.

230) Improper access control (CVE-ID: CVE-2026-68448)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the overlayfs copy_file_range handling in fs/overlayfs/file.c when performing cross-superblock copy operations. A local user can invoke a copy operation between different overlayfs filesystems to disclose sensitive information.

The issue occurs because read access to the source file is checked with destination overlayfs mounter credentials instead of source overlayfs mounter credentials.

231) Out-of-bounds read (CVE-ID: CVE-2026-68453)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the s390 zcrypt CCA token validation and handling logic when processing crafted CCA key token buffers with user-controlled length fields. A local user can provide a specially crafted key token with inconsistent length values to cause a denial of service or disclose sensitive information.

The issue involves both oversized length fields that exceed the actual buffer size and undersized length fields that can cause a buffer under-run with similar effects.

232) Out-of-bounds read (CVE-ID: CVE-2026-68470)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the mac80211 RX path when processing unsupported extension frames and S1G beacon extension frames. A remote attacker can send a specially crafted wireless frame to cause a denial of service.

The issue affects extension-frame handling before unsupported extension subtypes are dropped, and S1G beacon processing requires the target system to receive crafted 802.11 frames.

233) Improper input validation (CVE-ID: CVE-2026-68471)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ieee80211_mle_size_ok() and ieee80211_mle_common_size() when parsing multi-link element data. A remote attacker can send specially crafted MLE data to cause a denial of service.

The issue affects validation of advertised common information lengths for known MLE types, including Reconfiguration and Priority Access MLEs.

234) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72009)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the imx93-blk-ctrl power domain handling for MIPI DSI and CSI when managing shared clock and reset resources. A local user can trigger concurrent use of the DSI and CSI domains to cause a denial of service.

The issue occurs because the two domains share control bits for clock and reset, so one domain may disable a resource while the other remains active.

235) Improper resource shutdown or release (CVE-ID: CVE-2026-72031)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper device power state handling in libata-core for the PNY CS900 1TB SSD when entering device-initiated slumber during idle. A local user can trigger idle conditions to cause a denial of service.

The issue can cause the SATA link to go down and not recover, forcing the filesystem read-only.

236) Use-after-free (CVE-ID: CVE-2026-72073)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in the vub300_probe error path in drivers/mmc/host/vub300.c when handling a failed mmc_add_host() call after the inactivity timer has been armed. A local user can trigger a probe failure race to cause a use-after-free.

Exploitation requires a failure during device probe after the inactivity timer is armed, and the queued deadwork may continue running after the timer callback has completed.

237) Out-of-bounds write (CVE-ID: CVE-2026-72098)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in dm-verity fec calculation when processing erasure data during FEC decoding. A local user can trigger crafted corruption conditions to cause memory corruption.

The out-of-bounds write can occur when the erasure count exceeds the intended Reed-Solomon roots limit and the decoder writes past the end of the lambda array into the syndrome buffer.

238) Out-of-bounds read (CVE-ID: CVE-2026-72162)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in ocfs2_sum_rightmost_rec when processing a corrupted inode embedded extent list from disk. A local user can provide a crafted ocfs2 filesystem image with invalid extent list metadata to cause a denial of service.

The issue is triggered when l_next_free_rec is zero or exceeds l_count in the embedded extent list of an inode.

239) Use-after-free (CVE-ID: CVE-2026-72288)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the KVM arm64 virtual generic interrupt controller (vgic) AP list handling when racing interrupt affinity changes with LPI disabling. A local user can trigger concurrent interrupt state changes to cause a denial of service.

The issue occurs during LPI handling involving multiple vCPUs.

240) Resource management error (CVE-ID: CVE-2026-72321)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in igmp_mod_timer() and igmp_stop_timer() when deleting or stopping IGMP timers during concurrent multicast group removal. A local user can trigger IGMP processing that reaches these code paths to cause a denial of service.

The issue can occur when the affected multicast list entry is accessed from an RCU reader path while the group is concurrently removed from the list.

241) Use-after-free (CVE-ID: CVE-2026-72329)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the liquidio SR-IOV VF pci_dev lookup handling when processing an OCTEON_VF_FLR_REQUEST mailbox command. A local user can trigger a VF FLR request that causes dereference of a stale pci_dev pointer to cause a denial of service.

Exploitation requires the affected device to be operating in SR-IOV mode with allocated virtual functions.

242) Use-after-free (CVE-ID: CVE-2026-72337)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Bluetooth 6LoWPAN debugfs enable handler when processing a debugfs enable write that races with module exit. A local user can trigger an enable state change and race it with module teardown to cause a denial of service.

The issue occurs because queued work can later access stale state, including listen_chan, after the debugfs operation has returned.

243) Race condition (CVE-ID: CVE-2026-72341)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mlx5 driver channel statistics handling when reading netdevice statistics concurrently with channel initialization. A local user can trigger concurrent statistics queries to cause a denial of service.

The issue can lead to a NULL pointer dereference on weakly ordered architectures such as ARM, PowerPC, and RISC-V during NIC bringup.

244) Improper Initialization (CVE-ID: CVE-2026-72366)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource initialization in netfs_create_write_req() when handling write operations during asynchronous cache object creation. A local user can trigger a write operation before the fscache cookie is fully enabled to cause a denial of service.

The issue occurs because caching may be skipped while asynchronous cache object creation has not progressed far enough for the cookie to be enabled.

245) Integer underflow (CVE-ID: CVE-2026-72367)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data corruption.

The vulnerability exists due to an integer underflow in fs/iomap/ioend.c when handling concurrent truncate and writeback operations around EOF. A local user can trigger concurrent file append writes and truncation to cause data corruption.

The issue occurs when EOF moves to or before the ioend start offset, causing a negative size calculation to wrap to a large unsigned value.

246) Improper Initialization (CVE-ID: CVE-2026-72375)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in afs_vnode lock_work handling when processing file locking operations on AFS inodes. A local user can trigger lock operations on a reused inode to cause a denial of service.

The issue can lead to kernel warnings from debug object handling, and the affected work item may still be running during inode eviction.

247) Out-of-bounds write (CVE-ID: CVE-2026-72380)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in pvcalls_front_event_handler() when processing a backend-supplied ring response with an out-of-range req_id. A local user can supply a crafted backend response to cause memory corruption.

The issue affects the Xen pvcalls frontend in deployments where the frontend does not trust its backend.

248) Use-after-free (CVE-ID: CVE-2026-72383)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in sctp_free_addr_wq() and sctp_addr_wq_timeout_handler() when handling addr_wq_timer teardown. A local attacker can trigger a race condition to cause a denial of service.

The issue arises because a timer handler may continue running after the associated wait queue has been freed.

249) Improper locking (CVE-ID: CVE-2026-72388)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the panthor scheduler fence handling code when accessing shared dma_fence objects from hardirq context. A local user can trigger fence operations and race lock acquisition to cause a denial of service.

The issue arises because dma_fence objects may be shared with other subsystems and accessed from hardirq context.

250) Improper input validation (CVE-ID: CVE-2026-72397)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to send incorrect voltage commands to a PMBus device.

The vulnerability exists due to improper input validation in pmbus_data2reg_vid() in the pmbus core when converting user-supplied voltage values for PMBUS_VOUT_COMMAND. A local user can request a voltage using a non-VR11 VID mode to send incorrect voltage commands to a PMBus device.

Only drivers that select a non-VR11 VID mode and expose a regulator or hwmon vout setter are affected.

251) Improper input validation (CVE-ID: CVE-2026-72398)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to tamper with SCTP association handling and cause a denial of service.

The vulnerability exists due to improper input validation in SCTP COOKIE-ECHO processing paths when processing a cookie containing a reconstructed INIT chunk while cookie authentication is disabled. A remote attacker can send a specially crafted COOKIE-ECHO packet to tamper with SCTP association handling and cause a denial of service.

The issue only arises when cookie authentication is disabled.

252) Use-after-free (CVE-ID: CVE-2026-72404)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the TIPC UDP media bearer cleanup logic in net/tipc/udp_media.c when tearing down a bearer while concurrent transmit or receive operations are still accessing cached destinations or bearer state under RCU protection. A local attacker can trigger concurrent TIPC UDP activity during bearer cleanup to cause a denial of service.

The issue can affect concurrent transmitters through replicast destination cache access and concurrent receivers through access to the bearer structure after teardown begins.

253) Out-of-bounds write (CVE-ID: CVE-2026-72423)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in conntrack lookup and allocation bpf kfunc wrappers in net/netfilter/nf_conntrack_bpf.c when handling an opts pointer with an invalid size smaller than the end of opts->error. A local user can supply a crafted opts pointer and opts__sz value to cause memory corruption.

Exploitation requires invoking the affected bpf conntrack lookup or allocation helpers with an invalid opts size.

254) Improper resource shutdown or release (CVE-ID: CVE-2026-72439)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the raid10 write request handling in drivers/md/raid10.c when processing write requests that fail before being queued. A local user can trigger write request failure paths to cause a denial of service.

The issue occurs because certain error paths complete the bio without reaching the normal write completion path.

255) Improper resource shutdown or release (CVE-ID: CVE-2026-72440)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the raid1 write request handling in drivers/md/raid1.c when processing write requests that fail before being successfully queued. A local user can trigger write failure paths to cause a denial of service.

The issue involves leaked writes_pending and barrier references on error paths.

256) Out-of-bounds read (CVE-ID: CVE-2026-72488)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in sdw_add_element_group_count when processing SoundWire group rate and lane entries. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the loop iterates with an index equal to the element count.

257) Use-after-free (CVE-ID: CVE-2026-72493)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition leading to use-after-free in enqueue_to_backlog() when processing packets during device unregistration. A local attacker can trigger packet transmission during device unregistration to cause a denial of service.

The issue occurs because a packet can escape backlog flushing during network namespace exit or similar device unregistration timing.

258) Race condition (CVE-ID: CVE-2026-72494)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the irdma cqp request completion handling when waiting for cqp request completion. A local user can trigger a race condition to cause a denial of service.

The issue arises from missing memory barriers around the request_done flag.

259) Race condition (CVE-ID: CVE-2026-72495)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the bnxt_re RDMA ucontext WC page allocation handler when processing repeated concurrent requests to allocate WC pages for the same ucontext. A local user can send repeated allocation requests to cause a denial of service.

Only one WC page per ucontext is supported.

260) Improper input validation (CVE-ID: CVE-2026-72497)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the bnxt_re queue pair initialization logic when processing a user-supplied sq_slots value for variable WQE mode. A local user can supply an invalid sq_slots value to cause a denial of service.

The issue occurs when variable WQE mode is used, and the supplied sq_slots value is zero or exceeds the hardware-supported maximum of 64K.

261) Use-after-free (CVE-ID: CVE-2026-72499)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the bnxt_re CQ destruction logic when handling an NQ interrupt during completion queue teardown. A local user can trigger completion queue destruction while an interrupt arrives to cause a denial of service.

The issue occurs because the toggle page may be written after it has already been freed during firmware teardown.

262) Use-after-free (CVE-ID: CVE-2026-72500)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the bnxt_re SRQ teardown logic when handling an NQ interrupt during SRQ destruction. A local user can trigger SRQ destruction while an interrupt arrives to cause a denial of service.

The issue occurs because toggle values may be written to an already-freed page before firmware teardown completes.

263) Use of Uninitialized Variable (CVE-ID: CVE-2026-72501)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the BNXT_RE_METHOD_ALLOC_PAGE handler in drivers/infiniband/hw/bnxt_re/uapi.c when processing page allocation requests. A local user can trigger the handler so that an uninitialized dpi value is copied to user space to disclose sensitive information.

264) Use-after-free (CVE-ID: CVE-2026-74257)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in udp_bpf_recvmsg() when processing concurrent recvmsg operations on BPF-enabled UDP sockets. A local user can trigger concurrent socket receive operations to cause a denial of service.

The issue arises because sk_msg_recvmsg() accesses an ingress message under a lock but processes it without serialization, allowing multiple threads to touch the same sk_msg.

265) Race condition (CVE-ID: CVE-2026-74261)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ALSA sequencer FIFO handling in sound/core/seq/seq_fifo.c when resizing the FIFO while processing and relinking event cells. A local user can trigger concurrent FIFO resize and event handling operations to cause a denial of service.

The issue can leave a retired pool waiting indefinitely for stale cells to drain during pool teardown.

266) Race condition (CVE-ID: CVE-2026-74264)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the network device watchdog code when concurrent watchdog operations are performed. A local user can trigger concurrent watchdog activity to cause a denial of service.

The issue can lead to list corruption and a kernel crash.

267) Double free (CVE-ID: CVE-2026-74269)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in the bnxt driver receive path in bnxt_rx_multi_page_skb when processing XDP head-grow adjustments. A local user can trigger crafted XDP head adjustment behavior to cause a denial of service.

The issue occurs because a head underflow can corrupt page pool fragment reference counts, causing a page to be prematurely recycled while still in use.

268) Race condition (CVE-ID: CVE-2026-74272)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the cxl region deletion logic when handling sysfs requests and root device teardown. A local user can trigger concurrent region deletion operations to cause a denial of service.

The issue involves races between sysfs-triggered region deletion, multiple deletion paths, and kernel teardown of the CXL root device.

269) Improper locking (CVE-ID: CVE-2026-74273)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in the cxl region management code when creating or deleting regions. A local user can trigger concurrent region creation and deletion operations to cause a denial of service.

The issue arises during the window between region construction and target attachment, and between device registration and remove action registration.

270) Out-of-bounds write (CVE-ID: CVE-2026-74317)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a slab out-of-bounds write in __netif_set_xps_queue in the ixgbe driver when loading an XDP program that configures XDP transmit queues. A local user can load an XDP program to trigger the out-of-bounds write and cause a denial of service.

The issue occurs on E610 adapters on systems with 64 or more CPUs when the last XDP queue is configured.

271) Improper input validation (CVE-ID: CVE-2026-74338)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the BPF verifier for BPF_LSM_CGROUP program loading when loading a sleepable BPF_LSM_CGROUP program through the bpf(2) interface. A local user can load a specially crafted sleepable BPF program to cause a denial of service.

The issue can be triggered by bypassing libbpf and using bpf(2) directly.

272) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74344)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in bpf_rb_root_free() and bpf rbtree node handling when removing a surviving node from a later reused rbtree root allocation. A local user can trigger reuse of a stale bpf rbtree node with retained owner and linkage state to cause a denial of service.

The issue arises when a refcounted object survives being dropped and its rb node retains stale tree linkage and an owner pointer to a freed root.

273) Out-of-bounds read (CVE-ID: CVE-2026-74350)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the ocfs2 fast symlink read path when processing a malformed zero-cluster symlink inode. A local user can provide a crafted filesystem image containing an invalid fast symlink to disclose sensitive information.

The issue is triggered when the inline symlink payload is not NUL-terminated at the recorded size or when the recorded size exceeds the inline fast-symlink capacity.

274) Memory leak (CVE-ID: CVE-2026-74368)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() when processing frames with an invalid NWIFI header length during TKIP MIC verification. A remote attacker can send a specially crafted frame to cause a denial of service.

The issue occurs on an error path where the MSDU is no longer referenced by the defragmentation path and is never freed.

275) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74373)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource accounting in the md raid1 and raid10 subsystems when handling split md cloned bios on the error path. A local user can trigger read requests that cause failed bios to be split and resubmitted to cause a denial of service.

The issue occurs when a failed bio is split and resubmitted via bio_submit_split_bioset().

276) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74374)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state handling in the md/raid1 and md/raid10 read request paths when processing split and resubmitted failed bios in the error path. A local user can trigger I/O that causes failed bios to be split and resubmitted to cause a denial of service.

The issue can lead to incorrect memory allocation flags being used under memory pressure, which may result in a deadlock.

277) Deadlock (CVE-ID: CVE-2026-74375)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in md_handle_request() and the raid1/raid10 read error recovery path when resubmitting a split md cloned bio while the array is suspended. A local user can trigger read error recovery to cause a denial of service.

The issue occurs because an md cloned bio already holds an active_io reference before another reference is attempted.

278) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74385)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper exception handling in nvmet_tcp_tls_handshake_done when completing a TCP/TLS handshake. A remote attacker can trigger a failure in nvmet_tcp_set_queue_sock to cause a denial of service.

The issue can occur if the socket is not in TCP_ESTABLISHED state, leading to queue and socket leakage.

279) Use-after-free (CVE-ID: CVE-2026-74388)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ALSA OSS sequencer event handling logic when processing SysEx data embedded in MIDI events and dispatching a pending event after a sequencer port is closed concurrently. A local user can send crafted MIDI bytes that produce a pending SysEx event with a stale pointer to cause a denial of service.

The issue occurs during concurrent port closure before deferred event dispatch.

280) Race condition (CVE-ID: CVE-2026-74405)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to refcount corruption in the OPP core when adding and looking up dynamic OPP entries concurrently. A local user can trigger concurrent OPP addition and lookup operations to cause a denial of service.

The issue can lead to a potential premature free of a newly added OPP object.

281) Race condition (CVE-ID: CVE-2026-74407)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in the ath11k PCI shutdown and SSR recovery handling when shutdown or reboot overlaps with WLAN firmware crash recovery. A local attacker can trigger a reboot during concurrent SSR activity to cause a denial of service.

This issue affects only PCI/MHI-based devices; AHB-based ath11k devices are not affected in normal SSR flows.

282) Division by zero (CVE-ID: CVE-2026-74449)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to divide-by-zero in calculate_mcache_setting in the AMD display driver when processing a zero-area viewport. A local user can trigger display mode handling with a degenerate viewport to cause a denial of service.

The issue can also cause an underflow on the num_mcaches value.

283) Out-of-bounds read (CVE-ID: CVE-2026-74466)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the s390 zcrypt ioctl CPRB handling in _zcrypt_send_cprb() and _zcrypt_send_ep11_cprb() when processing a user-controlled domain value under speculative execution. A local user can supply a crafted ioctl structure to disclose sensitive information.

Exploitation requires special conditions involving a custom device node and an administrative load path.

284) Use-after-free (CVE-ID: CVE-2026-74506)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in afs_make_call() when handling asynchronous AFS call transmission and completion. A local user can trigger a race condition during asynchronous call handling to execute arbitrary code.

The issue affects asynchronous calls that can be completed or torn down while afs_make_call() still accesses the call object.

285) Use-after-free (CVE-ID: CVE-2026-74513)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in dibs loopback DMB handling in drivers/dibs/dibs_loopback.c when performing concurrent loopback attach, detach, or unregister operations. A local user can trigger racing reference count operations on a dmb_node to cause a denial of service.

The issue arises from a race window between hash table lookup and refcount operations on dmb_node.

286) Use-after-free (CVE-ID: CVE-2026-74520)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the IOMMUFD IOPF group handling logic when processing page fault groups during device detach or HWPT replacement. A local user can trigger fault handling and later access a freed group to cause a denial of service.

The issue occurs because an accepted group can remain referenced by the IOMMUFD deliver list or response xarray after being freed through the generic pending list.

287) Improper access control (CVE-ID: CVE-2026-74527)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify shared packet kind configuration and disrupt network parsing behavior.

The vulnerability exists due to improper access control in the octeontx2-af CGX/NIX PKIND configuration logic when allocating or configuring a VF NIX logical function that shares a CGX LMAC with a PF using HiGig2 or EDSA parsing. A local user can allocate or configure a crafted VF NIX logical function to modify shared packet kind configuration and disrupt network parsing behavior.

Only CGX-mapped virtual functions sharing a LMAC with a physical function using special parse kinds are affected.

288) Use-after-free (CVE-ID: CVE-2026-74529)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in hci_connect_pa_sync() callback handling in net/bluetooth/hci_sync.c when processing Bluetooth periodic advertising sync connection operations. A local user can trigger the vulnerable callback flow to cause a denial of service.

The issue is theoretical and occurs if the connection object is freed while the hci_sync task is running.

289) Use-after-free (CVE-ID: CVE-2026-74530)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in hci_connect_big_sync() callback handling in net/bluetooth/hci_sync.c when processing Bluetooth BIG sync connection operations. A local user can trigger a race condition leading to use of a freed connection object to cause a denial of service.

The issue is described as theoretical and occurs if the connection object is freed while the hci_sync task is running.

290) Use-after-free (CVE-ID: CVE-2026-74533)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free race condition in the Bluetooth ISO connection handling in net/bluetooth/iso.c when processing Bluetooth ISO data and connection teardown. A local user can trigger concurrent access to hci_conn->iso_data to cause a denial of service or execute arbitrary code.

The issue involves unsynchronized access to hci_conn->iso_data during iso_recv(), iso_conn_put(), iso_conn_add(), and iso_conn_free().

291) Use-after-free (CVE-ID: CVE-2026-74537)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in iso_conn_ready in the Bluetooth ISO subsystem when handling connection ready events during a concurrent socket close. A local user can trigger a race condition to cause a denial of service.

292) Improper locking (CVE-ID: CVE-2026-74538)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in iso_connect_ind when handling Bluetooth ISO connection indication events. A local user can trigger a race condition to cause a denial of service.

The issue occurs because iso_pi(sk)->conn may be accessed after the socket has transitioned away from the LISTEN or CONNECT states.

293) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74542)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of memory allocation failure in netfs writeback rolling buffer operations when processing writeback requests under memory pressure. A local user can trigger folio_queue allocation failure to cause a denial of service.

The issue can lead to a kernel warning in netfs_writepages.

294) Improper input validation (CVE-ID: CVE-2026-74544)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the cls_u32 packet classifier when processing a crafted filter configuration with varoffset enabled. A local user can supply an out-of-range offshift value to trigger shift-out-of-bounds behavior and cause a denial of service.

Exploitation is possible by an unprivileged user via user or network namespaces.

295) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74558)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the AF_XDP zero-copy transmit batch parser when processing invalid or oversized transmit descriptors. A local user can submit specially crafted transmit descriptors to cause a denial of service.

The issue affects packet handling in the zero-copy batch path and can leave UMEM frames unreclaimable until the affected transmit processing state is resolved.

296) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-74559)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in xsk_build_skb() and the generic AF_XDP transmit path when processing fragmented packet descriptors after an overflow or invalid descriptor condition. A local user can submit crafted multi-buffer descriptors to cause a denial of service.

The issue occurs when the count of descriptors exceeds MAX_SKB_FRAGS or an invalid descriptor is included in a fragmented packet.

297) NULL pointer dereference (CVE-ID: CVE-2026-74571)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in btrfs_update_global_block_rsv() when mounting a btrfs filesystem with rescue=ibadroots and corrupted tree roots. A local user can mount a crafted corrupted filesystem image to cause a denial of service.

The issue occurs on fully read-only rescue mounts when the block group tree root or raid stripe tree root cannot be read, leaving the corresponding root pointer NULL while the on-disk feature bit remains set.

298) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74600)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of special zero mappings in page_table_check in mm/page_table_check.c when processing user page-table mappings. A local user can populate enough zero mappings to overflow file_map_count and trigger the existing BUG_ON() to cause a denial of service.

The issue affects both the PTE path with the shared zero page and the PMD path with huge zero mappings.

299) Race condition (CVE-ID: CVE-2026-74605)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in eventfs inode handling in fs/tracefs/event_inode.c when iterating over the SRCU-protected children list during inode freeing. A local user can trigger concurrent eventfs operations to cause a denial of service.

The issue occurs because a freed inode can be observed with its children list reused as an RCU head, causing iteration to read an invalid list target.

300) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74611)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to overwrite memory in later caller iovecs beyond the returned length.

The vulnerability exists due to an improper iterator state restoration in tls_decrypt_sw() and the TLS 1.3 zero-copy retry path when processing a TLS 1.3 control record after optimistic zero-copy decryption. A remote attacker can send a specially crafted TLS record to overwrite memory in later caller iovecs beyond the returned length.

Exploitation requires the receiver to have TLS_RX_EXPECT_NO_PAD enabled.

301) Use-after-free (CVE-ID: CVE-2026-74687)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the at91sam9 watchdog timer callback handling in drivers/watchdog/at91sam9_wdt.c when tearing down the driver after probe failure or device removal. A local user can trigger driver teardown while the timer callback rearms the timer to cause a denial of service.

The issue occurs because a running timer callback may continue accessing devm-allocated at91wdt memory after it has been freed.

302) Use-after-free (CVE-ID: CVE-2026-74690)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ism interrupt handler and ism_dev_exit() cleanup path when handling interrupts during device removal. A local user can trigger concurrent interrupt handling during device teardown to cause a denial of service.

303) Improper resource shutdown or release (CVE-ID: CVE-2026-74695)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in netfilter nf_flow_table offload hooks and the XFRM offload path when processing incoming sk_buffs that already carry a ref-counted dst_entry. A local user can trigger packet handling that overwrites the existing destination reference to cause a denial of service.

The issue leaks a previous dst_entry reference count and triggers a DEBUG_NET_WARN_ON_ONCE assertion in skb_dst_check_unset().

304) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-74697)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to improper hardware interaction in the bnxt_en AGG ring handling in the bnxt driver when processing TPA data with EOP and relaxed ordering enabled. A local user can trigger network traffic processing that causes overlapping zero padding to corrupt data.

The issue was reported on some ARM systems using 57508 (P5) chips, and it occurs when TPA is enabled.

305) Out-of-bounds read (CVE-ID: CVE-2026-74711)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in pmbus_notify() in the PMBus hwmon subsystem when processing device attributes in notification logic. A local user can trigger notification handling with a non-sensor_device_attribute attribute to disclose sensitive information.

The issue is caused by type confusion from casting multiple attribute structure types to struct sensor_device_attribute.

306) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-74713)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in vhost_iotlb_add_range_ctx() and related vhost IOTLB allocation paths when handling userspace- or guest-controlled IOTLB mapping requests. A local user can send crafted mapping updates that keep allocating IOTLB entries beyond the configured limit to cause a denial of service.

Non-retiring tables could continue allocating entries after reaching their configured limit, and full-range mappings are split into two IOTLB entries.

307) Race condition (CVE-ID: CVE-2026-74715)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the BPF conntrack kfuncs when processing a shared map value for the opts argument during conntrack lookup or allocation. A local user can modify opts->netns_id concurrently to trigger an unmatched namespace reference release and cause a denial of service.

Exploitation requires the ability to invoke the affected BPF conntrack kfuncs with an opts argument that can reference a shared map value.

308) Out-of-bounds read (CVE-ID: CVE-2026-74723)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the btrfs lzo decompression logic when reading a crafted inline lzo compressed file extent from a crafted btrfs image. A local user can supply a crafted filesystem image containing an invalid inline extent header to cause a denial of service.

The issue is triggered when the inline extent contains only an lzo header without the required segment header or payload, and user interaction is required to access the crafted filesystem data.

309) NULL pointer dereference (CVE-ID: CVE-2026-74728)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in xfs_buf_free() when freeing a buffer after xfs_buf_alloc_backing_mem() fails. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can dereference an invalid address through virt_to_folio(NULL) and crash the kernel.

310) Race condition (CVE-ID: CVE-2026-74729)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information or cause a denial of service.

The vulnerability exists due to a race condition in snoop_file_read and the aspeed lpc snoop channel kfifo when reading snoop data concurrently with IRQ-driven fifo updates. A local user can read from the snoop device while concurrent interrupt activity updates the fifo to disclose sensitive information or cause a denial of service.

The issue occurs on SMP systems due to unsynchronized producer and consumer access to the same ring buffer.

311) Race condition (CVE-ID: CVE-2026-74733)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unintended register reads or writes.

The vulnerability exists due to improper synchronization in pca953x_irq_bus_sync_unlock() in the gpio-pca953x driver when handling interrupt state changes and accessing regmap without holding the i2c_lock. A local user can trigger concurrent operations to cause unintended register reads or writes.

The issue arises because multiple threads may access regmap operations without the required driver lock.

312) NULL pointer dereference (CVE-ID: CVE-2026-74734)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ar_context_release() in the firewire ohci driver when handling device probe error cleanup. A local attacker can trigger an early pci_probe() failure to cause a denial of service.

The issue occurs on the driver's error handling path before the asynchronous receive context has been successfully initialized.

313) Out-of-bounds read (CVE-ID: CVE-2026-74747)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ip_vs_nat_icmp() when processing embedded IP headers in ICMP packets after copying header data into the skb head. A local user can modify the ihl field to trigger out-of-bounds access and disclose sensitive information, modify data, or cause a denial of service.

The issue occurs because the embedded header length was not revalidated after reading data from skb fragments.

314) Out-of-bounds read (CVE-ID: CVE-2026-74752)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in SCTP COOKIE_ECHO handling when processing peer-controlled cookie AUTH fields with cookie authentication disabled. A remote attacker can send a forged cookie with a crafted RANDOM length to disclose sensitive information.

The issue is reachable when cookie authentication is disabled, and malformed AUTH parameters restored from the cookie are not validated against local backing arrays.

315) Out-of-bounds write (CVE-ID: CVE-2026-74752)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in SCTP COOKIE_ECHO handling when processing peer-controlled cookie AUTH fields with cookie authentication disabled. A remote attacker can send a forged cookie with a crafted HMAC identifier to execute arbitrary code.

The issue is reachable when cookie authentication is disabled, and malformed AUTH parameters restored from the cookie are not validated against local backing arrays.

316) Race condition (CVE-ID: CVE-2026-74754)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the scsi error handler when handling error recovery concurrently with power management state changes. A local user can trigger error handling during power management operations to cause a denial of service.

The issue can leave an unmatched runtime power management put operation and trigger a runtime power management usage count underflow.

317) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80581)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of IPC timeout conditions in sof_ipc4_trigger_pipelines in sound/soc/sof/ipc4-pcm.c when processing pipeline trigger state changes. A local user can trigger pipeline state transitions that encounter an IPC timeout to cause a denial of service.

The issue occurs when reply handling is blocked by system scheduling blockage, which can leave internal pipeline state handling inconsistent until the DSP is booted again.

318) Reachable assertion (CVE-ID: CVE-2026-80607)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable warning condition in parse_btf_arg in tracing probes when adding a kprobe event based on a raw address with a BTF parameter. A local user can add a crafted kprobe event to cause a denial of service.

319) NULL pointer dereference (CVE-ID: CVE-2026-80614)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in emac_irq() when handling an early interrupt during emac_probe initialization. A local attacker can trigger an interrupt before device registers are mapped to cause a denial of service.

320) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80616)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of memory allocation failures in cfg802154_switch_netns() when switching network namespaces. A local user can trigger an -ENOMEM condition to cause a denial of service.

The issue was identified in the ieee802154 subsystem.

321) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80623)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the coresight etm4x/ete power management handling when powering down CPUs while using coresight tracing. A local user can trigger CPU power management events while tracing is active to cause a denial of service.

This affects system register ETMs, ETE devices, and ACPI-based systems where trace state is not preserved across CPU power down.

322) Race condition (CVE-ID: CVE-2026-80628)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in snd_seq_oss_readq_clear() in the ALSA OSS sequencer read queue when resetting the queue concurrently with locked queue updates. A local user can trigger queue reset and concurrent read or event handling operations to cause a denial of service.

The race can leave stale records in the queue, drop newly queued records, or report incorrect readiness after wakeup.

323) Out-of-bounds read (CVE-ID: CVE-2026-80631)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in lzo_decompress_bio() in the Btrfs LZO decompression logic when processing a crafted compressed extent. A local attacker can supply a crafted compressed segment length that extends beyond the compressed input to cause a denial of service.

324) Out-of-bounds read (CVE-ID: CVE-2026-80634)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in nft_dev_forward_path() when processing a malformed bridge path stack. A local user can trigger a bridge VLAN untag path condition to disclose sensitive information.

The issue is caused by an underflow of the num_encaps counter that can wrap its value to 255 and lead to reads past the end of the fixed-size info.encap[] stack buffer.

325) Improper resource shutdown or release (CVE-ID: CVE-2026-80643)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in igen6_edac driver device handling when unloading the driver. A local user can trigger driver removal to cause a denial of service.

326) Race condition (CVE-ID: CVE-2026-80653)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the hisi_sas v3 hardware SCSI device link handling when executing a remote PHY link reset concurrently with driver removal. A local user can trigger concurrent link reset and device removal operations to cause a kernel warning and destabilize the system.

The issue occurs during SAS PHY revalidation and device cleanup in the hisi_sas driver.

327) Race condition (CVE-ID: CVE-2026-80655)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the zynqmp_power event registration handlers when processing firmware-triggered suspend or subsystem restart events immediately after event registration. A local user can trigger the affected event handling path to cause a denial of service.

The issue can lead to a NULL pointer dereference in work_pending() if the callback runs before the work structures are allocated and initialized.

328) Out-of-bounds read (CVE-ID: CVE-2026-80662)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the cxl RAS header log handling and trace event path when processing CXL RAS error data. A local user can trigger CXL error handling to copy kernel stack data into the trace event ring buffer and disclose sensitive information.

Userspace can read the exposed trace event data via tracefs.

329) Race condition (CVE-ID: CVE-2026-80668)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nf_conntrack expectation handling when removing or expiring expectations. A local user can trigger concurrent expectation operations to cause a denial of service.

The issue involves an expectation accessing a stale exp->master pointer after the associated master connection has already been released.

330) Use-after-free (CVE-ID: CVE-2026-80692)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in hci_connect_acl_sync() and hci_connect_le_sync() callbacks in net/bluetooth/hci_sync.c when processing Bluetooth connection operations. A local user can trigger a race condition to cause a denial of service.

The issue is described as theoretical and occurs if the connection object is freed while the hci_sync task is running.

331) Out-of-bounds write (CVE-ID: CVE-2026-80693)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service or corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in idpf_get_reg_intr_vecs() when processing a VIRTCHNL2_OP_ALLOC_VECTORS reply. A remote user can return a crafted reply whose per-chunk num_vectors sum exceeds num_allocated_vectors to cause a denial of service or corrupt kernel memory.

Exploitation requires control of the control plane, such as a PF or hypervisor device model, that provides the vector allocation reply.

332) Double free (CVE-ID: CVE-2026-80698)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in the idxd wq, engine, and group device setup and cleanup paths when handling device reference release during error handling and cleanup. A local user can trigger affected cleanup paths to cause a denial of service.

The issue occurs when put_device() drops the device reference count to zero and invokes the release callbacks, while the same allocations are also freed explicitly.

333) Unchecked Return Value (CVE-ID: CVE-2026-80705)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an allocation failure in dml21_add_phantom_plane() in the AMD display driver when handling phantom streams and planes. A local user can trigger the vulnerable code path to cause a denial of service.

334) Improper Initialization (CVE-ID: CVE-2026-80734)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in Btrfs cached inode mapping flags and minimum folio order when reloading a cached inode after it has been evicted from memory. A local user can trigger the reuse of an evicted cached inode to cause a denial of service.

The issue occurs with an 8K block size and a 4K page size.

335) Improper input validation (CVE-ID: CVE-2026-80738)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of socket types in the bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie helpers when processing a socket pointer that represents a mini-socket. A local user can invoke the helpers with a mini-socket pointer to cause a denial of service.

336) Out-of-bounds read (CVE-ID: CVE-2026-80747)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to improper bounds checking in the AMD KFD CRAT parser when parsing a malformed CRAT table with an oversized subtype length field. A local user can supply a malformed CRAT table with an oversized subtype length field to read memory out of bounds.

337) Use of uninitialized resource (CVE-ID: CVE-2026-80761)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized stack memory in the Bluetooth ISO socket getname handler when returning socket address information through getsockname(2) or getpeername(2). A local user can open a BTPROTO_ISO socket and invoke getsockname(2) to disclose sensitive information.

The larger disclosure involving broadcast-peer address fields requires an established BIS or PA connection.

338) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80786)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause inconsistent framebuffer console state.

The vulnerability exists due to improper state management in fb_set_var() callers when processing display mode changes through sysfs or driver code. A local user can invoke a display mode change to cause inconsistent framebuffer console state.

339) Infinite loop (CVE-ID: CVE-2026-80866)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a busy-wait loop in tipc_exit_net() when waiting for pending UDP bearer cleanup work during network namespace exit. A local user can trigger network namespace exit while cleanup work is pending to cause a denial of service.

The issue can result in soft lockups when the exit is executed by a high-priority task or on kernels configured with CONFIG_PREEMPT_NONE.

340) Release of invalid pointer or reference (CVE-ID: CVE-2026-80884)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an invalid DMA memory release.

The vulnerability exists due to release of an invalid pointer in the NTB transport memory-window buffer cleanup routine when freeing coherent DMA memory after the DMA address has been modified. A local user can trigger cleanup of an NTB transport memory window to trigger an invalid DMA memory release.

341) Incorrect calculation (CVE-ID: CVE-2026-80905)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect transport-header handling.

The vulnerability exists due to incorrect header offset handling in tap_get_user_xdp() when processing VLAN-tagged frames. A local user can send a VLAN-tagged frame to cause incorrect transport-header handling.

342) Deadlock (CVE-ID: CVE-2026-80920)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in io_uring CQ ring eventfd signaling when task work is queued from a waitqueue wakeup handler. A local user can submit io_uring operations that queue task work from a waitqueue wakeup handler to cause a denial of service.

The issue affects DEFER_TASKRUN rings with CQ ring eventfd signaling.

343) Memory leak (CVE-ID: CVE-2026-80948)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in iwl_op_mode_dvm_start() when handling an error path after successfully parsing EEPROM data. A local user can trigger the error path to cause a denial of service.

344) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-89528)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of cumulative Read segment lengths in the SVCRDMA Read list processing when processing a Read list containing multiple segments whose cumulative length exceeds the page budget. A remote attacker can send a crafted Read list to cause a denial of service.

345) Use-after-free (CVE-ID: CVE-2026-89534)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the svcrdma listener's sc_cm_id handling when processing an RDMA_CM_EVENT_ADDR_CHANGE after replacement listener allocation fails. A remote attacker can trigger handling of an address-change event to cause a denial of service.

346) Out-of-bounds read (CVE-ID: CVE-2026-89537)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read memory out of bounds.

The vulnerability exists due to improper length validation in gss_krb5_verify_mic_v2() when verifying a short RFC 4121 MIC token. A remote attacker can supply a short MIC token to read memory out of bounds.

347) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89601)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause loss of inode updates.

The vulnerability exists due to improper handling of inode dirty state in ext2_setsize() and ext2_xattr_set2() when updating file sizes or extended attributes of IS_SYNC inodes. A local user can update the file size or extended attributes of an IS_SYNC inode to cause loss of inode updates.

348) Out-of-bounds read (CVE-ID: CVE-2026-89631)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the CIFSTCon() SMB client tree connect response parser when processing a tree connect response with a byte count smaller than two. A remote attacker can send a malformed tree connect response to disclose sensitive information.

Disclosed bytes are exposed through /proc/fs/cifs/DebugData.

349) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-89642)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to incomplete clearing of page-cache data in cifs_setsize() when extending a file. A local user can extend a file to disclose sensitive information.

Dirty bytes in the page region spanning the previous end of file can be written back to the server.

350) Resource exhaustion (CVE-ID: CVE-2026-89648)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in ceph_parse_deleg_inos() when processing MDS create-with-delegation replies. A remote privileged user can send a reply containing excessively large or numerous delegated-inode intervals to cause a denial of service.

Exploitation requires control of a Ceph MDS.

351) Use-after-free (CVE-ID: CVE-2026-89654)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to missing session reference counting in check_new_map() when processing MDS session map updates. A local user can trigger a race between session map processing and session teardown to cause a use-after-free.

352) Use-after-free (CVE-ID: CVE-2026-89682)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a use-after-free in the NFS server file cache disposal queue when file disposal occurs during per-network namespace teardown. A local user can trigger deferred file disposal while callbacks access the disposal queue to cause a use-after-free.

The global shrinker, laundrette, and fsnotify callbacks can access the queue during teardown.

353) Out-of-bounds read (CVE-ID: CVE-2026-89705)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read beyond the bounds of an inline operations array.

The vulnerability exists due to improper synchronization in nfsd_dispatch() when processing NFS requests that follow cache-hit, drop, or encode-error paths. A remote attacker can leave rq_status_counter in an odd state while nfsd_nl_rpc_status_get_dumpit() reads request fields to read beyond the bounds of an inline operations array.

Exploitation requires concurrent access by the lockless status dump reader while request fields are being mutated.

354) Use-after-free (CVE-ID: CVE-2026-89709)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the nlmsvc_ops dispatch path in fs/lockd/svcsubs.c when lockd dispatches callbacks while the nfsd module is being unloaded. A local privileged user can trigger lockd dispatch during nfsd module shutdown to cause a denial of service.

355) Improper initialization (CVE-ID: CVE-2026-89757)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect memory-lock accounting.

The vulnerability exists due to improper initialization of mlock_count in sort_folio() when handling an unevictable folio on a generation list. A local user can lock and unlock memory associated with an affected folio to cause incorrect memory-lock accounting.

Concurrent LRU isolation can observe a folio after it has been removed from the generation list.

356) Use-after-free (CVE-ID: CVE-2026-89788)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in smb2_tree_connect() when processing concurrent SMB2 TREE_CONNECT and session logoff operations. A remote attacker can trigger a race between SMB2 TREE_CONNECT and session logoff operations to compromise confidentiality, integrity, and availability.

357) Use of Uninitialized Variable (CVE-ID: CVE-2026-89808)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of an uninitialized variable in the drm/amdkfd svm_migrate_copy_to_vram function when migrating a VM range containing a hole from CPU memory to VRAM. A local user can trigger the migration of such a VM range to cause a denial of service.

358) Release of invalid pointer or reference (CVE-ID: CVE-2026-89810)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to release of an invalid page reference in svm_migrate_copy_to_ram when handling a failed page migration from device memory to system RAM. A local user can trigger a failed page migration to compromise confidentiality, integrity, and availability.

The issue can occur with IOMMU enabled.

359) Race condition (CVE-ID: CVE-2026-89811)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the AMD KFD MES queue management code when evicting or suspending MES queues while DMA descriptors are in flight. A local user can trigger queue eviction or suspension while in-flight DMA descriptors access unmapped memory to cause a denial of service.

The issue occurs during SVM page migration.

360) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89812)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization of polling fence state in the amdgpu MES scheduler rings when recovering from a GPU reset after MES stops responding. A local user can initiate a post-reset MES submission to cause a denial of service.

361) Improper initialization (CVE-ID: CVE-2026-89813)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in KIQ ring fence handling in amdgpu_device_pre_asic_reset() when the first KIQ submission is made after a MODE1 reset. A local user can trigger the first KIQ submission after a reset to cause a denial of service.

The KIQ ring uses polling fences and has no scheduler.

362) Race condition (CVE-ID: CVE-2026-89833)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in f2fs_fsync_node_pages() when fsync operations race with file truncation. A local user can trigger concurrent fsync and truncation operations to cause a denial of service.

363) Incorrect calculation (CVE-ID: CVE-2026-89906)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause soft lockups.

The vulnerability exists due to an incorrect jump offset calculation in LoongArch BPF JIT tail-call handling when performing extra JIT passes. A local user can trigger incorrect branch offsets to cause soft lockups.

364) Use-after-free (CVE-ID: CVE-2026-89913)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in vgic_v3_save_pending_tables() when saving pending tables while LPI references are concurrently released. A local user can trigger concurrent LPI reference handling to compromise confidentiality, integrity, and availability.

365) Free of Memory not on the Heap (CVE-ID: CVE-2026-89920)

CWE-ID: CWE-590 - Free of Memory not on the Heap

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to improper freeing of stack memory in KVM s390 machine check reinjection when reinjecting channel-subsystem damage machine checks. A local user can trigger machine check reinjection to cause memory corruption.

366) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89987)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause silent data loss.

The vulnerability exists due to failure to propagate the PMD dirty bit in zap_huge_pmd_folio() when unmapping a PMD-mapped MAP_SHARED tmpfs mapping after data has been written through a read-faulted mapping. A local user can write data through a shared tmpfs mapping and unmap it to cause silent data loss.

Exploitation requires shmem transparent huge pages and swap to be enabled.

367) Improper update of reference count (CVE-ID: CVE-2026-90061)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a module reference count imbalance warning.

The vulnerability exists due to improper reference count management caused by double cloning in nf_tables set element expression handling when processing element insertions without override expressions. A local user can insert set elements without override expressions to trigger a module reference count imbalance warning.

The reported warning occurs when connlimit expressions are resorted on default set expressions.

368) Out-of-bounds write (CVE-ID: CVE-2026-90083)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect Ethernet header length handling in the Linux kernel IFE traffic-control action when processing a packet redirected from a non-Ethernet device to an Ethernet device at traffic-control ingress. A local user can redirect a packet to an Ethernet device with an IFE action on its ingress hook to cause a denial of service.

369) Race condition (CVE-ID: CVE-2026-90084)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the octeontx2 VF driver's workqueue and network-device lifecycle when registering or removing a network device. A local user can cause the receive-mode callback to queue work on an uninitialized workqueue to cause a denial of service.

370) Improper input validation (CVE-ID: CVE-2026-90086)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unintended processing of transmit metadata.

The vulnerability exists due to improper input validation in the AF_XDP zero-copy transmit metadata handling when submitting transmit descriptors with UMEM metadata space without the XDP_TX_METADATA option set. A local user can submit specially crafted transmit descriptors to cause unintended processing of transmit metadata.

The issue is limited to zero-copy transmission with UMEM metadata space.

371) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90087)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper connection state validation in create_le_conn_complete() when handling rejection of a second LE connection while another LE connection is pending. A local user can initiate concurrent LE connection attempts to cause a denial of service.

372) Use-after-free (CVE-ID: CVE-2026-90093)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the L2CAP get/setsockopt handlers in net/bluetooth/l2cap_sock.c when accessing socket options during HCI connection teardown. A local user can invoke L2CAP get/setsockopt operations during connection teardown to cause a denial of service.

373) Improper resource shutdown or release (CVE-ID: CVE-2026-90097)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper cleanup of uninitialized resources in the VMBus module exit function when unloading the VMBus module on a non-nested root partition. A local privileged user can unload the VMBus module to cause a denial of service.

374) Resource exhaustion (CVE-ID: CVE-2026-90099)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory resource accounting in traffic-control classifier allocation paths when creating traffic-control filters. A local user can create a large number of traffic-control filters to cause a denial of service.

The issue requires network scheduling, a supported classifier, classifier actions, memory control groups, user namespaces, and network namespaces to be enabled.

375) Access of Uninitialized Pointer (CVE-ID: CVE-2026-90104)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uninitialized pointer in the NFSv4.1 callback sequence argument decoder when handling NFSv4.1 callback sequence arguments containing an empty referring call list. A remote attacker can send a crafted NFSv4.1 callback request to cause a denial of service.

376) Race condition (CVE-ID: CVE-2026-90105)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause partial reads of neighbor hardware addresses.

The vulnerability exists due to a race condition in the VXLAN arp_reduce and neigh_reduce functions when processing ARP or IPv6 neighbor-discovery traffic during a neighbor hardware-address update. A remote attacker can send network traffic to cause partial reads of neighbor hardware addresses.

377) Race condition (CVE-ID: CVE-2026-90106)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect ARP or neighbor discovery proxy responses.

The vulnerability exists due to a race condition in the Linux bridge ARP and neighbor discovery proxy handling when processing proxy requests while a neighbor entry is being updated. A remote attacker can send ARP or neighbor discovery requests during a concurrent neighbor update to cause incorrect ARP or neighbor discovery proxy responses.

378) Use-after-free (CVE-ID: CVE-2026-90111)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a slab use-after-free.

The vulnerability exists due to a use-after-free in the IPv6 multicast routing cache reporting function ip6mr_cache_report() when resolving an unresolved multicast forwarding-cache entry after its associated route has been deleted and the queue is resolved with a wrong parent interface. A remote attacker can send an ingress multicast packet that misses multicast forwarding-cache lookup to trigger a wrong-parent-interface report.

379) Use-after-free (CVE-ID: CVE-2026-90116)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to improper synchronization in the MTPAV driver's output timer teardown handling when an output timer callback runs during card teardown. A local user can cause output timer activity to overlap with card teardown to trigger a use-after-free.

380) Out-of-bounds write (CVE-ID: CVE-2026-90142)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write past the end of the XSK buffer array.

The vulnerability exists due to an out-of-bounds write in the virtio_net RX ring resize handling when resizing the RX ring while an AF_XDP socket is attached. A local user can resize the RX ring to write past the end of the XSK buffer array.

381) NULL pointer dereference (CVE-ID: CVE-2026-90144)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in dpll_device_ops() when a DPLL device is unregistered while a queued pin notification still references it. A local user can trigger the teardown race to cause a denial of service.

382) NULL pointer dereference (CVE-ID: CVE-2026-90149)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the NFSv4 flexfiles data server session and error-handling paths when processing I/O for NFSv4.0 data servers. A remote user can perform I/O operations against an NFSv4.0 flexfiles data server to cause a denial of service.

NFSv4.0 data server clients do not maintain sessions.

383) Race condition (CVE-ID: CVE-2026-90154)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper connection-to-session association in ksmbd_all_conn_set_status when processing SMB session logoff or session replacement operations. A remote user can initiate a session logoff or session replacement to cause a denial of service.

384) Use-after-free (CVE-ID: CVE-2026-90155)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in ksmbd byte-range lock handling when processing SMB byte-range lock requests with blocked dependent waiters. A remote attacker can submit lock requests that leave a dependent waiter attached to a freed lock to cause a denial of service.

385) Use-after-free (CVE-ID: CVE-2026-90156)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the ksmbd smb2_lock function when processing deferred SMB lock requests during asynchronous setup failures. A remote attacker can send SMB lock requests that result in deferred locks to cause a denial of service.

386) Out-of-bounds read (CVE-ID: CVE-2026-90161)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper validation of interlaced ztailpacking pclusters in the EROFS decompression and block-mapping code when processing a crafted EROFS filesystem image. A local user can process an image containing invalid interlaced ztailpacking pclusters to disclose sensitive information.

Existing valid filesystems are not affected.

387) Use-after-free (CVE-ID: CVE-2026-90162)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a use-after-free and double-free.

The vulnerability exists due to improper synchronization in smb2_lock() when processing SMB2_LOCK request arrays. A remote attacker can submit a crafted SMB2_LOCK request with a later failing lock element while concurrently sending an UNLOCK request to cause a use-after-free and double-free.

The concurrent UNLOCK request must target the same connection before rollback processing occurs.

388) Race condition (CVE-ID: CVE-2026-90167)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect oplock state handling.

The vulnerability exists due to a race condition in ksmbd oplock handling when handling concurrent SMB requests that close files and break oplocks. A remote attacker can trigger concurrent oplock close and break operations to cause incorrect oplock state handling.

389) Out-of-bounds read (CVE-ID: CVE-2026-90174)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in ksmbd_alloc_user() when processing a mountd IPC login response with an oversized hash_sz value. A local user can send a malformed mountd IPC login response to read memory out of bounds.

390) Type Confusion (CVE-ID: CVE-2026-90177)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass pointer type verification.

The vulnerability exists due to improper pointer type validation in the BPF verifier's atomic read-modify-write verification when verifying atomic read-modify-write instructions. A local user can route an atomic read-modify-write instruction through paths with incompatible destination pointer types to bypass pointer type verification.

391) Deadlock (CVE-ID: CVE-2026-90179)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in the AppArmor change_hat functionality when handling a change_hat request in complain mode for a nonexistent hat. A local user can invoke change_hat for a nonexistent hat to cause a denial of service.

392) Incomplete cleanup (CVE-ID: CVE-2026-90182)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incomplete cleanup of delay state in the blk-iocost policy-data free handler when freeing I/O cost policy data after a block cgroup enters a delay state. A local user can trigger policy-data cleanup after the delay state is set to cause a denial of service.

The stale congestion state applies to every task in the affected block cgroup and its descendants.

393) Incomplete cleanup (CVE-ID: CVE-2026-90183)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cleanup of delay state in the blk-iolatency io.latency policy data when freeing policy data for a collaterally throttled cgroup. A local user can trigger freeing of the affected policy data to cause a denial of service.

394) Use-after-free (CVE-ID: CVE-2026-90204)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free error.

The vulnerability exists due to improper validation in the OCFS2 dinode validator when processing a corrupted append-DIO dinode during inode read. A local user can cause DIO orphan recovery to use an out-of-range orphaned-slot value to trigger a use-after-free error.

395) Out-of-bounds read (CVE-ID: CVE-2026-90205)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in ocfs2_wipe_inode when processing a corrupted OCFS2 dinode marked with OCFS2_ORPHANED_FL. A local user can cause OCFS2 to process a dinode whose i_orphaned_slot is outside the mounted filesystem slot range to read memory out of bounds.

396) Race condition (CVE-ID: CVE-2026-90206)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause memory corruption.

The vulnerability exists due to a race condition in NVMe target controller allocation when changing a subsystem's max_qid limit during controller allocation. A local privileged user can concurrently modify the max_qid configuration and allocate a controller to cause memory corruption.

397) Improper locking (CVE-ID: CVE-2026-90208)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in the Samsung PWM timer driver when handling timer operations in hard interrupt context. A local user can trigger Samsung PWM timer operations to cause a denial of service.

The issue is limited to ARM systems with PREEMPT_RT enabled where the Samsung PWM timer is used as a clock source.

398) Incorrect Comparison (CVE-ID: CVE-2026-90217)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass BPF verifier safety checks.

The vulnerability exists due to improper comparison of iterator pointer types in BPF verifier state pruning when comparing iterator stack slots during BPF program verification. A local user can load a BPF program with iterator stack slots in different pointer states to bypass BPF verifier safety checks.

399) Improper access control (CVE-ID: CVE-2026-90231)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escape AppArmor confinement.

The vulnerability exists due to improper access control in AppArmor profile transition handling when executing two transitions through an unconfined profile. A local user can execute two transitions through an unconfined profile to escape AppArmor confinement.

The issue applies when unprivileged transitions to unconfined profiles are restricted.

400) Improper input validation (CVE-ID: CVE-2026-90232)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the AMT device creation handler (amt_newlink) when configuring an AMT device with a lower device in a different network namespace. A local user can create a cross-network-namespace AMT device and remove its lower device to cause a denial of service.

401) Improper resource shutdown or release (CVE-ID: CVE-2026-90234)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in nfs_inode_set_delegation() when handling NFS delegation grants during error flows. A remote attacker can trigger a delegation recall that races with a re-open operation to cause a denial of service.

402) Use-after-free (CVE-ID: CVE-2026-90240)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the IOMMU to access freed memory.

The vulnerability exists due to improper context-cache invalidation in the Intel VT-d IOMMU context-cache invalidation logic when tearing down DMA aliases. A local user can trigger teardown of a device with DMA aliases to cause the IOMMU to access freed memory.

In scalable mode, a stale cached context entry can continue to reference a freed PASID directory.

403) Improper locking (CVE-ID: CVE-2026-90247)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in the BPF per-CPU mmap unlock work handling when nested BPF VMA lookups reuse the same work slot before a deferred unlock is queued. A local user can trigger nested BPF VMA lookups to cause a denial of service.

404) Use-after-free (CVE-ID: CVE-2026-90256)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the Bluetooth L2CAP l2cap_disconn_ind function when processing concurrent L2CAP connection deletion. A remote attacker can trigger concurrent L2CAP disconnection processing to cause a denial of service.

405) Incorrect calculation (CVE-ID: CVE-2026-90259)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect freeing of reserved qgroup data.

The vulnerability exists due to an incorrect length calculation in qgroup_free_reserved_data() when freeing reserved qgroup data. A local user can trigger reserved-data range processing to cause incorrect freeing of reserved qgroup data.

406) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-90260)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt filesystem metadata and cause a denial of service.

The vulnerability exists due to improper control of an extent buffer's lifetime in the Btrfs zoned filesystem write path when writing a freed-but-still-dirty tree block. A local user can trigger writeout of a freed-but-still-dirty tree block to corrupt filesystem metadata and cause a denial of service.

407) Improper access control (CVE-ID: CVE-2026-90263)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify POSIX ACLs on a read-only Btrfs filesystem.

The vulnerability exists due to improper access control in the btrfs_set_acl POSIX ACL-setting path when setting a POSIX ACL on a Btrfs filesystem whose read-only property is enabled. A local user can set a POSIX ACL to modify POSIX ACLs on a read-only Btrfs filesystem.

408) Race condition (CVE-ID: CVE-2026-90264)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in Btrfs ordered extent handling when performing an append buffered write after a short direct I/O operation. A local user can trigger conflicting ordered extents to cause a denial of service.

409) Deadlock (CVE-ID: CVE-2026-90265)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock ordering in btrfs defragmentation when reserving delayed-allocation space while holding dirty and locked folios and an extent-range lock. A local user can perform filesystem operations that trigger btrfs defragmentation to cause a denial of service.

The deadlock was observed with autodefrag and flushoncommit enabled.

410) Memory leak (CVE-ID: CVE-2026-90267)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the SCSI disk driver command setup routines when handling UNMAP or WRITE SAME commands after SCSI scatter-gather table allocation failure. A local user can issue UNMAP or WRITE SAME commands when SCSI scatter-gather table allocation fails to cause a denial of service.

411) Improper resource shutdown or release (CVE-ID: CVE-2026-90273)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause active configuration reference leaks.

The vulnerability exists due to improper resource shutdown or release in the ETMv4 CoreSight perf enable path when branch broadcast is selected but unsupported by the hardware or hardware enablement fails. A local user can enable a perf event that encounters either error condition to cause active configuration reference leaks.

412) Off-by-one (CVE-ID: CVE-2026-90289)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to an off-by-one error in the AMDGPU display manager HDCP per-connector arrays when handling a 32nd display connector. A local user can cause the HDCP code to process a 32nd connector to cause an out-of-bounds memory access.

413) Use of uninitialized resource (CVE-ID: CVE-2026-90300)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause nondeterministic BPF map-key behavior.

The vulnerability exists due to use of uninitialized memory in __bpf_get_task_stack when a BPF stack helper encounters an error. A local user can invoke an affected BPF stack helper to cause nondeterministic BPF map-key behavior.

The condition occurs when the task stack cannot be acquired or task registers are unavailable.

414) Use-after-free (CVE-ID: CVE-2026-90301)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in the OCFS2 o2hb heartbeat region handlers and delayed timeout work when processing heartbeat negotiation messages while a heartbeat region is being initialized or torn down. A remote user can send a heartbeat negotiation message to cause a denial of service.

Exploitation requires racing heartbeat region lifecycle operations with an in-flight o2net callback or delayed work.

415) Incomplete cleanup (CVE-ID: CVE-2026-90311)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in thermal_remove_hwmon_sysfs when removing a thermal zone that hosts a shared hwmon class device. A local user can trigger removal of the thermal zone to cause a denial of service.

The shared hwmon interface can contain sysfs attributes associated with other thermal zones of the same type.

416) Use-after-free (CVE-ID: CVE-2026-90320)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of external extended attribute entry bounds in OCFS2 extended attribute metadata handling when listxattr() or getxattr() processes corrupted external xattr metadata. A local user can invoke listxattr() or getxattr() on a filesystem containing corrupted external xattr metadata to cause a denial of service.

The issue affects both non-indexed external extended attribute blocks and indexed extended attribute buckets.

417) Out-of-bounds read (CVE-ID: CVE-2026-90321)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read.

The vulnerability exists due to insufficient bounds checking in OCFS2 inline extended-attribute metadata when accessing an inode with corrupted inline extended attributes. A local user can invoke getxattr() or listxattr() on the affected inode to trigger an out-of-bounds read.

418) Unchecked Return Value (CVE-ID: CVE-2026-90324)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger I/O processing with an uninitialized iov_iter.

The vulnerability exists due to an unchecked return value in the ublk_map_io and ublk_unmap_io functions when processing an I/O buffer address supplied by a userspace ublk server. A local user can operate a userspace ublk server and provide an address range outside the allowed user address space to trigger I/O processing with an uninitialized iov_iter.

419) Use-after-free (CVE-ID: CVE-2026-90326)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a race condition leading to use-after-free in the blk-cgroup policy activation rollback path when rolling back policy-data allocation during concurrent block cgroup deletion. A local user can trigger concurrent I/O scheduler switching and block cgroup deletion to cause memory corruption.

The race requires policy-data allocation to fail during policy activation.

420) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-90328)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger processing of truncated Steam Controller feature reports.

The vulnerability exists due to improper validation of a declared report length in the steam_recv_report function when handling Steam Controller feature reports. A local user can provide a feature report whose declared length exceeds the number of bytes read to trigger processing of truncated feature reports.

421) Memory leak (CVE-ID: CVE-2026-90330)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to improper resource cleanup in hidpp_ff_init() when initializing a force-feedback device. A local user can trigger force-feedback device initialization to cause a resource leak.

The issue occurs when allocation of the HID++ force-feedback private data, effect ID array, or workqueue fails after the force-feedback device is created.

422) Insufficient verification of data authenticity (CVE-ID: CVE-2026-90333)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause modified data to be treated as authentic.

The vulnerability exists due to improper verification of data authenticity in the dm-integrity discard-block check within dm_integrity_rw_tag() when processing blocks marked with the constant discard filler tag. A local privileged user can write a forged discard filler tag to the backing device to cause modified data to be treated as authentic.

The issue requires standalone dm-integrity mode with discard requests enabled.

423) NULL pointer dereference (CVE-ID: CVE-2026-90335)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in tty_unregister_device when removing a TTY device after device registration fails before a character device is allocated. A local user can trigger device removal after a failed TTY device registration to cause a denial of service.

424) Use-after-free (CVE-ID: CVE-2026-90336)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to failure to clear dangling pointers in uart_register_driver() when processing a subsequent device probe after a failed driver registration. A local user can cause a driver registration failure and bind a PL011 port again to trigger a use-after-free.

425) Use-after-free (CVE-ID: CVE-2026-90337)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in serial_core_add_one_port() when allocation fails during serial port binding. A local user can trigger a serial port bind that encounters an allocation failure to cause a denial of service.

426) Use-after-free (CVE-ID: CVE-2026-90343)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in cfg80211 PMSR request teardown when stopping a P2P device or NAN interface with a pending PMSR request. A local privileged user can stop a P2P device or NAN interface while a PMSR request is pending to trigger a use-after-free condition.

The stale request can be used when the driver later reports a result.

427) NULL pointer dereference (CVE-ID: CVE-2026-90345)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the brcmfmac P2P action frame handling code when processing action-frame operations without a P2P device virtual interface. A local user can send non-P2P public action frames through the primary interface to cause a denial of service.

428) Memory leak (CVE-ID: CVE-2026-90346)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in nl80211_color_change() when parsing beacon_next templates. A local user can trigger a beacon_next parsing failure to cause a denial of service.

429) Protection mechanism failure (CVE-ID: CVE-2026-90347)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass seccomp and audit checks.

The vulnerability exists due to improper synchronization of the original first syscall argument in arm64 ptrace register and syscall setting code when modifying the first syscall argument during a seccomp ptrace exit. A local user can modify the first syscall argument to bypass seccomp and audit checks.

430) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-90351)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an exceptional condition in the mt7996 WED initialization path when initializing the secondary hif2 WED function after primary WED attachment fails. A local user can trigger the affected probe path to cause a system crash.

The secondary hif2 setup can re-enable hwrro_mode after the failed primary attachment disabled it.

431) Improper input validation (CVE-ID: CVE-2026-90359)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt function return values.

The vulnerability exists due to improper validation of return value size in BPF return-reading trampolines when attaching a BPF program to a function with a return value larger than 8 bytes. A local privileged user can attach a BPF program using a supported return-reading attach type to corrupt function return values.

Affected attach types include fexit, fmod_ret, fsession, their applicable multi variants, and struct_ops.

432) Use-after-free (CVE-ID: CVE-2026-90363)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the MDP4 and MDP5 KMS initialization error-handling paths when KMS initialization fails partway through. A local user can trigger a KMS initialization failure to cause a denial of service.

433) Race condition (CVE-ID: CVE-2026-90365)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the mt76 mt7915 and mt7996 device unregistration routines when pending reset_work or rc_work executes during device unregistration. A local user can trigger device unregistration while reset_work or rc_work is pending to cause a denial of service.

434) Race condition (CVE-ID: CVE-2026-90367)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause descriptor or token corruption.

The vulnerability exists due to a race condition in mt7996_mac_reset_work() when an L1 SER races a channel switch. A local user can trigger an L1 SER while a channel switch is in progress to cause descriptor or token corruption.

435) Out-of-bounds read (CVE-ID: CVE-2026-90408)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to improper bounds checking in ath12k_wmi_process_csa_switch_count_event() when processing a firmware-supplied CSA switch count status event. A local user can provide a malformed firmware event to read out-of-bounds memory.

436) Improper access control (CVE-ID: CVE-2026-90409)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to map user-exposed buffer objects into an address-space region reserved for kernel buffer objects.

The vulnerability exists due to improper access control in the Panthor vm_bind ioctl path when processing vm_bind mapping operations. A local user can submit a vm_bind mapping that overlaps the reserved kernel buffer object region to map user-exposed buffer objects into an address-space region reserved for kernel buffer objects.

437) Double free (CVE-ID: CVE-2026-90417)

CWE-ID: CWE-415 - Double Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a double free.

The vulnerability exists due to improper memory management in the RDMA/cxgb4 memory-registration error handling when processing DMA memory-region registration errors. A local user can trigger error handling to cause a double free.

438) Use-after-free (CVE-ID: CVE-2026-90421)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in pci_match_device() when a device probe runs concurrently with dynamic ID removal. A local user can race dynamic ID removal against device probing to trigger a use-after-free condition.

439) Improper resource shutdown or release (CVE-ID: CVE-2026-90422)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the MediaTek PLL frequency-hopping clock driver when failing to register a PLL. A local user can trigger a failed PLL registration to cause a denial of service.

440) Memory leak (CVE-ID: CVE-2026-90424)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource cleanup in the Tegra241 CMDQV VINTF initialization and removal routines when handling failed VINTF0 initialization or logical VCMDQ preallocation. A local user can trigger these failure paths to cause a memory leak.

VINTF0 can remain unpublished to the VINTF array, preventing probe-failure cleanup from reaching it.

441) Use-after-free (CVE-ID: CVE-2026-90427)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to use-after-free in the tegra241 cmdqv probe fallback path when devm_krealloc() relocates the SMMU allocation and a subsequent probe operation fails. A local user can trigger a failed probe operation after reallocation to cause a use-after-free condition.

442) Out-of-bounds read (CVE-ID: CVE-2026-92480)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond a descriptor buffer.

The vulnerability exists due to an out-of-bounds read in the UFS string descriptor handling function when processing a malformed UFS string descriptor. A local user can cause the kernel to process a descriptor with an invalid UTF-16 payload length to read beyond a descriptor buffer.

443) Use-after-free (CVE-ID: CVE-2026-92482)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the Mediatek pinctrl GPIO chip registration code when unbinding or removing an affected driver module. A local privileged user can remove an affected driver module while its GPIO chip remains registered to trigger a use-after-free.

444) Race condition (CVE-ID: CVE-2026-92485)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a kernel warning.

The vulnerability exists due to improper synchronization and flag handling in the BPF trampoline flag management logic when attaching multiple fexit programs targeting a tail-call-reachable BPF program. A local privileged user can attach fexit programs and close an attached fexit link to cause a kernel warning.

445) Deadlock (CVE-ID: CVE-2026-92503)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an ABBA deadlock in ext4_xattr_inode_cache_find() when concurrently exercising extended-attribute workloads. A local user can issue concurrent extended-attribute operations to cause a denial of service.

The issue occurs when the ea_inode mount/format option is in use.

446) Use of Uninitialized Variable (CVE-ID: CVE-2026-92520)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized stack contents.

The vulnerability exists due to use of an uninitialized output buffer in BPF queue and stack pop/peek helpers when a lock acquisition fails. A local user can invoke the affected helpers during a failed lock acquisition to disclose uninitialized stack contents.

447) Improper initialization (CVE-ID: CVE-2026-93058)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization handling in msm_ringbuffer_new() and msm_ringbuffer_destroy() when scheduler initialization fails before completion. A local user can initiate ring-buffer creation that encounters a scheduler initialization failure, causing cleanup to invoke scheduler teardown on a partially initialized scheduler to cause a denial of service.

448) Use-after-free (CVE-ID: CVE-2026-93081)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to improper reference handling in the SCMI device destruction path when a concurrent unregister occurs after an SCMI child-device lookup. A local user can trigger concurrent SCMI device destruction and unregistration to cause a use-after-free condition.

449) Use-after-free (CVE-ID: CVE-2026-93100)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in rdtgroup_kn_put() in the resctrl subsystem when concurrently releasing an rdtgroup reference and tearing down a resctrl directory. A local user can trigger the race between rdtgroup_kn_put() and bulk rdtgroup teardown to trigger a use-after-free condition.

450) Use-after-free (CVE-ID: CVE-2026-93104)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to returning a dangling pointer in rvt_alloc_device when allocating a port array. A local user can trigger a port-array allocation failure to cause a use-after-free.

451) Improper update of reference count (CVE-ID: CVE-2026-93105)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to free a page that is still in use.

The vulnerability exists due to improper reference count handling in the ESP esp_ssg_unref() function when processing an ESP packet with managed fragments during an AEAD operation. A local user can process an ESP packet with managed fragments to free a page that is still in use.

Managed fragments can be attached through io_uring SEND_ZC with a registered buffer.

452) Improper resource shutdown or release (CVE-ID: CVE-2026-93116)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak resources.

The vulnerability exists due to improper resource shutdown in asus_wmi_add() when handling failures during driver initialization. A local user can cause a relevant initialization routine to fail to leak resources.

453) Out-of-bounds write (CVE-ID: CVE-2026-93122)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write past the end of fixed-size sampling-rate arrays.

The vulnerability exists due to an out-of-bounds write in the UAC1 and UAC2 configfs rate-list store paths when parsing comma-separated sampling-rate lists containing more than ten entries. A local user can write a crafted rate list to a UAC configfs rate-list attribute to write past the end of fixed-size sampling-rate arrays.

454) Numeric Truncation Error (CVE-ID: CVE-2026-93125)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass BPF verifier memory-access checks.

The vulnerability exists due to numeric truncation in the BPF verifier's check_kfunc_args() function when processing rdonly_buf_size or rdwr_buf_size kfunc arguments larger than U32_MAX. A local user can load a BPF program that supplies an oversized buffer-size argument to bypass BPF verifier memory-access checks.

455) Out-of-bounds read (CVE-ID: CVE-2026-93129)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory beyond the intended buffer.

The vulnerability exists due to an out-of-bounds read in dell_wmi_process_key() in the dell-wmi-base driver when handling ultra performance key event data. A local user can trigger processing of ultra performance key event data to read memory beyond the intended buffer.

456) Improper access control (CVE-ID: CVE-2026-93144)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass read-only restrictions on untrusted BTF pointers.

The vulnerability exists due to improper access control in check_ptr_to_btf_access() in the BPF verifier when validating write accesses through untrusted BTF pointers. A local user can load a BPF program that performs a write through an untrusted BTF pointer to bypass read-only restrictions on untrusted BTF pointers.

457) Improper input validation (CVE-ID: CVE-2026-93146)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect time calculations or unexpected behavior.

The vulnerability exists due to improper input validation in proc_timens_set_offset() when processing a time namespace offset with an invalid nanosecond field. A local user can provide a time offset containing an out-of-range nanosecond value to cause incorrect time calculations or unexpected behavior.

458) Memory corruption (CVE-ID: CVE-2026-93148)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory beyond allocated object bounds.

The vulnerability exists due to improper bounds checking in the BPF verifier BTF struct-walking logic when validating BPF program accesses to MEM_ALLOC objects. A local user can load a BPF program that accesses beyond the static BTF type size to access memory beyond allocated object bounds.

The issue also affects struct ID matching used for kfunc and kptr type checks.

459) Resource exhaustion (CVE-ID: CVE-2026-93168)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper timeout calculation in xilinx_dma_poll_timeout in the Xilinx DMA driver when polling an unfulfilled DMA hardware condition with a zero delay. A local user can initiate a DMA operation under these conditions to cause a denial of service.

460) Use-after-free (CVE-ID: CVE-2026-93175)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in amdgpu_dm_crtc_reset_state() when allocating a new CRTC state after freeing the old state. A local user can invoke CRTC state reset when memory allocation fails to trigger a use-after-free condition.

461) Use-after-free (CVE-ID: CVE-2026-93176)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a dangling pointer in amdgpu_dm_plane_drm_plane_reset() when allocation of a new plane state fails after the old state has been freed. A local user can trigger the affected plane reset path under allocation-failure conditions to trigger a use-after-free condition.

462) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-93181)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disrupt uncore event collection.

The vulnerability exists due to improper resource lifetime management in the Intel x86 uncore event handling code when CPUs transition online or offline. A local privileged user can trigger CPU online or offline events to disrupt uncore event collection.

On systems with one CPU per die, an uncore box can remain uninitialized.

463) Deadlock (CVE-ID: CVE-2026-93202)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to recursive locking in i3c_master_register_new_i3c_devs() in the I3C master subsystem when registering newly discovered I3C devices. A local user can trigger I3C device registration to cause a denial of service.

464) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-93216)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check to time-of-use race condition in print_page_owner_memcg() in mm/page_owner.c when a page is concurrently freed and reallocated. A local user can race page freeing and reallocation to trigger VM_BUG_ON assertions and cause a denial of service.

The issue affects builds configured with CONFIG_DEBUG_VM=y.

465) Race condition (CVE-ID: CVE-2026-93221)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to a race condition in nfsd4_end_grace() when grace completion is concurrently processed by the laundromat workqueue and RECLAIM_COMPLETE handling. A remote attacker can issue RECLAIM_COMPLETE requests during grace-period processing to cause memory corruption.

The race can cause concurrent reclaim-record walkers to corrupt reclaim_str_hashtbl and double-free nfs4_client_reclaim entries.

466) Improper initialization (CVE-ID: CVE-2026-93230)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper initialization in gigantic bootmem HugeTLB struct pages when page allocator setup evaluates zone contiguity before the struct pages are initialized. A local privileged user can boot a system with a bootmem HugeTLB region marked noinit to cause a denial of service.

467) Use-after-free (CVE-ID: CVE-2026-93251)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in acpi_get_first_physical_node() when obtaining a physical device pointer while acpi_unbind_one() runs concurrently. A local user can invoke get_device() on a stale device pointer to trigger a use-after-free condition.

468) Use-after-free (CVE-ID: CVE-2026-93260)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper error handling in xive_smp_probe() when handling a failed XIVE IPI initialization. A local user can cause xive_setup_cpu_ipi() to dereference the freed global xive_ipis array to trigger a use-after-free condition.

The initialization failure may occur when irq_domain_alloc_irqs() fails.

469) Out-of-bounds read (CVE-ID: CVE-2026-93272)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause regulator initialization failures.

The vulnerability exists due to out-of-bounds access in the qcom_wcnss regulator initialization routine when initializing regulators after attaching power domains. A local user can trigger remoteproc regulator initialization to cause regulator initialization failures.

The issue affects pronto-v3 platforms that do not list power-domain regulators in the vregs array.

470) Improper access control (CVE-ID: CVE-2026-93282)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to obtain unauthorized file access rights.

The vulnerability exists due to improper access control in the ksmbd DACL maximum access calculation when processing SMB2 open requests that request maximal access. A remote user can request maximal access to a file to obtain unauthorized file access rights.

471) Missing Authorization (CVE-ID: CVE-2026-97422)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose information about GPU workloads.

The vulnerability exists due to improper authorization in the AMDKFD KFD SMI event handling when emitting PROCESS_START, PROCESS_END, and VMFAULT events with a process ID of zero. A local user can monitor GPU workloads to disclose information about GPU workloads.

The disclosed event data includes another process's PID and command name.

472) Double free (CVE-ID: CVE-2026-97424)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double release of an interrupt reference in the AMDGPU RAS cleanup logic when suspending the system and unloading the driver without resuming. A local user can trigger the suspend-then-unload sequence to cause a denial of service.

The issue affects the cp_ecc_error_irq cleanup path for GFX v9.

473) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-97432)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper binding state management in the iwlwifi mvm P2P-Device binding handling when processing binding updates after a remain-on-channel operation. A local user can trigger a binding update after a P2P-Device is removed from a binding to cause a denial of service.

A stale P2P-Device binding can cause the firmware to crash after its PHY context is removed.

474) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-97477)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the RDMA counter allocation and binding routine alloc_and_bind() when handling repeated RDMA queue pair bind failures. A local user can repeatedly trigger queue pair bind failures to cause a denial of service.

475) Use-after-free (CVE-ID: CVE-2026-97478)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ACRN irqfd handling code when racing irqfd deassignment with an eventfd EPOLLHUP wakeup. A local user can trigger concurrent irqfd cleanup paths to cause a denial of service.

476) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-97479)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a kernel warning.

The vulnerability exists due to improper device-link state handling in __device_links_no_driver when removing a consumer device while its supplier is unbinding. A local privileged user can remove a device in the affected device-link topology to trigger a kernel warning.

477) NULL pointer dereference (CVE-ID: CVE-2026-97480)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the serial8250_register_8250_port() function when registering an 8250 serial port without a parent device. A local privileged user can register an 8250 serial port without a parent device to cause a denial of service.

478) Out-of-bounds write (CVE-ID: CVE-2026-97493)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds write.

The vulnerability exists due to improper validation of VBIOS-reported GPIO I2C table sizes in the AMDGPU ATOMBIOS GPIO I2C table handling code when processing a VBIOS GPIO I2C table with a corrupt size field. A local user can provide a VBIOS GPIO I2C table with a corrupt size field to cause an out-of-bounds write.

479) Improper locking (CVE-ID: CVE-2026-97501)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel warning.

The vulnerability exists due to improper locking in the Mediatek Paris GPIO direction callbacks when the shared GPIO proxy performs GPIO direction operations. A local user can invoke GPIO direction operations to cause a kernel warning.

480) Stack-based buffer overflow (CVE-ID: CVE-2026-97503)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a stack-based buffer overflow.

The vulnerability exists due to insufficient buffer size calculation in the /proc/irq directory name handling in kernel/irq/proc.c when formatting ten-digit interrupt numbers. A local user can trigger registration or removal of an interrupt proc entry with a ten-digit interrupt number to trigger a stack-based buffer overflow.

Exploitation requires a sparse-IRQ configuration that permits ten-digit interrupt numbers.

481) Use-after-free (CVE-ID: CVE-2026-97513)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Wave5 media driver when an IRQ thread accesses active stream instances during instance release. A local user can trigger the release of a stream instance while IRQ handling is in progress to cause a denial of service.

482) Infinite loop (CVE-ID: CVE-2026-97515)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper interrupt status handling in the I3C master request IBI handler when an I3C target remains stuck holding SDA low on NPCM845. An attacker with physical access can cause an I3C target to hold the SDA line low to cause a denial of service.

483) Out-of-bounds read (CVE-ID: CVE-2026-97538)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose uninitialized bytes through sensor values exposed via sysfs.

The vulnerability exists due to an out-of-bounds read in the rog_ryujin_raw_event() function of the ASUS ROG Ryujin hwmon driver when processing a short HID report. An attacker with physical access can provide a short HID report to disclose uninitialized bytes through sensor values exposed via sysfs.

484) Use of uninitialized resource (CVE-ID: CVE-2026-97554)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose kernel stack contents to the userspace idmap daemon.

The vulnerability exists due to use of uninitialized stack memory in cifs_posix_to_fattr() when processing malformed POSIX directory entries containing invalid SID lengths from an untrusted server. A remote attacker can provide a malformed POSIX directory entry to cause uninitialized SID data to be processed.

485) Improper access control (CVE-ID: CVE-2026-97561)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to control local file ownership.

The vulnerability exists due to improper access control in the Linux kernel CIFS/SMB client SID-to-UID/GID mapping logic when processing SMB server-provided SID ownership data. A remote attacker can provide SID ownership values to control local file ownership.

Only mounts configured with the forceuid or forcegid mount options are affected.

486) Resource exhaustion (CVE-ID: CVE-2026-97928)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper VMID 0 flush handling in amdgpu_ttm_map_buffer() when clearing VRAM or copying buffers mapped through direct MC addresses. A local user can trigger these buffer operations to cause a denial of service.

The spurious SDMA flush can wedge the engine on GFX11 hardware.

487) Race condition (CVE-ID: CVE-2026-97960)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access out-of-bounds memory.

The vulnerability exists due to a race condition caused by reentrant access in the Intel PEBS buffer-draining functionality when a performance monitoring interrupt interrupts an in-flight PEBS buffer drain. A local user can trigger reentrant PEBS buffer draining to access out-of-bounds memory.

The PEBS buffer is shared by all events on a CPU.

488) Improper locking (CVE-ID: CVE-2026-97962)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper locking in the representor vnic devlink health reporter lifecycle when unbinding the driver. A local user can unbind the driver to trigger a kernel warning.

489) Race condition (CVE-ID: CVE-2026-97975)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in hci_conn_del_sysfs() and device_del() when concurrently unregistering child devices while connection devices are being removed. A local user can trigger concurrent child device unregistration to cause a NULL pointer dereference.

490) Race condition (CVE-ID: CVE-2026-97988)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause stale ring mappings to be used.

The vulnerability exists due to improper synchronization of cached vring pointers and IOTLB metadata in vhost IOTLB handling when transitioning VIRTIO_F_ACCESS_PLATFORM. A local user can transition VIRTIO_F_ACCESS_PLATFORM settings to cause stale ring mappings to be used.

491) Improper input validation (CVE-ID: CVE-2026-97989)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in vduse_validate_config() when opening a virtio-net device created with a zero virtqueue alignment value. A local user can create and open a virtio-net device with an invalid virtqueue alignment value to cause a denial of service.

492) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97997)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper descriptor state management in packed virtqueue handling when a scatter-gather mapping fails partway through adding a packed descriptor chain. A local user can submit an I/O request that triggers a failed mapping to cause a denial of service.

The issue typically occurs in swiotlb configurations under memory pressure with larger I/O requests.

493) Memory leak (CVE-ID: CVE-2026-98003)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust memory resources.

The vulnerability exists due to a memory leak in the AMD IOMMU guest-address log buffer initialization when reinitializing GA log buffers during system resume. A local user can trigger repeated system resumes to exhaust memory resources.

The allocation occurs from a syscore resume callback while interrupts are disabled and non-boot CPUs are offline.

494) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-98019)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect BPF verifier state pruning.

The vulnerability exists due to failure to mark scalar registers precise in the BPF verifier's check_func_arg() and check_helper_call() functions when handling nullable function arguments or zero bpf_get_local_storage() flags. A local user can submit BPF code that triggers the affected verification paths to cause incorrect BPF verifier state pruning.

495) Race condition (CVE-ID: CVE-2026-98032)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose uninitialized memory.

The vulnerability exists due to a race condition in the tracing ring buffer read-page handling when concurrently resizing trace ring-buffer subbuffers while reading trace_pipe_raw. A local user can concurrently resize trace ring-buffer subbuffers and read trace_pipe_raw to cause a denial of service or disclose uninitialized memory.

496) Use-after-free (CVE-ID: CVE-2026-98033)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to improper preservation of map identity in BPF verifier callback frame constructors when invoking timer callbacks on nested inner maps. A local user can pair a timer from a second inner map with a first inner map and free the first map to trigger a use-after-free.

497) Improper input validation (CVE-ID: CVE-2026-98034)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass BPF verifier pointer-type checks.

The vulnerability exists due to improper state precision tracking in check_map_kptr_access() when verifying BPF programs that store a known-zero scalar in an untrusted kptr field. A local user can craft a program that causes state pruning to accept a path with a nonzero scalar and treat attacker-controlled bits as a PTR_TO_BTF_ID to bypass BPF verifier pointer-type checks.

498) NULL pointer dereference (CVE-ID: CVE-2026-98038)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a null pointer dereference.

The vulnerability exists due to improper reference ownership tracking in the BPF verifier when verifying BPF programs that acquire references from borrowed RCU kptrs. A local user can load a crafted BPF program that uses a borrowed RCU kptr without a required NULL check to trigger a null pointer dereference.

The issue occurs when the refcounted object does not contain a graph node and its last real reference is dropped during an RCU critical section.

499) NULL pointer dereference (CVE-ID: CVE-2026-98043)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect non-NULL pointer inference in the BPF verifier's reg_not_null() function when processing BPF programs with pointer arithmetic using unbounded offsets. A local user can load a crafted BPF program to cause a denial of service.

500) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-98044)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a BPF verifier warning and make BPF program loading fail.

The vulnerability exists due to improper callback-context validation in the BPF verifier's check_ld_abs() handling when loading a BPF program that uses legacy BPF_LD_ABS or BPF_LD_IND instructions from synchronous callbacks. A local privileged user can load a crafted BPF program to trigger the verifier warning and an -EFAULT BPF_PROG_LOAD failure.

501) Improper access control (CVE-ID: CVE-2026-98047)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to improper enforcement of rbtree callback restrictions in the BPF verifier's in_rbtree_lock_required_cb() function when executing static subprogram calls from bpf_rbtree_add() comparator callbacks. A local user can release the root lock, remove and drop the node being compared, and relock the tree, causing native insertion to use stale pointers to freed memory.

502) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-98048)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect eBPF program behavior.

The vulnerability exists due to improper control flow handling in the BPF verifier fastcall pattern rewrite logic when processing a spill-call-fill instruction sequence entered by a jump. A local user can load an eBPF program containing such a sequence to cause incorrect eBPF program behavior.

503) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-98049)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to produce incorrect 32-bit compare-and-exchange results.

The vulnerability exists due to incorrect numeric conversion in the BPF cmpxchg instruction detection logic when executing a BPF program that performs a 32-bit compare-and-exchange on an arena pointer. A local user can execute a BPF program containing the affected operation to produce incorrect 32-bit compare-and-exchange results.

The issue is relevant on architectures where 32-bit compare-and-exchange operations require explicit zero extension of the destination register.

504) Out-of-bounds read (CVE-ID: CVE-2026-98053)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in avs_path_module_send_init_configs() when processing module initialization configuration IDs. A local user can supply an initialization configuration ID equal to or greater than the number of initialization configurations to read memory out of bounds.

505) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98058)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper execution-context validation in the bpf_sys_bpf() and bpf_sys_close() BPF syscall helpers when BPF timer callbacks invoke the helpers. A local user can register a BPF timer callback that invokes either helper to cause a denial of service.

BPF timer callbacks are checked in a non-sleepable context and can run in hrtimer softirq context.

506) Type Confusion (CVE-ID: CVE-2026-98062)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper type handling in the signal_generate and signal_deliver tracepoints when tp_btf programs access the siginfo argument. A local user can trigger signal tracepoint processing with a tp_btf program that dereferences the argument to cause a denial of service.

The signal_generate tracepoint can execute in timer interrupt context.

507) Expected behavior violation (CVE-ID: CVE-2026-98067)

CWE-ID: CWE-440 - Expected Behavior Violation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data corruption.

The vulnerability exists due to an incorrect assumption about LZ4 literal copy direction in EROFS LZ4 rolling decompression when processing LZ4-compressed extents. A local user can trigger decompression of an LZ4-compressed extent to cause data corruption.

The issue can occur on x86 because the upstream LZ4 literal-copy memmove() may copy non-overlapping long literals backward.

508) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-98073)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of conflicting alternative interface names in __dev_change_net_namespace() when moving network devices from a dying network namespace. A local user can create network devices with identical alternative names in separate network namespaces and remove the non-root network namespace to trigger a kernel warning.

509) Race condition (CVE-ID: CVE-2026-98079)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the Btrfs zstd workspace management code when waiting for a zstd workspace after workspace allocation fails. A local user can trigger the lost-wakeup condition to cause a denial of service.

The condition involves maximum-level workspaces, for which a fallback workspace is retained for waiters.

510) Improper input validation (CVE-ID: CVE-2026-98084)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the BPF verifier to accept unsafe programs.

The vulnerability exists due to improper precision propagation in the BPF verifier backtracking logic when verifying repeated bpf_loop() calls with callbacks. A local user can submit a crafted BPF program that repeatedly invokes bpf_loop() to cause the BPF verifier to accept unsafe programs.

511) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98085)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an implicit subprogram exit edge in the BPF verifier's backtrack_insn() function when verifying BPF_LD | BPF_{IND,ABS} instructions. A local user can submit crafted BPF instructions for verification to cause a denial of service.

These instructions are modeled as fallthrough and implicit subprogram exit branches.

512) Race condition (CVE-ID: CVE-2026-98099)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a race condition.

The vulnerability exists due to improper synchronization in IPv6 multicast RCU-protected list management in net/ipv6/mcast.c when concurrently modifying IPv6 multicast group memberships while lockless readers traverse the lists. A local user can modify IPv6 multicast group memberships concurrently with list traversal to trigger a race condition.

513) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98124)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose stale file contents.

The vulnerability exists due to improper cache invalidation in FS-Cache handling for SMB client server-side range operations when performing server-side range operations on a file. A local user can perform a server-side range operation and read the affected file to disclose stale file contents.

FS-Cache must be enabled on a CIFS mount with an active CacheFiles backend.

514) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98131)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause DMA mapping leaks.

The vulnerability exists due to failure to release DMA mappings in stmmac_tso_xmit() in the stmmac Ethernet driver when a DMA mapping of an skb fragment fails during transmission. A local user can transmit a fragmented skb to cause DMA mapping leaks.

515) NULL pointer dereference (CVE-ID: CVE-2026-98134)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper null pointer validation in check_cond_jmp_op() in the BPF verifier when comparing pointer registers in a BPF program. A local user can submit a crafted BPF program that causes an unchecked null pointer dereference to cause a denial of service.

516) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-98147)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper handling of an exceptional condition in printk kernel-thread creation when kthread_run() fails after __kthread_create_on_node() returns -EINTR following SIGKILL. A local user can cause kthread_run() to fail to trigger a kernel warning.

517) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98148)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a kernel warning.

The vulnerability exists due to missing validation in gud_plane_add_properties when processing device-reported supported rotations. An attacker with physical access can provide a device rotation bitmask that omits GUD_ROTATION_0 to trigger a kernel warning.

518) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-98156)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability of memory belonging to another domain.

The vulnerability exists due to improper DMA address handling in virtio_gpu_object_shmem_init() when providing resource backing for a virtio-gpu framebuffer. A local user can cause framebuffer backing pages to be described with guest-physical addresses to compromise confidentiality, integrity, and availability of memory belonging to another domain.

Only Xen PV domains are affected; PVH domains are identity-mapped.

519) Improper input validation (CVE-ID: CVE-2026-98916)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a wireless driver to process an invalid link, potentially disrupting wireless operation.

The vulnerability exists due to improper validation of wireless link state in the nl80211_color_change() function when handling a color change request for a link that is not beaconing. A local privileged user can submit such a request to cause the kernel to invoke the driver's color change operation with an invalid link, potentially disrupting wireless operation.

520) Incorrect calculation (CVE-ID: CVE-2026-98974)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt another file's contents by overwriting shared filesystem blocks without triggering copy-on-write.

The vulnerability exists due to incorrect file size calculations in the Linux kernel XFS exchange-range implementation when processing XFS_IOC_EXCHANGE_RANGE operations with the TO_EOF flag and nonzero offsets on a filesystem supporting reflink and exchange-range. A local user can perform a sequence of file range exchanges that leaves shared blocks beyond the reported end of a file and incorrectly clears its reflink flag, then extend that file with a write to modify blocks still shared with another file.

521) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98975)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt data in files that share filesystem blocks.

The vulnerability exists due to improper management of reflink flags in the XFS mapping-exchange and extent-swap paths when exchanging mappings between files that retain shared blocks. A local user can perform an affected exchange and subsequently write to a shared block whose inode has lost its reflink flag, causing an in-place write instead of copy-on-write to corrupt another file sharing that block.

522) Incorrect authorization (CVE-ID: CVE-2026-98977)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to clear security flags on propagated automounts in their own namespace and prevent the host from changing flags on its own automounts.

The vulnerability exists due to incorrect authorization in the Linux kernel's attach_recursive_mnt() function in fs/namespace.c when assigning mount locks during automount propagation across user namespaces. A local user can trigger an automount through a directory descriptor referring to a host mount from a child namespace to cause the host's automount to be locked instead of the child's copy, allowing changes to mount security flags in the child namespace while blocking corresponding host operations.

523) Race condition (CVE-ID: CVE-2026-98981)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose file contents hidden by mounts in another mount namespace.

The vulnerability exists due to a race condition in the Linux kernel mount namespace handling when unlink(), rmdir(), or rename() removes an entry that is a mountpoint in another mount namespace. A local user can race pathname lookups against mount detachment while the underlying directory entry remains hashed and positive to access file contents previously hidden by the mount.

524) Use-after-free (CVE-ID: CVE-2026-98985)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a use-after-free read that may cause a denial of service.

The vulnerability exists due to use-after-free in path_pivot_root() in fs/namespace.c when reading mount parents before verifying that the mounts belong to the caller's mount namespace. A local privileged user can invoke pivot_root() with a reference to an unmounted mount while its parent is concurrently released to trigger a read of freed memory, potentially causing a denial of service.

The same invalid parent read can also occur through the caller's root set via chroot().

525) Use-after-free (CVE-ID: CVE-2026-98993)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service and potentially corrupt kernel memory through a use-after-free.

The vulnerability exists due to improper inheritance of the MNT_UMOUNT flag in clone_mnt() when copying a lazily unmounted mount kept alive by an open file descriptor. A local user can perform bind-mount and namespace operations on the resulting mount to disrupt mount tracking, cause nonterminating mount traversal, or trigger access to a freed mount namespace structure.

The detached source mount can be copied through this path only when its root is an nsfs or pidfs file.

526) Out-of-bounds read (CVE-ID: CVE-2026-99002)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger out-of-bounds reads that may disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel vmwgfx cursor snooping functionality when copying surface data using insufficiently validated userspace-supplied pitch and box dimensions. A local user can supply crafted surface copy parameters to cause reads beyond the source buffer or its mapped region, potentially disclosing sensitive information or causing a denial of service.

527) Deadlock (CVE-ID: CVE-2026-99009)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a deadlock in Bluetooth RFCOMM processing.

The vulnerability exists due to inconsistent lock ordering in the Linux kernel Bluetooth RFCOMM subsystem when establishing an RFCOMM connection while a BR/EDR link is being authenticated. A local user can issue an RFCOMM socket connect() call from userspace to trigger circular acquisition of rfcomm_mutex and hdev->lock, potentially deadlocking Bluetooth processing.

528) Use-after-free (CVE-ID: CVE-2026-99014)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth HCI command handling code when setting up periodic advertising synchronization scans. A local user can potentially exercise a race between scan setup and command processing to cause a kernel crash by accessing command buffers after they have been freed.

529) Memory leak (CVE-ID: CVE-2026-99019)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leak kernel memory, potentially causing a denial of service through repeated resource exhaustion.

The vulnerability exists due to missing cleanup of allocated memory in the Linux kernel SCSI changer driver's probe error path when ch_probe() fails after ch_readconfig(). A local privileged user can trigger such probe failures to leave the allocated data transfer device pointer array unreleased, potentially exhausting kernel memory if the failures are repeated.

530) Improper update of reference count (CVE-ID: CVE-2026-99019)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by preventing replacement SCSI devices from being accepted and preventing the low-level driver's module from being unloaded.

The vulnerability exists due to missing reference-count decrements in ch_readconfig() in the Linux kernel SCSI changer driver when looking up data transfer devices reported by a changer. A local privileged user can trigger changer initialization and subsequent drive removal to leave unreleased scsi_device references that keep removed devices on the host's device list.

The changer must report its drives' SCSI IDs for the issue to occur.

531) Use-after-free (CVE-ID: CVE-2026-99027)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel team driver's queue override transmission helper when an override port's queueing discipline drops a packet buffer and transmission returns a nonzero result. A local user can trigger packet transmission through the affected queue override path to cause the freed buffer to be reused for another port or the mode transmit operation, potentially crashing the kernel.

532) Race condition (CVE-ID: CVE-2026-99028)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt freed memory through DMA writes, potentially causing a denial of service.

The vulnerability exists due to a race condition between axienet_dma_rx_cb() and axienet_stop() in the Xilinx AXI Ethernet driver's dmaengine path when receive-buffer resubmission overlaps interface teardown. A local privileged user can trigger interface shutdown during receive processing, if permitted, to leave the DMA engine writing into a buffer freed by teardown, potentially corrupting memory and causing a denial of service.

533) Memory leak (CVE-ID: CVE-2026-99028)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by exhausting memory or DMA mapping resources.

The vulnerability exists due to missing release of socket buffers and DMA mappings in the Xilinx AXI Ethernet driver's dmaengine path when stopping a network interface with outstanding DMA descriptors. A local privileged user can repeatedly bring an interface down, if permitted, to accumulate unreleased buffers and mappings, potentially exhausting a limited IOMMU aperture and causing a denial of service.

534) NULL pointer dereference (CVE-ID: CVE-2026-99041)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to a null pointer dereference in ip6erspan_tunnel_xmit() when obsolete path MTU handling treats tunnel metadata attached to a packet as a route with an output device. A local user can use tc tunnel_key to attach METADATA_IP_TUNNEL metadata and mirred to redirect the packet to a native ip6erspan device to trigger a kernel panic.

The reported reproduction used self-created user and network namespaces.

535) Use-after-free (CVE-ID: CVE-2026-99044)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a use-after-free in the Linux kernel ice driver's ice_dealloc_dynamic_port() function when cleaning up a dynamic port. A local privileged user can trigger the affected cleanup path, which reads dyn_port->vsi->idx after freeing the VSI to remove an entry from pf->dyn_ports, to potentially cause a denial of service through a kernel crash.

536) Observable discrepancy (CVE-ID: CVE-2026-99077)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to discover the ephemeral port used by a connected UDP socket through a cache side channel.

The vulnerability exists due to an observable discrepancy in IPv4 UDP error handling in the Linux kernel when processing locally delivered ICMP Fragmentation Needed or Redirect messages that quote UDP packets. A remote attacker can send crafted ICMP messages containing guessed UDP ports and observe changes in the FIB nexthop exception (FNHE) cache to distinguish packets matching an existing socket and discover its ephemeral port.

537) Incorrect comparison (CVE-ID: CVE-2026-99082)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass KVM's write tracking for guest RAM and cause continued use of stale guest memory translations.

The vulnerability exists due to incorrect memslot generation comparisons in the x86 KVM per-vCPU MMIO cache when caching and validating entries across normal and system management mode address spaces. A local user can cause a stale cache entry to misclassify a valid guest RAM access as KVM_EXIT_MMIO after an SMM memslot update, allowing completion through the virtual machine monitor's RAM address space to bypass write tracking and leave shadow translations stale if the modified page backs a nested EPT table.

538) Out-of-bounds write (CVE-ID: CVE-2026-99083)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt kernel heap memory and potentially cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the Linux kernel ksmbd krb5_authenticate() function when processing SMB2_SESSION_SETUP as a non-first element of a compounded SMB2 request. A remote attacker can send a specially crafted compounded request to trigger an overstated response buffer capacity calculation, allowing a Kerberos AP-REP token to be copied beyond response_buf into adjacent kernel heap memory.

539) Deadlock (CVE-ID: CVE-2026-99085)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by hanging CPU hotplug operations.

The vulnerability exists due to improper synchronization in the Linux kernel sched_ext scheduler when offlining a CPU whose tasks remain in a user dispatch queue or are held by the BPF scheduler. A local user can trigger the affected scheduling conditions during CPU offlining to prevent the hotplug thread from completing, potentially leaving cpu_down() hung while holding cpu_hotplug_lock and causing a denial of service.

540) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-99092)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause BPF just-in-time compilation to fail on affected RISC-V systems.

The vulnerability exists due to incorrect configuration-dependent control flow in the RISC-V patch_map() function when copying BPF instructions into read-only executable memory with CONFIG_STRICT_MODULE_RWX disabled. A local user can trigger BPF just-in-time compilation to cause instruction copying to fail because a temporary writable mapping is not created, leaving the BPF program un-JITed.

Builds without MMU support are unaffected.

541) Stack-based buffer overflow (CVE-ID: CVE-2026-99098)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in dm_integrity_check and dm_integrity_inline_recheck when computing block checksums in inline mode. A local privileged user can configure a tag size larger than HASH_MAX_DIGESTSIZE and trigger a read to cause checksum padding to overflow the on-stack digest buffer and cause a denial of service.

With CONFIG_STACKPROTECTOR enabled, the kernel panics in dm_integrity_check on the first read.

542) Out-of-bounds read (CVE-ID: CVE-2026-99100)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering out-of-bounds reads in the kernel.

The vulnerability exists due to out-of-bounds reads in the Linux kernel p54 firmware parser when processing firmware records without verifying that their lengths cover the accessed fields. A local privileged user can cause specially crafted firmware containing undersized records to be parsed to trigger reads beyond record boundaries, potentially crashing the kernel.

543) Use-after-free (CVE-ID: CVE-2026-99103)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel workqueue subsystem when canceling the last inactive work leaves an empty pool_workqueue on pending_pwqs and its underlying unbound worker pool is freed before the pending entry is removed. A local user can potentially trigger pending workqueue activation to make node_activate_pending_pwq() access the freed pool's lock, causing a kernel crash and a denial of service.

544) Insufficient Control Flow Management (CVE-ID: CVE-2026-99105)

CWE-ID: CWE-691 - Insufficient Control Flow Management

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by stalling runnable tasks.

The vulnerability exists due to improper control flow management in the Linux kernel sched_ext function put_prev_task_scx() when a task enqueued with SCX_ENQ_LAST returns to its CPU's local dispatch queue after the scheduler has selected the idle task. A local user can trigger affected task scheduling paths under a scheduler using SCX_OPS_ENQ_LAST to leave runnable tasks queued while the CPU remains idle until an unrelated wakeup or watchdog intervention.

545) Memory leak (CVE-ID: CVE-2026-99106)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust kernel memory and potentially cause a denial of service.

The vulnerability exists due to missing deallocation of HMM ranges in the Linux kernel AMDGPU command submission error paths when command submission fails after amdgpu_cs_parser_bos() succeeds. A local user can submit repeated command streams containing an indirect buffer with an unmapped va_start on a ring that patches command streams in place, such as VCN, to leak HMM ranges, their hmm_pfns arrays, and retained buffer object references, potentially exhausting kernel memory.

546) Heap-based buffer overflow (CVE-ID: CVE-2026-99110)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through kernel heap corruption.

The vulnerability exists due to a heap-based buffer overflow in the Linux kernel SMB client's cifs_do_set_acl() function when converting POSIX ACLs to the CIFS wire format. A local user can supply an ACL that passes validation based on the smaller extended-attribute representation but exceeds the destination buffer after conversion to corrupt kernel heap memory and potentially cause a denial of service.

547) Out-of-bounds read (CVE-ID: CVE-2026-99112)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering an out-of-bounds kernel memory read.

The vulnerability exists due to an out-of-bounds read in the Linux kernel's flower classifier when processing nested tunnel-option attributes with an improperly validated mask cursor. A local privileged user can supply crafted filter attributes that advance the mask cursor beyond its valid payload, causing subsequent attribute parsing to read outside the mask buffer and potentially crash the kernel.

548) Use of uninitialized resource (CVE-ID: CVE-2026-99113)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose portions of SMB responses that the client was not authorized to receive.

The vulnerability exists due to incomplete initialization of the FS_OBJECT_ID_INFORMATION response buffer in the Linux kernel ksmbd smb2_get_info_filesystem() function when handling compound SMB requests. A remote user can submit a compound request in which a preceding command writes response data before failing, causing the subsequent filesystem information response to overlap that data and disclose up to 31 bytes, including data from a response that failed with an access denied error.

549) Use of Uninitialized Variable (CVE-ID: CVE-2026-99114)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose residual response-buffer data.

The vulnerability exists due to an uninitialized FileSystemControlFlags field in the Linux kernel ksmbd smb2_get_info_filesystem() function when processing compound SMB requests. A remote user can send a specially crafted compound request that places an FS_CONTROL_INFORMATION response over data left by a discarded earlier response to disclose four bytes of residual response-buffer data.

550) Use of uninitialized resource (CVE-ID: CVE-2026-99115)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose residual response-buffer data from the Linux kernel SMB server.

The vulnerability exists due to an uninitialized FileSysIdentifier field in ksmbd's smb2_get_info_filesystem() function when processing compound SMB requests for FS_POSIX_INFORMATION. A remote user can submit a compound request in which an earlier reply is replaced by a shorter error response, leaving residual data that the subsequent filesystem-information reply can disclose through the eight-byte field.

551) Use-after-free (CVE-ID: CVE-2026-99117)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel bridge multicast subsystem when tearing down port groups. A local user can trigger a teardown sequence in which deleting the iterator's saved next node prematurely terminates the port-group walk, leaving dangling port pointers that are subsequently accessed during a multicast database dump to cause a denial of service.

552) Integer overflow (CVE-ID: CVE-2026-99118)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service.

The vulnerability exists due to an unchecked integer overflow in the i915 DMC firmware parser when converting firmware payload sizes from dwords to bytes. A local privileged user can provide malformed DMC firmware containing a crafted size value to cause incorrect payload sizing, potentially leading to invalid memory accesses and a denial of service.

553) Division by zero (CVE-ID: CVE-2026-99121)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to division by zero in the Linux kernel's fib_rebalance() function when a concurrent change to ignore_routes_with_linkdown causes inconsistent nexthop eligibility between its two passes. A local privileged user can trigger rebalancing during such a change to cause a division-by-zero fault that may crash the kernel.

554) Origin validation error (CVE-ID: CVE-2026-99123)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to inject attacker-chosen data into another process's AF_VSOCK connection.

The vulnerability exists due to improper validation of packet source addresses in virtio_transport_recv_pkt() when matching incoming packets through the destination-only bound-socket lookup. A local user can send a RESPONSE packet from an unrelated source to a socket in TCP_SYN_SENT to transition it to TCP_ESTABLISHED, then send RW packets through the same fallback to inject data despite the socket retaining its intended peer address.

555) Out-of-bounds read (CVE-ID: CVE-2026-99124)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause an out-of-bounds read of kernel memory and include the data in a malformed SCLP error report.

The vulnerability exists due to an out-of-bounds read in the Linux kernel s390 PCI report_error_write() function when processing a buffer shorter than the report's declared payload length. A local privileged user can submit a buffer whose report->length exceeds the supplied payload size to copy up to approximately 4 KB of kernel data beyond the allocated buffer into the SCLP report. The privileged entity processing the report already has access to the relevant memory, so this does not expose data that entity could not otherwise access.

556) NULL pointer dereference (CVE-ID: CVE-2026-99126)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the Linux kernel s390 CTCM driver's mpc_validate_xid() function when validating a null peer XID or handling a read/write channel pairing mismatch. A local user can trigger these validation error conditions to cause access to the uninitialized grp->saved_xid2 pointer, potentially crashing the kernel.

557) Reliance on Data/Memory Layout (CVE-ID: CVE-2026-99127)

CWE-ID: CWE-188 - Reliance on Data/Memory Layout

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a kernel panic.

The vulnerability exists due to insufficient fragment alignment in page_pool_alloc_frag_netmem() when processing odd-sized allocation requests on architectures where DMA cache alignment does not ensure socket buffer alignment. A local privileged user can trigger odd-sized packet fragment allocations through generic XDP processing to leave subsequent allocations from the shared page pool misaligned, causing atomic operations during socket buffer cloning to cross cache-line boundaries and panic the kernel on x86 systems with fatal split-lock detection enabled.

558) Infinite loop (CVE-ID: CVE-2026-99128)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by locking up the kernel's receive softirq.

The vulnerability exists due to insufficient chunk-length validation in the SCTP inqueue parser, sctp_inq_pop(), when processing incoming SCTP chunks. A remote attacker can send a zero-length ASCONF chunk over an established association whose SCTP-AUTH policy covers ASCONF to cause repeated processing of the same malformed chunk and lock up the receive softirq.

Exploitation requires net.sctp.addip_enable=1 and net.sctp.auth_enable=1.

559) Infinite loop (CVE-ID: CVE-2026-99130)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through sustained CPU consumption or a kernel panic.

The vulnerability exists due to an infinite loop in the Linux kernel's io_uring_cancel_generic() function when an exiting task waits on pending local work that only another task may execute. A local user can create a disabled IORING_SETUP_DEFER_TASKRUN ring, have a child enable it and stop, post work using IORING_OP_MSG_RING, and exit with a request in flight that only the child can complete to make the exiting thread spin continuously without sleeping.

The kernel-panic outcome requires panic_on_warn to be set.

560) Incorrect authorization (CVE-ID: CVE-2026-99131)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass enforced group disk quota limits.

The vulnerability exists due to incorrect capability checks against real rather than effective credentials in the Linux kernel XFS filesystem when processing file attribute changes through an NFS client. A remote user can change a file's group ID to another group they belong to, causing quota handling to use XFS_QMOPT_FORCE_RES to bypass quota accounting checks even when the file exceeds the destination group's hard limit.

561) Deadlock (CVE-ID: CVE-2026-99132)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through an XFS filesystem deadlock.

The vulnerability exists due to a deadlock caused by holding superblock buffer locks across a synchronous transaction commit in xfs_sync_sb_buf() when filesystem shutdown occurs during a committed item list (CIL) push. A local privileged user can trigger an affected superblock synchronization under these conditions to cause the committing task and CIL push worker to wait indefinitely for each other, blocking affected filesystem operations.

562) Race condition (CVE-ID: CVE-2026-99133)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt AF_IUCV flow control by causing receive credits to be advertised more than once.

The vulnerability exists due to a race condition in afiucv_hs_send() when concurrent socket operations read the receive-credit counter and subtract the sampled value after transmission without shared serialization. A local user can exercise concurrent recvmsg() and sendmsg() operations to subtract the same credit more than once, make the counter negative, and advertise duplicate credit to the peer.

563) Improper locking (CVE-ID: CVE-2026-99133)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disrupt kernel operation by triggering a sleeping allocation in an atomic context.

The vulnerability exists due to improper locking in iucv_sock_recvmsg() when a window update calls iucv_send_ctrl() while message_q.lock is held with spin_lock_bh(). A local user can invoke recvmsg() to reach a GFP_KERNEL allocation inside the atomic section, potentially causing scheduling errors or a denial of service.

564) NULL pointer dereference (CVE-ID: CVE-2026-99133)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering an unintended AF_IUCV socket disconnect.

The vulnerability exists due to a NULL pointer dereference in iucv_send_ctrl() when iucv_sock_recvmsg() sends a HiperSockets-only window update over the classic z/VM transport. A local user can set SO_MSGLIMIT to 1 and invoke recvmsg() on their own socket to trigger the invalid access through iucv->hs_dev and an unintended disconnect.

565) Use-after-free (CVE-ID: CVE-2026-99134)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service and corrupt association results in the Linux kernel.

The vulnerability exists due to unsynchronized access to the coordinator pointer and association results in mac802154 when processing association responses concurrently with association cleanup. A remote attacker on the local network can send carefully timed association responses to trigger a NULL pointer dereference or use-after-free, potentially crashing the kernel, or send a second response to leave the caller with an inconsistent status and address pair.

566) Infinite loop (CVE-ID: CVE-2026-99135)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering an infinite loop during discard processing.

The vulnerability exists due to an incorrect fallback buffer size calculation in the dm-integrity integrity_metadata() function when processing discard requests after a memory allocation failure. A local user can trigger discard processing on a device configured with a tag size greater than HASH_MAX_DIGESTSIZE to cause max_blocks to become zero, preventing bi_size from decreasing and causing an infinite loop.

567) Race condition (CVE-ID: CVE-2026-99136)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause failed encrypted storage operations to be reported as successful, potentially compromising data integrity.

The vulnerability exists due to a race condition in the Linux kernel dm-crypt crypt_dec_pending function when concurrent I/O completion updates the error status between its initial read and the final reference decrement. A local user can exploit this timing window to cause completion with a stale success status, masking a failed write or a failed read whose data was never decrypted.

568) Use-after-free (CVE-ID: CVE-2026-99138)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by crashing the kernel.

The vulnerability exists due to use-after-free in do_tcp_getsockopt() when handling TCP_CC_INFO requests without protecting the congestion-control operations pointer against concurrent deallocation. A local user can request TCP congestion-control information while dynamically allocated BPF struct_ops congestion-control operations are being freed to trigger a stale pointer dereference or function-pointer call, potentially crashing the kernel.

569) Use-after-free (CVE-ID: CVE-2026-99139)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service or disclose kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel's do_tcp_getsockopt() function when reading the TCP_CONGESTION algorithm name without RCU read-side protection. A local user can race getsockopt(TCP_CONGESTION) with setsockopt(TCP_CONGESTION), causing dynamically allocated BPF struct_ops memory to be freed while its name is being copied to user space, to potentially crash the kernel or disclose kernel memory.

570) Race condition (CVE-ID: CVE-2026-99140)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger kernel warnings and cause incorrect timestamps in tracing histograms.

The vulnerability exists due to a race condition in hist_field_timestamp() in kernel/trace/trace_events_hist.c when a histogram trigger is attached while a filtered event is being processed in a per-CPU temporary buffer. A local privileged user can race histogram trigger registration against event processing to cause timestamp retrieval from an event without an active ring buffer commit, triggering a kernel warning and recording an incorrect timestamp.

571) Out-of-bounds write (CVE-ID: CVE-2026-99142)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds write in the Linux kernel tracing predicate_parse() function when processing opening parentheses in tracing filter expressions. A local privileged user can submit a crafted filter expression that causes an operator stack push beyond the last allocated entry to corrupt kernel memory, potentially causing a denial of service.

572) Heap-based buffer overflow (CVE-ID: CVE-2026-99143)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to incorrect predicate-limit accounting in the Linux kernel tracing function predicate_parse() when parsing filter expressions containing more predicates than initially counted. A local privileged user can supply a crafted filter expression to exhaust the allocated program capacity and trigger out-of-bounds heap accesses, potentially causing a kernel crash.

573) Improper locking (CVE-ID: CVE-2026-99147)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel assertion failure.

The vulnerability exists due to improper tracking of implicitly prelocked objects in the Linux kernel DRM execution locking helpers when recovering from lock contention. A prelocked object can remain in the locked-object array without a reserved dma_fence slot if the driver never explicitly locks it again. A local user can exercise graphics operations that encounter this condition to trigger a warning or kernel assertion failure when the driver uses drm_exec_for_each_locked_object() to add fences.

574) Improper update of reference count (CVE-ID: CVE-2026-99150)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disrupt GPU runtime power management and potentially cause a denial of service.

The vulnerability exists due to improper reference count updates in the Linux kernel amdgpu_debugfs_gpr_read() function when copying GPU wave register data to userspace fails. A local privileged user can read the amdgpu_gpr debugfs interface into an invalid userspace buffer to trigger a second release of the same runtime power management reference, potentially disrupting GPU operation.

575) NULL pointer dereference (CVE-ID: CVE-2026-99152)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by crashing the Linux kernel.

The vulnerability exists due to a null pointer dereference caused by insufficient task validation in libiscsi's __iscsi_complete_pdu() function when processing iSCSI management responses. A remote attacker can send an unsolicited NOP-In or a Text Response from a controlled iSCSI target with an initiator task tag identifying a never-used task slot, causing a null task connection pointer to be dereferenced and crashing the kernel.

576) Improper input validation (CVE-ID: CVE-2026-99153)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or compromise data integrity by incorrectly completing SCSI commands.

The vulnerability exists due to improper validation of the reflected initiator task tag in the Linux kernel libiscsi iscsi_handle_reject() function when processing iSCSI Reject PDUs. A remote attacker can send a specially crafted Reject PDU from a malicious iSCSI target to select an unrelated task, triggering a NULL pointer dereference, a reference-count underflow, or successful completion of an in-flight SCSI command without the expected data transfer.

577) Out-of-bounds read (CVE-ID: CVE-2026-99154)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an out-of-bounds kernel memory read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel libiscsi task lookups when processing a negative task index returned by parse_pdu_itt. A remote attacker can send an unsolicited NOP-In PDU from an iSCSI target through the be2iscsi transport with an ITT value that becomes a negative signed index to cause a read before the session's task array, potentially crashing the kernel.

578) NULL pointer dereference (CVE-ID: CVE-2026-99155)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by crashing a guest operating system.

The vulnerability exists due to a NULL pointer dereference in the Linux kernel Xen SCSI frontend function scsifront_do_response() when processing a backend response with an in-range request identifier that selects an unpopulated shadow slot. A local privileged user can control a malicious backend and return a spurious response or a duplicate response for a completed request to crash the guest.

579) Use-after-free (CVE-ID: CVE-2026-99156)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through kernel memory corruption.

The vulnerability exists due to a use-after-free race in the Linux kernel SCSI tape driver when opening a tape device concurrently with its removal. A local user can open the device during removal to cause st_open() to access a freed scsi_tape structure through st_index_idr, potentially crashing the kernel.

580) Heap-based buffer overflow (CVE-ID: CVE-2026-99157)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel heap memory, potentially causing a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the Linux kernel BSG reply handling when processing UFS Advanced RPMB commands that return an EHS. A local user can trigger processing of such a command to cause ufshcd_advanced_rpmb_req_handler() to write a 104-byte reply, consisting of a 40-byte header and a 64-byte EHS, into a 96-byte heap buffer, corrupting eight bytes beyond its boundary and potentially causing a denial of service.

581) Incorrect Check of Function Return Value (CVE-ID: CVE-2026-99158)

CWE-ID: CWE-253 - Incorrect Check of Function Return Value

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a spurious kernel warning.

The vulnerability exists due to incorrect handling of a valid NULL return value in ring_buffer_map_get_reader() when a memory-mapped tracing ring-buffer reader catches up with a writer that is still committing events. A local user can read from the ring buffer during concurrent event commits to trigger a spurious kernel warning because the function incorrectly treats a no-data result from rb_get_reader_page() as an error.

582) NULL pointer dereference (CVE-ID: CVE-2026-99159)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service and loss of trace data from the previous boot.

The vulnerability exists due to an incorrect sub-buffer base calculation in rb_meta_subbuf_idx() when calculating indices for a persistent ring buffer. A local user can map trace_pipe_raw from userspace to trigger a NULL pointer dereference in __rb_map_vma(), potentially crashing the kernel. Incorrect indices stored in the metadata can also cause the previous boot's trace to be discarded on the next boot.

583) NULL pointer dereference (CVE-ID: CVE-2026-99160)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to a null pointer dereference in the Linux kernel ring-buffer rbm_start() function when reading buffer metadata for a CPU that has never come online. A local user can read the corresponding per_cpu/cpuN/buffer_meta file to trigger access to an unallocated CPU buffer and potentially crash the kernel.

584) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-99161)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a clock resource leak that may degrade system availability.

The vulnerability exists due to failure to release clock references in the Linux kernel's wmt_i2c_probe() function when a subsequent probe operation fails or the module is unloaded. A local privileged user can potentially trigger these driver lifecycle conditions to leave references acquired through of_clk_get() unreleased, which may exhaust resources over repeated occurrences.

585) Type Confusion (CVE-ID: CVE-2026-99163)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through an invalid kernel pointer dereference.

The vulnerability exists due to type confusion in check_synth_field() in the Linux kernel tracing histogram subsystem when validating histogram fields for synthetic stacktrace events. A local privileged user can supply an 8-byte signed scalar histogram field that passes size and signedness checks and is subsequently dereferenced as a kernel stacktrace pointer in get_field_size() and trace_stack(), potentially causing a kernel fault and denial of service.

586) NULL pointer dereference (CVE-ID: CVE-2026-99165)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the Linux kernel SCTP send path when processing an output stream after a wait that releases the socket lock. A remote attacker can negotiate a reduced stream count during association establishment while a send operation is waiting to cause the sender to reuse a stream whose extension has been freed, triggering a kernel fault.

The association-establishment wait scenario requires message interleaving to be enabled.

587) NULL pointer dereference (CVE-ID: CVE-2026-99166)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by crashing the Linux kernel.

The vulnerability exists due to a null pointer dereference in the RDS RDMA connection event handler when processing a resolved route for an outgoing connection bound to an iWARP device. A local user can initiate an RDS connection whose local address resolves to an iWARP device to reach a write through the unset cm_id->route.path_rec pointer and crash the kernel.

588) Access of Uninitialized Pointer (CVE-ID: CVE-2026-99166)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by crashing the Linux kernel.

The vulnerability exists due to an uninitialized pointer dereference in rds_rdma_cm_event_handler_cmn() when handling connection requests received on non-InfiniBand RDMA devices. A remote attacker can send a connection request to an RDS listener on an iWARP device to trigger a dereference of the uninitialized transport pointer and crash the kernel.

589) Use-after-free (CVE-ID: CVE-2026-99167)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to a use-after-free in __tcf_action_put() in the Linux kernel traffic control subsystem when concurrent operations release an action. A local user can trigger concurrent action releases to potentially cause a kernel crash: another thread may free the action after its reference count is decremented but before its binding count is updated, causing a write to freed memory.

590) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-99169)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to interfere with futex wakeups and potentially cause a denial of service in affected processes.

The vulnerability exists due to improper resource lifetime tracking in the Linux kernel futex subsystem when matching FUT_OFF_MMSHARED waiters using a memory descriptor address that can be reused after the descriptor is freed. A local user can requeue a FUT_OFF_INODE waiter onto a FUT_OFF_MMSHARED futex and exploit subsequent memory descriptor address reuse to consume wakeups intended for a different process, potentially leaving its threads blocked.

591) Use-after-free (CVE-ID: CVE-2026-99171)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel ntfs3 filesystem when an RCU path lookup accesses superblock private information after the last mount reference is dropped. A local user can potentially trigger a lookup on a filesystem mounted with the "nocase" option concurrently with mount teardown to access prematurely freed memory and cause a kernel crash.

592) Use-after-free (CVE-ID: CVE-2026-99173)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to a use-after-free in eventfs inode lifetime management when an SRCU grace period permits an inode to be freed before an ongoing RCU path walk completes. A local user can trigger overlapping path lookups and dentry teardown to potentially cause a denial of service when tracefs_d_revalidate() reads the freed inode's is_freed field.

593) Use-after-free (CVE-ID: CVE-2026-99174)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel ext4 filesystem when RCU-mode symlink traversal races with the release of the final mount reference. A local user can trigger concurrent path traversal and final reference release on a lazily unmounted filesystem to access freed superblock information or destroyed extent status counters and cause a kernel crash.

594) Race condition (CVE-ID: CVE-2026-99175)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to a race condition in the Linux kernel fsnotify connector teardown when new notification marks are inserted while fsnotify_destroy_marks() destroys existing marks. A local user can race an inotify watch re-addition and an fdinfo read against connector teardown to trigger a call to igrab(NULL), causing a kernel crash.

595) NULL pointer dereference (CVE-ID: CVE-2026-99176)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel NULL pointer dereference.

The vulnerability exists due to a failure to restore the root MMU context in the Linux kernel's KVM nested VMX implementation when loading L2 state fails during RSM emulation or KVM_SET_NESTED_STATE handling. A local user can trigger this failure and subsequently free the nested virtualization state, leaving the vCPU using a nested MMU while running L1, to cause a NULL pointer dereference when KVM accesses the L1-to-L2 EPT pointer.

596) Race condition (CVE-ID: CVE-2026-99178)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic in a KVM guest.

The vulnerability exists due to a race condition in the Linux kernel's x86 KVM asynchronous page-fault handler when a kernel-mode page fault in NMI context consumes pending asynchronous page-fault reason flags belonging to an interrupted handler. A local user can run perf sampling with user call chains and an invalid user-space frame pointer to trigger a guest kernel panic if the sampling NMI faults during the interval between asynchronous page-fault delivery and consumption of its reason flags.

597) Race condition (CVE-ID: CVE-2026-99179)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to a race condition in the Linux kernel watch queue subsystem when publishing notification pool state concurrently with notification delivery. A local user can race ioctl(IOC_WATCH_QUEUE_SET_SIZE) on a notification pipe against keyctl(KEYCTL_SETPERM) on a watched key they own from another CPU to cause post_one_notification() to dereference a NULL notes pointer and panic the kernel.

598) Use-after-free (CVE-ID: CVE-2026-99180)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel Unicode map handling used by generic_ci_d_hash() and generic_ci_d_compare() when RCU-mode pathname lookups race with filesystem teardown. A local user can race a pathname lookup against release of the last reference to a casefolded filesystem mount outside the normal unmount path to trigger access to a freed Unicode map and potentially crash the kernel.

599) Race condition (CVE-ID: CVE-2026-99181)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service in a shared autofs service during a legitimate daemon restart.

The vulnerability exists due to a race condition in autofs_notify_daemon() in fs/autofs/waitq.c when handling notification write errors after the daemon replaces its notification pipe. A local user can trigger lookups that fill the old notification pipe and block a write across a legitimate daemon restart to cause a denial of service: a delayed -EPIPE error from the old pipe triggers catatonic mode against the current superblock state, closing the replacement pipe and releasing the new daemon's wait queues.

600) Integer underflow (CVE-ID: CVE-2026-99182)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering an invalid shift during audio capture configuration.

The vulnerability exists due to integer underflow in the Linux kernel's sof_ipc4_prepare_copier_module() function in sound/soc/sof/ipc4-topology.c when configuring aggregated ALH capture streams. A local user can trigger configuration of a capture stream with fewer channels than aggregated devices, causing step to become zero and step - 1 to underflow to UINT_MAX, which produces an out-of-bounds shift in GENMASK() and may disrupt audio processing or system availability.

601) Insufficient Control Flow Management (CVE-ID: CVE-2026-99187)

CWE-ID: CWE-691 - Insufficient Control Flow Management

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disrupt performance monitoring during CPU hotplug.

The vulnerability exists due to incorrect red-black tree traversal in __perf_pmu_remove() in kernel/events/core.c when removing performance event groups during PMU context migration. A local user can exercise affected performance event groups during CPU hotplug to potentially disrupt performance monitoring: removing a group leader prematurely terminates the traversal, leaving other groups running on the source CPU while the PMU interrupt and migrated events reside on another CPU.

602) Integer overflow (CVE-ID: CVE-2026-99191)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect IPv6 payload-length reporting, potentially disrupting packet processing by nf_tables, conntrack and sch_cake.

The vulnerability exists due to integer wraparound and incorrect handling of the zero payload-length marker in calipso_skbuff_setattr() when inserting or resizing CALIPSO options on IPv6 packets forwarded to a destination mapped to CALIPSO. A remote attacker can send traffic that forms oversized aggregated packets or crosses the IPv6 payload-length limit during labeling to cause downstream components to use an incorrect payload length.

603) Race condition (CVE-ID: CVE-2026-99192)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by stalling a network transmit queue.

The vulnerability exists due to improper synchronization of shared socket buffer control-block updates in the Linux kernel bcmgenet driver when transmitting a buffer that is still pending completion in the transmit ring. A local privileged user can trigger repeated transmission of a shared buffer to overwrite its last_cb state, preventing earlier transmit slots from crediting their completed bytes and causing byte queue limits (BQL) to stall the queue until the watchdog resets it.

604) Information disclosure (CVE-ID: CVE-2026-99201)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose the kernel address of init_net.

The vulnerability exists due to information exposure through hashing a raw network namespace pointer in the netlink rhashtable key when exposing hash table bucket order through /proc/net/netlink and socket diagnostics. A local user can bind and rebind chosen NETLINK_USERSOCK port IDs to identify matching buckets, recover low bits of the Jenkins hash, and search the hash seed and possible kernel-image slides offline to recover the address of init_net.

605) Deadlock (CVE-ID: CVE-2026-99202)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by deadlocking host adapter resume and associated storage operations.

The vulnerability exists due to a circular wait in the Linux kernel libsas function smp_execute_task_sg() when issuing an SMP command during host adapter resume. A local user can trigger an affected resume sequence to cause a denial of service: pm_runtime_get_sync() waits for the ongoing resume to finish, while the resume waits in sas_drain_work() for the same SMP operation to complete.

The deadlock requires an expander-attached SATA disk.

606) Use-after-free (CVE-ID: CVE-2026-99203)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel pipe_fasync() function when concurrent attempts to enable asynchronous notifications on an O_RDWR FIFO encounter a writer-entry allocation failure. A local user can trigger concurrent enables under memory pressure, causing an existing reader registration to be removed while the writer registration remains active, to leave a stale reference that may crash the kernel during a later pipe notification.

607) Use-after-free (CVE-ID: CVE-2026-99204)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through invalid kernel memory access.

The vulnerability exists due to use-after-free in the Linux kernel OCFS2 DLM debug_state_print() function when reading recovery participant records without holding the lock that protects their list. A local privileged user can open the DLM debugfs state interface concurrently with recovery-area teardown to trigger reads of freed participant records, potentially causing a kernel crash.

608) Double free (CVE-ID: CVE-2026-99206)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a double free caused by a race condition in the Linux kernel iSCSI target discovery authentication configuration when processing concurrent configfs updates to the AuthMethod parameter. A local privileged user can update discovery authentication through separate configfs opens concurrently to cause iscsi_update_param_value() to free the same parameter value twice, potentially crashing the kernel.

609) Use of uninitialized resource (CVE-ID: CVE-2026-99211)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized kernel memory from socket buffer headroom.

The vulnerability exists due to the use of uninitialized memory in Linux kernel netlink socket filtering when processing messages whose network and MAC header offsets have not been reset after reserving headroom. A local user can attach a classic socket filter to an unprivileged NETLINK_RDMA socket and use SKF_NET_OFF or SKF_LL_OFF to read before the initialized IWPM HELLO reply, disclosing headroom data through the length of the delivered reply.

610) Use-after-free (CVE-ID: CVE-2026-99212)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel's rds_rdma_cm_event_handler_cmn() function when RDMA route resolution fails synchronously while handling RDMA_CM_EVENT_ADDR_RESOLVED. A local user can exploit the stale connection identifier retained by RDS after such a failure to potentially cause a kernel crash when connection shutdown accesses and destroys the already freed identifier.

611) Race condition (CVE-ID: CVE-2026-99213)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through kernel memory corruption.

The vulnerability exists due to a race condition in the Linux kernel vsock_connect() function when handling an OP_RST transition from TCP_ESTABLISHED to TCP_CLOSING during connection establishment. A local user can trigger this race to reset a socket still present in connected_table, causing kernel memory corruption and crashes when the socket is reinserted.

612) Incorrect behavior order (CVE-ID: CVE-2026-99214)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning during HDMI audio preparation.

The vulnerability exists due to incorrect ordering of Packet RAM initialization in the Linux kernel VC4 HDMI driver when preparing audio before video has been restored. A local user can initiate HDMI audio preparation while Packet RAM is disabled to trigger a kernel warning in vc4_hdmi_write_infoframe().

613) Incomplete cleanup (CVE-ID: CVE-2026-99216)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leave a VMBus connection active after teardown, potentially disrupting guest operation through continued host messages or interrupts.

The vulnerability exists due to incomplete cleanup in the Linux kernel Hyper-V VMBus driver when handling connection-establishment errors or driver exit. A local privileged user can trigger an affected cleanup path to leave the connection active because vmbus_connection.conn_state is prematurely set to DISCONNECTED, causing vmbus_initiate_unload() to skip unloading the connection and allowing host messages or VMBus interrupts to continue.

614) Use-after-free (CVE-ID: CVE-2026-100072)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the ACPI platform-device creation code when obtaining the physical device associated with an ACPI parent device. A local user can cause a device reference to be used after the device has been freed to trigger a use-after-free condition.

615) Improper input validation (CVE-ID: CVE-2026-100074)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper uniqueness marking in BPF reference-count field handling when processing BPF type information. A local user can trigger the flaw to cause a denial of service.

616) Memory leak (CVE-ID: CVE-2026-100076)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to failure to release management transmit frame and buffer resources in the rtl8723bs management frame transmission paths when handling management frame transmission error conditions. A local user can repeatedly trigger affected error paths to exhaust the management transmit pools and prevent the interface from sending beacons or probe and association responses.

617) Use-after-free (CVE-ID: CVE-2026-100077)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the MSM GPU recovery worker when retiring a hung submission before GPU recovery. A local user can trigger recovery for a hung GPU submission to cause a denial of service.

Remediation

Install update from vendor's website.

References

• https://lists.debian.org/debian-security-announce/2026/msg00521.html