SB20261103108 - Ubuntu update for linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx

Description

This security bulletin contains information about 2047 vulnerabilities.

1) NULL pointer dereference (CVE-ID: CVE-2022-1205)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a null pointer dereference and use after free errors in the net/ax25/ax25_timer.c. A local user can simulate Amateur Radio and perform a denial of service (DoS) attack.

2) NULL pointer dereference (CVE-ID: CVE-2022-3114)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the imx_register_uart_clocks() function in drivers/clk/imx/clk.c. A local user can perform a denial of service (DoS) attack.

3) Out-of-bounds read (CVE-ID: CVE-2022-49234)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the dsa_switch_bridge_leave() function in net/dsa/switch.c. A local user can perform a denial of service (DoS) attack.

4) Use-after-free (CVE-ID: CVE-2022-49359)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the panfrost_job_hw_submit(), panfrost_job_handle_err() and panfrost_job_handle_done() functions in drivers/gpu/drm/panfrost/panfrost_job.c, within the panfrost_ioctl_submit() function in drivers/gpu/drm/panfrost/panfrost_drv.c. A local user can escalate privileges on the system.

5) Input validation error (CVE-ID: CVE-2022-49562)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the arch/x86/kvm/mmu/paging_tmpl.h. A local user can perform a denial of service (DoS) attack.

6) Use-after-free (CVE-ID: CVE-2022-49651)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cleanup_srcu_struct() function in kernel/rcu/srcutree.c. A local user can escalate privileges on the system.

7) Memory leak (CVE-ID: CVE-2022-49858)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the otx2_tx_napi_handler() and otx2_sq_append_skb() functions in drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c, within the otx2_sq_init() function in drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c. A local user can perform a denial of service (DoS) attack.

8) Memory leak (CVE-ID: CVE-2022-50071)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mptcp_sock_destruct() function in net/mptcp/subflow.c, within the __mptcp_wr_shutdown(), mptcp_copy_inaddrs(), mptcp_destroy_common() and mptcp_destroy() functions in net/mptcp/protocol.c. A local user can perform a denial of service (DoS) attack.

9) NULL pointer dereference (CVE-ID: CVE-2022-50303)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the kfd_process_device_init_vm() function in drivers/gpu/drm/amd/amdkfd/kfd_process.c. A local user can perform a denial of service (DoS) attack.

10) NULL pointer dereference (CVE-ID: CVE-2022-50406)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the iomap_writepage_map() function in fs/iomap/buffered-io.c. A local user can perform a denial of service (DoS) attack.

11) Integer overflow (CVE-ID: CVE-2023-52676)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the check_ptr_to_map_access() and check_stack_access_within_bounds() functions in kernel/bpf/verifier.c. A local user can execute arbitrary code.

12) Improper locking (CVE-ID: CVE-2023-53231)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the z_erofs_decompress_kickoff() function in fs/erofs/zdata.c. A local user can perform a denial of service (DoS) attack.

13) Out-of-bounds read (CVE-ID: CVE-2023-53320)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the mpi3mr_get_all_tgt_info() function in drivers/scsi/mpi3mr/mpi3mr_app.c. A local user can perform a denial of service (DoS) attack.

14) Use of uninitialized resource (CVE-ID: CVE-2023-53707)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the amdgpu_cs_pass1() function in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c. A local user can perform a denial of service (DoS) attack.

15) Use-after-free (CVE-ID: CVE-2023-54125)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ntfs_read_ea() function in fs/ntfs3/xattr.c. A local user can escalate privileges on the system.

16) NULL pointer dereference (CVE-ID: CVE-2023-54271)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the blkcg_activate_policy() function in block/blk-cgroup.c. A local user can perform a denial of service (DoS) attack.

17) NULL pointer dereference (CVE-ID: CVE-2024-41062)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the l2cap_sock_kill(), l2cap_sock_new_connection_cb() and l2cap_sock_recv_cb() functions in net/bluetooth/l2cap_sock.c. A local user can perform a denial of service (DoS) attack.

18) Input validation error (CVE-ID: CVE-2024-46754)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the net/core/filter.c. A local user can perform a denial of service (DoS) attack.

19) Input validation error (CVE-ID: CVE-2024-49568)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the smc_clc_msg_prop_valid() function in net/smc/smc_clc.c, within the smc_find_rdma_v2_device_serv() function in net/smc/af_smc.c. A local user can perform a denial of service (DoS) attack.

20) Input validation error (CVE-ID: CVE-2024-50017)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ident_pud_init() function in arch/x86/mm/ident_map.c. A local user can perform a denial of service (DoS) attack.

21) Buffer overflow (CVE-ID: CVE-2024-53187)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the io_pin_pages() function in io_uring/memmap.c. A local user can escalate privileges on the system.

22) Memory leak (CVE-ID: CVE-2024-53210)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the iucv_sock_recvmsg() function in net/iucv/af_iucv.c. A local user can perform a denial of service (DoS) attack.

23) Improper locking (CVE-ID: CVE-2024-53220)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the fs/f2fs/segment.h. A local user can perform a denial of service (DoS) attack.

24) Improper locking (CVE-ID: CVE-2024-54683)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the idletimer_tg_destroy() and idletimer_tg_destroy_v1() functions in net/netfilter/xt_IDLETIMER.c. A local user can perform a denial of service (DoS) attack.

25) Out-of-bounds read (CVE-ID: CVE-2024-57945)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the EXPORT_SYMBOL(), setup_bootmem() and setup_vm() functions in arch/riscv/mm/init.c. A local user can perform a denial of service (DoS) attack.

26) Out-of-bounds read (CVE-ID: CVE-2024-57982)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the xfrm_state_deref_prot(), xfrm_dst_hash(), xfrm_src_hash(), xfrm_spi_hash(), xfrm_init_tempstate(), __xfrm_state_lookup_all(), xfrm_input_state_lookup(), EXPORT_SYMBOL(), __xfrm_state_lookup_byaddr(), xfrm_state_find(), xfrm_state_lookup() and xfrm_state_lookup_byaddr() functions in net/xfrm/xfrm_state.c. A local user can perform a denial of service (DoS) attack.

27) Improper locking (CVE-ID: CVE-2024-57999)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the enable_ddw() and spapr_tce_create_table() functions in arch/powerpc/platforms/pseries/iommu.c, within the iommu_table_clear() function in arch/powerpc/kernel/iommu.c. A local user can perform a denial of service (DoS) attack.

28) Input validation error (CVE-ID: CVE-2024-58094)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the jfs_truncate_nolock() function in fs/jfs/inode.c. A local user can perform a denial of service (DoS) attack.

29) Input validation error (CVE-ID: CVE-2024-58095)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the extAlloc() and extRecord() functions in fs/jfs/jfs_extent.c. A local user can perform a denial of service (DoS) attack.

30) Resource management error (CVE-ID: CVE-2024-58096)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ath11k_dp_rx_mon_dest_process(), ath11k_dp_full_mon_process_rx() and ath11k_hal_srng_access_end() functions in drivers/net/wireless/ath/ath11k/dp_rx.c. A local user can perform a denial of service (DoS) attack.

31) NULL pointer dereference (CVE-ID: CVE-2025-21649)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the hclge_ptp_set_tx_info() function in drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c. A local user can perform a denial of service (DoS) attack.

32) Resource management error (CVE-ID: CVE-2025-21651)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the hclge_misc_irq_init(), hclge_init_ae_dev() and hclge_uninit_ae_dev() functions in drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c. A local user can perform a denial of service (DoS) attack.

33) Use-after-free (CVE-ID: CVE-2025-21759)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mld_send_cr() and igmp6_send() functions in net/ipv6/mcast.c. A local user can escalate privileges on the system.

34) Improper locking (CVE-ID: CVE-2025-21801)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ravb_suspend() and ravb_resume() functions in drivers/net/ethernet/renesas/ravb_main.c. A local user can perform a denial of service (DoS) attack.

35) Use-after-free (CVE-ID: CVE-2025-21812)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ax25_rt_autobind() function in net/ax25/ax25_route.c, within the ax25_send_frame() and ax25_queue_xmit() functions in net/ax25/ax25_out.c, within the ax25_ip_xmit() function in net/ax25/ax25_ip.c, within the ax25_dev_device_up() and ax25_dev_device_down() functions in net/ax25/ax25_dev.c, within the ax25_fillin_cb_from_dev() and ax25_setsockopt() functions in net/ax25/af_ax25.c. A local user can escalate privileges on the system.

36) Race condition (CVE-ID: CVE-2025-21947)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the handle_response() function in fs/smb/server/transport_ipc.c. A local user can escalate privileges on the system.

37) Buffer overflow (CVE-ID: CVE-2025-22026)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the nfsd_show() function in fs/nfsd/stats.c, within the nfsd_net_init() function in fs/nfsd/nfsctl.c. A local user can perform a denial of service (DoS) attack.

38) Out-of-bounds read (CVE-ID: CVE-2025-22039)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the smb_inherit_dacl() and smb_check_perm_dacl() functions in fs/smb/server/smbacl.c. A local user can perform a denial of service (DoS) attack.

39) Use-after-free (CVE-ID: CVE-2025-22057)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the dst_count_dec() function in net/core/dst.c. A local user can escalate privileges on the system.

40) Memory leak (CVE-ID: CVE-2025-22083)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the vhost_scsi_set_endpoint(), target_undepend_item() and vhost_scsi_flush() functions in drivers/vhost/scsi.c. A local user can perform a denial of service (DoS) attack.

41) NULL pointer dereference (CVE-ID: CVE-2025-22103)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ipvlan_l3s_unregister() function in drivers/net/ipvlan/ipvlan_l3s.c. A local user can perform a denial of service (DoS) attack.

42) NULL pointer dereference (CVE-ID: CVE-2025-23131)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the new_lockspace() function in fs/dlm/lockspace.c. A local user can perform a denial of service (DoS) attack.

43) Memory leak (CVE-ID: CVE-2025-23160)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mtk_vcodec_fw_scp_init() function in drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c. A local user can perform a denial of service (DoS) attack.

44) Improper locking (CVE-ID: CVE-2025-37861)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the mpi3mr_process_factsdata(), mpi3mr_process_admin_reply_q(), mpi3mr_process_op_reply_q(), mpi3mr_check_op_admin_proc() and mpi3mr_soft_reset_handler() functions in drivers/scsi/mpi3mr/mpi3mr_fw.c. A local user can perform a denial of service (DoS) attack.

45) Improper locking (CVE-ID: CVE-2025-37920)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the xp_create_and_assign_umem() function in net/xdp/xsk_buff_pool.c, within the xsk_generic_rcv() and xsk_create() functions in net/xdp/xsk.c. A local user can perform a denial of service (DoS) attack.

46) Use-after-free (CVE-ID: CVE-2025-38069)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the pci_epf_test_set_bar() and pci_epf_test_free_space() functions in drivers/pci/endpoint/functions/pci-epf-test.c. A local user can escalate privileges on the system.

47) Memory leak (CVE-ID: CVE-2025-38097)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the __xfrm_state_delete() function in net/xfrm/xfrm_state.c, within the esp_ssg_unref(), esp6_find_tcp_sk(), esp_output_tcp_finish() and esp6_output_tcp_encap() functions in net/ipv6/esp6.c, within the esp_ssg_unref(), esp_find_tcp_sk(), esp_output_tcp_finish() and esp_output_tcp_encap() functions in net/ipv4/esp4.c. A local user can perform a denial of service (DoS) attack.

48) Out-of-bounds read (CVE-ID: CVE-2025-38239)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the megasas_set_high_iops_queue_affinity_and_hint() function in drivers/scsi/megaraid/megaraid_sas_base.c. A local user can perform a denial of service (DoS) attack.

49) Memory leak (CVE-ID: CVE-2025-38259)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the WCD9335_SLIM_TX_CH() and wcd9335_parse_dt() functions in sound/soc/codecs/wcd9335.c. A local user can perform a denial of service (DoS) attack.

50) Use-after-free (CVE-ID: CVE-2025-38349)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the __ep_remove() and ep_clear_and_put() functions in fs/eventpoll.c. A local user can escalate privileges on the system.

51) NULL pointer dereference (CVE-ID: CVE-2025-38361)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dce110_blank_stream() function in drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c. A local user can perform a denial of service (DoS) attack.

52) Input validation error (CVE-ID: CVE-2025-38615)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ntfs_rename() function in fs/ntfs3/namei.c, within the ni_add_name() and ni_rename() functions in fs/ntfs3/frecord.c. A local user can perform a denial of service (DoS) attack.

53) Improper locking (CVE-ID: CVE-2025-38643)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the cfg80211_check_and_end_cac() function in net/wireless/reg.c. A local user can perform a denial of service (DoS) attack.

54) Buffer overflow (CVE-ID: CVE-2025-39726)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the ism_cmd() and ism_probe() functions in drivers/s390/net/ism_drv.c. A local user can perform a denial of service (DoS) attack.

55) Improper locking (CVE-ID: CVE-2025-39779)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the btrfs_subpage_set_writeback() function in fs/btrfs/subpage.c. A local user can perform a denial of service (DoS) attack.

56) Buffer overflow (CVE-ID: CVE-2025-39810)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the bnxt_set_xps_mapping(), bnxt_trim_dflt_sh_rings(), bnxt_set_dflt_rings() and bnxt_init_dflt_ring_mode() functions in drivers/net/ethernet/broadcom/bnxt/bnxt.c. A local user can escalate privileges on the system.

57) Use-after-free (CVE-ID: CVE-2025-39863)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the brcmf_btcoex_detach() function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c. A local user can escalate privileges on the system.

58) Resource management error (CVE-ID: CVE-2025-39925)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the j1939_sk_netdev_event_netdown() function in net/can/j1939/socket.c. A local user can perform a denial of service (DoS) attack.

59) Memory leak (CVE-ID: CVE-2025-39929)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the smbd_negotiate() function in fs/smb/client/smbdirect.c. A local user can perform a denial of service (DoS) attack.

60) Infinite loop (CVE-ID: CVE-2025-39931)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the af_alg_sendmsg() function in crypto/af_alg.c. A local user can perform a denial of service (DoS) attack.

61) Use-after-free (CVE-ID: CVE-2025-40054)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the f2fs_merge_page_bio() function in fs/f2fs/data.c. A local user can escalate privileges on the system.

62) Improper error handling (CVE-ID: CVE-2025-40102)

CWE-ID: CWE-388 - Error Handling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the kvm_arch_vcpu_ioctl() function in arch/arm64/kvm/arm.c. A local user can perform a denial of service (DoS) attack.

63) NULL pointer dereference (CVE-ID: CVE-2025-40123)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __bpf_prog_map_compatible() function in kernel/bpf/core.c. A local user can perform a denial of service (DoS) attack.

64) NULL pointer dereference (CVE-ID: CVE-2025-68190)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the amdgpu_atom_execute_table_locked() function in drivers/gpu/drm/amd/amdgpu/atom.c. A local user can perform a denial of service (DoS) attack.

65) Integer underflow (CVE-ID: CVE-2025-68794)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the iomap_adjust_read_range() function in fs/iomap/buffered-io.c. A local user can execute arbitrary code.

66) Incorrect calculation (CVE-ID: CVE-2026-100070)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose internal network details.

The vulnerability exists due to an incorrect calculation of the Contact-header parsing offset in nf_nat_sip when processing a SIP packet whose NAT address translation changes its length. A remote attacker can send a SIP packet containing subsequent Contact headers to disclose internal network details.

Exploitation requires NAT address translation to shorten the packet.

67) Incomplete cleanup (CVE-ID: CVE-2026-100075)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect send queue credit accounting.

The vulnerability exists due to incomplete cleanup in the srpt_alloc_rw_ctxs() error unwind path when handling an allocation failure partway through a multi-buffer indirect descriptor. A remote attacker can trigger the error path to cause incorrect send queue credit accounting.

68) Use-after-free (CVE-ID: CVE-2026-23191)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the is_access_interleaved() and loopback_check_format() functions in sound/drivers/aloop.c. A local user can escalate privileges on the system.

69) Observable discrepancy (CVE-ID: CVE-2026-23364)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to obtain sensitive information.

The vulnerability exists due to improper timing handling in the ksmbd component when comparing message authentication codes (MACs). A local user can leverage timing differences during MAC comparison to infer sensitive information.

Exploitation requires local access and the ability to trigger MAC comparisons through the ksmbd subsystem.

70) Improper input validation (CVE-ID: CVE-2026-31420)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in br_mrp_start_test(), br_mrp_start_in_test(), and br_mrp_start_in_test_parse() when processing user-supplied netlink attributes. A local user can supply a zero interval value to cause a denial of service.

A zero interval causes delayed work to be rescheduled with no delay, creating a tight loop that allocates and transmits MRP test frames until system memory is exhausted and the kernel panics via OOM deadlock.

71) Out-of-bounds read (CVE-ID: CVE-2026-31449)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ext4_ext_correct_indexes when processing a corrupted or crafted on-disk extent header. A local user can supply a crafted filesystem image to disclose sensitive information.

72) Reachable assertion (CVE-ID: CVE-2026-31451)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of oversized inline data in ext4_read_inline_folio when reading inline data from a crafted ext4 filesystem. A local user can trigger processing of inline data whose size exceeds PAGE_SIZE to cause a denial of service.

73) Memory leak (CVE-ID: CVE-2026-31610)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in smb2_sess_setup() SPNEGO negotiation handling when processing a malformed SPNEGO negotiation token. A remote attacker can send a specially crafted negotiation blob to cause a denial of service.

The issue is reachable pre-authentication, and malformed later elements in the same token can leave an allocated mechToken uncleared after both SPNEGO grammars fail.

74) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-31700)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass safety checks.

The vulnerability exists due to a time-of-check time-of-use race condition in tpacket_snd() when processing a mmap'd vnet_hdr in the TPACKET TX path with PACKET_VNET_HDR enabled. A local user can modify vnet_hdr fields in the shared ring buffer between validation and use to bypass safety checks.

Only the TPACKET TX path is affected.

75) Out-of-bounds read (CVE-ID: CVE-2026-31708)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in smb2_ioctl_query_info() when processing a crafted QUERY_INFO response from an SMB server. A remote attacker can return a malformed response with an OutputBufferLength larger than the actual response buffer to disclose sensitive information.

76) Out-of-bounds read (CVE-ID: CVE-2026-31709)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in cifsacl DACL rewrite helpers when processing a server-supplied truncated DACL. A remote attacker can send a malformed ACL response to cause a denial of service.

The issue occurs because the incoming DACL body and each ACE were not structurally validated before chmod/chown security descriptor rebuild paths walked the ACE list.

77) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-31711)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in ksmbd_tcp_new_connection() when handling TCP connections that trigger transport allocation failure. A remote attacker can hold open connections with large RFC1002 lengths to cause a denial of service.

The issue is reachable pre-authentication over TCP port 445, and repeated allocation failures can exhaust the connection slot counter until subsequent connection attempts are rejected for the remainder of the boot.

78) Out-of-bounds read (CVE-ID: CVE-2026-31712)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in smb_check_perm_dacl() when processing a crafted DACL during SMB permission checks. A remote user can set a crafted ACL on a file they own and trigger a subsequent CREATE request to cause a denial of service.

The issue is reachable by an authenticated SMB client with permission to set an ACL on a file, and it is not pre-authentication. The out-of-bounds read is not reflected to the attacker, but KASAN reports and kernel state corruption are possible.

79) Use-after-free (CVE-ID: CVE-2026-31715)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in f2fs_write_end_io() and f2fs_in_warm_node_list() when handling concurrent write completion and unmount operations. A local user can trigger the race condition to cause a denial of service.

The issue can lead to a NULL pointer dereference and kernel panic during processing of F2FS checkpoint data pages.

80) Improper resource shutdown or release (CVE-ID: CVE-2026-43064)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the idxd DSA/IAA device workqueue handling when releasing a device object. A local user can trigger release of a crafted or repeatedly created device object to cause a denial of service.

81) Use of uninitialized resource (CVE-ID: CVE-2026-43088)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an information exposure caused by uninitialized memory in PF_KEY export paths when exporting aligned sockaddr payloads for certain PF_KEY messages. A local user can trigger affected PF_KEY message handling to disclose sensitive information.

The issue affects the SADB_ACQUIRE, SADB_X_NAT_T_NEW_MAPPING, and SADB_X_MIGRATE export paths, while state and policy dump builders are not affected.

82) Improper locking (CVE-ID: CVE-2026-43216)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in skb_may_tx_timestamp() when processing transmit timestamps in interrupt context. A local user can trigger transmit timestamp handling to cause a deadlock.

The issue occurs when a driver completes the transmit timestamp from a dedicated interrupt handler while the same lock is already write-locked on the same CPU.

83) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43219)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in cpsw_unregister_ports() when handling a failed register_netdev() call for the first MAC in cpsw_register_ports(). A local user can trigger an error during network device registration to cause a denial of service.

84) Out-of-bounds read (CVE-ID: CVE-2026-43350)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in parse_dacl() when parsing ACE SIDs returned by an SMB server. A remote attacker can send a specially crafted ACE with a truncated NFS mode SID to disclose sensitive information.

The issue occurs because an ACE with only two subauthorities can still match the NFS mode SID pattern, leading to a read of sid.sub_auth[2] past the end of the ACE.

85) Improper resource shutdown or release (CVE-ID: CVE-2026-43355)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the bh1780 light sensor driver when handling read operations that encounter an error. A local user can trigger an error during a read operation to cause a denial of service.

86) Use-after-free (CVE-ID: CVE-2026-43437)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in snd_pcm_drain() when handling a linked stream runtime after releasing the stream lock. A local user can trigger a concurrent close() on the linked stream's file descriptor to cause a denial of service.

The issue occurs because the drain path dereferences stale runtime fields from a linked stream after the runtime can be freed by concurrent unlink and detach operations.

87) Type Confusion (CVE-ID: CVE-2026-43456)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to type confusion in bond_setup_by_slave() when handling header operations for a bonded non-Ethernet slave device. A local user can enslave a non-Ethernet device such as a GRE tunnel to a bond and trigger packet transmission to cause a denial of service.

The issue is triggered because header callbacks from the slave device are invoked with the bond device context, causing device-specific private data to be interpreted as the wrong type.

88) Improper input validation (CVE-ID: CVE-2026-43491)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the qrtr namespace service when handling NEW_SERVER messages. A remote attacker can send a flood of NEW_SERVER messages to cause a denial of service.

Exploitation can exhaust memory by registering excessive servers for a node.

89) Integer underflow (CVE-ID: CVE-2026-43492)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer underflow in mpi_read_raw_from_sgl() when processing a crafted scatterlist during a KEYCTL_PKEY_ENCRYPT system call. A local user can supply an input buffer of zeroes with a larger out_len than in_len to cause a denial of service.

The issue can cause the kernel to spin forever, resulting in soft lockup splats.

90) Improper input validation (CVE-ID: CVE-2026-45850)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ipvs checksum validation when processing IPv6 packets with extension headers. A remote attacker can send specially crafted IPv6 packets to cause a denial of service.

91) Improper Initialization (CVE-ID: CVE-2026-45930)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in netlink ndmsg response messages when handling RTM_GETNEIGH requests. A local user can send a crafted netlink request to disclose sensitive information.

The issue affects pad bytes in the ndmsg data returned by the kernel.

92) Heap-based buffer overflow (CVE-ID: CVE-2026-45991)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in part_descs_loc[] handling in handle_partition_descriptor() when mounting a crafted UDF image with repeated partition descriptors. A local user can supply a specially crafted UDF image to cause a denial of service.

93) Out-of-bounds read (CVE-ID: CVE-2026-45999)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in z_erofs_lz4_handle_overlap() when processing a crafted EROFS image during LZ4 inplace decompression. A local user can mount a crafted image and trigger decompression to disclose sensitive information.

The issue occurs for illegal extents where partial decoding is disabled and m_llen is smaller than m_plen, causing an unsigned underflow in the outpages minus inpages calculation.

94) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-46003)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource allocation in the qrtr nameserver when handling node registration requests. A remote attacker can register random nodes to exhaust memory and cause a denial of service.

95) Use-after-free (CVE-ID: CVE-2026-46021)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in thermal_set_governor() and thermal_zone_device_unregister() when handling concurrent governor updates via sysfs during thermal zone unregistration. A local user can trigger a governor update race to cause a denial of service.

The issue can occur if thermal_zone_device_register_with_trips() fails after adding a thermal governor to the thermal zone being registered.

96) Improper input validation (CVE-ID: CVE-2026-46026)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the qrtr nameserver lookup handling when processing NEW_LOOKUP messages over the same socket. A local user can send a flood of NEW_LOOKUP messages to cause a denial of service.

The issue is limited to local clients.

97) Memory leak (CVE-ID: CVE-2026-46038)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in ctrl_cmd_bye() when processing a BYE packet from a node. A remote attacker can send a BYE packet to trigger a memory leak and cause a denial of service.

98) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-46052)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of negative dentries in fs/ceph/dir.c when processing Ceph lookup or atomic_open operations with reused cached negative dentries. A local user can trigger lookup paths that call d_add() on an already-hashed negative dentry to cause a denial of service.

The issue can corrupt the dcache hash bucket, potentially creating a self-loop that causes __d_lookup() to spin forever and trigger RCU stall reports.

99) Use-after-free (CVE-ID: CVE-2026-46056)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in SSP passkey handlers when handling Bluetooth SSP passkey and keypress notification events. A local user can trigger concurrent connection teardown during event processing to cause a denial of service.

100) Use-after-free (CVE-ID: CVE-2026-46065)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fbdev deferred I/O handling when accessing a memory mapping after device hot-unplug. A local user can keep an active mapping of graphics memory and access it after hot-unplug to cause a denial of service.

Access to the invalidated mapping may result in a SIGBUS signal.

101) Use-after-free (CVE-ID: CVE-2026-46069)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mwifiex_adapter_cleanup() when cleaning up the adapter while the wakeup timer callback is still executing. A local user can trigger device removal during this race condition to cause a denial of service.

102) Out-of-bounds read (CVE-ID: CVE-2026-46078)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the EROFS directory entry handling code when parsing a crafted EROFS image with a trailing directory entry containing an invalid name offset. A local user can provide a specially crafted EROFS image to disclose sensitive information.

The issue occurs because an unchecked name offset can cause an underflow in the length calculation used by strnlen(), leading to a read past the directory block.

103) NULL pointer dereference (CVE-ID: CVE-2026-46086)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in br_fdb_fillbuf() when reading bridge forwarding database entries through the brforward_read() sysfs path during a concurrent local FDB update. A local user can trigger concurrent access to cause a denial of service.

The issue arises because RCU readers can observe inconsistent values of f->dst across a check and a later dereference.

104) Use-after-free (CVE-ID: CVE-2026-46090)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the ALSA aloop peer runtime handling when processing a format-change stop during concurrent stream operations. A local user can trigger concurrent playback start and capture close operations to cause a denial of service.

The issue occurs because a stale peer substream pointer may be used after the capture runtime is detached or freed.

105) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46091)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of dma coherency in igorplugusb when processing a usb control request. A local user can trigger a crafted interaction with the usb device to cause a denial of service.

106) NULL pointer dereference (CVE-ID: CVE-2026-46092)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a NULL pointer in the rtw88 PCI probing routine when probing an 8821CE device on a root bus without an upstream PCI bridge. A local user can install or attach a device in a crafted PCI topology to cause a denial of service.

The issue is triggered only on systems where the 8821CE device is present on a root bus and no upstream PCI-to-PCI bridge exists.

107) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46103)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource lifetime management in the ucan USB driver control message buffer when drivers are unbound without physical device disconnection. A local user can trigger driver unbind conditions to cause a denial of service.

This can occur during probe deferral or configuration changes.

108) Use-after-free (CVE-ID: CVE-2026-46113)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in KVM shadow paging when handling guest page table changes between VM entries. A local user can modify guest page tables to create a stale reverse-mapping entry and trigger a stale rmap walk to cause a denial of service.

This can be triggered during operations such as dirty logging or MMU notifier invalidations.

109) Use-after-free (CVE-ID: CVE-2026-46116)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __xfrm_state_delete when deleting xfrm_state list entries during xfrm_state lifecycle handling. A local user can trigger repeated deletion of the same xfrm_state object to cause a denial of service.

The issue was reproduced under syzkaller load during network namespace cleanup in the xfrm subsystem.

110) Improper resource shutdown or release (CVE-ID: CVE-2026-46158)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mptcp path manager ADD_ADDR retransmission handling when retransmitting ADD_ADDR messages. A local user can trigger ADD_ADDR retransmissions to cause a denial of service.

111) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-46159)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a time-of-check time-of-use race in btrfs_ioctl_space_info() when processing a space information ioctl request while block groups are concurrently removed. A local user can trigger the ioctl and race concurrent block group removal to disclose sensitive information.

The issue can result in copying uninitialized kmalloc heap bytes to userspace.

112) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46160)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause filesystem corruption and a denial of service.

The vulnerability exists due to improper state update in the btrfs directory unlink handling when removing a directory and later fsyncing it through an open file descriptor. A local user can remove a directory, retain a file descriptor to it, and trigger fsync to cause filesystem corruption and a denial of service.

The issue can cause log replay to fail with an -EIO error when the filesystem is mounted.

113) Use of Uninitialized Variable (CVE-ID: CVE-2026-46169)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uninitialized memory use in hfs_brec_read() and catalog record handling in the hfsplus filesystem code when mounting a corrupted filesystem. A local user can mount a specially crafted filesystem image to cause a denial of service.

114) Improper resource shutdown or release (CVE-ID: CVE-2026-46170)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mptcp path manager ADD_ADDR retransmission timer handling when processing ADD_ADDR retransmissions. A local user can trigger ADD_ADDR retransmissions to cause a system hang.

The issue occurs when the last socket reference is released from the timer handler, leading to an indefinite wait on the same timer.

115) Use-after-free (CVE-ID: CVE-2026-46180)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the brcmfmac watchdog task handling when stopping the watchdog task. A local user can trigger the watchdog task shutdown to cause a denial of service.

116) Out-of-bounds write (CVE-ID: CVE-2026-46191)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in fbcon_rotate_font() and the rotated font buffer handling in fbcon when printing to a rotated console after console rotation reallocation fails. A local user can print a high-enough character code to overflow the font buffer to cause a denial of service.

Exploitation requires a console to be using rotation and the font reallocation during rotation to fail.

117) Incorrect calculation (CVE-ID: CVE-2026-46193)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of ESN high bits in async callbacks in the AH implementation when processing AH packets with ESN enabled using an asynchronous AH implementation. A local user can send specially crafted AH traffic to cause a denial of service.

The issue affects both IPv4 and IPv6 AH paths, and exploitation requires ESN to be enabled with an asynchronous AH implementation selected.

118) Improper resource shutdown or release (CVE-ID: CVE-2026-46196)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in tracepoint_add_func() when handling tracepoint registration failures after invoking ext->regfunc(). A local user can trigger a func_add() failure during probe installation to cause a denial of service.

For syscall tracepoints, the issue can leave syscall tracing state enabled and impose persistent syscall entry and exit overhead until reboot.

119) Use-after-free (CVE-ID: CVE-2026-46208)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tp_meter session handling during mesh teardown when processing tp_meter sessions as a mesh interface is being removed. A local user can trigger tp_meter activity during interface teardown to cause a denial of service.

120) Use-after-free (CVE-ID: CVE-2026-46242)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in ep_remove() in fs/eventpoll.c when removing epoll file references during a race with file release handling. A local user can trigger a race condition to cause memory corruption.

The issue involves the epoll-watches-epoll case and a concurrent __fput() path that can lead to operations on freed structures.

121) Improper locking (CVE-ID: CVE-2026-46252)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in regulator_resolve_supply() in the regulator core when handling a failed late enable of a supply regulator. A local user can trigger this error path to cause a denial of service.

122) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-46291)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in hash_digest_key in the caam hash implementation when debug hex dumps are generated with CONFIG_DYNAMIC_DEBUG enabled. A local user can read exposed HMAC key bytes from debug output to disclose sensitive information.

The issue affects HMAC key material handled by the CAAM crypto driver.

123) Improper resource shutdown or release (CVE-ID: CVE-2026-46292)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in genpd_dev_pm_detach() for virtual devices in the generic PM domain core when detaching a device from a PM domain after attachment through genpd_dev_pm_attach_by_id(). A local user can trigger device detach handling to cause a denial of service.

In worst cases, the issue may result in a NULL pointer dereference in genpd_runtime_suspend().

124) Improper locking (CVE-ID: CVE-2026-46299)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock management in hfsplus_fill_super() when mounting a crafted HFS+ filesystem image. A local user can trigger the error path during filesystem mount to cause a denial of service.

The issue occurs when hfsplus_cat_build_key() fails after hfs_find_init() has acquired tree->tree_lock, leading to cleanup of the tree structure while the lock is still held.

125) Improper resource shutdown or release (CVE-ID: CVE-2026-46320)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in tap_get_user_xdp() when processing XDP frames. A local user can send a crafted short frame or trigger skb allocation failure to cause a denial of service.

Each rejected frame in a batch leaks one page-frag chunk.

126) Memory leak (CVE-ID: CVE-2026-46321)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in tun_xdp_one() in the tun driver when processing short frames through the tun and vhost-net transmit path. A local user can submit TX descriptors whose payload length is shorter than ETH_HLEN to exhaust host memory and trigger an OOM panic.

Exploitation requires the ability to open /dev/net/tun and /dev/vhost-net and to attach a tun/tap device as the vhost-net backend.

127) Memory leak (CVE-ID: CVE-2026-46322)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in tun_xdp_one() when handling a build_skb() allocation failure. A local user can trigger this error path to cause a denial of service.

The issue occurs because a page allocated for the frame is not freed on the failure path, and the per-buffer error may be discarded during batch processing.

128) Improper access control (CVE-ID: CVE-2026-52909)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to move a fallback tunnel device to another network namespace.

The vulnerability exists due to improper access control in the ip6_vti fallback tunnel device initialization when initializing the per-network-namespace fallback device. A local user can move the ip6_vti0 device to another network namespace to move a fallback tunnel device to another network namespace.

The issue affects the per-netns fallback tunnel device ip6_vti0.

129) Out-of-bounds read (CVE-ID: CVE-2026-52910)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the reuseport cBPF program handling in sk_reuseport_prog_free() when detaching or replacing a reuseport program while UDP packets are being processed concurrently. A local user can trigger concurrent reuseport program updates and packet transmission to cause a denial of service.

The issue occurs because the classic BPF reuseport program may be freed before RCU readers have completed.

130) NULL pointer dereference (CVE-ID: CVE-2026-52913)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the batman-adv OGMv2 handling code when processing OGM dispatch on an interface that has been disabled and lost its mesh interface association. A local user can trigger OGM processing on such an interface to cause a denial of service.

The issue occurs because an interface may be disabled after OGM processing begins, leaving its mesh interface pointer set to NULL while the code still attempts to use it.

131) Out-of-bounds read (CVE-ID: CVE-2026-52917)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the SCTP sock_diag dump-one path when processing an exact association lookup after taking the socket lock on a stale association. A local user can trigger a stale association lookup to disclose sensitive information.

The issue occurs when association state is reaped or detached from the endpoint while the lookup path resumes after blocking on the socket lock.

132) Race condition (CVE-ID: CVE-2026-52918)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in bt_sock_poll() and the Bluetooth accept queue when polling Bluetooth sockets. A local user can trigger concurrent socket teardown and accept queue access to cause a denial of service.

The issue occurs because the accept queue is walked without synchronization while child teardown can unlink a socket and drop its last reference.

133) Use-after-free (CVE-ID: CVE-2026-52923)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ipc_idr_alloc() in the checkpoint/restore SysV IPC allocation path when processing a request for the next SysV IPC id. A local user can request allocation beyond the valid IPC id range to cause a denial of service.

A subsequent walk of /proc/sysvipc/shm can dereference freed memory through a stale IDR entry.

134) Out-of-bounds read (CVE-ID: CVE-2026-52927)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in compat_mtw_from_user in the ebtables netfilter subsystem when converting 32-bit user-supplied extension structures to native kernel structures. A local user can provide a crafted match or target size smaller than the extension requires to disclose sensitive information.

The issue affects extensions that rely on compat_from_user callbacks, which assume they can read the required compat size.

135) Improper access control (CVE-ID: CVE-2026-52928)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the AF_UNIX SIOCATMARK ioctl handler when processing SIOCATMARK requests on non-stream sockets. A local user can invoke the ioctl on a SOCK_DGRAM or SOCK_SEQPACKET socket to cause a denial of service.

136) NULL pointer dereference (CVE-ID: CVE-2026-52929)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null-pointer dereference in the SCTP stream scheduler state handling in net/sctp/stream.c when processing a denied ADD_OUT_STREAMS operation and a later stream re-add. A remote attacker can trigger SCTP stream reset operations that leave stale removed stream metadata behind to cause a denial of service.

The issue occurs because removed outgoing stream state is not fully rolled back, leaving scheduler-private stream metadata inconsistent for later reuse.

137) Race condition (CVE-ID: CVE-2026-52930)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in shared memory orphan cleanup in ipc/shm.c when cleaning up orphaned shared memory segments while attachment counts are updated concurrently. A local user can trigger concurrent shared memory attach and cleanup operations to cause a denial of service.

The issue occurs because shm_destroy_orphaned() may decide that an orphaned segment is unused before taking the object lock.

138) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-52933)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper type conversion in io_poll_get_ownership() in io_uring/poll.c when handling poll ownership checks. A local user can trigger the affected code path to cause a denial of service.

139) Integer overflow (CVE-ID: CVE-2026-52934)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to an integer overflow leading to an out-of-bounds write in batadv_tvlv_container_ogm_append() and batadv_tvlv_container_list_size() when processing registered TVLV containers. A local user can cause the accumulated TVLV size to exceed U16_MAX and trigger an undersized allocation to corrupt kernel memory.

140) Out-of-bounds read (CVE-ID: CVE-2026-52935)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in espintcp_sendmsg() when handling a new send while a previous partial send is still in progress. A local user can trigger a partial send and initiate another send to disclose sensitive information.

The issue occurs in the send path because a stale offset from a live partial-send state can remain attached to a new sk_msg.

141) NULL pointer dereference (CVE-ID: CVE-2026-52939)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in rds_ib_send_cqe_handler() and rds_ib_send_unmap_op() when processing an atomic cmsg over an active RDS/IB connection. A local user can send a crafted AF_RDS sendmsg() request to cause a denial of service.

On hardware that natively accepts masked atomic operations, no additional setup is required.

142) Out-of-bounds read (CVE-ID: CVE-2026-52942)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in dump_mac_header() in the netfilter nf_log syslog logger when processing an skb sent through AF_PACKET with PACKET_QDISC_BYPASS and an unset MAC header. A local user can send a specially crafted packet to disclose sensitive information.

Only skbs with an unset MAC header are affected.

143) Use-after-free (CVE-ID: CVE-2026-52943)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a use-after-free in pskb_carve_inside_header() and pskb_carve_inside_nonlinear() when copying skb_shared_info for MSG_ZEROCOPY skbs. A local user can trigger repeated zerocopy skb operations to escalate privileges.

The issue is caused by copying the destructor_arg pointer into a new skb_shared_info without incrementing the associated zerocopy reference count, which can prematurely free ubuf_info_msgzc while transmit skbs still hold live references.

144) Improper access control (CVE-ID: CVE-2026-52944)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass permission checks and modify file sparse attributes.

The vulnerability exists due to improper access control in fsctl_set_sparse() when handling FSCTL_SET_SPARSE requests. A remote user can send a crafted FSCTL_SET_SPARSE request on an opened file to bypass permission checks and modify file sparse attributes.

The issue affects both clients on read-only shares and clients on writable shares that lack FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES access.

145) Use-after-free (CVE-ID: CVE-2026-52947)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in qrtr_port_remove in the qrtr socket subsystem when handling concurrent qrtr port removal and lookup operations under RCU. A local user can trigger the race condition to cause a denial of service.

The issue arises because a socket pointer can remain reachable through the qrtr_ports XArray before the RCU grace period elapses.

146) Integer overflow (CVE-ID: CVE-2026-52948)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in the I2C_TIMEOUT ioctl handler in i2c-dev when processing a user-supplied timeout value. A local user can supply a large timeout value to cause a denial of service.

The issue can corrupt the SMBus controller state machine and leave it in an unrecoverable state.

147) Race condition (CVE-ID: CVE-2026-52977)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in futex requeue-PI handling in kernel/futex/requeue.c when processing wait-requeue-pi and requeue-PI operations during signal or timeout wakeup. A local user can trigger concurrent futex operations to cause a denial of service.

The issue can result in a live lock where one task blocks on a hash bucket lock while another busy loops, potentially locking up the system.

148) Race condition (CVE-ID: CVE-2026-52988)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nf_tables commit phase hook list handling in netfilter when publishing new hooks while concurrent netlink dump list traversal via rcu is in progress. A local user can trigger concurrent ruleset updates to cause a denial of service.

149) Out-of-bounds read (CVE-ID: CVE-2026-53078)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in BPF sock_ops context field access handling when accessing ctx fields with the same destination and source register. A local user can trigger the flawed register handling to cause a denial of service.

The issue occurs when the fullsock or locked_tcp_sock check is false, causing a stale ctx pointer to be retained and used as a bogus socket pointer.

150) Out-of-bounds read (CVE-ID: CVE-2026-53078)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in BPF sock_ops context field access handling when accessing ctx fields with the same destination and source register. A local user can trigger the flawed register handling to disclose sensitive information.

The issue occurs when the fullsock or locked_tcp_sock check is false, causing a stale ctx pointer to be retained.

151) NULL pointer dereference (CVE-ID: CVE-2026-53080)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the cls_fw classifier when classifying packets with an invalid old-style filter on a shared block. A local user can send crafted traffic while creating such a filter to cause a denial of service.

Exploitation requires the ability to configure traffic control filters and trigger packet classification.

152) Use-after-free (CVE-ID: CVE-2026-53089)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() when querying info for an offloaded BPF map or program during network namespace destruction. A local user can query crafted offloaded BPF map or program information to cause a denial of service.

The issue occurs because the associated network namespace may be racing with teardown and its reference count may already have reached zero.

153) Improper access control (CVE-ID: CVE-2026-53090)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass BPF verifier checks.

The vulnerability exists due to improper access control in the Linux kernel BPF verifier when analyzing ld_{abs,ind} instructions in subprograms. A local user can load a crafted BPF program to bypass BPF verifier checks.

The issue affects subprograms where ld_{abs,ind} instructions are permitted, including cases involving BTF-annotated subprograms with scalar return types.

154) Integer overflow (CVE-ID: CVE-2026-53133)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in __rdma_block_iter_next() in the RDMA umem block iterator when reassembling split scatter-gather entries during IOMMU-backed mapping linearization. A local user can trigger processing of a very large mapped block to cause a denial of service.

The issue occurs for block sizes greater than or equal to 4G when a single large block is split across multiple scatter-gather entries.

155) Use of Uninitialized Variable (CVE-ID: CVE-2026-53134)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in the nft_fib IPv4/IPv6 evaluation logic when processing nftables fib expressions that use the OIFNAME result or an invalid NFTA_FIB_F_PRESENT combination. A local user can configure and trigger a crafted fib expression to disclose sensitive information.

The issue occurs because only part of the declared destination register span is written on certain evaluation paths, leaving stale kernel stack data available to a downstream expression that reads the full register span.

156) Out-of-bounds read (CVE-ID: CVE-2026-53135)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in dp_sdp_message_debugfs_write() in the AMD display debugfs interface when handling writes to the sdp_message debugfs node with a user-supplied buffer smaller than 36 bytes. A local user can provide a short user buffer to disclose sensitive information.

157) NULL pointer dereference (CVE-ID: CVE-2026-53135)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dp_sdp_message_debugfs_write() in the AMD display debugfs interface when handling writes to the sdp_message debugfs node. A local user can write to the debugfs node to cause a denial of service.

A connector may be connected but not bound to any CRTC, such as after hot-plug before the next atomic commit.

158) Heap-based buffer overflow (CVE-ID: CVE-2026-53136)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in get_integrated_info_v11() and get_integrated_info_v2_1() in the AMD display BIOS parser when parsing a malformed VBIOS during driver probe. A local user can provide a specially crafted VBIOS with oversized HDMI retimer register counts to cause a denial of service or execute arbitrary code.

Exploitation requires control over the VBIOS data consumed by the driver.

159) Out-of-bounds write (CVE-ID: CVE-2026-53137)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in mod_hdcp_read_rx_id_list() when processing a malicious HDMI HDCP 2.x repeater ReceiverID list over I2C. An attacker with physical access can provide a malicious HDMI repeater that advertises an oversized message length to cause a denial of service.

The issue occurs during HDCP 2.x repeater authentication over HDMI.

160) Out-of-bounds read (CVE-ID: CVE-2026-53138)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or disclose sensitive information.

The vulnerability exists due to an out-of-bounds read and unbounded iteration in amd display bios_parser.c and bios_parser2.c record-chain walk loops when parsing a malformed VBIOS image during probe time. An attacker with physical access can provide a crafted VBIOS image missing the terminator record to cause a denial of service or disclose sensitive information.

The issue is triggered when the VBIOS record chain lacks the 0xFF terminator record or uses a zero-sized termination condition incorrectly.

161) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-53139)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of zero-valued workgroup counts in v3d compute shader dispatch handling when processing an indirect CSD job. A local user can submit a crafted indirect CSD job with a zeroed workgroup dimension to cause a denial of service.

A zero value in any workgroup dimension is interpreted by the hardware as 65536 instead of a no-op.

162) Out-of-bounds read (CVE-ID: CVE-2026-53146)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tb_xdomain_copy() in the thunderbolt xdomain component when processing a short response frame. A local user can send a specially crafted short response to disclose sensitive information.

163) Out-of-bounds write (CVE-ID: CVE-2026-53148)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in tb_xdp_properties_request() in the thunderbolt xdomain handler when processing a crafted XDomain response from a malicious peer. A remote attacker can send a response with a forged length field to cause memory corruption.

164) Out-of-bounds read (CVE-ID: CVE-2026-53149)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in __tb_property_parse_dir() in the thunderbolt property parser when parsing a crafted root directory property block. A local user can supply a crafted property block to cause a denial of service.

165) Out-of-bounds write (CVE-ID: CVE-2026-53150)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in tb_property_entry_valid() and the TEXT property null-termination logic in drivers/thunderbolt/property.c when parsing XDomain property entries. A local attacker can provide a crafted zero-length TEXT property entry to cause a denial of service.

166) Use-after-free (CVE-ID: CVE-2026-53157)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in phonet_device_destroy() when walking the per-net phonet device list with RCU readers after device removal. A local user can trigger destruction of a phonet_device while concurrent readers still hold a stale pointer to cause a denial of service.

The issue arises because the object is removed with RCU list semantics but may be freed before the RCU grace period has elapsed.

167) NULL pointer dereference (CVE-ID: CVE-2026-53158)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in fastrpc_rpmsg_callback() when handling a glink message before probe initialization has completed. A local attacker can trigger the callback during early channel activation to cause a denial of service.

This issue can occur during boot when the rpmsg channel becomes live before driver initialization is fully complete.

168) Integer underflow (CVE-ID: CVE-2026-53159)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt a DMA address.

The vulnerability exists due to an integer underflow in fastrpc_get_args() when processing a user-provided pointer that falls in a gap before a returned VMA. A local user can supply a crafted pointer value to corrupt a DMA address.

The corrupted DMA address is sent to the DSP.

169) Use-after-free (CVE-ID: CVE-2026-53161)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the fastrpc workqueue cleanup path when processing DSP responses during file descriptor release. A local user can trigger a race by closing the file descriptor while an in-flight DSP invocation completes to cause a denial of service.

The issue occurs because context cleanup may run in parallel with device release after the user structure has already been freed.

170) NULL pointer dereference (CVE-ID: CVE-2026-53163)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in remove_waiter() in the rtmutex futex proxy locking path when handling FUTEX_CMP_REQUEUE_PI operations during deadlock detection or proxy lock acquisition. A local user can invoke crafted futex operations to cause a denial of service.

171) Use of uninitialized resource (CVE-ID: CVE-2026-53167)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an exposure of uninitialized memory in FUSE_NOTIFY_RETRIEVE in fs/fuse/dev.c when retrieving data from page cache folios. A local user can trigger FUSE_NOTIFY_RETRIEVE on a non-uptodate folio to disclose sensitive information.

This has security impact only on systems that do not enable automatic zero-initialization of page allocations.

172) Improper access control (CVE-ID: CVE-2026-53168)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in fuse_notify_store() and fuse_notify_retrieve() when processing FUSE pagecache notification operations on directories. A remote user can issue crafted FUSE_NOTIFY_STORE or FUSE_NOTIFY_RETRIEVE operations on a directory inode to cause a denial of service.

The issue affects directory inodes that use kernel-internal pagecache storage.

173) NULL pointer dereference (CVE-ID: CVE-2026-53177)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the bnxt_io_error_detected error recovery path when handling PCIe error recovery on a closed NIC. A local user can trigger PCIe error recovery for a device whose bnapi state is not allocated to cause a denial of service.

The issue occurs because error recovery services may run on subordinate devices regardless of administrative state.

174) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53181)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in vmci_transport_recv_listen() when handling failed connection handshakes. A remote attacker can send malformed packets that trigger repeated handshake failures to cause a denial of service.

The issue can permanently prevent the listener from accepting new connections until the affected process is restarted.

175) Use-after-free (CVE-ID: CVE-2026-53189)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __split_huge_pmd_locked() when splitting a huge PMD mapping. A local user can trigger the affected memory-management path to cause a denial of service.

The issue occurs because file/shmem RSS accounting may access freed folio state after the last folio reference is dropped.

176) Out-of-bounds write (CVE-ID: CVE-2026-53194)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in klsi_105_prepare_write_buffer() when processing writes to the tty device. A local user can write bulk_out_size or more bytes to the tty to cause a denial of service.

The issue is triggered when the write fifo holds at least the full bulk-out buffer size, causing data to be copied starting two bytes into a 64-byte buffer.

177) Heap-based buffer overflow (CVE-ID: CVE-2026-53195)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in build_i2c_fw_hdr() in the io_ti USB serial driver when parsing a crafted firmware file. A local user can supply a firmware image with an oversized Length field to cause a denial of service.

The issue arises because the Length field from the firmware image is not validated against the available destination buffer space before copying.

178) Heap-based buffer overflow (CVE-ID: CVE-2026-53196)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in get_manuf_info() in the io_ti USB serial driver when processing a crafted USB device EEPROM descriptor. An attacker with physical access can connect a malicious USB device with a forged Size field to trigger the overflow and cause a denial of service or execute arbitrary code.

The out-of-bounds access is compounded because a checksum routine also iterates over the device-controlled length after the EEPROM data is read.

179) Memory corruption (CVE-ID: CVE-2026-53199)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory access in netvsc_copy_to_send_buf() when copying skb fragments into the VMBus send buffer. A local user can trigger packet transmission with page-backed fragments to cause a denial of service.

The issue occurs on 32-bit x86 systems with CONFIG_HIGHMEM enabled when fragment pages reside above the LOWMEM boundary, and the fault happens on the transmit softirq path.

180) Improper input validation (CVE-ID: CVE-2026-53208)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in l2cap_sig_channel() when processing oversized Bluetooth BR/EDR signaling packets. A remote attacker can send a specially crafted fixed-channel CID 0x0001 packet containing many L2CAP_ECHO_REQ commands to cause a denial of service.

Exploitation is possible by a Bluetooth BR/EDR peer within radio range before pairing.

181) Memory leak (CVE-ID: CVE-2026-53213)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of memory allocation failure in vc4 shader validation when processing crafted shader data. A local user can trigger a failed memory reallocation to cause a denial of service.

182) Out-of-bounds read (CVE-ID: CVE-2026-53217)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to improper memory synchronization in mvpp2_rx() in the mvpp2 network driver when processing received packets on non-coherent DMA systems. A local attacker can send network traffic that triggers reception of a crafted frame to disclose sensitive information.

Only non-coherent DMA systems are affected.

183) Use of uninitialized resource (CVE-ID: CVE-2026-53218)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an uninitialized memory exposure in nft_exthdr_init and the nft_exthdr evaluation paths when processing a userspace request with the NFT_EXTHDR_F_PRESENT flag set and an invalid length value. A local user can supply a crafted netfilter expression that causes uninitialized stack data from nft_regs to be retained in registers and disclose sensitive information.

The issue occurs because the initialized register bitmap can mark more bytes as written than the evaluation paths actually store when the presence flag is used.

184) Information disclosure (CVE-ID: CVE-2026-53219)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper handling of partially failed copy_to_user operations in x_tables get-entries implementations when copying rule entries to userspace. A local user can provide a userspace buffer that faults during the initial header copy to disclose sensitive information.

On SMP kernels, the leaked value is the internal percpu counter allocation pointer. The issue affects the IPv4, IPv6, and ARP native and compat get-entries paths.

185) Out-of-bounds read (CVE-ID: CVE-2026-53223)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the generic timestamp cmsg path in net/socket.c when processing timestamped messages for AF_PACKET sockets. A local user can send or receive crafted packets on an AF_PACKET socket to disclose sensitive information.

Exploitation requires timestamping to be enabled, and information disclosure can occur when SO_RXQ_OVFL is enabled and a non-linear skb is processed.

186) NULL pointer dereference (CVE-ID: CVE-2026-53227)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an invalid pointer dereference in the openvswitch datapath flow command handler when handling crafted flow set operations after a reply skb allocation failure. A local user can trigger the error-handling path to cause a denial of service.

187) Out-of-bounds read (CVE-ID: CVE-2026-53238)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in netlbl_unlabel_addrinfo_get() when handling crafted Generic Netlink requests with a shorter unlabeled address mask attribute. A local user can send a specially crafted Generic Netlink request to cause a denial of service.

188) Use-after-free (CVE-ID: CVE-2026-53239)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in xfrm_policy_bysel_ctx() and inexact bin handling in the xfrm policy subsystem when processing concurrent policy deletion and hash rebuild operations. A local user can trigger a race condition to cause a denial of service.

The issue occurs because an inexact bin may be freed during a window after the policy lock is released and before pruning is performed.

189) Improper input validation (CVE-ID: CVE-2026-53245)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in mrp_pdu_parse_vecattr when parsing crafted MRP vector attributes in protocol data units. A remote attacker can send a specially crafted MRP packet to cause a denial of service.

The issue can be triggered when a VectorAttribute uses a zero-length value set or event counts that cross byte boundaries.

190) Improper access control (CVE-ID: CVE-2026-53249)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in ip_options_get() in net/ipv4/ip_options.c when setting IPv4 Loose Source and Record Route or Strict Source and Record Route options. A local user can set crafted IP options to force packets through attacker-controlled nodes to disclose sensitive information.

Exposure depends on network paths that support and forward these IPv4 options.

191) Memory leak (CVE-ID: CVE-2026-53252)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in bt_host_release() when handling failed Bluetooth HCI device initialization before hci_register_dev() completes. A local user can trigger device initialization failures to cause a denial of service.

The issue occurs because the unregistered device cleanup path bypasses hci_release_dev(), leaving the SRCU structure allocated in hci_alloc_dev() uncleared.

192) Out-of-bounds read (CVE-ID: CVE-2026-53253)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in bnep_rx_frame() and bnep_rx_control() in the BNEP packet parser when processing short BNEP frames. A remote attacker can send a specially crafted short BNEP SDU to cause a denial of service.

The issue is triggered by malformed control packets with missing fixed fields or an empty control payload.

193) Out-of-bounds read (CVE-ID: CVE-2026-53254)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the Bluetooth RFCOMM MCC handlers when processing truncated MCC frames from a remote Bluetooth device. A remote attacker can send specially crafted truncated MCC frames to cause a denial of service.

The issue affects the RFCOMM MCC handling paths including rfcomm_recv_mcc(), rfcomm_recv_pn(), rfcomm_recv_rpn(), rfcomm_recv_rls(), and rfcomm_recv_msc().

194) Out-of-bounds read (CVE-ID: CVE-2026-53255)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the tlv_data_is_valid() advertising data parser in net/bluetooth/mgmt.c when processing a crafted MGMT_OP_ADD_ADVERTISING request. A local user can send a specially crafted advertising data field to disclose sensitive information.

The issue is triggered when a malformed field length byte appears at the end of the supplied buffer.

195) Use-after-free (CVE-ID: CVE-2026-53256)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in rfcomm_connect_ind() and rfcomm_get_sock_by_channel() when handling RFCOMM connection indications for a listener socket during a concurrent close. A remote attacker can trigger a race condition to cause a denial of service.

The issue occurs in the Linux kernel Bluetooth RFCOMM socket handling path when a listener socket is closed while a child socket is being queued, and KASAN reported the resulting slab-use-after-free in lock_sock_nested().

196) Off-by-one (CVE-ID: CVE-2026-53263)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an off-by-one error in lowpan_iphc_mcast_ctx_addr_compress() when compressing multicast context addresses. A remote attacker can send network traffic that triggers the vulnerable compression path to disclose sensitive information.

Uninitialized kernel stack memory may be transmitted over the network via lowpan_push_hc_data().

197) Use-after-free (CVE-ID: CVE-2026-53264)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the net/sched action lifecycle handling in act_api when NEWTFILTER and DELFILTER are run concurrently. A local user can trigger concurrent filter operations to cause a denial of service.

The issue arises from a race between action lookup and action deletion under RCU-protected access.

198) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-53265)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a check-then-act race condition in smq_invalidate_mapping() in the dm-cache-policy-smq component when invalidating cache blocks concurrently. A local user can trigger concurrent invalidation operations to cause a denial of service.

The issue can corrupt the SMQ queues or hash table and may result in a double free condition.

199) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53266) Exploited

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory handling in the ebtables SNAT target ARP sender hardware address rewrite in net/bridge/netfilter/ebt_snat.c when processing ARP packets in bridge netfilter hooks. A local user can trigger ARP sender hardware address rewriting on a crafted nonlinear skb to cause a denial of service.

Exploitation requires the ARP sender hardware address rewrite path to be reached with a nonlinear skb fragment backed by a splice-imported file page.

200) Out-of-bounds read (CVE-ID: CVE-2026-53268)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the conntrack_irc helper when parsing IRC DCC commands. A remote attacker can send specially crafted IRC traffic to cause a denial of service.

201) Race condition (CVE-ID: CVE-2026-53269)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the synproxy hook reference counting logic in netfilter when concurrently adding the first iptables target or nftables expression. A local user can trigger concurrent registration or teardown operations to cause a denial of service.

The issue affects on-demand netfilter hook registration performed by the SYNPROXY infrastructure from both iptables and nftables frontends.

202) Use-after-free (CVE-ID: CVE-2026-53270)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the IPVS scheduler handling in ip_vs_edit_service() when editing a service and unbinding the old scheduler. A local privileged user can trigger service reconfiguration while packets are being scheduled to cause a denial of service.

The issue occurs because packets may continue using the old scheduler after its scheduling data has been freed following an RCU grace period.

203) Use-after-free (CVE-ID: CVE-2026-53273)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the optee supplicant request handling in drivers/tee/optee/supp.c when a client exits before the supplicant finishes processing its request. A local user can trigger a race condition to cause a denial of service.

The issue occurs because the request can be freed by the client while its request ID remains referenced on the supplicant path.

204) Use-after-free (CVE-ID: CVE-2026-53275)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in __mld_query_work in net/ipv6/mcast.c when processing crafted MLD queries. A remote attacker can send a specially crafted MLD query packet to cause a denial of service.

The issue occurs because a pointer to the multicast group address is dereferenced after skb header reallocation following pskb_may_pull() calls.

205) Improper handling of exceptional conditions (CVE-ID: CVE-2026-53325)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in agp_amd64_probe() in the AMD64 AGP driver when probing for AMD northbridge hardware in a virtualized environment without a physical AMD northbridge. A local user can trigger driver initialization to cause a denial of service.

The issue occurs because a negative error from cache_nbs() is not handled correctly, allowing initialization to continue until a NULL pointer is dereferenced in amd64_fetch_size().

206) Integer overflow (CVE-ID: CVE-2026-53329)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in dal_vector_reserve() in the AMD display vector implementation when resizing a vector buffer. A local user can trigger allocation size wraparound to cause a denial of service.

Successful exploitation can lead to a heap overflow on subsequent vector appends.

207) Improper locking (CVE-ID: CVE-2026-53331)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in qcom_slim_ngd_ssr_pdr_notify() and slim_report_absent() when processing SSR/PDR down notifications. A local user can trigger the vulnerable locking sequence to cause a denial of service.

The issue arises from inconsistent lock ordering between ctrl->tx_lock and ctrl->lock, creating a possible deadlock.

208) Use of Uninitialized Variable (CVE-ID: CVE-2026-53332)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use of uninitialized data in the qcom-ngd-ctrl driver when callbacks are triggered during NGD driver probing before device initialization completes. A local attacker can trigger parallel remoteproc startup or hardware interrupt handling to cause a denial of service.

The issue can prevent affected boards from booting.

209) NULL pointer dereference (CVE-ID: CVE-2026-53337)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in bond_do_ioctl() when handling bonding ioctl requests with a non-existent slave interface name. A local privileged user can send a bonding ioctl request referencing a non-existent slave interface to cause a denial of service.

The issue is reachable from userspace through the bonding ioctl interface.

210) NULL pointer dereference (CVE-ID: CVE-2026-53339)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in cci_remove() in the i2c-qcom-cci driver when removing or unbinding the driver on systems where only one I2C master is initialized. A local user can trigger device unbinding or driver removal to cause a denial of service.

Only systems where the Qualcomm CCI controller exposes two I2C masters but only one master is enabled are affected.

211) Race condition (CVE-ID: CVE-2026-53352)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in zap_other_threads() when handling a concurrent execve() during a pending group stop. A local user can trigger this race to cause a denial of service.

The issue occurs when a multithreaded process receives a stop signal while one thread concurrently calls execve().

212) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2026-53356)

CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose or modify unintended memory contents.

The vulnerability exists due to improper pointer handling in i915_gem_object_pread_phys and i915_gem_object_pwrite_phys in the i915 GEM physical buffer object handling code when processing pread or pwrite operations with a non-zero offset. A local user can supply crafted offset values to access the wrong parts of a physical buffer object to disclose or modify unintended memory contents.

The issue affects physical buffer objects on impacted platforms using overlay or cursor planes with physical mapping.

213) Use-after-free (CVE-ID: CVE-2026-53357)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in l2cap_sock_cleanup_listen() and bt_accept_dequeue() in the Bluetooth L2CAP socket handling code when racing listen socket cleanup with a concurrent HCI disconnect. A local user can trigger a listen/close versus HCI-disconnect race to cause a denial of service.

The issue occurs during cleanup of not-yet-accepted child sockets on a listening socket.

214) Improper locking (CVE-ID: CVE-2026-53358)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in l2cap_sock_cleanup_listen() when cleaning up listening L2CAP channels. A local user can trigger a race condition to cause a denial of service.

The issue involves incorrect lock ordering between conn->lock, chan->lock, and sk_lock during Bluetooth L2CAP channel cleanup.

215) Use-after-free (CVE-ID: CVE-2026-53381)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fuse_release_end() during virtiofs auto_submount unmount processing when releasing files during submount unmount after the superblock has already been destroyed. A local user can trigger submount unmount activity to cause a denial of service.

The issue affects the virtiofs auto_submounts case, where the wait counter is tracked per connection rather than per superblock.

216) NULL pointer dereference (CVE-ID: CVE-2026-53382)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in vidtv_mux_push_si when handling PID contexts during stream information processing. A local user can trigger allocation failure conditions that leave a PID context unset to cause a denial of service.

The issue can lead to a general protection fault in the vidtv test driver workqueue path.

217) Improper access control (CVE-ID: CVE-2026-53383)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper access control in smb2_check_user_session() and the ksmbd compound request handling path when processing a crafted compound SMB request with a non-valid session. A remote attacker can send a specially crafted compound request to cause a denial of service.

By using SESSION_SETUP as the first compound operation and a related TREE_CONNECT request with SessionId set to ULLONG_MAX as the second operation, an in-progress session can reach a NULL pointer dereference because sess->user remains NULL.

218) NULL pointer dereference (CVE-ID: CVE-2026-53385)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference caused by a race condition in vcs_notifier() in drivers/tty/vt/vc_screen.c when handling concurrent vcs_write operations. A local user can trigger concurrent write activity to cause a denial of service.

The issue occurs after the console lock is temporarily dropped and re-acquired, allowing the vc_data pointer to become stale before notifier processing.

219) Use-after-free (CVE-ID: CVE-2026-53388)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fuse_try_move_folio() in the FUSE subsystem when moving a page cache folio during FUSE read handling. A local user can trigger a race condition to cause a denial of service.

The issue occurs because the request is not re-locked on the success path, allowing request abortion to free fuse_io_args while subsequent copy logic still accesses it.

220) NULL pointer dereference (CVE-ID: CVE-2026-53391)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in nfs4_decode_mp_ds_addr() when processing a crafted GETDEVICEINFO multipath-DS body containing a zero-length r_addr or r_netid value. A remote attacker can send malicious metadata server responses to cause a denial of service.

The issue is reachable from a pNFS-flexfile client mounted against a malicious or compromised metadata server.

221) Improper input validation (CVE-ID: CVE-2026-53392)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ff_layout_alloc_lseg() in the NFSv4 flexfiles layout handling when processing a malformed flexfiles layout body with a zero filehandle-version array count. A remote attacker can send a specially crafted flexfiles layout to cause a denial of service.

The issue can lead to a null pointer dereference and kernel panic.

222) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-53393)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause silent data loss.

The vulnerability exists due to improper state management in nfsd_vfs_write() and nfsd_commit() when handling deferred writeback errors for UNSTABLE write data followed by COMMIT. A remote user can trigger writeback errors and then issue COMMIT operations to cause silent data loss.

The issue violates the UNSTABLE+COMMIT durability contract by returning an unchanged write verifier after failed writeback.

223) Memory leak (CVE-ID: CVE-2026-53397)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a memory leak in the nfsd SETACL request decoding and release handling when processing crafted NFS ACL SETACL requests. A remote user can send a specially crafted SETACL request that triggers a decode failure after partial ACL allocation to cause a denial of service.

The leaked posix_acl object remains allocated for the lifetime of the server.

224) Use-after-free (CVE-ID: CVE-2026-53399)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in the nfsd layout stateid handling in fs/nfsd/nfs4layouts.c when processing layout stateid allocation failures after a setlease error. A remote user can trigger a setlease failure and subsequent IDR walker access to dereference a dangling pointer to cause a denial of service.

The issue occurs because a published stateid remains referenced in the IDR after the associated memory is freed, and a related destructor path may access uninitialized delayed work on the same failure path.

225) Race condition (CVE-ID: CVE-2026-53400)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the i2c adapter registration logic when looking up adapters by id during registration. A local user can trigger concurrent adapter lookup and registration activity to cause a denial of service.

The issue can lead to access to uninitialized adapter data, including NULL-pointer dereferences or use-after-free.

226) Out-of-bounds read (CVE-ID: CVE-2026-53402)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in fbcon_do_set_font() and subsequent rendering in the fbcon console subsystem when handling a failed font change rollback and later rendering user-controlled character indices. A local user can trigger a font change failure and then supply character indices greater than 255 to disclose sensitive information.

Exploitation requires a failure in the font-setting error path that leaves the console state desynchronized after vc_resize() fails.

227) NULL pointer dereference (CVE-ID: CVE-2026-53403)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fb_videomode_to_var in the fbdev subsystem when processing a userspace-supplied modelist that does not contain the current framebuffer mode. A local user can supply a crafted mode list to trigger a kernel crash and cause a denial of service.

Exploitation requires fbcon to be unbound so that the current mode is left without a matching entry before a later console takeover occurs.

228) Out-of-bounds write (CVE-ID: CVE-2026-63794)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in sev_dbg_crypt() when processing crafted KVM SEV debug encryption requests. A local user can send a crafted ioctl request with page offsets that cause the transfer length to exceed the destination page boundary to cause memory corruption.

The issue affects the encrypt path and can overflow a single-page intermediate buffer by up to 15 bytes when the destination offset is greater than the source offset.

229) Out-of-bounds read (CVE-ID: CVE-2026-63796)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the ocfs2 group descriptor bitmap handling in fs/ocfs2/suballoc.c when processing a crafted group bitmap descriptor. A local user can provide a descriptor with oversized bg_size or bg_bits values to cause a denial of service.

Exploitation requires access to a malicious ocfs2 filesystem image or on-disk metadata.

230) Use-after-free (CVE-ID: CVE-2026-63798)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the irq-imgpdc driver when handling interrupts after driver removal. A local user can trigger spurious interrupts that access freed memory to cause a denial of service.

The issue involves dangling chained handlers for peripheral and syswake interrupts, and generic chips may remain reachable by interrupt chip suspend, resume, or shutdown callbacks after the driver has been removed.

231) Use-after-free (CVE-ID: CVE-2026-63801)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in tipc_aead_decrypt_done in the TIPC crypto subsystem when processing crafted encrypted frames during asynchronous decryption. A remote attacker can send crafted encrypted frames to trigger a read from freed memory and cause a denial of service.

Exploitation requires the asynchronous decryption path to be used and can occur while the associated network namespace is being torn down.

232) Use-after-free (CVE-ID: CVE-2026-63803)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the hdlc ppp per-protocol timer handling when detaching the ppp protocol or re-attaching it while timers are still active. A local user can trigger protocol teardown while a timer callback is executing to cause a denial of service.

The issue affects LCP, IPCP, and IPV6CP control protocol timers embedded in the PPP state.

233) Reachable assertion (CVE-ID: CVE-2026-63806)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper handling of unaligned memory access in ioeventfd datamatch handling in KVM when processing a guest store that splits a page and targets emulated MMIO with a datamatch-enabled ioeventfd. A local user can trigger a specially crafted guest store operation to cause a denial of service.

Exploitation requires a guest configuration where the second page contains a datamatch-enabled ioeventfd at offset 0.

234) Out-of-bounds read (CVE-ID: CVE-2026-63807)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in the KVM x86 shadow MMU hugepage recovery logic when recovering hugepages for a direct shadow page whose gfn falls outside the target memslot. A local user can create a guest hugepage mapping that extends below the bounds of a memslot to cause a denial of service.

The issue can manifest as a host page fault in kernel mode during hugepage recovery.

235) Release of invalid pointer or reference (CVE-ID: CVE-2026-63809)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to memory corruption in proc_sys_call_handler and __cgroup_bpf_run_filter_sysctl() when processing a sysctl write that replaces the temporary buffer. A local privileged user can write a crafted sysctl value to trigger memory corruption and cause a denial of service.

Exploitation requires access to write to a sysctl entry from a task in the target cgroup, and the fault was reproduced while writing to /proc/sys/kernel/domainname.

236) NULL pointer dereference (CVE-ID: CVE-2026-63810)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the bdev pseudo-filesystem when userspace mounts it and accesses files. A local attacker can mount the pseudo-filesystem and access files to cause a denial of service.

The issue is triggered through move_mount() using inode_operations pointers that are equal to 0 for this pseudo-filesystem.

237) Out-of-bounds read (CVE-ID: CVE-2026-63814)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in f2fs_acl_from_disk() when parsing a malformed ACL xattr. A local user can supply a crafted ACL entry layout to trigger an out-of-bounds read and cause a denial of service.

The issue occurs because ACL_USER or ACL_GROUP entries can be placed in a slot that contains only a short ACL entry.

238) Out-of-bounds read (CVE-ID: CVE-2026-63815)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in f2fs_fill_dentries() and inline directory handling when mounting a crafted filesystem image and reading an inline directory. A local user can mount a specially crafted image and read a crafted directory to disclose sensitive information.

Exploitation requires the flexible_inline_xattr feature to be enabled.

239) Improper access control (CVE-ID: CVE-2026-63817)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in f2fs_iget() meta inode handling when processing a corrupted directory entry with an inode number equal to max_nid while compress_cache is disabled. A local user can create a corrupted directory entry to cause a denial of service.

Only F2FS mounts with compression support present and the compress_cache mount option disabled are affected by this behavior.

240) Out-of-bounds read (CVE-ID: CVE-2026-63818)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in f2fs_recover_orphan_inodes() when mounting a crafted f2fs image and replaying orphan inodes from the checkpoint pack. A local user can provide a crafted filesystem image with a corrupted orphan block entry count to cause a denial of service.

The issue occurs when the orphan block entry count is larger than F2FS_ORPHANS_PER_BLOCK, causing the recovery code to read past the ino[] array and interpret subsequent data as inode numbers.

241) Double free (CVE-ID: CVE-2026-63822)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in the ath11k dp tx_status buffer handling when unbinding a device after an initialization error related to firmware. A local user can trigger device initialization failure and subsequent unbinding to cause a denial of service.

The issue is reproducible in a VM when MSI addressing initialization fails.

242) Use-after-free (CVE-ID: CVE-2026-63823)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in request_key_auth handling in the Linux kernel key management subsystem when processing KEYCTL_INSTANTIATE_IOV or related key instantiation and rejection paths concurrently with request_key() completion. A local user can trigger concurrent key operations to cause a denial of service.

The issue occurs because the request_key_auth payload can be freed after helper completion while another path later resumes and accesses rka->target_key.

243) Out-of-bounds write (CVE-ID: CVE-2026-63824)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a buffer overflow in keyctl_pkey_params_get_2() when processing crafted keyctl public-key operation parameters. A local user can provide a too small buffer length to cause memory corruption.

244) Use-after-free (CVE-ID: CVE-2026-63827)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in aa_replace_profiles() during rawdata_list deduplication when processing policy replacement operations. A local user can trigger AppArmor profile replacement with crafted timing to cause a denial of service.

The issue occurs because entries can remain on the rawdata list after their profile reference count has reached zero and before deferred cleanup runs.

245) Improper access control (CVE-ID: CVE-2026-63828)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass AppArmor connect restrictions.

The vulnerability exists due to improper access control in apparmor_socket_sendmsg() when processing sendmsg()/sendto() calls with MSG_FASTOPEN and a supplied destination address. A local user can send a crafted fast open request to bypass AppArmor connect restrictions.

The issue affects implicit TCP and MPTCP connection establishment performed as part of sendmsg() fast open handling.

246) Improper access control (CVE-ID: CVE-2026-63829)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ipgre_changelink() and erspan_changelink() when handling RTM_NEWLINK changelink requests for GRE tunnel devices. A local privileged user can send a crafted RTM_NEWLINK request to modify tunnel configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace, because the check was performed only against dev_net(dev).

247) Improper access control (CVE-ID: CVE-2026-63830)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify the page cache contents.

The vulnerability exists due to improper access control in the sk_msg scatter-gather handling logic when processing SK_MSG transformations and BPF message helpers. A local user can trigger scatterlist entry transfers, shifts, splits, or copies that desynchronize sg.copy state to modify the page cache contents.

Exploitation requires the ability to reach a later SK_MSG verdict that exposes sg_virt(sge) as writable BPF ctx->data.

248) Use-after-free (CVE-ID: CVE-2026-63831)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or corrupt data.

The vulnerability exists due to use-after-free in the mac802154 llsec crypto processing in net/mac802154/llsec.c when performing in-place cryptographic transformations on shared skb data. A local user can trigger concurrent 802.15.4 traffic with security enabled to cause a denial of service or corrupt data.

The issue can affect both RX and TX paths when skb data buffers are shared across clones.

249) Improper access control (CVE-ID: CVE-2026-63833)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper access control in the ntfs3 xattr handler when handling direct userspace writes to reserved $LX* extended attributes. A local user can set crafted $LXUID, $LXGID, $LXMOD, or $LXDEV values on a file they own to escalate privileges.

Exploitation requires a writable ntfs3 mount and relies on inode reload of WSL permission metadata into inode ownership and mode fields.

250) Resource exhaustion (CVE-ID: CVE-2026-63834)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the batman-adv tp_meter unacked_list handling when processing crafted messages with small lengths and seqno gaps. A remote attacker can send specially crafted messages to cause a denial of service.

The issue can lead to an out-of-memory condition or excessive CPU usage from management overhead while searching the enlarged list.

251) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-63835)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in batadv_v_ogm_queue_on_if() and the OGM aggregation queue handling when processing OGM aggregation on a disabled hard interface. A local user can trigger interface disablement while causing new skbs to be queued to the aggregation list to cause a denial of service.

The issue can lead to skbs being queued after the worker has been disabled, and these queued skbs are never freed or consumed.

252) Integer overflow (CVE-ID: CVE-2026-63836)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow leading to divide-by-zero in batadv_tp_update_cwnd() in the batman-adv tp_meter component when processing crafted acknowledgment traffic. A local user can trigger the vulnerable calculation to cause a denial of service.

The issue occurs when the congestion window reaches 0x20000000, causing a left shift in the divisor to wrap to zero under 32-bit arithmetic.

253) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-63867)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause inconsistent MPTCP receiver window signaling.

The vulnerability exists due to a time-of-check time-of-use race in the MPTCP DSS option handling in net/mptcp/options.c when processing and emitting MPTCP acknowledgments on outgoing packets. A remote attacker can trigger packet processing that causes inconsistent ack_seq values to be used to confuse the peer.

The issue arises because the MPTCP-level ack_seq was accessed locklessly multiple times, allowing different values to be used for the DSS data acknowledgment and the announced receive window within the same packet.

254) Integer underflow (CVE-ID: CVE-2026-63868)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an unsigned integer underflow in garp_pdu_parse_attr in the GARP receive-side attribute parser when parsing crafted GARP attributes. A remote attacker can send crafted Join or Leave events to cause a denial of service.

The issue can cause received GARP events for common attributes, such as GVRP VLAN registration attributes, to be ignored.

255) Use of uninitialized resource (CVE-ID: CVE-2026-63870)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in lowpan_xmit() in the ieee802154 6LoWPAN transmit path when processing a non-IPv6 packet queued for transmission on a 6LoWPAN interface. A local user can queue a non-IPv6 packet for transmission to cause a denial of service.

The issue occurs because address information in skb headroom may remain uninitialized and is later copied and used by the transmit path.

256) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-63875)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cache invalidation in arm64 TLB flushing logic when unsharing PMD tables. A local user can trigger PMD table unsharing to cause a denial of service.

The issue can leave a stale PMD page table entry in the walk cache, which may result in incorrect page table walks.

257) Integer overflow (CVE-ID: CVE-2026-63889)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop caused by an integer truncation error in the FPIN pname walker in scsi_transport_fc when processing a crafted FPIN ELS frame. A remote attacker can send a crafted Fibre Channel fabric frame to cause a denial of service.

Exploitation requires the ability to inject Fibre Channel fabric traffic to an lpfc or qla2xxx Linux initiator, such as from a compromised switch or fabric controller, or from a same-zone N_Port on a fabric that permits source spoofing.

258) Improper input validation (CVE-ID: CVE-2026-63890)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in fcoe_ctlr_recv_clr_vlink() in drivers/scsi/fcoe/fcoe_ctlr.c when processing FIP CVL frames. A remote attacker can send a crafted FIP CVL frame with a zero-length non-critical descriptor to cause a denial of service.

Exploitation is limited to an unauthenticated layer 2 peer on the FCoE control VLAN and can block subsequent FIP frames on the affected controller.

259) Uncontrolled Recursion (CVE-ID: CVE-2026-63891)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in __tb_property_parse_dir() in the thunderbolt property parser when processing a crafted PROPERTIES_REQUEST control-plane exchange containing chained DIRECTORY entries with a back-reference loop. A remote attacker can send crafted XDomain property data to cause a denial of service.

The issue can be triggered by an untrusted XDomain peer such as a cable, dock, in-line inspector, or adjacent host.

260) Out-of-bounds read (CVE-ID: CVE-2026-63892)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read and integer underflow in __tb_property_parse_dir() in the thunderbolt property parser when parsing a crafted non-root property directory with dir_len less than 4. A local user can provide crafted property data to trigger out-of-bounds memory access and cause a denial of service.

The issue affects the non-root parsing path, where a short directory length can cause a UUID copy to read past the end of the property block and can also cause entry walking to continue out of bounds until the kernel oopses.

261) Integer overflow (CVE-ID: CVE-2026-63893)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer overflow leading to an out-of-bounds read in tb_property_entry_valid() in the thunderbolt property parser when processing a crafted XDomain property block from a peer device. A remote attacker can send crafted property entries with wrapped value and length fields to disclose sensitive information.

For TEXT-typed entries using the "deviceid" or "vendorid" keys, leaked data may be exposed through the per-XDomain sysfs device_name or vendor_name attributes. The disclosed data is NUL-bounded and the attacker controls an offset rather than an absolute address.

262) Out-of-bounds read (CVE-ID: CVE-2026-63895)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ffs_ep0_read() in the FunctionFS gadget implementation when handling a short ep0 control-OUT read. A local privileged user can trigger a short control-OUT transfer and read back uninitialized kernel heap memory to disclose sensitive information.

The issue is reachable through the FunctionFS device node and requires access to the privileged gadget daemon context. Reproducing the condition also requires bypassing normal host-side checks that usually reject short-wLength control-OUT requests before they reach the gadget.

263) Out-of-bounds read (CVE-ID: CVE-2026-63897)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the mct_u232 USB serial driver interrupt-in transfer handler when processing short interrupt-in transfers. A local user can trigger the driver to process a specially crafted short interrupt-in packet to disclose sensitive information.

The issue can lead to stale or uninitialized slab data being exposed to user space.

264) Out-of-bounds write (CVE-ID: CVE-2026-63898)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the mct_u232 USB serial driver when handling a malicious USB device that reports a smaller endpoint maximum packet size than expected. An attacker with physical access can connect a specially crafted USB device to cause memory corruption.

265) Out-of-bounds write (CVE-ID: CVE-2026-63899)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the mxuport USB serial driver when handling a malicious USB device that reports a bulk-out endpoint max packet size smaller than eight bytes. An attacker with physical access can attach a crafted device to cause memory corruption.

266) Out-of-bounds read (CVE-ID: CVE-2026-63900)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the usa49wg indat transfer parser in drivers/usb/serial/keyspan.c when parsing malformed indat packets from a USB device. A local attacker can provide a specially crafted USB device to disclose sensitive information.

The issue can cause parsing of stale or uninitialised slab data.

267) Improper input validation (CVE-ID: CVE-2026-63901)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to improper input validation in the digi_acceleport USB serial driver when handling a malicious USB device that reports smaller bulk-out buffers than expected. An attacker with physical access can connect a crafted device to cause memory corruption.

The issue can lead to out-of-bounds memory accesses or slab corruption.

268) Out-of-bounds read (CVE-ID: CVE-2026-63902)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in cypress_read_int_callback() in the cypress_m8 USB serial driver when processing malformed short interrupt packets. A local attacker can provide a specially crafted short interrupt report to cause a denial of service.

Successful interrupt transfers can complete with fewer bytes than required for the selected Cypress packet header format.

269) Out-of-bounds read (CVE-ID: CVE-2026-63903)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the belkin_sa_read_int_callback() USB serial interrupt handler when processing short successful interrupt transfers. A local attacker can trigger the driver to parse a crafted short interrupt packet to disclose sensitive information.

The issue occurs because the handler treats interrupt data as a four-byte status report and reads status fields at offsets 2 and 3 even when the completed packet is shorter.

270) Out-of-bounds read (CVE-ID: CVE-2026-63904)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the usbtmc interrupt notification handling in drivers/usb/class/usbtmc.c when processing interrupt-in notifications with an insufficient URB actual_length. A local attacker can provide a crafted USBTMC device that sends a short notification to disclose sensitive information.

The issue can also cause stale leftover data from a previous notification to be consumed.

271) Use-after-free (CVE-ID: CVE-2026-63905)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in vudc_remove() and the vudc transfer timer handling when racing device teardown with a pending or executing timer. A local user can repeatedly trigger unbind and rebind operations while the timer is active to cause a denial of service.

The issue is triggered by a race condition during the unplug or unbind path.

272) Out-of-bounds write (CVE-ID: CVE-2026-63908)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite adjacent memory.

The vulnerability exists due to an out-of-bounds write in mxt_prepare_cfg_mem in the atmel_mxt_ts driver when parsing a crafted configuration file with an object size larger than the expected object size. A local user can provide a specially crafted configuration file to overwrite adjacent memory.

The issue is caused by an incorrect boundary check on a 0-based index, which allows exactly one byte past the valid object boundary to be written.

273) Insufficient verification of data authenticity (CVE-ID: CVE-2026-63913)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state validation in the TCP conntrack state machine in netfilter conntrack when processing a crafted SYN followed by an invalid-sequence RST packet. A remote attacker can send a specially crafted packet sequence to cause a denial of service.

The issue can prematurely terminate an active NAT entry by forcing the conntrack entry into the CLOSE state.

274) Improper access control (CVE-ID: CVE-2026-63914)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in xfrm migrate notification handling in net/xfrm/xfrm_user.c and net/key/af_key.c when broadcasting successful XFRM_MSG_MIGRATE or SADB_X_MIGRATE events across network namespaces. A local user can trigger a migration notification from a non-init network namespace to disclose sensitive information.

An IKE daemon running in the initial network namespace may receive migration notifications originating from other network namespaces, including selector, old and new endpoint addresses, and the km_address.

275) Out-of-bounds read (CVE-ID: CVE-2026-63915)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in HCP header parsing in nfc_hci_recv_from_llc() and nci_hci_data_received_cb() when processing a 0-byte HCP frame from an NFC peer. A remote attacker can send a malformed HCP frame to cause a denial of service.

A non-final fragmented 0-byte frame can also underflow the reassembly length to UINT_MAX and trigger skb_over_panic() during reassembly.

276) Out-of-bounds write (CVE-ID: CVE-2026-63916)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in wacom_hid_set_device_mode() when handling a HID feature report where HID_DG_INPUTMODE is mapped to a field other than the first one. A local user can connect or emulate a crafted device to trigger the out-of-bounds write and cause a denial of service.

The issue occurs when the first field in the feature report has a report_count smaller than the usage index of HID_DG_INPUTMODE.

277) Use-after-free (CVE-ID: CVE-2026-63917)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the vti6 tunnel handling code in net/ipv6/ip6_vti.c when changing the configuration of a vti6 device after moving it across network namespaces. A local user can move a vti6 device between namespaces and then change its link parameters to cause a denial of service.

The issue is reachable from an unprivileged user namespace and may have cross-tenant impact on container hosts.

278) Use-after-free (CVE-ID: CVE-2026-63919)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in xfrm transport-mode deferred reinjection handling in net/xfrm/xfrm_input.c when processing deferred transport reinjection callbacks that use a stored network namespace pointer. A local user can trigger deferred transport reinjection with a dangling net namespace reference to cause a denial of service.

279) Out-of-bounds read (CVE-ID: CVE-2026-63920)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ip6_datagram_recv_specific_ctl() when processing IPv6 extension headers for recvmsg control messages after the hdrlen field is modified. A local user can use an nftables payload-write expression to corrupt the extension header length and trigger copying beyond the available header data to disclose sensitive information.

Exploitation is reachable from an unprivileged user namespace.

280) Improper access control (CVE-ID: CVE-2026-63921)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to redirect packets across network namespaces.

The vulnerability exists due to improper access control in vti6_siocdevprivate() in the IPv6 VTI tunnel handling code when processing SIOCCHGTUNNEL requests on a migrated tunnel. A local user can supply tunnel parameters that collide with a tunnel in the creation namespace to redirect packets across network namespaces.

Exploitation is reachable from an unprivileged user namespace and can have cross-tenant scope on container hosts.

281) Integer overflow (CVE-ID: CVE-2026-63925)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass replay protection.

The vulnerability exists due to an integer overflow in macsec_post_decrypt() when processing a crafted replayed frame on an XPN association with a packet number of 0xffffffff. A remote attacker can replay a captured legitimate frame to bypass replay protection.

Exploitation requires capturing a legitimate frame carrying the maximum 32-bit packet number on an XPN association.

282) Incorrect calculation (CVE-ID: CVE-2026-63926)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper offset calculation in bpf_msg_push_data() in the sockmap BPF subsystem when inserting data into the middle of a scatterlist entry. A local user can trigger the inconsistent split layout to cause a denial of service.

Exploitation requires access to BPF sockmap functionality.

283) Use-after-free (CVE-ID: CVE-2026-63927)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the dwc2 USB host controller driver debug code when dequeuing a usb request block and logging its status after calling usb_hcd_giveback_urb(). A local user can trigger URB handling to cause a denial of service.

The issue occurs in debug logging within the _dwc2_hcd_urb_dequeue() path.

284) Out-of-bounds write (CVE-ID: CVE-2026-63928)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the omninet USB serial driver bulk-out buffer handling when processing a malicious USB device that reports a smaller endpoint max packet size than expected. An attacker with physical access can connect a crafted USB device to cause memory corruption.

The issue can lead to user-controlled slab corruption.

285) Use-after-free (CVE-ID: CVE-2026-63930)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in iio_hw_consumer_alloc() when cleaning up buffers in the error path. A local user can trigger the vulnerable cleanup path to cause a denial of service.

286) Division by zero (CVE-ID: CVE-2026-63931)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in the scd30_write_raw function when writing a zero fractional part to the sampling_frequency sysfs attribute. A local user can write a zero fractional value to the sampling_frequency sysfs attribute to cause a denial of service.

287) Division by zero (CVE-ID: CVE-2026-63933)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in adis16260_write_raw in the adis16260 gyroscope driver when writing a zero value to the sampling_frequency sysfs attribute. A local user can write zero to the sampling_frequency sysfs attribute to cause a denial of service.

288) Use of Uninitialized Variable (CVE-ID: CVE-2026-63934)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access of uninitialized memory in the itg3200 triggered buffer handling path when processing i2c reads for all scan channels. A local user can read data from /dev/iio:deviceX to disclose sensitive information.

The non-buffered read_raw() path is unaffected.

289) Race condition (CVE-ID: CVE-2026-63942)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the parport subsystem when port and client drivers are loaded around the same time during boot. A local user can load the lp and parport_pc modules concurrently to cause a crash.

The issue occurs because client drivers can attach to ports that are not completely initialized or are being torn down.

290) Out-of-bounds read (CVE-ID: CVE-2026-63947)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in hidp_input_report() when processing truncated Bluetooth HIDP input packets. A remote user can send a specially crafted truncated packet to disclose sensitive information.

Exploitation requires a paired Bluetooth device.

291) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-63948)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference leak in l2cap_chan_timeout() in the Bluetooth L2CAP subsystem when handling a channel timeout with a null connection pointer. A local user can trigger this condition to cause a denial of service.

292) Improper Initialization (CVE-ID: CVE-2026-63954)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in hpfs_check_free_dnodes in fs/hpfs/alloc.c when handling a failure from hpfs_map_dnode_bitmap. A local user can trigger the error path to cause a denial of service.

293) Improper input validation (CVE-ID: CVE-2026-63956)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or corrupt memory.

The vulnerability exists due to improper input validation in the cypress_m8 USB serial driver when processing a malicious USB device with a too-small interrupt-out endpoint max packet size. An attacker with physical access can connect a specially crafted USB device to cause a denial of service or corrupt memory.

The issue can be triggered if a device reports an interrupt-out endpoint max packet size smaller than eight bytes.

294) Out-of-bounds write (CVE-ID: CVE-2026-63957)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the safe_serial USB serial driver when processing a malicious USB device that reports a bulk-out endpoint size smaller than eight bytes in safe mode. An attacker with physical access can connect a crafted USB device to cause memory corruption.

Exploitation requires the target system to interact with a malicious USB device operating in safe mode.

295) Out-of-bounds write (CVE-ID: CVE-2026-63960)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in wcove_read_rx_buffer() when processing a crafted USB Power Delivery frame from a connected port partner. An attacker with physical access can transmit a crafted 31-byte frame to cause memory corruption.

The issue occurs on the IRQ thread stack, and the final register read may write past the end of struct pd_message.

296) Out-of-bounds read (CVE-ID: CVE-2026-63961)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the DisplayPort altmode handler when processing a malformed Status Update VDO from a connected USB Type-C device. An attacker with physical access can send a device response with an incorrect VDO count to disclose sensitive information.

The issue can cause the kernel to read uninitialized stack data and forward it elsewhere.

297) Improper input validation (CVE-ID: CVE-2026-63964)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper input validation in the do_flash() function in the ucsi_ccg driver when parsing a crafted firmware image without a ':' record header. A local privileged user can place a crafted firmware file under /lib/firmware and write to the do_flash sysfs attribute to cause a denial of service.

The issue can be triggered by an unsigned firmware blob reaching the flashing logic.

298) Use of Uninitialized Variable (CVE-ID: CVE-2026-63967)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory in the tagged FIFO buffer handling in st_lsm6dsx_buffer.c when copying FIFO sample data to userspace. A local user can read exposed uninitialized stack data to disclose sensitive information.

The issue affects the tagged FIFO path because a hole in the aligned stack structure is copied together with sample data and timestamp fields.

299) Race condition (CVE-ID: CVE-2026-63971)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in sctp_wait_for_connect() in the SCTP socket implementation when waiting for an association to reach established state while another thread peels off the association to a new socket. A local user can trigger association migration during this window to cause a denial of service.

Exploitation requires concurrent access from another thread while the socket lock is dropped and re-acquired.

300) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-63975)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of channel deletion during list iteration in l2cap_ecred_conn_rsp in the Bluetooth L2CAP subsystem when processing a crafted L2CAP credit-based connection response with an already-assigned destination CID. A remote attacker can send a specially crafted Bluetooth packet to cause a denial of service.

The issue occurs when a duplicate destination CID is received for an L2CAP extended credit based connection response.

301) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-63976)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in the Bluetooth L2CAP ECRED reconfiguration response handler when processing a replayed failure response after a successful reconfiguration. A remote attacker can replay a failure response with a stale ident value to cause a denial of service.

The issue can destroy an already-established channel by causing the kernel to match a subsequent response against a recycled ident value.

302) Improper input validation (CVE-ID: CVE-2026-63985)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in fallback_set_params() in the ethtool EEPROM Netlink fallback path when processing module EEPROM read parameters. A local user can supply an offset and length combination that exceeds the EEPROM bounds to cause a denial of service.

The issue affects the Netlink fallback path for reading module EEPROM and may lead to unexpected behavior in drivers or device firmware.

303) NULL pointer dereference (CVE-ID: CVE-2026-63990)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null-pointer dereference in the bonding driver when enslaving a CAN device to a bonding master. A local user can enslave a virtual CAN device to a bonding master to cause a denial of service.

The issue can be triggered with a virtual CAN device such as vxcan, and subsequent socket cleanup operations may access invalid CAN receiver state.

304) NULL pointer dereference (CVE-ID: CVE-2026-63991)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in send_mcast_pkt() in the Bluetooth 6LoWPAN subsystem when processing multicast packets. A local user can trigger a memory allocation failure that leads to dereferencing a NULL skb pointer in send_pkt() to cause a denial of service.

305) Use-after-free (CVE-ID: CVE-2026-64002)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in ipv4_sysctl_exit_net() when unregistering the IPv4 sysctl table while sysctl handlers may still access sysctl_local_reserved_ports. A local user can trigger access to the freed sysctl entry to cause a denial of service.

The issue affects access to /proc/sys/net/ipv4/ip_local_reserved_ports during network namespace sysctl teardown.

306) Race condition (CVE-ID: CVE-2026-64004)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the AF_IUCV getsockopt handler when racing recvmsg() with getsockopt(SO_MSGSIZE). A local user can trigger concurrent socket operations to cause a denial of service.

The issue can lead to a NULL pointer dereference in the kernel.

307) Improper Initialization (CVE-ID: CVE-2026-64005)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the SMC hash tables in net/smc/af_smc.c when initializing the SMC subsystem. A local user can trigger use of corrupted hash list state to cause a denial of service.

The issue can occur when the hash tables are re-initialized after hash entries already exist and are in use, potentially resulting in a corrupted list.

308) Integer underflow (CVE-ID: CVE-2026-64009)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow leading to an out-of-bounds write in the esp component, specifically xfrm_state_mtu(), when processing a UDP datagram through an IPv4 ESP tunnel SA with attacker-controlled parameters. A local user can install a crafted IPv4 ESP tunnel SA and send a UDP datagram through the tunnel to cause a denial of service.

The issue involves a negative length being sign-extended to size_t before being passed to memset() in esp_output_fill_trailer().

309) Use-after-free (CVE-ID: CVE-2026-64010)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race condition in nfc_llcp_recv_cc() when processing an NFC LLCP connection acceptance packet concurrently with socket release. A local user can trigger concurrent connection handling and socket release to cause a denial of service.

The issue occurs during a connection state transition when a socket can be moved from the connecting_sockets list to the sockets list after it has already been unlinked and marked for destruction.

310) Use-after-free (CVE-ID: CVE-2026-64011)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in llcp_sock_release() when releasing an LLCP socket in connecting state. A local user can trigger socket release in that state to cause a denial of service.

311) NULL pointer dereference (CVE-ID: CVE-2026-64012)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the sch_sfb packet scheduler when dequeuing packets from child qdiscs after a peek operation. A local user can trigger network traffic processing through a crafted qdisc hierarchy to cause a denial of service.

Exploitation requires the sfb scheduler to have child qdiscs whose peek callback uses qdisc_peek_dequeued().

312) Out-of-bounds read (CVE-ID: CVE-2026-64014)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the nexio_read_data() function in the usbtouchscreen driver when processing a crafted device interrupt packet with falsified length fields. An attacker with physical access can provide a malicious USB device that reports oversized data_len and x_len values to disclose sensitive information and cause a denial of service.

Kernel memory contents may be exposed to userspace through reported ABS_X and ABS_Y input events.

313) NULL pointer dereference (CVE-ID: CVE-2026-64048)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in smc_v2_determine_accepted_chid and smc_conn_create when processing a crafted SMC-Dv2 accept reply with CHID 0. A remote attacker can send a specially crafted reply to trigger a kernel fault and cause a denial of service.

Exploitation requires a malicious peer to reply to an SMC-Dv2-only proposal.

314) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64090)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of empty vlan responses in batman-adv translation table handling when processing indirect translation table replies from the global tt state. A remote attacker can trigger indirect translation table responses containing empty vlan data to cause a denial of service.

The issue affects replies generated indirectly by another node using the global tt state rather than only direct local translation table responses.

315) Race condition (CVE-ID: CVE-2026-64093)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in batman-adv tp_meter timer handling in batadv_tp_sender_cleanup() when shutting down the sender timer during cleanup. A local user can trigger timer re-arming after cleanup to cause a denial of service.

The issue occurs because the timer may be re-armed after its reference has already been released.

316) NULL pointer dereference (CVE-ID: CVE-2026-64094)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in batman-adv bridge loop avoidance claim handling in net/batman-adv/bridge_loop_avoidance.c when sending an ARP request after a primary interface is decoupled from its mesh interface. A local user can trigger this race condition to cause a denial of service.

The issue occurs when the primary hard interface is accessed without rtnl_lock held and its mesh interface pointer becomes NULL during the operation.

317) Race condition (CVE-ID: CVE-2026-64095)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the batman-adv bridge loop avoidance subsystem when handling concurrent backbone gateway state changes and request tracking. A local user can trigger concurrent operations to cause a denial of service.

The issue stems from non-atomic updates to request state and the bla.num_requests counter across multiple concurrent code paths.

318) NULL pointer dereference (CVE-ID: CVE-2026-64116)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ipv6_hop_ioam() when processing an IPv6 IOAM Hop-by-Hop option during concurrent interface teardown. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because IPv6 interface state can be cleared concurrently through RCU, allowing __in6_dev_get(skb->dev) to return NULL while the packet is being handled.

319) Double free (CVE-ID: CVE-2026-64118)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in qed_cid_map_free() in the QLogic qed driver context management code when handling failed CID bitmap allocations. A local user can trigger the failing allocation path to cause a denial of service.

Exploitation requires device-specific setup to reach the affected allocation failure path.

320) Use-after-free (CVE-ID: CVE-2026-64123)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information or cause a denial of service.

The vulnerability exists due to a use-after-free in the hsr node table handling code when processing generic-netlink node-list or node-status operations concurrently with RTM_DELLINK teardown. A local user can trigger concurrent netlink operations to disclose sensitive information or cause a denial of service.

The generic-netlink reader accesses node entries under RCU and may retain a node pointer while teardown frees the same entry.

321) Out-of-bounds read (CVE-ID: CVE-2026-64126)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the Bluetooth MGMT add_ext_adv_data() handler when processing a crafted MGMT_OP_ADD_EXT_ADV_DATA command with inconsistent length fields. A local privileged user can send a specially crafted management command to disclose sensitive information.

Exploitation requires CAP_NET_ADMIN in the initial user namespace, and exposed memory may be read back via MGMT_OP_GET_ADV_INSTANCE.

322) Improper access control (CVE-ID: CVE-2026-64137)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to affect service availability.

The vulnerability exists due to improper access control in the CIFS SWN netlink notify handler when sending witness notification commands. A local user can send crafted RESOURCE_CHANGE or CLIENT_MOVE notifications to affect service availability.

The intended sender is the cifs.witness helper, but any local process could send notifications to the in-kernel witness handler.

323) Improper access control (CVE-ID: CVE-2026-64137)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the CIFS SWN generic netlink multicast group when joining the multicast group and receiving registration messages. A local user can join the CIFS_GENL_MCGRP_SWN group to disclose sensitive information.

For NTLM-authenticated mounts, exposed registration messages may include the username, domain, and password attributes copied from the CIFS session.

324) Improper handling of exceptional conditions (CVE-ID: CVE-2026-64170)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error pointers in the spi-qup DMA initialization logic when handling DMA setup failures during driver probe. A local user can trigger a DMA setup failure and subsequent probe error or driver unbind to cause a denial of service.

The issue can lead to dereferencing an error pointer or attempting to release a DMA channel a second time.

325) NULL pointer dereference (CVE-ID: CVE-2026-64187)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in xlog_recover_reorder_trans in the XFS log recovery code when processing a crafted log during filesystem recovery. A local user can provide a crafted log item with no regions to trigger a kernel fault and cause a denial of service.

This issue only occurs for crafted log data during recovery, as the normal runtime commit path does not generate such a transaction.

326) Use-after-free (CVE-ID: CVE-2026-64188)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in rmnet_dellink() and the rmnet endpoint handling in the Qualcomm rmnet driver when processing network packets on the receive path while an endpoint is being removed. A local user can trigger concurrent packet processing and endpoint deletion to cause a denial of service.

The stale read occurs when lockless RCU readers dereference the egress_dev pointer after the endpoint memory has been freed.

327) Use-after-free (CVE-ID: CVE-2026-64189)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in ip_set_dump_do() and ip_set_dump_done() in the ipset netfilter subsystem when handling netlink dump operations concurrently with ip_set_list resizing. A local user can trigger concurrent netlink dump and set creation operations to cause a denial of service.

The issue can lead to a general protection fault and kernel panic.

328) Out-of-bounds read (CVE-ID: CVE-2026-64191)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in stub_xfer() in the i2c-stub driver when handling an I2C_SMBUS ioctl with I2C_SMBUS_I2C_BLOCK_DATA and an invalid block length. A local user can issue a crafted ioctl request with data->block[0] greater than 32 to cause a denial of service.

The issue affects the development and test i2c-stub driver, which is not built by default and must be loaded with a chip_addr= parameter.

329) Out-of-bounds write (CVE-ID: CVE-2026-64192)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in BPF_MAP_TYPE_INODE_STORAGE handling when creating and updating inode storage maps while the BPF LSM is uninitialized. A local privileged user can create and update a BPF_MAP_TYPE_INODE_STORAGE map to cause a denial of service.

This issue occurs when CONFIG_BPF_LSM is enabled but the BPF LSM is not enabled at boot time, causing the inode security blob offset to remain uninitialized and leading to a kernel panic during later RCU callback execution.

330) Deadlock (CVE-ID: CVE-2026-64206)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper locking in the Bluetooth L2CAP connection teardown path when canceling pending receive work during connection deletion. A remote attacker can trigger Bluetooth L2CAP traffic and connection teardown to cause a denial of service.

The issue can deadlock between the pending_rx_work worker and the teardown path in l2cap_conn_del().

331) Double free (CVE-ID: CVE-2026-64222)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in otx2_pool_aq_init() and cn20k_pool_aq_init() when handling allocation or mailbox synchronization failures during pool initialization. A local user can trigger the affected error path to cause a denial of service.

Exploitation requires OcteonTX2 or CN20K hardware.

332) Out-of-bounds read (CVE-ID: CVE-2026-64225)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the cgx_speed_mbps array access in link_status_user_format() when processing firmware-reported link status values. A local user can trigger an out-of-range RESP_LINKSTAT_SPEED value to cause a denial of service.

333) NULL pointer dereference (CVE-ID: CVE-2026-64234)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dma_handle_rx() in the pch_uart driver when handling DMA receive operations after coherent DMA buffer allocation fails. A local user can trigger allocation failure conditions to cause a denial of service.

334) Out-of-bounds read (CVE-ID: CVE-2026-64237)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the elan_i2c firmware update handler when processing a crafted firmware file. A local user can provide a specially crafted firmware file to disclose sensitive information.

335) Double free (CVE-ID: CVE-2026-64242)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in net2280_probe() error handling in the net2280 usb gadget driver when probing a device. A local user can trigger the probe error path to cause a denial of service.

336) Out-of-bounds read (CVE-ID: CVE-2026-64243)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in simple_mux_control_put() when processing enumerated control values. A local user can supply an invalid enumerated item value to trigger an out-of-bounds read and cause a denial of service.

337) Use-after-free (CVE-ID: CVE-2026-64246)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in linkstation_poweroff_init() when initializing the linkstation poweroff driver. A local attacker can trigger the vulnerable initialization path to cause a denial of service.

338) Use-after-free (CVE-ID: CVE-2026-64249)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in child_regions_with_firmware() in drivers/fpga/of-fpga-region.c when handling child FPGA region data. A local user can trigger the error path to cause a denial of service.

339) Use-after-free (CVE-ID: CVE-2026-64266)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fuse_ref_folio() in the FUSE subsystem when handling a subsequent copy chain after unlocking the request. A local user can trigger request abort and asynchronous end callback timing to cause a denial of service.

340) Out-of-bounds write (CVE-ID: CVE-2026-64268)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to write out of bounds.

The vulnerability exists due to an out-of-bounds write in siw_proc_rresp() in drivers/infiniband/sw/siw/siw_qp_rx.c when processing Read Response DDP segments for an outstanding RREAD over an established RDMA connection. A remote user can send Read Response segments with more total payload than requested while keeping the DDP Last flag clear to write out of bounds.

Exploitation requires a connected siw peer on an established RDMA connection over routable TCP.

341) Out-of-bounds read (CVE-ID: CVE-2026-64269)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rdma_write_sg when processing an RTRS READ response with an attacker-controlled descriptor length. A remote attacker can advertise a crafted desc[0].len value larger than max_chunk_size to disclose sensitive information or cause a denial of service.

With no IOMMU or in passthrough mode, adjacent host memory may be returned to the peer; with a translating IOMMU, the out-of-range access is expected to fault and abort the connection.

342) Stack-based buffer overflow (CVE-ID: CVE-2026-64270)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to overwrite stack memory and cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in mms114_interrupt() when processing a device-reported packet size from the touchscreen controller over the I2C bus. A local attacker can tamper with the I2C bus or use a malicious controller to supply an oversized packet size to overwrite stack memory and cause a denial of service.

The out-of-bounds write occurs on the IRQ-thread stack and may overwrite the stack canary, saved registers, and the return address.

343) Out-of-bounds write (CVE-ID: CVE-2026-64271)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to overwrite heap memory.

The vulnerability exists due to out-of-bounds write in the tw_interrupt() handler in drivers/input/touchscreen/touchwin.c when processing serial input from a Touchwindow peripheral. An attacker with physical access can send crafted non-zero bytes with mismatched second and third packet bytes to overwrite heap memory.

Exploitation requires a malicious, malfunctioning, or counterfeit Touchwindow peripheral.

344) Memory corruption (CVE-ID: CVE-2026-64272)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory access in the mms114 touchscreen driver when processing touch data packets from MMS134S and MMS136 controllers. A local user can trigger crafted touch event data to cause a denial of service.

The issue affects handling of touch events beyond the first one because 6-byte events are parsed using 8-byte structure indexing.

345) Out-of-bounds write (CVE-ID: CVE-2026-64273)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in iforce_process_packet() when processing a device-reported force-feedback status packet. An attacker with physical access can supply a crafted device payload with an out-of-range effect index to corrupt kernel memory.

The issue affects both USB interrupt endpoint and serio transports, and the status handling path is not gated on force-feedback support being present.

346) Stack-based buffer overflow (CVE-ID: CVE-2026-64274)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to a stack-based out-of-bounds write in goodix_ts_read_input_report() when processing device-reported touch contact data. A remote attacker can tamper with the I2C bus or use a malicious controller to write beyond an on-stack buffer and cause memory corruption.

The issue occurs because the maximum contact count taken from a 4-bit device configuration field can exceed the number of contacts the buffer is sized to hold.

347) Integer underflow (CVE-ID: CVE-2026-64275)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to integer underflow in the touch reporting logic of the elan_i2c touchpad driver when handling small calculated or fallback width values. A local attacker can cause width values smaller than ETP_FWIDTH_REDUCE to trigger an underflow and report a massive unsigned integer to userspace.

The issue affects touch width reporting to userspace.

348) Division by zero (CVE-ID: CVE-2026-64275)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to division by zero in the elan_i2c touchpad driver when processing invalid device firmware or device tree parameters during device probe. A local attacker can provide zero trace-count values to trigger a kernel panic.

The issue occurs during device probe.

349) Out-of-bounds read (CVE-ID: CVE-2026-64276)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in the rmi_f30_attention handler and EVIOCGKEYCODE/EVIOCSKEYCODE ioctl handling in the synaptics-rmi4 F30 driver when processing a device that reports a gpioled_count greater than 6 with GPIO support enabled. A local user can trigger the attention interrupt or use EVIOCGKEYCODE/EVIOCSKEYCODE ioctls to cause a denial of service or disclose sensitive information.

The issue occurs because the keymap allocation is smaller than the gpioled_count value used for iteration and keycode bounds.

350) Out-of-bounds read (CVE-ID: CVE-2026-64277)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and overwrite adjacent kernel memory.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in the synaptics-rmi4 F3A GPIO keymap handling in drivers/input/rmi4/rmi_f3a.c when processing a device that reports a gpio_count greater than the allocated keymap size. A local user can open the evdev node and invoke keymap ioctls to disclose sensitive information and overwrite adjacent kernel memory.

The information disclosure occurs through EVIOCGKEYCODE leaking adjacent slab memory to user space, while EVIOCSKEYCODE writes a caller-controlled value past the buffer.

351) Use-after-free (CVE-ID: CVE-2026-64279)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the i2c core adapter lookup and deregistration logic when looking up an adapter by id during adapter deregistration or registration failure. A local user can trigger a race condition to cause a denial of service.

352) Improper input validation (CVE-ID: CVE-2026-64280)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in afu_ioctl_dma_map() when handling a DFL_FPGA_PORT_DMA_MAP ioctl request with a user-supplied length. A local user can provide an excessively large length value to cause a denial of service.

353) Improper access control (CVE-ID: CVE-2026-64294)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the mincore() and madvise(MADV_PAGEOUT) ownership checks when handling files on idmapped mounts. A local user can access these interfaces on a crafted idmapped mount to disclose sensitive information.

The issue affects side-channel protection logic and occurs because ownership was checked against an idmap that ignored the file's mount idmap.

354) Out-of-bounds write (CVE-ID: CVE-2026-64296)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read and write.

The vulnerability exists due to an out-of-bounds write in exfat_find_dir_entry() when parsing crafted exfat directory entries containing many short name fragments. A local user can provide a crafted directory structure to cause an out-of-bounds read and write.

The issue occurs because the per-entry output pointer advances by a fixed amount while the tracked accumulated name length can remain smaller when a name fragment contains an early NUL.

355) Improper access control (CVE-ID: CVE-2026-64298)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass file write permission checks and truncate a file.

The vulnerability exists due to improper access control in nfs_open_permission_mask() when handling open requests with O_TRUNC on NFSv4 delegated opens. A local user can open a file with O_RDONLY | O_TRUNC to bypass file write permission checks and truncate a file.

This issue occurs when the client satisfies the OPEN locally from a cached write delegation and then sends truncation to the server using delegation state.

356) Out-of-bounds read (CVE-ID: CVE-2026-64299)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in regex_match_glob() glob matching in the tracing event filter subsystem when processing non-NUL-terminated string event fields. A local user can supply a crafted glob filter against such fields to disclose sensitive information.

One reported path reaches the issue from the xfs_lookup tracepoint, and the affected string fields may be dynamic char arrays copied without a trailing NUL byte.

357) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64301)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in scmi_regulator_probe() in the SCMI regulator driver when processing device tree child nodes. A local user can trigger an error condition during device probing to cause a denial of service.

358) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64303)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption or trigger a use-after-free.

The vulnerability exists due to improper resource shutdown in the fsl-lpspi dma transfer error path in drivers/spi/spi-fsl-lpspi.c when preparing a tx dma descriptor after the rx dma channel has already been submitted and issued. A local user can trigger a tx prepare failure during a spi dma transfer to cause memory corruption or trigger a use-after-free.

The issue occurs because the spi core unmaps dma buffers after the error is returned while the rx dma engine may continue writing to those buffers.

359) Out-of-bounds write (CVE-ID: CVE-2026-64304)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in qat_rsa_setkey_crt() when processing RSA CRT key components larger than half of the key size. A local user can provide a crafted RSA CRT key to cause memory corruption.

The issue occurs because CRT components are bounded by the modulus size in the generic RSA key parser, while the QAT driver allocates half-size DMA buffers for those components.

360) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64306)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper handling of error conditions in drbg_ctr_generate() when processing additional input during CTR_DRBG generation. A local user can trigger a failure in drbg_ctr_update() to disclose sensitive information.

The output buffer may remain uninitialized when the function incorrectly reports success.

361) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64312)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper callback handling in the pcrypt aead fallback path in crypto/pcrypt.c when processing non-parallel fallback after padata submission returns -EBUSY. A local user can trigger asynchronous cryptographic operations that use the fallback path to cause a denial of service.

362) Integer overflow (CVE-ID: CVE-2026-64313)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect cryptographic computation.

The vulnerability exists due to an integer overflow in crypto/ecc.c when performing elliptic curve multiplication. A local user can trigger the vulnerable arithmetic path to cause incorrect cryptographic computation.

363) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-64315)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in the caam crypto driver setkey handlers when dumping key material during key setup with dynamic debug enabled. A local user can access debug output containing sensitive key material to disclose sensitive information.

Exposure occurs at runtime when CONFIG_DYNAMIC_DEBUG is enabled.

364) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-64316)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in the caam crypto driver key-dump code when handling key material in *_setkey() and gen_split_key(). A local user can access debug output containing sensitive key material to disclose sensitive information.

Exposure occurs at runtime when CONFIG_DYNAMIC_DEBUG is enabled.

365) Out-of-bounds read (CVE-ID: CVE-2026-64317)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Rock Ridge SL record handling in fs/isofs/rock.c when parsing a crafted ISO 9660 image containing a malformed symbolic link record. A local user can supply a crafted filesystem image to disclose sensitive information.

The issue can copy adjacent kernel memory into the symlink body returned to user space by readlink().

366) Out-of-bounds read (CVE-ID: CVE-2026-64318)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the aix partition parser when scanning the physical-partition-extent array from a crafted AIX/IBM partition table. A local user can supply a crafted block-device image to disclose sensitive information.

The issue can be triggered during partition scanning without mounting the filesystem, including when a crafted image is attached with partition scanning enabled or when a device is auto-scanned by udev.

367) Out-of-bounds write (CVE-ID: CVE-2026-64322)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and corrupt memory.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in udf sparing table handling in fs/udf/super.c when parsing a crafted UDF image. A local user can mount or otherwise trigger processing of a specially crafted UDF image to disclose sensitive information and corrupt memory.

The issue is caused by validating reallocationTableLen as a byte count even though it is later used as an entry count for sparingEntry array access.

368) Out-of-bounds read (CVE-ID: CVE-2026-64323)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in udf_load_vat() and udf_get_pblock_virt15() when mounting a crafted UDF image with a virtual (VAT) partition. A local user can provide a crafted UDF image with an oversized VAT header length to disclose sensitive information.

User interaction is required to mount the crafted filesystem image.

369) Out-of-bounds read (CVE-ID: CVE-2026-64324)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in udf_free_blocks() and block bitmap handling in fs/udf/balloc.c when processing crafted UDF filesystem block extents. A local user can supply a crafted filesystem and truncate a writable file on it to cause a denial of service.

On systems where active users can mount removable UDF media without administrative privileges, user interaction is not required beyond mounting the media and truncating a file.

370) Use-after-free (CVE-ID: CVE-2026-64329)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the ucsi_ccg_remove() remove path and threaded IRQ handler when handling connector-change events during device removal. A local user can trigger concurrent remove and IRQ activity to cause a denial of service.

The issue arises from a race condition where an in-flight IRQ handler may access a freed ucsi object.

371) Out-of-bounds read (CVE-ID: CVE-2026-64330)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect registration of alternate modes.

The vulnerability exists due to an out-of-bounds read in svdm_consume_modes() when processing partner-supplied SVDM Discovery Modes data. A remote attacker can inject crafted SVDM values and drive the SVID index out of bounds to cause incorrect registration of alternate modes.

The issue can read adjacent fields in struct tcpm_port, and a connected USB Type-C partner can influence the loaded SVID value.

372) NULL pointer dereference (CVE-ID: CVE-2026-64331)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in vep_dequeue() when cancelling FunctionFS AIO requests. A local user can trigger request cancellation on the FunctionFS AIO path to cause a denial of service.

The issue is reachable when stressing FunctionFS endpoints via AIO in usbip's vudc path.

373) Memory leak (CVE-ID: CVE-2026-64332)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in the ULPI device registration logic in drivers/usb/common/ulpi.c when handling early ULPI device registration failures. A local user can trigger a registration failure to cause a denial of service.

374) Out-of-bounds write (CVE-ID: CVE-2026-64333)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to memory corruption in digi_write_inb_command() in the digi_acceleport usb serial driver when handling usb serial write commands while the write urb is in use. A local user can trigger a timeout or no-timeout command path to corrupt the write urb buffer to cause memory corruption.

On 32-bit systems, one corruption path is triggered by a broken jiffies comparison after several minutes of system uptime, while commands such as break control can corrupt the urb immediately when no timeout is used.

375) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64334)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the digi_acceleport USB serial driver when sending out-of-band commands during operations that race with device disconnect. A local user can trigger operations such as open, set_termios, or close while the device is being disconnected to cause a denial of service.

The issue can result in an indefinite loop with interrupts disabled, leading to a hard lockup.

376) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64335)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the digi_acceleport usb serial driver when reopening a port after it was closed while throttled. A local user can close and reopen a throttled port to cause a denial of service.

The issue prevents the port from receiving further data until the device is reconnected or the driver is rebound.

377) Information disclosure (CVE-ID: CVE-2026-64336)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an information leak in the keyspan_pda USB serial driver write() callback when handling write operations. A local user can trigger a write operation that causes the line discipline to continue reading data beyond the tty write buffer to disclose sensitive information.

The issue occurs because the driver may report accepting more characters than were actually passed to write().

378) Improper resource shutdown or release (CVE-ID: CVE-2026-64337)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mtu3_gadget_queue() function when queuing a USB gadget request and transfer preparation fails. A local user can trigger a queue failure to cause a denial of service.

The issue occurs because a DMA mapping remains active on the failed queue path before the request is linked on the endpoint request list.

379) Improper resource shutdown or release (CVE-ID: CVE-2026-64338)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in uss720_probe() when handling a probe failure after reading the 1284 register. A local attacker can trigger a failed probe with a device that causes get_1284_register() to fail to cause a denial of service.

The issue can leave a registered parport device behind with stale private_data after the common cleanup path releases the associated private data and USB device reference.

380) Use-after-free (CVE-ID: CVE-2026-64340)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the legousbtower USB driver when handling a race between device release and disconnect. A local user can trigger the race condition by opening and releasing the device while it is being disconnected to cause a denial of service.

The issue arises from object lifetime management during concurrent disconnect and release operations.

381) Use-after-free (CVE-ID: CVE-2026-64342)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the iowarrior USB driver disconnect handling when processing device disconnect events with submitted write URBs still active. A local user can trigger device disconnect while write completion handling is still possible to cause a denial of service or execute arbitrary code.

Exploitation requires local access to the affected USB device interface.

382) Use-after-free (CVE-ID: CVE-2026-64343)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in the ldusb driver when release() races with disconnect(). A local user can trigger a device disconnect while releasing the device to cause a use-after-free.

The issue affects the drivers/usb/misc/ldusb.c code path in the Linux kernel.

383) Use-after-free (CVE-ID: CVE-2026-64344)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in the idmouse USB driver when release() races with disconnect(). A local user can trigger a device disconnect while the device file is being released to cause a denial of service or execute arbitrary code.

Exploitation requires a race condition involving device disconnection and file release in the idmouse driver.

384) Use-after-free (CVE-ID: CVE-2026-64346)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in gadget_match_driver() in the usb gadget udc core when handling concurrent gadget removal and configfs access. A local user can trigger a race condition via configfs operations to cause a denial of service.

The issue arises because the udc and gadget lifecycles are decoupled, and concurrent mode-switch work can free the udc structure while it is still being accessed.

385) Out-of-bounds read (CVE-ID: CVE-2026-64347)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the USB OTG handler in composite_setup() when handling a control transfer with an empty configuration list. A remote attacker can trigger the vulnerable code path to cause a denial of service.

The issue can occur during a teardown race on gadget unbind with a control transfer in flight, or when a driver sets is_otg before adding a configuration.

386) Memory leak (CVE-ID: CVE-2026-64350)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in cdnsp_alloc_stream_info() when handling stream ring allocation or stream mapping update failures. A local user can trigger allocation failure conditions to cause a denial of service.

387) Out-of-bounds read (CVE-ID: CVE-2026-64351)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in kalmia_rx_fixup() when processing a crafted short bulk-in frame from a USB device. An attacker with physical access can provide malformed frame lengths to disclose sensitive information.

The issue occurs when framing headers are not both present before frame-length subtraction, causing an integer underflow that lets a device-supplied packet length drive buffer access past the end of the rx buffer.

388) Improper locking (CVE-ID: CVE-2026-64352)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the lpm trie implementation when sleepable BPF programs access LPM maps. A local user can trigger lockdep warnings through crafted BPF map lookup, update, or delete operations to cause a denial of service.

This issue is lockdep-only on debug kernels and can spam the console when a sleepable BPF LSM hook touches an LPM trie.

389) Out-of-bounds read (CVE-ID: CVE-2026-64355)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in dev_map_enqueue_clone() and dev_map_redirect_clone() when cloning fragmented native XDP frames or nonlinear generic XDP packets for devmap broadcast redirects. A local user can trigger clone-based broadcast handling with a crafted fragmented frame to cause a denial of service.

The issue occurs because fragment metadata is not present in the linear cloned frame, and later frame return can interpret uninitialized tail data as skb_shared_info.

390) Improper input validation (CVE-ID: CVE-2026-64359)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in nilfs_clean_segments when processing user-supplied segment numbers through the CLEAN_SEGMENTS ioctl. A local user can submit out-of-range segment numbers to cause a denial of service.

The issue can hold ns_segctor_sem long enough to block concurrent filesystem operations such as chmod().

391) Use of Uninitialized Variable (CVE-ID: CVE-2026-64360)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in hfs_bnode_read() in the hfs and hfsplus bnode handling code when reading bnode data with an invalid offset or a corrected zero length. A local user can trigger an early return and cause callers to use uninitialized stack data to disclose sensitive information.

392) Integer overflow (CVE-ID: CVE-2026-64361)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in check_and_correct_requested_length() in the hfs and hfsplus filesystem code when processing crafted filesystem metadata. A local user can trigger an underflowed length value that bypasses a bounds check to cause a denial of service.

Exploitation can result in a read far beyond the node buffer during a subsequent memmove operation.

393) Use-after-free (CVE-ID: CVE-2026-64362)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to use-after-free in the hid-lg-g15 driver work handling logic when a pending work item is triggered and the device is unplugged. An attacker with physical access can trigger a backlight cycle key event and disconnect the keyboard to cause a denial of service.

The issue is reachable as a race condition on device unplug for G15, G15 v2, and G510 models that initialize the work item.

394) Use-after-free (CVE-ID: CVE-2026-64363)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to use-after-free in the appleir HID driver when processing concurrent device teardown and timer or raw event handling. A local attacker can trigger device disconnection shortly after key events to execute arbitrary code or cause a denial of service.

Exploitation requires a pending key-up timer or concurrent raw event activity to race with device removal.

395) Out-of-bounds write (CVE-ID: CVE-2026-64364)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the HID multitouch driver when processing input from a crafted USB or Bluetooth HID multitouch device that advertises a large contact count. An attacker with physical access can provide a crafted device to corrupt adjacent members of struct mt_device and cause a denial of service.

The issue is reachable from an untrusted USB or Bluetooth HID multitouch device, and the kernel panic can be triggered from timer context through the sticky-fingers release path.

396) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64370)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in do_cpu_nanosleep() when handling an error after creating a POSIX CPU timer. A local user can trigger a failure in posix_cpu_timer_set() to cause a denial of service.

397) Race condition (CVE-ID: CVE-2026-64371)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in procfs handlers for task statistics, wchan, map_files, and namespace links when accessing process information during concurrent exec state updates without exec_update_lock protection. A local user can access affected /proc interfaces to disclose sensitive information.

The issue involves calls to ptrace_may_access() without the required exec_update_lock protection.

398) Use-after-free (CVE-ID: CVE-2026-64372)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in pcc_cpufreq_do_osc() when performing two-phase _OSC negotiation through acpi_evaluate_object(). A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue also involves a double free after the stale pointer is freed again.

399) Race condition (CVE-ID: CVE-2026-64373)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in cpufreq_suspend() when rebooting the system while cpu hotplug operations run concurrently. A local user can trigger a reboot while concurrent cpu hotplug activity causes governor_data to be freed during access to cause a denial of service.

The issue can result in a kernel null pointer dereference during the reboot path because processes and kernel threads remain active.

400) Deadlock (CVE-ID: CVE-2026-64374)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a live lock condition in the linux kernel scheduler RT_PUSH_IPI logic when handling RT task migration and repeated inter-processor interrupts on non-PREEMPT_RT systems. A local user can trigger heavy networking activity and wake RT tasks to cause a denial of service.

The issue occurs on non-PREEMPT_RT systems when softirqs execute for long periods and prevent the target CPU from returning to task context.

401) Race condition (CVE-ID: CVE-2026-64375)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a race condition in proc_pid_get_link() and proc_pid_readlink() when handling access to /proc pid link targets. A local user can trigger concurrent task state changes to disclose sensitive information.

The issue affects file descriptor-related proc links and involves ptrace_may_access() checks performed on a different task lookup than the one used for the actual access.

402) Improper input validation (CVE-ID: CVE-2026-64379)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify file mode bits.

The vulnerability exists due to improper input validation in parse_dacl() when processing a server-provided NFS mode SID. A remote attacker can provide crafted mode values to modify file mode bits.

The issue occurs when modefromsid is active.

403) Out-of-bounds read (CVE-ID: CVE-2026-64380)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in posix_info_sid_size() in the SMB client when parsing truncated POSIX SIDs. A remote attacker can send a specially crafted SMB response to cause a denial of service.

404) Memory leak (CVE-ID: CVE-2026-64381)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in receive_encrypted_standard() when processing compound SMB PDUs. A remote attacker can send compound SMB messages that exceed MAX_COMPOUND to cause a denial of service.

The issue affects the Linux kernel SMB client.

405) Use-after-free (CVE-ID: CVE-2026-64390)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in ksmbd byte-range lock handling when processing smb2 lock requests in smb3 multichannel environments. A remote attacker can trigger concurrent lock traversal and removal to cause a denial of service.

The issue occurs because a lock list entry can be removed under a different spinlock than the one protecting the list it belongs to.

406) Use-after-free (CVE-ID: CVE-2026-64401)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the SMB client witness notification handling in fs/smb/client/cifs_swn.c when processing witness notifications for shared registrations. A local user can trigger notification handling involving a freed tcon pointer to cause a denial of service.

Exploitation requires a same-share second mount so that a registration remains live after the first tcon is unregistered and freed.

407) Out-of-bounds read (CVE-ID: CVE-2026-64403)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in l2cap_get_conf_opt() when parsing L2CAP configuration options. A remote attacker can send a specially crafted Bluetooth L2CAP packet to cause a denial of service.

The read occurs before the malformed option is rejected, and up to 4 bytes may be read past the end of the buffer.

408) Use-after-free (CVE-ID: CVE-2026-64408)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in bnep_add_connection() during network device registration when handling a concurrent controller teardown. A local user can trigger a race condition to cause a denial of service.

409) Out-of-bounds read (CVE-ID: CVE-2026-64411)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in find_table_lock() table name handling when processing a user-supplied ebtables table name through setsockopt calls. A local user can supply a non-null-terminated table name to trigger a read past the end of the name buffer and disclose sensitive information.

The issue occurs on a lookup miss when module autoload formatting uses the supplied table name.

410) Improper input validation (CVE-ID: CVE-2026-64412)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the ebtables match handling code in net/bridge/netfilter/ebtables.c when processing a crafted module name. A local user can supply a non-null-terminated module name to cause a denial of service.

411) Improper Initialization (CVE-ID: CVE-2026-64413)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the ebtables table translation logic in net/bridge/netfilter/ebtables.c when allocating and freeing the chainstack array. A local user can trigger an allocation failure during table translation to cause a denial of service.

The issue arises when a sparse cpu_possible_mask causes an uninitialized chainstack entry to be freed during cleanup.

412) Use-after-free (CVE-ID: CVE-2026-64420)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the cros_ec device probe handling in drivers/mfd/cros_ec_dev.c when sub-drivers access platform device drvdata after probe failure. A local user can trigger a failed probe and subsequent access to a stale pointer to cause a denial of service.

The issue occurs because the stale drvdata pointer remains accessible to sub-drivers such as cros_ec_typec after the underlying cros_ec_dev structure has already been released.

413) Out-of-bounds read (CVE-ID: CVE-2026-64422)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tcp_mtu_probe() when processing an invalid net.ipv4.tcp_reordering value during MTU probing. A local user can write a negative tcp_reordering value to trigger the out-of-bounds read and disclose sensitive information.

Exploitation requires tcp_mtu_probing to be set to 2.

414) Use-after-free (CVE-ID: CVE-2026-64423)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the IGMP multicast group handling in net/ipv4/igmp.c when destroying a device while concurrent RCU readers traverse the multicast hash table. A local user can trigger multicast group membership operations and concurrent network processing to cause a denial of service.

The issue occurs because multicast group entries can remain reachable through the device multicast hash table during RCU reclamation.

415) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-64425)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in io_worker_handle_work() in io_uring/io-wq.c when processing linked work items during io_uring worker exit handling. A local user can submit linked work and trigger ring closure to cause a denial of service.

Exploitation requires a race condition where worker exit begins after the first linked item has started but before the remaining linked items are processed.

416) Improper locking (CVE-ID: CVE-2026-64428)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock type selection in the sch irq startup path when starting up a requested irq on PREEMPT_RT systems. A local user can request a threaded irq that reaches sch_irq_unmask() and sch_irq_mask_unmask() to cause a denial of service.

The issue occurs because the path is not sleepable, but a regular spinlock_t becomes a sleeping lock on PREEMPT_RT.

417) Improper locking (CVE-ID: CVE-2026-64429)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the Spreadtrum EIC GPIO interrupt controller driver when starting up a requested IRQ on PREEMPT_RT systems. A local user can request a threaded IRQ to trigger a sleeping lock in an invalid context to cause a denial of service.

The issue occurs because the callback can be reached from a non-sleepable irq_startup() path.

418) Race condition (CVE-ID: CVE-2026-64430)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource access in the ntb_epf_vec_isr interrupt handler in drivers/ntb/hw/epf/ntb_hw_epf.c when handling interrupts and deriving the vector number through pci_irq_vector() in hardirq context. A local user can trigger the vulnerable interrupt handling path to cause a denial of service.

The issue can result in "scheduling while atomic" kernel splats because pci_irq_vector() reaches code that takes a mutex in hardirq context.

419) Out-of-bounds write (CVE-ID: CVE-2026-64432)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in log_replay in fs/ntfs3/fslog.c when mounting a crafted NTFS image and replaying the $LogFile journal. A local user can provide a specially crafted NTFS image to cause a denial of service or execute arbitrary code.

The issue can be triggered at mount time during the analysis pass when LCNs from an action log record are copied into an existing Dirty Page Table entry, and integer underflow in the target VCN delta can drive the destination index past the allocated page_lcns array.

420) Race condition (CVE-ID: CVE-2026-64435)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a data race in audit_queue handling in kernel/audit.c when reading queue length concurrently with queue updates. A local user can trigger audit activity to cause a denial of service.

The issue affects multiple lockless readers of the audit queue length in the audit subsystem.

421) Use of Uninitialized Variable (CVE-ID: CVE-2026-64436)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in pfkey_msg2xfrm_state() when processing a PF_KEY IPComp state and migrating it. A local user can add a crafted IPComp security association via PF_KEY and trigger migration to cause a denial of service.

The issue affects the PF_KEY path for IPComp states; the XFRM netlink path is not affected.

422) Use-after-free (CVE-ID: CVE-2026-64438)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the VF2PF response workqueue handling in the intel_qat SR-IOV implementation when processing VF2PF messages during SR-IOV teardown. A local user can trigger concurrent VF2PF work so that a queued or in-flight worker dereferences freed per-VF state to cause a denial of service.

The issue occurs because PF-side response work stores a raw pointer to per-VF state that may be freed by adf_disable_sriov() before queued work completes.

423) Out-of-bounds write (CVE-ID: CVE-2026-64440)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in HT_caps_handler() when parsing a crafted 802.11 association response frame. A remote attacker can send a malicious access point response with an oversized HT Capabilities information element to cause memory corruption.

The issue can write beyond the fixed 26-byte HT_cap array into adjacent fields of struct mlme_ext_info.

424) Out-of-bounds read (CVE-ID: CVE-2026-64441)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in IE and WPS attribute parsing functions in drivers/staging/rtl8723bs/core/rtw_ieee80211.c when parsing crafted information element buffers. A local user can provide a specially crafted buffer to disclose sensitive information.

The issue affects rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr().

425) Out-of-bounds read (CVE-ID: CVE-2026-64442)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in IE parsing loops in issue_assocreq() and join_cmd_hdl() when processing AP beacon and probe-response frames with a truncated final information element. A remote attacker can send a malicious AP beacon or probe-response frame with a truncated final information element to cause a denial of service.

The issue is triggered when the stored IE data ends with an element_id byte without a following length byte.

426) Out-of-bounds read (CVE-ID: CVE-2026-64443)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the update_beacon_info() IE parsing loop in rtl8723bs when parsing a crafted Beacon frame from a malicious access point. A remote attacker can send a specially crafted Beacon frame to disclose sensitive information.

The issue can be triggered when the last information element is truncated or when an information element declares a length that extends past the available frame data.

427) Out-of-bounds read (CVE-ID: CVE-2026-64444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in OnAssocRsp() in the rtl8723bs driver when parsing a crafted association response frame. A remote attacker can send a specially crafted association response frame to disclose sensitive information.

The issue can be triggered by a malicious access point through a truncated information element in the frame.

428) Improper input validation (CVE-ID: CVE-2026-64445)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in OnAuth() when processing seq=3 shared-key authentication responses. A remote attacker can send a specially crafted authentication frame to cause a denial of service.

The issue is triggered when the Challenge Text information element length differs from the required 128 bytes.

429) Out-of-bounds read (CVE-ID: CVE-2026-64445)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in OnAuth() when processing crafted shared-key authentication frames. A remote attacker can send a specially crafted authentication frame to disclose sensitive information.

The issue occurs in the shared-key authentication path when the Privacy bit is set and the frame is too short to contain a valid WEP IV and ICV.

430) Heap-based buffer overflow (CVE-ID: CVE-2026-64446)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a heap-based buffer overflow in rtw_cfg80211_set_wpa_ie() when handling a crafted WPA or WPA2 information element in a connect request via nl80211. A local user can send a specially crafted connect request to cause memory corruption.

The issue can overflow the 256-byte supplicant_ie buffer by one byte into the adjacent last_mic_err_time field.

431) Out-of-bounds read (CVE-ID: CVE-2026-64448)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in smb2_check_message() and subsequent SMB client protocol decoders when processing crafted SMB2 responses with a data area. A remote attacker can send a specially crafted SMB server response to disclose sensitive information.

The issue is reachable during NEGOTIATE and SESSION_SETUP before the session is established, including through the SPNEGO/negTokenInit and NTLMSSP challenge decoders when mounting against a non-conforming server.

432) Out-of-bounds read (CVE-ID: CVE-2026-64450)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the TIPC broadcast Gap ACK blocks handling in tipc_bcast_sync_rcv() when processing a crafted broadcast PROTOCOL/STATE_MSG. A remote attacker can send a specially crafted broadcast STATE_MSG with a malformed Gap ACK blocks record to cause a denial of service.

Exploitation requires a TIPC neighbour that has negotiated TIPC_GAP_ACK_BLOCK.

433) Use-after-free (CVE-ID: CVE-2026-64452)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in lowpan_nhc_do_uncompression() when processing a malformed 6LoWPAN packet on an error path. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue is caused by a race condition involving descriptor unregistration and access to nhc->name outside the protection of lowpan_nhc_lock, and it can be reached through the Bluetooth 6LoWPAN L2CAP receive path.

434) Improper locking (CVE-ID: CVE-2026-64454)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in the dwc3 gadget disconnect callback path when suspending the gadget. A local user can trigger a gadget disconnect during suspend to cause a denial of service.

The issue occurs because the disconnect callback may run in a non-sleepable context with IRQs disabled, which can trigger kernel lockdep warnings and sleeping-function-in-invalid-context failures.

435) Use-after-free (CVE-ID: CVE-2026-64455)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in chaoskey_release() in the chaoskey USB driver when closing the device file after the USB device has been unplugged. A local user can close the device file after device unplug to cause a denial of service.

The invalid access occurs in a debugging log statement after the usb_interface structure has already been deallocated.

436) Out-of-bounds read (CVE-ID: CVE-2026-64456)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the virtio-rng driver copy_data() function when processing device-reported used.len values from a virtio-rng backend. A remote attacker can provide a specially crafted length value to disclose sensitive information.

The issue can leak adjacent guest-kernel slab contents through the guest RNG and can also be observed directly via /dev/hwrng. No guest userspace interaction is required for the initial out-of-bounds read to occur.

437) Improper resource shutdown or release (CVE-ID: CVE-2026-64461)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the MediaTek PCIe controller driver when enabling a port fails during setup. A local user can trigger a port initialization failure to cause a denial of service.

The issue occurs in the probe error path after IRQ domains have already been created for the port.

438) Use-after-free (CVE-ID: CVE-2026-64462)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stale pointer in the altera pcie irq handler teardown logic in drivers/pci/controller/pcie-altera.c when handling a probe failure after irq setup. A local user can trigger a driver probe failure to cause a denial of service.

The issue occurs because the chained IRQ handler and INTx IRQ domain can remain configured after probe failure while the associated devm-managed host bridge storage is released.

439) Improper locking (CVE-ID: CVE-2026-64465)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in xhci_free_streams() when freeing USB stream resources during device disconnect. A local user can disconnect a USB device with active stream endpoints to cause a denial of service.

The issue is triggered because memory freeing may sleep while the code is executing in atomic context.

440) Use-after-free (CVE-ID: CVE-2026-64468)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in binder_free_transaction() when freeing binder transactions. A local user can trigger a race condition involving a binder transaction to cause a denial of service.

The issue occurs because the target process can be freed after its reference is read and before its inner lock is acquired.

441) Use-after-free (CVE-ID: CVE-2026-64469)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in binder_thread_release() when releasing binder threads while transactions are being freed in parallel. A local user can trigger concurrent binder transaction activity to cause a denial of service.

The issue is caused by a race condition involving transaction stack cleanup during thread exit and parallel process teardown.

442) Use-after-free (CVE-ID: CVE-2026-64470)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in the btusb probe path in drivers/bluetooth/btusb.c when handling probe failures after Marvell OOB wakeup configuration. A local user can trigger a device probe failure after TX URBs have been submitted to cause a use-after-free.

The issue occurs in the completion callback for submitted TX URBs.

443) Use-after-free (CVE-ID: CVE-2026-64471)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the btusb driver probe error handling in drivers/bluetooth/btusb.c when handling Bluetooth USB controller registration failures and subsequent interface disconnection. A local attacker can trigger controller registration failure to cause a denial of service.

The issue can also result in a double-free when the sibling interfaces are eventually disconnected.

444) Use-after-free (CVE-ID: CVE-2026-64475)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the VGA arbiter callback handling in vfio_pci_core_register_device() when registration of a vfio PCI device fails after VGA arbiter client initialization. A local user can trigger device registration failure and leave a stale callback referencing freed device data to cause a denial of service.

The issue occurs on the error path and depends on a stale VGA arbiter registration remaining after the vfio device state has been freed.

445) NULL pointer dereference (CVE-ID: CVE-2026-64478)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in snd_dualsense_ih_match() when handling repeated device disconnect and reconnect events. A local attacker can trigger a controller disconnect race to cause a denial of service.

The issue can occur when a weak physical connection causes rapid hotplug activity during USB device teardown.

446) Out-of-bounds write (CVE-ID: CVE-2026-64483)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or execute arbitrary code.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in isight_packet() when processing crafted FireWire isochronous packets from a device on the bus during normal capture. An attacker with physical access can provide a malicious device that reports an oversized sample count to cause a denial of service or execute arbitrary code.

Exploitation requires a malicious or faulty Apple iSight device connected on the FireWire bus.

447) NULL pointer dereference (CVE-ID: CVE-2026-64484)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in snd_es1938_mixer() in sound/pci/es1938.c when handling mixer control initialization. A local user can trigger a memory allocation failure and reach the vulnerable code path to cause a denial of service.

448) Out-of-bounds read (CVE-ID: CVE-2026-64487)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to out-of-bounds read in snd_usb_caiaq_tks4_dispatch() when parsing input from a crafted USB device input stream. An attacker with physical access can provide a malformed short final message block to cause a denial of service.

The issue is triggered because the device-controlled input length is not guaranteed to be a multiple of the 16-byte message block size, leading to an unsigned underflow during iteration.

449) NULL pointer dereference (CVE-ID: CVE-2026-64488)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in sound/aoa/fabrics/layout.c when handling control creation failures in layout_attached_codec(). A local user can trigger a memory allocation failure that leads to dereferencing a NULL control pointer to cause a denial of service.

450) Improper resource shutdown or release (CVE-ID: CVE-2026-64494)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in gp2ap002_read_raw() when handling read errors from gp2ap002_get_lux(). A local user can trigger a read operation that causes an error to prevent the device from autosuspending and cause a denial of service.

The issue permanently leaks a runtime PM reference on the error path.

451) Out-of-bounds read (CVE-ID: CVE-2026-64495)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in bmg160_get_filter() and bmg160_set_filter() when handling sysfs input for the in_anglvel_filter_low_pass_3db_frequency interface. A local user can supply a value that is not present in bmg160_samp_freq_table to cause a denial of service.

The issue is reachable from userspace through the sysfs interface.

452) Out-of-bounds read (CVE-ID: CVE-2026-64496)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the iio event FIFO handling in drivers/iio/industrialio-event.c when reading from a newly created event file descriptor concurrently with FIFO reset. A local user can read from the file descriptor from another thread to disclose sensitive information.

Exploitation requires shared file descriptor table access between threads, creating a race window before the fd number is returned to userspace.

453) Integer overflow (CVE-ID: CVE-2026-64497)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect sensor data processing.

The vulnerability exists due to an integer sign-extension bug in the scd30_float_to_fp() function in the SCD30 IIO chemical sensor driver when converting floating-point sensor values. A local user can trigger the conversion of a crafted floating-point value to cause incorrect sensor data processing.

The issue affects the Linux kernel SCD30 sensor driver code path that converts device-provided floating-point values into fixed-point representation.

454) Improper Initialization (CVE-ID: CVE-2026-64500)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in lpc32xx_adc_probe() and the lpc32xx ADC interrupt handling path when handling a spurious interrupt during device probe before completion initialization. A local user can trigger a device state that causes an interrupt to arrive before init_completion() to cause a denial of service.

The issue can lead to a kernel panic through a NULL pointer dereference and resulting wild memory access in the interrupt wake-up path.

455) Improper resource shutdown or release (CVE-ID: CVE-2026-64503)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in kxsd9_write_raw() when handling write requests for scale values with a non-zero integer part. A local user can send a crafted write request to cause a denial of service.

The issue leaks a runtime PM usage-counter reference, which can prevent the device from autosuspending.

456) Stack-based buffer overflow (CVE-ID: CVE-2026-64504)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in __bmc150_accel_fifo_flush() when processing a device-reported FIFO frame count. An attacker with physical access can tamper with the I2C/SPI bus or use a malicious device that reports an oversized frame count to execute arbitrary code or cause a denial of service.

The issue can overwrite the stack canary, saved registers, and return address during FIFO data transfer.

457) Out-of-bounds read (CVE-ID: CVE-2026-64505)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rndis_rm_hdr in the RNDIS USB gadget function when parsing a crafted RNDIS header. A local user can provide a truncated header to cause a denial of service.

458) Use-after-free (CVE-ID: CVE-2026-64510)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the ACPI NFIT core when handling a subsequent ACPI Machine Check Exception after a failed or incomplete NFIT initialization and shutdown path. A local attacker can trigger the vulnerable initialization state to cause a denial of service.

The issue occurs because a freed acpi_desc object may remain referenced in the acpi_descs list and later be accessed by nfit_handle_mce().

459) Improper input validation (CVE-ID: CVE-2026-64512)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the ACPI CPPC register width handling in drivers/acpi/cppc_acpi.c when processing ACPI PCC register definitions. A local attacker can provide a crafted access_width value to trigger a shift-out-of-bounds condition and cause a denial of service.

The issue occurs because the access_width field is reused as a PCC subspace identifier for ACPI_ADR_SPACE_PLATFORM_COMM entries.

460) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64514)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of non-present page table entries in userfaultfd_must_wait() and userfaultfd_huge_must_wait() when checking writability during userfaultfd write-protect fault handling. A local user can trigger a fault involving a swap or migration entry to cause a denial of service.

In the worst case, the affected thread may remain asleep waiting for a wake event that never arrives.

461) Out-of-bounds read (CVE-ID: CVE-2026-64524)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Hyper-V DRM protocol resolution response parser when processing a crafted SYNTHVID_RESOLUTION_RESPONSE message. A remote attacker can send a specially crafted resolution response with an oversized resolution_count value to cause a denial of service.

The issue affects the drm/hyperv code path while parsing supported display resolutions from the host.

462) Out-of-bounds read (CVE-ID: CVE-2026-64527)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hyperv_receive() and hyperv_receive_sub() in the Hyper-V DRM protocol handler when handling oversized or malformed VMBus packets. A remote attacker can send a specially crafted VMBus packet to cause a denial of service.

An error path may report a required packet length larger than the 16 KiB receive buffer, leading the code to use that length unsafely if forwarded for copying.

463) Out-of-bounds read (CVE-ID: CVE-2026-64527)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in hyperv_receive_sub() in the Hyper-V DRM protocol handler when processing crafted VMBus packets. A remote attacker can send a specially crafted VMBus packet to disclose sensitive information.

The issue affects completion-driving message handling and can cause residual data from a prior message to be treated as a valid response payload.

464) Improper locking (CVE-ID: CVE-2026-64528)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable() when console flow control is engaged during transmit state changes. A local user can trigger the affected serial driver code path to cause a denial of service.

The issue occurs because the code attempts to reacquire the same non-recursive spinlock while it is already held on the same CPU.

465) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-64529)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to affect device configuration and control operations.

The vulnerability exists due to an exposed attack surface in the qat_adf_ctl character device and its ioctl interface when handling ioctl requests for device configuration, start, stop, status query, and enumeration. A local user can send crafted ioctl requests to affect device configuration and control operations.

The ioctl interface was not part of any public uAPI header.

466) Use-after-free (CVE-ID: CVE-2026-64530)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tcf_qevent_handle in net/sched/cls_api.c when handling TC_ACT_CONSUMED during qevent processing of fragmented traffic. A local user can send specially crafted fragmented network traffic to trigger use of an skb after ownership has been transferred and cause a denial of service.

Exploitation requires RED qdisc qevents together with ct defragmentation and traffic that produces out-of-order fragments.

467) Out-of-bounds write (CVE-ID: CVE-2026-64532)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in do_action() in fs/ntfs3/fslog.c when processing a crafted on-disk NTFS index entry in UpdateRecordDataRoot or UpdateRecordDataAllocation. A local user can mount or otherwise supply a specially crafted NTFS image to trigger the out-of-bounds write and cause a denial of service.

The issue occurs because view.data_off and the resulting write length are not properly bounded against the NTFS_DE entry size.

468) Out-of-bounds read (CVE-ID: CVE-2026-64533)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in log_replay() in fs/ntfs3 when replaying a malformed NTFS filesystem restart table. A local user can provide a specially crafted filesystem image to cause a denial of service.

The issue occurs during conversion of DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records for version 0 restart tables.

469) Use-after-free (CVE-ID: CVE-2026-64534)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in nvmet_tcp_try_recv_ddgst() when processing a command with a data digest mismatch after request initialization previously failed. A remote attacker can send a specially crafted request to cause a denial of service.

The issue can lead to a refcount underflow, kernel warnings, and a permanent workqueue deadlock.

470) Use-after-free (CVE-ID: CVE-2026-64535)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in the NVMe/TCP target digest error handling in nvmet_tcp_try_recv_ddgst() and queue teardown logic when processing a digest mismatch on a non-final H2C_DATA PDU during an R2T-based data transfer. A remote user can trigger a digest mismatch to cause a denial of service.

Exploitation requires data digest to be enabled on the NVMe/TCP connection.

471) Out-of-bounds read (CVE-ID: CVE-2026-64536)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in is_ap_in_tkip() in drivers/staging/rtl8723bs/core/rtw_wlan_util.c when parsing information elements from network data. A remote attacker can provide a truncated or crafted information element buffer to cause a denial of service.

472) Improper input validation (CVE-ID: CVE-2026-64537)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the bridge cfm ccm transmission logic when configuring an invalid ccm interval. A local user can set an invalid expiration interval to trigger a tight workqueue loop and exhaust memory to cause a denial of service.

The issue can result in immediate re-arming of delayed work and repeated skb allocations until out-of-memory conditions occur.

473) NULL pointer dereference (CVE-ID: CVE-2026-64538)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fib6_nh_mtu_change() when processing router advertisement-driven MTU changes. A remote attacker can send a specially crafted ICMPv6 router advertisement to cause a denial of service.

The issue can occur during interface teardown when the IPv6 device pointer has been cleared while nexthop-backed routes are still being walked.

474) Out-of-bounds read (CVE-ID: CVE-2026-64540)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in genelink_rx_fixup() when processing device-supplied aggregated RX frames from a crafted GeneLink (GL620A) USB device. An attacker with physical access can provide a short URB with inconsistent packet length metadata to disclose sensitive information.

The issue can leak adjacent kernel heap contents to the network stack as soon as the USB network interface is up.

475) Use-after-free (CVE-ID: CVE-2026-64541)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in smc_cdc_rx_handler() when handling SMC-R CDC messages for a connection after releasing conns_lock. A local user can trigger a concurrent socket close while the handler continues to dereference the freed socket to cause a denial of service.

Only SMC-R is affected.

476) Use-after-free (CVE-ID: CVE-2026-64543)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tipc_disc_rcv() when processing TIPC discovery messages on a UDP bearer. A local user can trigger network namespace-accessible TIPC bearer operations and send crafted traffic to cause a denial of service.

Exploitation requires CONFIG_TIPC and CONFIG_TIPC_MEDIA_UDP. The affected functionality is reachable from an unprivileged user namespace because the TIPCv2 generic netlink family is netnsok and its bearer commands do not require GENL_ADMIN_PERM.

477) Out-of-bounds read (CVE-ID: CVE-2026-64544)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in pefile_digest_pe_contents when processing a crafted PE file. A local user can supply a specially crafted PE file to cause a denial of service.

The issue occurs because an unsigned subtraction can underflow after the trailing-data hash length calculation exceeds the PE length, which can lead to a kernel panic on unmapped vmalloc guard pages.

478) NULL pointer dereference (CVE-ID: CVE-2026-64545)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in xdp_master_redirect() when processing XDP_TX on a bond slave during upper-master unlinking. A local user can trigger packet processing in this race window to cause a denial of service.

The issue can lead to a kernel panic when the receiving device no longer has an upper-master adjacency but is still treated as a bond slave.

479) Out-of-bounds read (CVE-ID: CVE-2026-64546)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in drm_parse_tiled_block() when parsing a crafted DisplayID tiled-display block in EDID data. A local user can supply crafted EDID data with a truncated tiled-display block to disclose sensitive information.

The issue is triggered when the tiled-display block declares a small payload length near the end of a DisplayID extension.

480) Out-of-bounds read (CVE-ID: CVE-2026-64547)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in net1080_rx_fixup() when processing a crafted short frame from a malicious NetChip 1080 device. An attacker with physical access can send a frame advertising a large even packet length to cause a denial of service.

481) Integer overflow (CVE-ID: CVE-2026-64548)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow leading to an out-of-bounds write in bpf_msg_push_data() when processing a crafted len value in the copy fallback path. A local user can supply a crafted len value to cause a denial of service.

Exploitation requires access to BPF-driven sockmap message processing and occurs when the scatterlist ring is full or nearly full.

482) Out-of-bounds read (CVE-ID: CVE-2026-64549)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in bpa10x_setup() when processing a crafted device response to the vendor command. An attacker with physical access can return a one-byte or unterminated response to disclose sensitive information.

The out-of-bounds data may be exposed through the kernel log and the firmware-info debugfs file.

483) Out-of-bounds read (CVE-ID: CVE-2026-64550)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rmnet_map_ingress_handler() and __rmnet_map_ingress_handler() when processing a crafted short MAP frame on the no-aggregation ingress path. A local user can send a specially crafted frame to disclose sensitive information.

The issue occurs when ingress deaggregation is disabled, causing packet parsing to use the on-wire packet length without verifying skb->len first.

484) Out-of-bounds read (CVE-ID: CVE-2026-64551)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized memory.

The vulnerability exists due to an out-of-bounds read in sctp_sf_do_5_2_6_stale() when processing an ERROR chunk with a STALE_COOKIE cause in the COOKIE_ECHOED state. A local user can send a specially crafted SCTP packet to disclose uninitialized memory.

The leaked value is echoed to the peer in the Cookie Preservative of the reply INIT. Exploitation is reachable by a peer that can drive an association into COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket in a user and network namespace.

485) Information disclosure (CVE-ID: CVE-2026-64553)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an information leak caused by improper clearing of padding bytes in PSAMPLE_ATTR_DATA handling in net/psample/psample.c when copying packet data into a netlink attribute. A local user can trigger processing of packet data whose length is not divisible by 4 bytes to disclose sensitive information.

The issue occurs because netlink attributes are padded to 4-byte boundaries.

486) Use-after-free (CVE-ID: CVE-2026-64554)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in br_ip6_fragment() when processing crafted IPv6 packets on a cloned skb. A local user can send a specially crafted packet to cause a denial of service.

The issue results from dereferencing a stale prevhdr pointer after skb_checksum_help() reallocates the skb head, and the resulting write can trigger a kernel panic.

487) Use-after-free (CVE-ID: CVE-2026-64560)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the posix CPU timers subsystem when handling a non-leader exec() race involving POSIX CPU timer deletion, setting, or rearming. A local user can trigger concurrent exec() and timer operations to execute arbitrary code.

The issue occurs when a TGID-targeted timer remains inherited across exec(), and can also cause user-visible transient -ESRCH errors or prevent timer rearming.

488) Improper Initialization (CVE-ID: CVE-2026-64561)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the KVM x86 shadow MMU page fault handling code when processing stale page faults after reclaiming shadow pages. A local user can trigger page faults that lead KVM to map memory into an invalid root to cause a denial of service.

The issue occurs when reclaiming shadow pages invalidates an in-use root, causing child shadow pages created during map or fetch operations to inherit an invalid role and violate the invariant that invalid shadow pages must not appear on the list of active MMU pages.

489) Use-after-free (CVE-ID: CVE-2026-64562)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in KVM nested VMX shadow VMCS handling when freeing nested virtualization state asynchronously with respect to loaded VMCS clearing during vCPU migration. A local user can trigger nested virtualization cleanup and vCPU migration to execute VMCLEAR on a freed shadow VMCS and cause a denial of service.

The issue occurs because vmcs01 may still reference the shadow VMCS until explicit VMCLEAR completes.

490) Use-after-free (CVE-ID: CVE-2026-64563)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in rhashtable_walk_next in the rhashtable iterator logic when resuming multi-fragment rhashtable walks across walk_stop and walk_start boundaries after a table restart. A local user can trigger a stale iterator pointer dereference to cause a denial of service.

Concrete affected call paths include netlink_diag and TIPC.

491) Use-after-free (CVE-ID: CVE-2026-64564)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in sctp_process_asconf_param() when processing crafted SCTP ASCONF DEL-IP parameters. A remote attacker can send a specially crafted SCTP ASCONF message to cause a denial of service.

The issue can occur when a single ASCONF carries DEL-IP parameters that free the cached transport and a later wildcard DEL-IP reuses the dangling transport pointer.

492) Heap-based buffer overflow (CVE-ID: CVE-2026-64565)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in ims_pcu_handle_response() when processing oversized packets from a malicious USB device. An attacker with physical access can send a specially crafted oversized USB packet to execute arbitrary code.

The issue arises because ims_pcu_process_data() does not properly bound-check read_pos, allowing it to be overwritten and later used as a controlled index during response handling.

493) Out-of-bounds read (CVE-ID: CVE-2026-64567)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in io_ctl_check_crc() in the btrfs free space cache loader when loading a corrupted v1 free space cache. A local user can modify free space cache header counts to exceed the number of allocated pages to cause a denial of service.

The invalid out-of-bounds slot is treated as a struct page and can lead to a general protection fault during crc32c() processing.

494) NULL pointer dereference (CVE-ID: CVE-2026-64569)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mpls_valid_fib_dump_req() when handling an RTM_GETROUTE dump request for AF_MPLS with strict checking and no RTA_OIF attribute. A local user can send a specially crafted netlink request to cause a denial of service.

The issue affects CONFIG_INET=n builds.

495) Out-of-bounds read (CVE-ID: CVE-2026-64571)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in p54_rx_eeprom_readback() when processing a device-supplied EEPROM readback frame. An attacker with physical access can send a truncated frame with a matching advertised length to disclose sensitive information.

The issue can be triggered by a malicious USB device.

496) Use-after-free (CVE-ID: CVE-2026-64572)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib_table_lookup() and the IPv4 FIB alias list handling in fib_trie.c when processing concurrent route insertion failure and lookup operations. A local privileged user can trigger a route insertion error path and perform a concurrent lookup to cause a denial of service.

Exploitation requires CAP_NET_ADMIN and a registered FIB notifier that can reject a route, such as when an IPv4 FIB resource is exhausted on a netdevsim device.

497) Integer underflow (CVE-ID: CVE-2026-64573)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in the qca_tlv_check_data() TLV parser when parsing a crafted firmware TLV with an undersized NVM tag length. A local user can supply a specially crafted firmware image to trigger out-of-bounds access and cause a denial of service.

The issue is caused by an integer underflow in the loop bound calculation for TLV_TYPE_NVM records.

498) Use of Uninitialized Variable (CVE-ID: CVE-2026-64576)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in nh_res_bucket_migrate() when handling rtnetlink nexthop operations. A local user can send a specially crafted netlink message to cause a denial of service.

The issue can lead to a general protection fault and kernel panic when an error path dereferences an uninitialized extack message pointer.

499) Out-of-bounds read (CVE-ID: CVE-2026-64578)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ksmbd_smb2_check_message() when processing a crafted compound SMB2 request. A remote attacker can send a specially crafted compound request with a trailing element that is too small to hold StructureSize2 to disclose sensitive information.

The issue occurs when the last compound element contains only a 64-byte SMB2 header, causing a 2-byte read at offset 64 to extend past the receive buffer.

500) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64579)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in xfrm_hash_rebuild() in the xfrm policy subsystem when rebuilding policy hashes under memory pressure. A local user can trigger policy reinsertions that take the allocating inexact insertion path and cause a kernel crash.

The issue is reachable under memory pressure and can be triggered deterministically with failslab.

501) Double free (CVE-ID: CVE-2026-64581)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in xfrm_user_policy() when racing a per-socket policy change with packet transmission on a connected UDP socket. A local user can trigger concurrent socket operations to cause a denial of service.

The issue is reachable by an unprivileged user via a user and network namespace.

502) Use-after-free (CVE-ID: CVE-2026-64582)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in rxe_mmap in the RDMA/rxe subsystem when processing a memory mapping request concurrently with a DESTROY_CQ ioctl. A local user can trigger a race condition to cause a denial of service or execute arbitrary code.

Exploitation requires winning a narrow race window between the mmap path and concurrent object destruction.

503) Use-after-free (CVE-ID: CVE-2026-64583)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Broadcom BDC USB gadget UDC driver IRQ handler and delayed work processing when tearing down the driver during device removal. A local user can trigger a shared interrupt or delayed work execution during teardown to cause a denial of service.

The issue occurs in the window after teardown of endpoint and DMA-related structures begins while the IRQ handler remains deliverable, and delayed work may also execute after removal.

504) Use-after-free (CVE-ID: CVE-2026-64584)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the f_midi driver work handler when handling concurrent userspace writes to an open rawmidi substream during device teardown. A local user can write to a rawmidi substream to trigger pending work on a freed midi object and cause a denial of service.

The issue occurs because the rawmidi device can remain usable by an open substream after USB endpoints have been disabled and before the final midi object reference is released.

505) Use-after-free (CVE-ID: CVE-2026-64585)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in esd_usb_disconnect() and unlink_all_urbs() when handling USB device disconnect events. A local user can trigger a device disconnect condition to cause a denial of service.

The issue occurs because per-netdev private data embedded in the net_device allocation is dereferenced after free during teardown.

506) Use-after-free (CVE-ID: CVE-2026-64586)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the brcmfmac bus_reset work handling when a reset is scheduled during device removal. A local user can trigger a bus reset through the debugfs "reset" entry to cause a denial of service.

The issue affects shared bus_reset work across PCIe, SDIO, and USB removal paths, and brcmf_fw_crashed() could also be triggered before driver attachment completed.

507) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-64590)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of overlapping dma mappings in udmabuf scatter-gather table mapping when importing a udmabuf into a DRM driver with DMA API debug enabled. A local user can import a udmabuf to trigger a kernel warning to cause a denial of service.

The issue is observed when CONFIG_DMA_API_DEBUG_SG is enabled.

508) NULL pointer dereference (CVE-ID: CVE-2026-64593)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in btrfs_trim_free_extents in the Btrfs filesystem when processing a FITRIM ioctl on a rescanned device that is not writeable. A local user can issue a trim request to trigger a kernel crash and cause a denial of service.

The issue occurs when a previously missing device is rescanned, clearing the missing-device state while the block device pointer remains NULL.

509) Improper Initialization (CVE-ID: CVE-2026-64594)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in reset_work handling in the functionfs gadget subsystem when unmounting a functionfs instance. A local user can unmount a crafted or affected functionfs instance to cause a denial of service.

The issue is triggered in the common case where the instance was never deactivated, including when it is not mounted with the "no_disconnect" option.

510) Double free (CVE-ID: CVE-2026-64599)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in meson_crypto_probe() when handling a failure after partial channel list allocation during device probe. A local user can trigger the vulnerable probe path to cause a denial of service.

The issue was reproduced by forcing the second dma_alloc_attrs() call in the gxl-crypto probe path to fail after partial initialization.

511) Race condition (CVE-ID: CVE-2026-64600)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in xfs_reflink_fill_cow_hole and xfs_reflink_fill_delalloc in the XFS reflink code when processing direct I/O writes after cycling the ILOCK. A local user can trigger a racing direct I/O write operation to cause a denial of service.

The issue occurs because a stale data fork mapping can be used after the ILOCK is dropped and reacquired, which can result in incorrect shared-block state during copy-on-write handling.

512) Access of Uninitialized Pointer (CVE-ID: CVE-2026-64602)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an uninitialized pointer dereference in the spear_adc_probe() initialization path and interrupt handler in drivers/iio/adc/spear_adc.c when handling a device interrupt before completion initialization. A local user can trigger a spurious interrupt during device probe to cause a denial of service.

The issue can lead to a kernel panic and was observed as a KASAN wild-memory-access caused by complete() operating on an uninitialized completion object.

513) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-64604)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state handling in vmx_update_cr8_intercept when creating a vCPU outside guest mode. A local user can issue crafted KVM vCPU creation operations to cause a denial of service.

The issue can trigger a kernel warning due to calling get_vmcs12() when the vCPU is not in guest mode.

514) Out-of-bounds read (CVE-ID: CVE-2026-68082)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in decode_lockers() in net/ceph/cls_lock_client.c when parsing OSD-supplied lock information. A remote user can send a specially crafted OSD reply to disclose sensitive information.

Exploitation requires control of a malicious or compromised OSD and can be triggered against kernel clients that issue the lock.get_info class method, such as during RBD exclusive lock acquisition in a multi-tenant Ceph deployment.

515) Out-of-bounds read (CVE-ID: CVE-2026-68088)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rndis_query_response() in the RNDIS USB gadget function when processing a crafted RNDIS query message. A remote attacker can send a specially crafted RNDIS query message to cause a denial of service.

516) Race condition (CVE-ID: CVE-2026-68090)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in debugobjects in lib/debugobjects.c when handling object activation or initialization assertions during a concurrent out-of-memory disable. A local user can trigger debug object operations while forcing a concurrent memory exhaustion condition to cause a denial of service.

The issue can cause a valid timer object to become nonfunctional through an unintended fixup path.

517) Improper resource shutdown or release (CVE-ID: CVE-2026-68091)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in wacom_parse_and_register() in the Wacom HID driver when handling post-start probe failures. A local user can trigger a device initialization failure after HID hardware has been started to cause a denial of service.

518) Deadlock (CVE-ID: CVE-2026-68096)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a recursive locking deadlock in audit_dupe_exe() in the Linux kernel audit subsystem when handling file move events for executable audit rules. A local user can move a file that matches an existing executable audit rule to cause a denial of service.

Exploitation requires an existing executable audit rule that matches the file being moved.

519) Use-after-free (CVE-ID: CVE-2026-68104)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the amdgpu ACP power management domain cleanup logic when removing the ACP power domain. A local user can trigger the affected cleanup path to cause a denial of service.

520) Division by zero (CVE-ID: CVE-2026-68106)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in the amdgpu UVD H264 and H264 Perf decode paths when processing crafted frame dimensions with a width or height less than 16. A local user can submit crafted decoding parameters to cause a denial of service.

521) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68111)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in the amdgpu gfx_v9_0 driver when processing misaligned GPU buffer or address values. A local user can trigger BUG_ON() assertions with crafted alignment-related values to cause a denial of service.

The issue results in a kernel crash instead of a warning when alignment checks fail.

522) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68115)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in the amdgpu gfx_v10 code when processing misaligned GPU addresses. A local user can trigger a BUG_ON condition to cause a denial of service.

523) Use-after-free (CVE-ID: CVE-2026-68117)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tipc_sk_create() and tipc_release() in the TIPC socket handling code when handling a failed accept() path after socket insertion failure. A local user can trigger creation of a large number of TIPC sockets and invoke accept() to cause a denial of service.

The issue is reached when the per-netns TIPC socket rhashtable hits its maximum size, leaving a pre-allocated child socket with a dangling sock->sk pointer during release.

524) Use-after-free (CVE-ID: CVE-2026-68121)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in pppoe_sendmsg() when handling a blocked send while a non-Ethernet port is added to an empty team device. A local user can trigger skb head reallocation and subsequent writes through a stale PPPoE header pointer to cause memory corruption.

The issue occurs because device header callbacks may reallocate the skb head and invalidate saved pointers into it.

525) Integer underflow (CVE-ID: CVE-2026-68123)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow in queue_userspace_packet() in the openvswitch subsystem when processing userspace actions on segmented gso packets after truncation. A local user can send a specially crafted packet that triggers truncation and segmentation handling to cause a denial of service.

The issue occurs because truncation state is reused across smaller gso segments, allowing the preserved length value to exceed the current packet length.

526) Out-of-bounds read (CVE-ID: CVE-2026-68125)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in llsec_do_decrypt_auth() when processing crafted IEEE 802.15.4 secured frames with payloads shorter than the authentication tag. A remote attacker can send a specially crafted frame to cause a denial of service.

The crafted frame can reach the vulnerable path from an IEEE 802.15.4 peer in radio range.

527) Use-after-free (CVE-ID: CVE-2026-68127)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to use-after-free in ila_update_ipv6_locator() and ila_csum_adjust_transport() when processing a crafted IPv6 packet routed through a configured ILA checksum-adjust-transport route or receive-side mapping. A remote attacker can send a specially crafted IPv6 packet to trigger a use-after-free.

Exploitation requires a configured ILA checksum-adjust-transport route or receive-side mapping.

528) Resource exhaustion (CVE-ID: CVE-2026-68129)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource handling in the gve Rx queue handling logic when processing received packets under extreme memory pressure. A local user can trigger page allocation failures that leave too few descriptors posted to hardware to cause a denial of service.

The issue can result in a permanent Rx queue stall because no receive completions are generated, preventing NAPI from being scheduled again.

529) Improper access control (CVE-ID: CVE-2026-68130)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in ntlm_authenticate() when processing an NTLM authentication request containing a crafted username field and PreviousSessionId. A remote user can supply a username matching a victim account and a victim session identifier to cause a denial of service.

The issue can destroy another user's SMB session before the NTLMv2 response is validated.

530) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68131)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of positive result codes in drivers/block/rbd.c when processing a corrupted reply to an object map update request. A remote attacker can send a corrupted reply to trigger an assertion and cause a denial of service.

The issue is triggered in the RBD object map update path for write requests.

531) Deadlock (CVE-ID: CVE-2026-68132)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in the emergency thaw worker in fs/super.c when thawing frozen block devices. A local user can trigger emergency thaw handling to cause a denial of service.

The issue can deadlock against itself while reacquiring s_umount and can block subsequent unmount, freeze, or thaw operations for the affected filesystem and block device.

532) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68135)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in the hip04_rx_poll() receive path when handling a build_skb() failure. A local user can trigger build_skb() failures to cause a denial of service.

The issue leaks an RX buffer and its DMA mapping when slot references are overwritten, and also involves a newly allocated RX fragment if dma_map_single() fails.

533) Use-after-free (CVE-ID: CVE-2026-68137)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in x25_kill_by_neigh() when handling termination of an X.25 neighbour while walking the global X.25 socket list. A local user can trigger concurrent socket release and neighbour teardown operations to cause a denial of service.

The issue is triggered by a race condition after the list lock is dropped and before the socket lifetime is pinned.

534) Race condition (CVE-ID: CVE-2026-68138)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to use-after-free and double-free in qdisc_get_rtab() and qdisc_put_rtab() when processing concurrent RTM_NEWTFILTER requests that add flower filters with a police action carrying the same rate. A local user can send concurrent netlink filter configuration requests to cause a denial of service.

The corrupted qdisc_rate_table object is shared system-wide because the affected rate-table list is process-global rather than per-network-namespace.

535) Use-after-free (CVE-ID: CVE-2026-68140)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the af_iucv message queue handling when processing queued message notifications after a connection is severed. A local user can trigger connection severing with queued notifications still pending and then invoke recvmsg() to cause a denial of service.

The issue occurs because queued notifications retain stale references to a freed iucv_path.

536) NULL pointer dereference (CVE-ID: CVE-2026-68141)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in afiucv_hs_callback_syn() when handling connection requests that enter the connection-refused path after child socket allocation fails. A local user can trigger this condition to cause a denial of service.

The issue occurs because the code calls iucv_sock_kill() with a NULL child socket pointer.

537) Improper access control (CVE-ID: CVE-2026-68142)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify Geneve tunnel device configuration in another network namespace.

The vulnerability exists due to improper access control in geneve_changelink() when handling rtnetlink changelink requests for a Geneve device whose underlay network namespace differs from the device network namespace. A local privileged user can send a specially crafted changelink request to modify Geneve tunnel settings in the underlay network namespace.

The issue arises when the Geneve device has been created in or moved to a different network namespace than the one associated with its underlay sockets.

538) Race condition (CVE-ID: CVE-2026-68143)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to an out-of-bounds write and use-after-free in slip_receive_buf() and sl_realloc_bufs() when processing received SLIP data during a concurrent MTU change. A local user can trigger receive processing while racing an MTU change to cause a denial of service or execute arbitrary code.

539) Use-after-free (CVE-ID: CVE-2026-68144)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in pep_get_sb() when processing Phonet socket buffer data. A remote attacker can send a specially crafted network packet to cause a denial of service.

540) Race condition (CVE-ID: CVE-2026-68146)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ftrace trace_parser handling in ftrace_regex_write(), ftrace_graph_write(), ftrace_regex_release(), and ftrace_graph_release() when processing concurrent writes and release operations on a shared trace file descriptor. A local user can issue concurrent operations from multiple threads to cause a denial of service.

The issue occurs when a userspace process shares an opened trace file descriptor across multiple threads, causing corruption of the parser's internal state fields.

541) Improper resource shutdown or release (CVE-ID: CVE-2026-68151)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the binfmt_elf_fdpic PT_INTERP program header handling when processing a crafted FDPIC ELF binary. A local user can execute a specially crafted binary to cause a denial of service.

The issue can be triggered repeatedly, and the affected file may remain unwritable for as long as the system runs.

542) Use-after-free (CVE-ID: CVE-2026-68153)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the monmap debugfs file handler when processing a concurrent read during client teardown. A local user can read the monmap debugfs file during teardown to cause a denial of service.

The issue is triggered by a race condition between debugfs access and ceph client teardown.

543) Out-of-bounds read (CVE-ID: CVE-2026-68154)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in crush_decode and the CRUSH mapper when parsing a malformed CRUSH map. A local user can supply a crafted CRUSH map with a zero bucket type to cause a denial of service.

The issue arises because bucket type 0 is reserved for devices, and an invalid map can make the mapper treat a negative bucket ID as a device and index the OSD weight array with a negative value.

544) Improper input validation (CVE-ID: CVE-2026-68155)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ceph_monmap_decode() when processing a CEPH_MSG_MON_MAP monmap message. A remote attacker can send a specially crafted monmap advertising zero monitors to cause a denial of service.

The issue is triggered when the client later attempts to open a session with a monitor, causing an assertion in pick_new_mon() to fire.

545) Use-after-free (CVE-ID: CVE-2026-68156)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Ceph authorizer handling code when processing a rebuilt authorizer during a messenger reconnect. A local user can trigger an authorizer update that reallocates the buffer and then cause a reconnect to use a stale pointer to cause a denial of service.

The issue is triggered when a newer service ticket causes the authorizer to be rebuilt and the rebuilt authorizer no longer fits in the existing buffer.

546) NULL pointer dereference (CVE-ID: CVE-2026-68157)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in get_immediate_parent() in net/ceph/osdmap.c when processing malformed CRUSH hierarchy metadata during localized read selection. A local user can trigger lookup of a parent bucket whose type has no matching entry in type_names to cause a denial of service.

The issue occurs when a parent bucket name exists in the CRUSH map but its type name metadata is missing, causing an invalid pointer to be passed to strcmp().

547) Integer overflow (CVE-ID: CVE-2026-68158)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer overflow in decode_new_up_state_weight() when processing a corrupted CEPH_MSG_OSD_MAP message containing a crafted osdmap. A remote attacker can send a specially crafted message to disclose sensitive information.

The issue can lead to out-of-bounds reads while decoding the new_state portion of the osdmap.

548) Out-of-bounds write (CVE-ID: CVE-2026-68159)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack out-of-bounds write in __decode_pg_temp(), __decode_pg_upmap_items(), and OSDMap handling in net/ceph/osdmap.c when processing a crafted OSDMap containing an oversized pg_temp, pg_upmap, or pg_upmap_items entry. A remote attacker can send a specially crafted OSDMap entry to cause a denial of service.

The issue is triggered when the decoded list is later copied into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE].

549) Out-of-bounds read (CVE-ID: CVE-2026-68160)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ceph_handle_caps() and ceph_update_snap_trace() when processing a crafted Ceph MDS caps message with a malicious snap_trace_len value. A remote attacker can send a specially crafted message to disclose sensitive information.

Exploitation requires a malicious or compromised MDS to send a version 1 message so the IMPORT path is reached without prior version-gated validation of snap_trace_len.

550) Use-after-free (CVE-ID: CVE-2026-68162)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the SCTP auth_enable sysctl handler when handling writes to an already opened sysctl file during network namespace teardown. A local user can write to the auth_enable sysctl entry to cause a denial of service.

The issue is exposed during initialization before the SCTP control socket exists and during teardown after the control socket has been released.

551) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68175)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in the mmiotrace tracer trace_pipe handling when closing the trace_pipe file with the mmiotrace tracer active. A local user can repeatedly open and close trace_pipe to cause a denial of service.

If the trace_pipe is read to completion, the resources are cleaned up; repeated partial reads such as reading a single line can trigger a large leak.

552) NULL pointer dereference (CVE-ID: CVE-2026-68176)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mmiotrace read() function when reading mmiotrace data after mmio_pipe_open() fails to find a PCI device. A local user can trigger the vulnerable read path to cause a denial of service.

553) Improper resource shutdown or release (CVE-ID: CVE-2026-68180)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the intel_th MSC output release path when opening and closing MSC output files. A local user can repeatedly open MSC output files to cause a denial of service.

Each successful MSC output open leaks one device reference because the release callback used for MSC outputs does not drop the reference acquired during open.

554) Improper Initialization (CVE-ID: CVE-2026-68182)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the comedi_parport interrupt handler and attach logic when handling interrupts during device attachment. A local user can supply a crafted I/O port base address or trigger a premature interrupt to cause a denial of service.

The issue can occur if the interrupt handler runs before the comedi device is fully attached, including when a user-supplied I/O port base address is not backed by real parallel port hardware.

555) Improper resource shutdown or release (CVE-ID: CVE-2026-68183)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the stratix10-svc memory management code when freeing allocated memory after failed lookups. A local user can trigger memory allocation and free operations to cause a denial of service.

556) Out-of-bounds read (CVE-ID: CVE-2026-68184)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a stack out-of-bounds read in mmc_ioctl_cdrom_volume() when processing the CDROMVOLCTRL ioctl on drives that return a non-zero block descriptor length. A local user can invoke the CDROMVOLCTRL ioctl to disclose sensitive information.

The issue is not triggered by CDROMVOLREAD and only occurs on drives that report a non-zero block descriptor length.

557) NULL pointer dereference (CVE-ID: CVE-2026-68186)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in load_misc_binary() and begin_new_exec() when processing a binfmt_misc entry with the open-binary flag after an interpreter open fails with -ENOEXEC. A local user can register a crafted binfmt_misc entry and execute a matching native ELF binary to cause a denial of service.

Exploitation requires binfmt_misc to be mountable in a user namespace and relies on the interpreter being located on a FUSE mount whose server fails the open request with -ENOEXEC.

558) Out-of-bounds read (CVE-ID: CVE-2026-68187)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in transfer_args_to_stack() when processing execve arguments on affected no-MMU builds. A local user can supply an excessively long argument or environment string to trigger the faulty loop behavior and cause a denial of service.

Only CONFIG_MMU=n builds are affected, and the vulnerable code path is used by binfmt_flat and binfmt_elf_fdpic.

559) Use-after-free (CVE-ID: CVE-2026-68188)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in rfcomm_tty_set_termios() and rfcomm_send_rpn() when handling TTY ioctl requests on an RFCOMM device during a concurrent session teardown. A local user can trigger a race condition to cause a denial of service or execute arbitrary code.

The issue is caused by concurrent access to dlc->session without proper locking while krfcommd can unlink the DLC and free the associated session.

560) Out-of-bounds read (CVE-ID: CVE-2026-68190)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the rtw_get_wps_ie() function when parsing IE data from network frames. A remote attacker can send a specially crafted network frame to cause a denial of service.

561) Double free (CVE-ID: CVE-2026-68192)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in brcmf_pcie_release_scratchbuffers() when releasing scratch and ring update DMA buffers during reset and device removal. A local user can trigger repeated sequential release to cause a denial of service.

The issue occurs when reset teardown runs before device removal, causing the same DMA allocation to be freed a second time.

562) NULL pointer dereference (CVE-ID: CVE-2026-68195)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mt7615_rx_check() and mt7615_queue_rx_skb() when processing PKT_TYPE_TXRX_NOTIFY on non-mmio buses. A local user can trigger the RX worker to handle a crafted TXRX_NOTIFY event to cause a denial of service.

The issue affects mt7663 USB and SDIO buses where the tx_cleanup callback is NULL.

563) Out-of-bounds read (CVE-ID: CVE-2026-68196)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in wilc_parse_assoc_resp_info() in the wilc1000 driver when parsing a received association response. A remote attacker can send a specially crafted short association response frame to disclose sensitive information.

A response shorter than the 6-byte fixed header can trigger the issue, and a response shorter than four bytes may cause an out-of-bounds read of status_code at offsets 2 and 3.

564) NULL pointer dereference (CVE-ID: CVE-2026-68197)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mwifiex_tdls_add_ht_oper() when setting up a TDLS link to a peer while associated with an access point that advertises HT Capabilities but omits the HT Operation element. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the driver checks bcn_ht_cap but dereferences bcn_ht_oper, which may remain NULL after beacon parsing.

565) Use-after-free (CVE-ID: CVE-2026-68198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in aggr_reset_state() in the ath6kl wireless driver when handling a race between timer callback execution and TID state teardown. A local user can trigger the race condition to cause a denial of service.

The timer callback may continue accessing rx_tid[] and stat[] fields after the associated aggr_conn structure is freed, and it can re-arm itself while the reset routine is running.

566) Out-of-bounds read (CVE-ID: CVE-2026-68199)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in aggr_recv_addba_req_evt() in the ath6kl wireless driver when processing a firmware-supplied ADDBA window size. A remote attacker can supply a crafted window size value to cause a denial of service.

The issue arises because an out-of-range window size can lead to a zero-size or overflowed allocation before subsequent memory access.

567) Use-after-free (CVE-ID: CVE-2026-68202)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ALSA sequencer queue timer handling in snd_seq_timer_delete() and related queue destruction logic when accessing /dev/snd/seq and re-opening a queue timer during queue teardown. A local user can issue crafted sequencer operations to leave a timer instance live and trigger a dereference of freed queue memory to cause a denial of service.

No queue ownership is required.

568) Race condition (CVE-ID: CVE-2026-68204)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unexpected results.

The vulnerability exists due to improper state management in vivid_update_format_cap() and vivid_update_format_out() when changing CROP, COMPOSE, or SCALE capability controls after REQBUFS and before STREAMON while the queue state is not properly enforced. A local user can change these controls to cause unexpected results.

The issue affects the vivid media test driver during the window between buffer request setup and the start of streaming.

569) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68205)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper ownership handling in v4l2_async_register_subdev_sensor() when registering a V4L2 subdevice sensor asynchronously. A local user can trigger registration of a crafted or removable sensor driver module to cause a denial of service.

The issue can leave the sensor driver's module owner unset, allowing the module to be removed while the subdevice is still in use by a notifier such as a CSI-2 receiver bridge driver.

570) Improper resource shutdown or release (CVE-ID: CVE-2026-68209)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the sun4i_csi_start_streaming() path of the sun4i-csi driver when handling streaming startup with an unsupported CSI format. A local user can trigger streaming initialization with a format that has no matching CSI format to cause a denial of service.

The issue occurs because queued video buffers are not returned on the error path after they have already been handed to the driver by the vb2 framework.

571) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68212)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in saa7134_video_init1 in the saa7134 video driver when probing a device and initializing video and VBI queues. A local user can trigger initialization failures that leave allocated resources unreleased and may result in use of uninitialized DMA resources to cause a denial of service.

The issue occurs during device probing before the device is fully registered, so the normal cleanup path is not executed.

572) Improper resource shutdown or release (CVE-ID: CVE-2026-68213)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in rtl2832_sdr_start_streaming() and queued buffer handling when handling start_streaming() failures. A local user can trigger a streaming start failure to cause a denial of service.

The issue occurs because buffers queued before streaming are not returned to the videobuf2 framework on error paths, which can trigger a WARN_ON and leak queued buffers.

573) Use-after-free (CVE-ID: CVE-2026-68214)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in rtl2832_remove() when removing a device while concurrent I2C transfers are still in flight through the mux adapter. A local user can trigger device removal during concurrent I2C activity to cause a denial of service.

The issue arises because delayed work may be rescheduled after cancellation by a concurrent thread during device teardown.

574) Improper resource shutdown or release (CVE-ID: CVE-2026-68215)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the si476x radio driver probe error path when handling device initialization failures. A local user can trigger a probe failure to cause a denial of service.

575) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68216)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in start_streaming() in the pwc USB camera driver when handling queued video buffers during streaming startup failure conditions. A local user can trigger a streaming startup failure to cause a denial of service.

The issue can be triggered when the USB device is already disconnected or when locking is interrupted by a signal.

576) Improper resource shutdown or release (CVE-ID: CVE-2026-68217)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in start_streaming() in the pwc USB media driver when handling a start_streaming() failure after isochronous URB submission. A local user can trigger a streaming start failure to cause a denial of service.

The issue occurs because a buffer moved from queued_bufs into fill_buf is not drained on the error path, which leads to a WARN_ON(owned_by_drv_count).

577) Improper resource shutdown or release (CVE-ID: CVE-2026-68218)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the dm1105 driver remove() callback when removing the device. A local user can trigger device removal to cause a denial of service.

578) Improper resource shutdown or release (CVE-ID: CVE-2026-68222)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in msi2500_start_streaming() and queued buffer cleanup handling when starting streaming after buffers have been queued by the vb2 framework. A local user can trigger start_streaming() error paths to cause a denial of service.

The issue occurs on multiple start_streaming() failure paths, including device disconnect, interrupted locking, USB ADC setup failure, isochronous initialization failure, and streaming command failure. In some cases, queued buffers are not returned as expected and submitted isochronous URBs may remain active without being consumable by the driver.

579) Improper resource shutdown or release (CVE-ID: CVE-2026-68223)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the vdec_open() function when opening the video decoder device and initialization of controls fails. A local user can open the device to cause a denial of service.

The issue occurs in the error path after m2m context allocation, resulting in a kernel memory leak.

580) NULL pointer dereference (CVE-ID: CVE-2026-68226)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in cx23885_dev_setup() in the cx23885 driver when handling a memory mapping failure for PCI BAR0. A local attacker can trigger the vulnerable code path to cause a denial of service.

581) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68227)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource lifetime management in the cx231xx USB media driver when the driver is unbound from a USB interface without physical device disconnection. A local user can trigger driver unbind or reconfiguration conditions to cause a denial of service.

The issue can be triggered during probe deferral or configuration changes.

582) Out-of-bounds read (CVE-ID: CVE-2026-68229)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in _cedrus_write_ref_list() when processing malformed or unsupported H.264 reference list entries. A local user can provide crafted stateless slice control reference list entries to disclose sensitive information.

583) Improper resource shutdown or release (CVE-ID: CVE-2026-68231)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in airspy_start_streaming() in the airspy USB media driver when starting streaming after the USB device has been disconnected. A local user can trigger streaming with queued buffers present to cause a denial of service.

The issue occurs because buffers accepted before start_streaming() are not returned on the error path.

584) Improper resource shutdown or release (CVE-ID: CVE-2026-68234)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in amdgpu_bo_create_reserved() when handling repeated calls with a non-NULL BO pointer. A local user can trigger repeated resume or firmware buffer reload operations to cause a denial of service.

The issue occurs because repeated calls increase the BO pin count, while teardown only removes a single pin reference, preventing the buffer object from being moved, swapped, or evicted.

585) Double free (CVE-ID: CVE-2026-68236)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in dm_update_crtc_state() in the AMD display manager when handling error paths after releasing new_stream on the skip_modeset path. A local user can trigger a later error condition after the initial release to cause a denial of service.

The issue occurs because a dangling pointer may be released again after a color management failure reaches the fail label.

586) NULL pointer dereference (CVE-ID: CVE-2026-68243)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the i915 GEM context SSEU parameter handling in set_proto_ctx_sseu() when applying I915_CONTEXT_PARAM_SSEU to a context engine slot previously set to I915_ENGINE_CLASS_INVALID or I915_ENGINE_CLASS_INVALID_NONE. A local user can configure the same slot and trigger the affected operation to cause a denial of service.

587) Memory leak (CVE-ID: CVE-2026-68244)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the i915 GEM proto context creation extension handling when processing user extensions after a successful BALANCE/PARALLEL_SUBMIT extension. A local user can submit crafted context creation extensions to cause a denial of service.

The issue occurs when an error is triggered while processing a subsequent user extension after BALANCE/PARALLEL_SUBMIT has already succeeded.

588) NULL pointer dereference (CVE-ID: CVE-2026-68248)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in active_instance in the i915 DRM driver when handling memory allocation failure during GFP_ATOMIC allocation. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when kmem_cache_alloc returns NULL and the function returns node->base derived from a NULL node.

589) Reachable assertion (CVE-ID: CVE-2026-68249)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable assertion in the sdma_v5_0 fence emission logic when processing a crafted fence address. A local user can trigger the BUG_ON() condition to cause a denial of service.

The issue results in a kernel crash rather than continued execution.

590) Reachable assertion (CVE-ID: CVE-2026-68250)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a BUG_ON assertion in sdma_v5_2_ring_emit_fence() in the amdgpu sdma_v5_2 component when processing a crafted fence address. A local user can trigger the BUG_ON condition to cause a denial of service.

591) Out-of-bounds write (CVE-ID: CVE-2026-68253)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the intel_hdcp_required_content_stream function when processing HDCP content stream data. A local user can trigger a stream count overflow to cause a denial of service.

592) Improper input validation (CVE-ID: CVE-2026-68254)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the intel_vrr.c VRR capability handling when processing EDID monitor range data. A local user can provide crafted min/max vertical frequency values to trigger a division by zero and cause a denial of service.

593) Out-of-bounds read (CVE-ID: CVE-2026-68255)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in virtio_get_edid_block() when parsing device-supplied EDID responses. A remote privileged user can supply a crafted virtio-gpu EDID response with a large reported size and high extension count to disclose sensitive information.

Exploitation requires control of a malicious virtio-gpu backend.

594) Out-of-bounds read (CVE-ID: CVE-2026-68277)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the sideband reply parsers in drm_dp_mst_topology.c when parsing crafted sideband reply messages. A local user can provide a crafted message with a truncated 2-byte field to disclose sensitive information.

The out-of-bounds read can access data from adjacent struct fields including curchunk_len, curchunk_idx, and curlen.

595) Out-of-bounds write (CVE-ID: CVE-2026-68278)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to out-of-bounds write in drm_dp_sideband_append_payload() when processing forged DP MST sideband reply messages from a connected device. An attacker with physical access can send crafted sideband reply data to cause memory corruption.

The issue is reachable from a DP MST device over a physical connection.

596) Out-of-bounds read (CVE-ID: CVE-2026-68279)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in drm_dp_sideband_parse_remote_dpcd_read() and drm_dp_sideband_parse_remote_i2c_read_ack() when parsing remote DPCD and I2C sideband reply messages from an MST hub. A remote attacker can send a specially crafted sideband reply with an oversized num_bytes value to disclose sensitive information.

The issue can be triggered by a malicious or misbehaving MST hub.

597) Use-after-free (CVE-ID: CVE-2026-68284)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tcp_bpf_sendmsg() when two threads send on the same socket and an error occurs after waiting for socket memory. A local user can trigger concurrent send operations to cause a denial of service.

The issue occurs in the sockmap BPF path and involves stale cork state being mistaken for a stack-local temporary message.

598) Improper access control (CVE-ID: CVE-2026-68294)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass network namespace isolation.

The vulnerability exists due to improper access control in the AF_QIPCRTR socket creation logic and global QRTR state handling when creating and using QRTR sockets from a separate network namespace. A local user can create an AF_QIPCRTR socket in another network namespace and send crafted QRTR datagrams to sockets owned by a different namespace to bypass network namespace isolation.

The receiving socket may treat the message as originating from node id 1, making it indistinguishable from a legitimate local client.

599) Improper input validation (CVE-ID: CVE-2026-68297)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in TIPC netlink MTU property handling when processing user-supplied MTU values through TIPC media or bearer configuration requests. A local user can supply an MTU value greater than 65535 to trigger a division by zero and cause a denial of service.

Exploitation is possible by an unprivileged user via a user namespace.

600) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68299)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of encapsulated packet headers in vmxnet3_get_hdr_len() when processing Geneve-encapsulated packets. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue is triggered when descriptor fields describe the inner header instead of the outer header, including cases where the outer protocol is UDP or the outer and inner IP versions differ.

601) Improper Authentication (CVE-ID: CVE-2026-68300)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass authentication.

The vulnerability exists due to improper authentication in sctp_auth_chunk_verify() when processing SCTP chunks with a NULL auth_chunk. A remote user can send a specially crafted SCTP chunk to bypass authentication.

This can occur for new connections or when no AUTH chunk precedes a COOKIE-ECHO chunk.

602) Memory leak (CVE-ID: CVE-2026-68301)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in hsr_del_port() when unregistering or destroying an HSR slave device while HSR is active. A local user can unregister or destroy a slave device to cause a denial of service.

The issue occurs because VLAN 0 and other synced VLANs can remain referenced on the slave device after it is detached from the HSR master.

603) Improper Initialization (CVE-ID: CVE-2026-68304)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the brcmfmac cfg80211 key management handling when processing 802.1X-SHA256 PMK configuration requests. A local user can send a crafted netlink request to trigger a kernel warning and cause a denial of service.

The issue occurs when 802.1X-SHA256 mode is used without the required firmware supplicant configuration.

604) NULL pointer dereference (CVE-ID: CVE-2026-68309)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mt76_connac_mcu_uni_bss_he_tlv() when processing HE BSS TLV data. A local user can trigger the vulnerable code path to cause a denial of service.

605) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68313)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in __tipc_nl_compat_dumpit in the TIPC netlink compatibility handler when processing dumpit callback results. A local user can trigger a negative return value path to cause a denial of service.

The issue can lead to an infinite loop that prevents genl_mutex from being released, causing tasks waiting on the mutex to starve in D state.

606) Integer overflow (CVE-ID: CVE-2026-68315)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow in sctp_process_strreset_inreq() when processing a crafted SCTP RESET_IN_REQUEST from a peer. A remote attacker can send a specially crafted SCTP stream reset request to cause a denial of service.

Exploitation is only possible on interfaces with MTU greater than 65535, such as loopback with IPv6 jumbograms.

607) Heap-based buffer overflow (CVE-ID: CVE-2026-68320)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in sctp_association_init and SCTP authentication chunk handling when processing endpoint authentication chunk lists containing more than 16 entries. A local user can add excessive chunk identifiers to trigger memory corruption and cause a denial of service.

608) NULL pointer dereference (CVE-ID: CVE-2026-68322)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the RDS IPv6 address check logic when binding an RDS socket to an IPv6 address while IPv6 is disabled. A local user can bind an RDS socket to an IPv6 address to cause a denial of service.

The issue occurs on systems booted with the ipv6.disable=1 parameter.

609) Out-of-bounds write (CVE-ID: CVE-2026-68324)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in dmar_latency_disable() when disabling latency statistics for a type value greater than 0. A local user can trigger the vulnerable code path to cause a denial of service.

When the type value is greater than 0, the operation writes beyond the end of the allocated array and corrupts adjacent memory.

610) Stack-based buffer overflow (CVE-ID: CVE-2026-68325)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in the ivrs_acpihid command-line parser when parsing the ivrs_acpihid kernel command-line parameter. A local attacker can supply a specially crafted parameter with more than four entries to cause a denial of service.

611) Out-of-bounds read (CVE-ID: CVE-2026-68326)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in mwifiex_process_uap_event() and the assoc_req_ies parsing path when processing a firmware-reported uAP association event with a crafted event length. A local attacker can supply a malicious or malformed event from a mwifiex device to disclose sensitive information.

The issue can be triggered by a malicious or malfunctioning mwifiex USB, SDIO, or PCIe device while the interface is operating in AP/uAP mode. An underflow in the calculated length may also cause stale event buffer bytes to be exposed through an NL80211_CMD_NEW_STATION notification.

612) NULL pointer dereference (CVE-ID: CVE-2026-68327)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in wanxl_reset in the wanxl PCI device removal path when handling early probe failures before BAR mapping. A local user can trigger device initialization failure conditions to cause a denial of service.

The issue occurs on an error path where the PLX MMIO BAR has not yet been mapped, leaving card->plx NULL when cleanup invokes the reset routine.

613) NULL pointer dereference (CVE-ID: CVE-2026-68328)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in nfp_cpp_resource_find() and nfp_resource_try_acquire() when opening a resource with a matching resource-table entry after mutex allocation fails. A local user can trigger resource acquisition to cause a denial of service.

This issue was identified through static analysis and confirmed by manual source review.

614) Improper resource shutdown or release (CVE-ID: CVE-2026-68331)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the dpaa2 Ethernet MAC disconnect path when disconnecting a MAC endpoint device. A local user can repeatedly trigger connect and disconnect operations to cause a denial of service.

The issue leaks a device reference stored in mac->mc_dev on each successful connect that is later disconnected.

615) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68333)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper release of a resource in dpaa2_switch_port_disconnect_mac in the dpaa2-switch driver when disconnecting a MAC endpoint device. A local user can repeatedly connect and disconnect the MAC endpoint to cause a denial of service.

616) Use-after-free (CVE-ID: CVE-2026-68335)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free and potentially execute arbitrary code.

The vulnerability exists due to use-after-free in the RDS receive path when delivering an incoming message across network namespace boundaries. A local user can create network namespaces and send a crafted message to trigger a dangling connection reference and potentially execute arbitrary code.

The issue is reachable from unprivileged user namespaces using CLONE_NEWUSER and CLONE_NEWNET.

617) Race condition (CVE-ID: CVE-2026-68338)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in packet_set_ring() and packet fanout hook handling in net/packet/af_packet.c when reconfiguring a packet socket ring while a network device is being unregistered. A local user can trigger ring reconfiguration during device unregister handling to cause a denial of service.

The issue occurs when a stale running state causes fanout hook re-registration after the device binding has already been invalidated.

618) Out-of-bounds read (CVE-ID: CVE-2026-68340)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the OCC poll response parser in drivers/hwmon/occ/common.c when parsing a truncated transport response. A local user can supply a malformed poll response to cause a denial of service.

The issue occurs because the parser used the backing-array capacity instead of the current response data length as the parse boundary, and malformed-response errors were not propagated before the OCC was published as active.

619) Heap-based buffer overflow (CVE-ID: CVE-2026-68349)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in carl9170_rx_stream() when processing USB transfer data in the rx stream failover path. A local attacker can provide specially crafted transfer data to cause a denial of service.

The issue is triggered when two transfers are near the maximum size and their combined copied length exceeds the 65535-byte failover SKB, resulting in skb_over_panic.

620) Out-of-bounds read (CVE-ID: CVE-2026-68350)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in carl9170_tx_process_status() when processing firmware-controlled TX status entries. A local attacker can provide a crafted firmware response with an oversized hdr.ext value to disclose sensitive information.

The issue is caused by an off-by-two bounds check error that allows two extra iterations past valid _tx_status entries.

621) Out-of-bounds read (CVE-ID: CVE-2026-68351)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in carl9170_cmd_callback() when processing a firmware command response with a length mismatch. A remote attacker can send a specially crafted firmware response to disclose sensitive information.

622) Out-of-bounds read (CVE-ID: CVE-2026-68352)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in ath6kl_wmi_connect_event_rx() when parsing firmware-controlled connect event information elements. A local attacker can supply crafted length fields to trigger out-of-bounds reads and disclose sensitive information.

The issue can also corrupt the wmi->is_wmm_enabled state during parsing.

623) Out-of-bounds read (CVE-ID: CVE-2026-68353)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ath6kl_wmi_tx_complete_event_rx() when processing a crafted WMI TX complete event from firmware. A local user can supply an inflated num_msg field to disclose sensitive information.

The num_msg field is firmware-controlled and can cause reads of up to 1020 bytes past the WMI event buffer.

624) Improper handling of exceptional conditions (CVE-ID: CVE-2026-68354)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of fragment list boundaries in the firewire networking fragmented datagram reassembly logic when processing fragmented datagrams. A remote attacker can send specially crafted fragmented datagrams to cause a denial of service.

The issue can prevent complete datagrams from being correctly recognized during reassembly.

625) Out-of-bounds read (CVE-ID: CVE-2026-68355)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in ath11k_hal_rx_msdu_list_get() when processing msdu descriptor entries. A local attacker can trigger a zero buffer address in the first msdu_details entry to cause a denial of service.

626) Use-after-free (CVE-ID: CVE-2026-68357)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in watchdog_unregister_governor() and the watchdog pretimeout governor handling logic when unregistering a watchdog governor that is still referenced as default_gov. A local user can trigger governor unregistration and subsequent watchdog device registration or reassignment to cause a denial of service.

The issue occurs when the unregistered governor remains referenced through a dangling default_gov pointer, affecting both newly registered watchdog devices and existing devices whose governor is reassigned.

627) Use-after-free (CVE-ID: CVE-2026-68360)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the corsair-cpro driver probe function when handling device I/O during probe failure after I/O start. A local user can trigger the vulnerable code path to execute arbitrary code.

The issue is caused by a race condition between hid_input_report() and execution immediately following hid_device_io_start() during probing.

628) Use-after-free (CVE-ID: CVE-2026-68361)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in corsairpsu_probe() and HID input report handling when stopping a device after probe failure while input reports are still being processed. A local user can trigger the race condition during device initialization failure to execute arbitrary code.

The issue is triggered by a race condition between hid_input_report() and the code path immediately following hid_device_io_start() during probe failure.

629) Use-after-free (CVE-ID: CVE-2026-68363)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in ath9k_hif_request_firmware() in drivers/net/wireless/ath/ath9k/hif_usb.c when handling a failed asynchronous firmware request during concurrent USB device disconnect. A local user can trigger a firmware download failure and a concurrent disconnect to cause a denial of service.

The issue is triggered by a race condition between the firmware callback running on the events workqueue and device disconnect, leading to a read from freed memory.

630) Out-of-bounds write (CVE-ID: CVE-2026-68365)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the io_edgeport USB serial driver ring buffer when processing interrupt-status packets that report transmit credits. A local user can provide a malicious or non-conforming USB device that returns excessive transmit credits to cause a denial of service.

Exploitation requires the system to interact with a USB serial device using the affected driver.

631) Out-of-bounds read (CVE-ID: CVE-2026-68366)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in uvc_send_response() when processing a UVCIOC_SEND_RESPONSE ioctl with a crafted response length. A local user can supply a crafted struct uvc_request_data to cause an out-of-bounds read and disclose sensitive information.

632) Use-after-free (CVE-ID: CVE-2026-68367)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the f_tcm delayed set_alt work handler when processing delayed USB gadget alternate-setting changes during disconnect or function teardown. A local user can trigger function unlink or teardown while delayed set_alt work is still pending to cause a denial of service.

The issue was reproduced by KASAN in tcm_delayed_set_alt after the function state was freed through configfs unlink operations.

633) Out-of-bounds read (CVE-ID: CVE-2026-68368)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ncm_unwrap_ntb() in the USB gadget NCM function when parsing host-supplied NTBs. A remote attacker can supply a crafted NTB with invalid block lengths, datagram offsets, or datagram lengths to disclose sensitive information.

Exploitation requires a malicious USB host interacting with a system using the affected USB gadget functionality.

634) Infinite loop (CVE-ID: CVE-2026-68369)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of copy_to_user() results in printer_read() in the USB gadget printer function when processing read requests with an unwritable user buffer. A local user can trigger a read operation with an unwritable user buffer to cause a denial of service.

The issue can result in an infinite loop if RX data is available and an iteration makes no progress.

635) Race condition (CVE-ID: CVE-2026-68370)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dummy_hcd shared fifo_req handling when processing small IN transfers through the emulated single-request FIFO fast-path. A local user can trigger concurrent request queueing and completion handling to cause a denial of service.

The issue can overwrite the request completion function pointer while a completion callback is still running, leading to a general protection fault or page fault in dummy_timer.

636) Out-of-bounds read (CVE-ID: CVE-2026-68373)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in at76_guess_freq() when processing truncated beacon or probe response frames during scanning. A remote attacker can send a specially crafted wireless management frame to disclose sensitive information.

The issue is reachable from at76_rx_tasklet() while scanning.

637) Out-of-bounds read (CVE-ID: CVE-2026-68376)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in sctp_auth_get_hmac() when processing SCTP authentication parameters during association initialization. A local user can configure four HMAC identifiers to trigger memory corruption that leads to an out-of-bounds read and disclose sensitive information.

The issue stems from an undersized auth_hmacs array in struct sctp_cookie that can corrupt the adjacent auth_chunks field and cause an invalid HMAC identifier to be accepted.

638) Use-after-free (CVE-ID: CVE-2026-68377)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tunnel_key_release_params() in net/sched/act_tunnel_key.c when handling concurrent tunnel key action processing on the datapath. A local user can trigger a race condition to cause a denial of service.

The issue arises because a reader may still access the old params structure under RCU while the associated metadata_dst is released synchronously.

639) Out-of-bounds read (CVE-ID: CVE-2026-68388)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in smb3_simple_fallocate_range() when handling server-reported allocated ranges during fallocate operations. A local user can trigger fallocate on an SMB client mount backed by a server that returns overlapping or malformed allocated ranges to cause a denial of service.

A later write to a skipped hole may fail with ENOSPC.

640) Improper Initialization (CVE-ID: CVE-2026-68395)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in the sata_dwc_460ex driver interrupt handling during device probe when enabling SATA interrupts before the IRQ handler is registered. A local attacker can trigger an interrupt during probe or cause a probe failure after interrupts are unmasked to cause a denial of service.

The issue can result in a spurious interrupt storm if the controller asserts an interrupt with no registered handler.

641) Use-after-free (CVE-ID: CVE-2026-68397)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in afiucv_hs_rcv() and the afiucv_hs_callback_* handlers when processing AF_IUCV socket traffic. A local user can trigger a concurrent socket close to cause a denial of service.

The issue arises because the destination socket is looked up under a lock and then used after the lock is released without holding a reference.

642) Use-after-free (CVE-ID: CVE-2026-68398)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in pppol2tp_recv() and PPP channel handling when processing pppol2tp receive traffic concurrently with channel teardown. A local user can trigger concurrent receive and close operations to cause a denial of service or execute arbitrary code.

The issue is reachable by an unprivileged user and affects a channel that is bound but not attached to a PPP unit and not bridged.

643) Use-after-free (CVE-ID: CVE-2026-68399)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sk_clone() and BPF socket local storage handling when cloning sockets and an early bailout occurs before BPF storage cloning. A local user can trigger socket cloning that fails before storage initialization completes to cause a denial of service.

Only systems with BPF syscall support enabled are vulnerable.

644) Out-of-bounds read (CVE-ID: CVE-2026-68402)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in cfg80211_is_element_inherited() when parsing a crafted wireless frame containing a zero-length extension element. A remote attacker can send a specially crafted frame to disclose sensitive information.

The issue is triggered during element parsing when a non-inheritance context exists, such as while parsing a per-STA profile of a Multi-Link element in a (re)association response or a non-transmitted BSS profile.

645) Improper Initialization (CVE-ID: CVE-2026-68403)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in brcmf_sdio_probe() and brcmf_sdio_remove() when handling an early probe failure during SDIO device initialization. A local attacker can trigger a workqueue allocation failure to cause a denial of service.

The issue occurs because the cleanup path cancels bus->datawork before the work item has been initialized.

646) Improper locking (CVE-ID: CVE-2026-68405)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock handling in ieee80211_do_stop() for AP_VLAN packet cleanup when freeing queued SKBs associated with ps->bc_buf while IRQs are disabled. A local user can trigger AP_VLAN stop processing with buffered packets to cause a denial of service.

The issue occurs because ieee80211_free_txskb() may invoke reporting paths beyond passive SKB release while the IRQ-disabled lock is still held.

647) Improper input validation (CVE-ID: CVE-2026-68406)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in PMSR FTM request parsing in cfg80211/nl80211 when processing user-supplied PMSR FTM request attributes. A remote attacker can send a specially crafted request with an out-of-range preamble value to cause a denial of service.

648) Memory leak (CVE-ID: CVE-2026-68410)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in helper_firmware_cb() in the libertas USB firmware-download path when handling an asynchronous firmware load. A local user can trigger the firmware-download path to cause a denial of service.

No runtime testing was performed because compatible Libertas USB hardware was unavailable.

649) Out-of-bounds write (CVE-ID: CVE-2026-68411)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in hwsim_virtio_rx_work() when processing a virtio RX length reported by the device. A remote attacker can report an oversized length value to cause a denial of service.

The issue can trigger skb_over_panic() and panic the guest system.

650) Improper resource shutdown or release (CVE-ID: CVE-2026-68413)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in ipw2100_pci_init_one() when handling error paths during device initialization. A local attacker can trigger initialization failures to cause a denial of service.

651) Use-after-free (CVE-ID: CVE-2026-68414)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in cfg80211_sched_scan_results_wk when processing scheduled scan result work during device unregister. A local user can trigger scheduled scan result handling during interface teardown to cause a denial of service.

The issue is caused by a race condition between the scheduled-scan result path and the unregister/free path.

652) Race condition (CVE-ID: CVE-2026-68417)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in siw_create_qp() and QP lookup handling when creating and looking up queue pairs. A local user can trigger a QPN lookup for a queue pair that is still being constructed to cause a denial of service.

The issue occurs because the queue pair can be published before its queues, completion queue pointers, state, completion object, and device list entry are fully initialized.

653) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68422)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing release of a reference in merge_reloc_roots() in the btrfs relocation code when handling an unexpected reloc_root for a root. A local user can trigger this condition to cause a denial of service.

The issue results in a root reference leak.

654) Improper input validation (CVE-ID: CVE-2026-68425)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state validation in the kernel-handled RMPP receive processing in IB MAD handling when processing unsolicited active RMPP DATA responses. A remote attacker can send a specially crafted unmatched RMPP response to cause a denial of service.

The issue occurs because receive-side reassembly could begin before the full TID and source address were verified against an outstanding send.

655) Use-after-free (CVE-ID: CVE-2026-68428)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the KVM x86 MMU cache cleanup logic when reloading a vendor module after a prior unload. A local user can trigger a vendor module reload sequence with a failed cache initialization to cause a denial of service.

The issue occurs when kvm.ko remains loaded while a vendor module is unloaded and then reloaded, leaving a stale cache pointer that is later passed to kmem_cache_destroy().

656) Reachable assertion (CVE-ID: CVE-2026-68430)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a reachable assertion in the amdgpu gfx8 fence emission logic when processing GPU fence operations. A local user can trigger the affected code path to cause a denial of service.

The issue results in a kernel crash.

657) Out-of-bounds read (CVE-ID: CVE-2026-68431)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ksmbd connection request handling when processing short SMB2 transform requests on an SMB 2.1 connection. A remote attacker can send a specially crafted truncated transform packet to disclose sensitive information.

The issue occurs when a transform packet is accepted even though the negotiated dialect does not provide transform handling.

658) Improper access control (CVE-ID: CVE-2026-68432)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify VXLAN device configuration across network namespaces.

The vulnerability exists due to improper access control in vxlan_changelink() when handling changelink requests for a VXLAN device whose underlay network namespace differs from the device network namespace. A local privileged user can send a crafted changelink request to modify VXLAN device configuration across network namespaces.

The issue occurs when the caller has CAP_NET_ADMIN in the device network namespace but not in the VXLAN underlay network namespace.

659) Out-of-bounds read (CVE-ID: CVE-2026-68433)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in handle_get_version_reply() in libceph when processing a truncated MON_GET_VERSION_REPLY message. A remote attacker can send a specially crafted reply to disclose sensitive information.

The issue occurs because decoding is bounded by the reused reply buffer size rather than the number of bytes actually received, allowing stale tail bytes from an earlier message to be read.

660) NULL pointer dereference (CVE-ID: CVE-2026-68444)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in ffa_partition_info_get() when processing a NULL partition UUID argument. A local attacker can trigger the vulnerable function with a NULL argument to cause a denial of service.

The issue results in a kernel panic.

661) Improper input validation (CVE-ID: CVE-2026-68446)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in vmw_gb_surface_define_internal when handling a userspace surface creation request with a crafted array_size value. A local user can submit a specially crafted request to cause a denial of service.

The array_size limit depends on which Shader Model is available.

662) Infinite loop (CVE-ID: CVE-2026-68449)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in the NCQ tag completion bit-scanning logic in sata_dwc_isr() in drivers/ata/sata_dwc_460ex.c when processing NCQ tag completion data with only high bits set in the tag mask. A local attacker can trigger this condition to cause a denial of service.

The issue can occur in hardirq context while a spinlock is held.

663) Memory leak (CVE-ID: CVE-2026-68450)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in __add_reloc_root() in fs/btrfs/relocation.c when inserting a relocation root into reloc_root_tree and encountering an unexpected duplicate entry. A local user can trigger the duplicate insert path to cause a denial of service.

This issue occurs because a newly allocated mapping node is left unfreed if insertion finds an existing entry and returns -EEXIST.

664) Improper input validation (CVE-ID: CVE-2026-68451)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in cca_ecc2protkey() when processing CCA ECC private key requests. A local user can supply a crafted key token with an oversized length field to cause a denial of service.

665) Improper input validation (CVE-ID: CVE-2026-68452)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in cca_cipher2protkey() when processing CCA AES cipher key requests. A local user can supply a key token with an excessive length field to cause a denial of service.

The copy length for the CPRB parameter block is derived directly from the length field in the key token.

666) Race condition (CVE-ID: CVE-2026-68456)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in the ueagle-atm USB driver disconnect handler when handling device removal during asynchronous pre-firmware loading. A local attacker can unplug a device while firmware loading is still in progress to cause a denial of service.

The issue is associated with the firmware sysfs fallback mechanism and manifests when device teardown runs concurrently with the asynchronous firmware request.

667) Deadlock (CVE-ID: CVE-2026-68459)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in f2fs_balance_fs() gc_merge path when handling filesystem writeback and foreground garbage collection. A local user can trigger filesystem activity that causes a deadlock to cause a denial of service.

Only systems mounted with the gc_merge option are vulnerable.

668) Deadlock (CVE-ID: CVE-2026-68460)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock condition in f2fs_balance_fs() when handling writeback and garbage collection on nearly exhausted f2fs filesystem space. A local user can trigger filesystem write activity to cause a denial of service.

The issue occurs when the f2fs filesystem space is nearly exhausted.

669) Use of Uninitialized Variable (CVE-ID: CVE-2026-68461)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in fwnode_init() in the firmware node handling code when initializing a fwnode_handle allocated on the stack or with a non-zeroing heap allocation. A local user can trigger dereference of an uninitialized secondary pointer to cause a denial of service.

Exploitation requires control over the lifetime and initialization context of the firmware node object.

670) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-68466)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in the lpc32xx_xmit_dma() function when waiting for DMA transfer completion. A local user can trigger a DMA completion timeout to cause a denial of service.

The timed out transfer may continue accessing the buffer after an error condition occurs.

671) Improper Initialization (CVE-ID: CVE-2026-68467)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the mchp23k256 SPI flash driver when probing id-table-only SPI device matches. A local user can attach or register a device that matches through the SPI id table to cause a denial of service.

The issue occurs because the driver may use incorrect chip capacity data and wrong MTD geometry for non-OF SPI modalias matches.

672) Race condition (CVE-ID: CVE-2026-68469)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in mwifiex_ret_802_11_associate() in the mwifiex wireless driver when processing an association command response during roaming. A local user can trigger repeated roam or connection changes to cause a denial of service.

The issue can leave scan requests permanently busy so later userspace scan requests fail with -EBUSY. The behavior was observed on IW412 firmware when power-save sleep events coincided with association handling.

673) Out-of-bounds read (CVE-ID: CVE-2026-68474)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in spufs_mem_mmap_access() when accessing the SPU local store through a memory-mapped area. A local user can supply a crafted offset and length to read beyond the LS_SIZE buffer and disclose sensitive information.

The issue affects 64-bit systems because the existing clamp does not properly limit access against the local store size.

674) Improper resource shutdown or release (CVE-ID: CVE-2026-68475)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to improper resource shutdown or release in sunxi_reset_init() in the sunxi reset driver when handling an ioremap() failure. A local user can trigger initialization that causes ioremap() to fail to cause a resource leak.

675) Use-after-free (CVE-ID: CVE-2026-68476)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in __ip_vs_get_out_rt() handling of skb head reallocation in net/netfilter/ipvs/ip_vs_xmit.c when processing packets in ip_vs_bypass_xmit(). A local user can trigger skb head reallocation and subsequent use of a stale IP header pointer to cause a denial of service.

676) Improper input validation (CVE-ID: CVE-2026-68477)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect packet processing.

The vulnerability exists due to improper handling of ipv6 transport offsets in ipvs application and icmpv6 response processing when handling ipv6 packets with extension headers. A remote attacker can send specially crafted ipv6 traffic to cause incorrect packet processing.

The issue affects TCP application handling and ICMPv6 checksum validation in IPVS for IPv6 traffic.

677) Out-of-bounds write (CVE-ID: CVE-2026-68478)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to corrupt memory.

The vulnerability exists due to an out-of-bounds write in the ms_block Memory Stick block translation layer when processing a Memory Stick card that reports an excessive number of blocks. An attacker with physical access can provide a crafted card with a block count above the supported maximum to corrupt memory.

The issue occurs because the card-supplied block count can cause indexing past the end of the fixed free_block_count array.

678) Integer underflow (CVE-ID: CVE-2026-68479)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer underflow leading to out-of-bounds read and out-of-bounds write in rtlbt_parse_firmware() when parsing a malformed Bluetooth firmware patch during Bluetooth setup. A local user can supply a specially crafted firmware patch to cause a denial of service.

The issue can be triggered by a firmware patch shorter than the version field, and arithmetic wraparound may affect 32-bit architectures.

679) Insufficient Control Flow Management (CVE-ID: CVE-2026-68480)

CWE-ID: CWE-691 - Insufficient Control Flow Management

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper control flow handling in the x86 Safe-RET sequence when interrupts are injected during execution of the sequence on SRSO-affected systems. A local user can inject interrupts during the Safe-RET sequence to disclose sensitive information.

Only systems affected by SRSO are vulnerable.

680) Memory leak (CVE-ID: CVE-2026-72004)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in ieee80211_register_hw() when copying supported band structures. A local user can trigger hardware registration with memory allocation failure conditions to cause a denial of service.

The issue occurs on an error path after rate control has been initialized.

681) Improper Initialization (CVE-ID: CVE-2026-72005)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in rt2x00lib_probe_dev() and rt2x00lib_remove_dev() when handling probe failures before work items are initialized. A local user can trigger an early probe failure to cause a denial of service.

The issue occurs when drv_data or workqueue allocation fails before intf_work, autowakeup_work, and sleep_work have been set up.

682) Division by zero (CVE-ID: CVE-2026-72010)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in mpol_relative_nodemask in the cpuset mempolicy rebind path when handling a CPU hotplug event for a task in a child cpuset with an unset cpuset.mems and a VMA mempolicy using MPOL_F_RELATIVE_NODES. A local user can create such a cpuset configuration and trigger CPU hotplug handling to cause a denial of service.

Exploitation requires a child cpuset where cpuset.mems is not set and a VMA mempolicy configured with MPOL_F_RELATIVE_NODES.

683) NULL pointer dereference (CVE-ID: CVE-2026-72013)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in machine_kexec_prepare() when processing kexec image segments. A local user can provide a kexec image segment with a NULL buffer pointer to cause a denial of service.

The issue occurs in the RISC-V kexec path during handling of segments prepared through kexec_file_load().

684) Out-of-bounds write (CVE-ID: CVE-2026-72014)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in recv_dless_read() when processing a crafted P_DATA_REPLY from a DRBD peer. A remote attacker can send a specially crafted data reply to corrupt kernel memory.

A node that reads from its peer, such as a diskless node or a node using read-balancing to the peer, is exposed in the default configuration. A man-in-the-middle DRBD peer can also exploit the issue.

685) Double free (CVE-ID: CVE-2026-72015)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in RMID management in fs/resctrl/rdtgroup.c when unmounting and removing pseudo-locked resctrl groups. A local user can create a pseudo-locked group and trigger unmount processing to cause a denial of service.

The issue affects pseudo-locked groups whose RMID is freed during setup and then freed again during cleanup.

686) Out-of-bounds read (CVE-ID: CVE-2026-72019)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in macsec_encrypt() when processing packets transmitted through the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS path with an unset MAC header. A local user can send a specially crafted packet to disclose sensitive information.

The 12-byte heap over-read may be emitted on the wire as the frame's outer source and destination MAC addresses.

687) Use of Uninitialized Variable (CVE-ID: CVE-2026-72020)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information and corrupt forwarded TCP traffic.

The vulnerability exists due to use of uninitialized memory in ip_vs_conn_new and TCP sequence handling in IPVS when processing a malformed sync message that omits sequence data. A remote user can send a specially crafted sync message to disclose sensitive information and corrupt forwarded TCP traffic.

The issue affects connections learned from a sync message when sequence flags are preserved without valid sequence data, causing stale slab bytes to be used in TCP sequence and acknowledgment number rewriting by an IPVS application helper.

688) Incorrect calculation (CVE-ID: CVE-2026-72021)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect connection state tracking.

The vulnerability exists due to improper calculation of buffer offsets in SCTP state lookup in net/netfilter/ipvs/ip_vs_proto_sctp.c when processing IPv6 SCTP packets with extension headers. A remote attacker can send a specially crafted IPv6 SCTP packet with extension headers to cause incorrect connection state tracking.

This can cause an SCTP connection to be moved to the established state before the SCTP handshake has completed, resulting in incorrect timeout handling and destination counter updates.

689) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72022)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in llc_ui_autobind() when repeatedly autobinding and closing LLC sockets. A local user can perform repeated autobind and close cycles to cause a denial of service.

The issue can consume all dynamic SAP values, causing subsequent autobind operations to fail with -EUSERS.

690) Memory leak (CVE-ID: CVE-2026-72023)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in otx2_init_hw_resources() and the SQ resource unwind path when handling initialization failures. A local user can trigger an initialization failure to cause a denial of service.

Exploitation requires access to a system using the OcteonTX2 PF driver.

691) Race condition (CVE-ID: CVE-2026-72024)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the mac802154 interface removal logic when handling asynchronous transmit completion during interface teardown. A local user can trigger interface removal while transmit completion paths access the interface list to cause a denial of service.

The issue arises because queue wake, stop, and disable paths walk local->interfaces under RCU while bulk hardware teardown removes interface entries.

692) Out-of-bounds write (CVE-ID: CVE-2026-72025)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the monwriter misc device when reusing data buffers with a different data length. A local user can submit crafted records with a changed data length to cause memory corruption.

By default, access to the device is restricted to root-only permissions.

693) Out-of-bounds read (CVE-ID: CVE-2026-72033)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in fill_from_part() in the OrangeFS directory handling code when processing a crafted readdir entry trailer supplied by a userspace client. A local user can supply a crafted directory entry with a wrapped length value to cause a denial of service.

The issue occurs because a directory entry size computed in size_t is truncated to a 32-bit value, which can bypass a bounds check and lead to a read far past the directory part.

694) NULL pointer dereference (CVE-ID: CVE-2026-72035)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the sch_taprio scheduler when processing ordinary egress through a non-work-conserving child qdisc after a peeked packet is orphaned and queue state is desynchronized. A local attacker can trigger network egress through a qfq child to cause a denial of service.

The issue can panic the kernel from softirq, and the qfq child can be re-entered on an emptied list.

695) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-72036)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in multiq_dequeue in the sch_multiq scheduler when handling queued packets after a peek operation on a non-work-conserving child qdisc. A local user can trigger network traffic through the affected queuing path to cause a denial of service.

The issue can desynchronize the child queue length and backlog accounting and lead to a NULL pointer dereference in softirq context on egress.

696) Improper resource shutdown or release (CVE-ID: CVE-2026-72038)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in setup_cn23xx_octeon_pf_device() in drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c when handling a PF number lookup failure during device initialization. A local user can trigger the affected initialization path to cause a denial of service.

697) Memory leak (CVE-ID: CVE-2026-72039)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in bnx2x_alloc_mem_bp() when handling allocation failures for fp[i].tpa_info. A local user can trigger allocation failure conditions to cause a denial of service.

698) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72041)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in espintcp_sendskmsg_locked in net/xfrm/espintcp.c when handling partial sends of sk_msg data. A local user can trigger partial send conditions to cause a denial of service.

699) Improper access control (CVE-ID: CVE-2026-72045)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in rvu_mbox_handler_lmtst_tbl_setup() when handling mailbox requests that specify base_pcifunc. A remote user can supply a crafted base_pcifunc value to disclose sensitive information.

Exploitation requires a VF caller on cn10k hardware, and the issue is limited to redirecting LMTLINE sharing outside the caller's own PF.

700) Type conversion (CVE-ID: CVE-2026-72047)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper pointer size handling in the ca8210 debugfs test interface when exchanging kmalloc'd buffer pointers through a kfifo on 64-bit systems. A local user can interact with the debugfs test interface to cause a denial of service.

Only 64-bit builds with CONFIG_IEEE802154_CA8210_DEBUGFS enabled are vulnerable.

701) Memory leak (CVE-ID: CVE-2026-72048)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a memory leak in ca8210_spi_transfer() in the ca8210 IEEE 802.15.4 driver when submitting asynchronous SPI transfers. A local attacker can trigger spi_async() submission failures to cause a denial of service.

Repeated retry attempts under sustained SPI bus contention can leak a new allocation on each occurrence.

702) Improper access control (CVE-ID: CVE-2026-72049)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the legacy IEEE802154_NL generic netlink LLSEC dump operations when handling LLSEC_LIST_KEY dump requests. A local user can issue a crafted generic netlink dump request to disclose sensitive information.

The issue exposes the raw 16-byte AES-128 LLSEC key bytes for any wpan netdev that has an administrator-installed LLSEC key.

703) Improper access control (CVE-ID: CVE-2026-72051)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ip6_tnl_changelink() when handling changelink requests for IPv6 tunnel devices across network namespaces. A local privileged user can send a crafted netlink changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace.

704) Improper access control (CVE-ID: CVE-2026-72052)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify tunnel link configuration across network namespaces.

The vulnerability exists due to improper access control in ip6gre_changelink() and ip6erspan_changelink() when handling changelink requests for devices and tunnel links in different network namespaces. A remote privileged user can send a crafted changelink request to modify tunnel link configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace, causing capability checks to be applied only to the device namespace.

705) Improper access control (CVE-ID: CVE-2026-72053)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify IPIP tunnel configuration in another network namespace.

The vulnerability exists due to improper access control in ipip_changelink() in net/ipv4/ipip.c when handling changelink requests for an IPIP device whose tunnel link resides in a different network namespace. A local privileged user can send a changelink request from a network namespace where they have CAP_NET_ADMIN to modify IPIP tunnel configuration in another network namespace.

The issue occurs when dev_net(dev) and the tunnel link namespace differ, such as after the device is created in or moved to a different network namespace.

706) Improper access control (CVE-ID: CVE-2026-72054)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in vti_changelink() in the ip_vti component when handling changelink requests for a tunnel whose link network namespace differs from the device network namespace. A local privileged user can send a changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the device is created in or moved to a different network namespace than the one from which the request is issued.

707) Improper access control (CVE-ID: CVE-2026-72055)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in vti6_changelink() in the ip6_vti component when handling changelink requests for a tunnel device associated with another network namespace. A local privileged user can send a changelink request from a namespace where they hold CAP_NET_ADMIN to modify tunnel configuration across network namespaces.

The issue arises when the device network namespace and the tunnel link network namespace differ.

708) Improper resource shutdown or release (CVE-ID: CVE-2026-72056)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in ena XDP TX queue handling in the ena network driver when setting up regular TX queues after XDP TX queues have already been created. A local user can trigger regular TX setup failures to cause a denial of service.

The issue occurs in error-handling paths that omit teardown of previously created XDP TX queues.

709) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72057)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper preservation of control-buffer state in tcf_ct_handle_fragments() in the act_ct component when handling fragmented traffic through connection-tracking defragmentation. A remote attacker can send specially crafted fragmented packets to cause a denial of service.

System impact occurs when panic_on_warn is enabled.

710) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72058)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in ixp4xx_hss_probe() when allocating and registering HDLC netdev objects. A local user can trigger device initialization and removal to cause a denial of service.

The issue stems from allocating two different netdev objects and later unregistering and freeing a different object than the one that was registered.

711) Improper access control (CVE-ID: CVE-2026-72061)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ipip6_changelink() in the sit tunnel handler when handling changelink requests for a tunnel whose link network namespace differs from the device network namespace. A local privileged user can send a changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the caller has CAP_NET_ADMIN in the device network namespace but not in the tunnel link network namespace.

712) Improper locking (CVE-ID: CVE-2026-72063)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper interaction with a mutex in tegra_gpio_direction_input() and tegra_gpio_direction_output() when changing GPIO direction on shared GPIO lines. A local user can trigger GPIO direction operations while a per-line spinlock is held to cause a denial of service.

The issue can lead to sleeping in an atomic context.

713) Improper input validation (CVE-ID: CVE-2026-72065)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in the mana RX completion queue handling in mana_process_rx_cqe() when processing packet length values reported by the NIC. An attacker with physical access can supply an invalid packet length via a malicious or compromised NIC device to cause a denial of service.

The reported packet length is supplied by the NIC device and is not sufficiently validated before skb processing.

714) Stack-based buffer overflow (CVE-ID: CVE-2026-72066)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in states_show() in kernel/cpu.c when generating sysfs output for CPU hotplug states. A local user can read the affected sysfs entry to cause a denial of service.

715) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72067)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in cpuhp_invoke_callback() when unwinding earlier callbacks for the same hotplug state after an instance callback failure. A local user can trigger a CPU hotplug state transition failure to cause a denial of service.

716) Integer overflow (CVE-ID: CVE-2026-72068)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer truncation in update_rlimit_cpu() when converting the RLIMIT_CPU value to nanoseconds on 32-bit kernels. A local user can set a CPU time limit of 5 seconds or more to cause a denial of service.

Only 32-bit kernels are affected. Limit enforcement remains correct, but the process CPU timer may be programmed to fire prematurely.

717) Use-after-free (CVE-ID: CVE-2026-72069)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in rt_spin_unlock(), rt_read_unlock(), and rt_write_unlock() when releasing RCU protection before completing unlock operations. A local user can trigger concurrent lock and RCU operations to execute arbitrary code.

The issue affects the RT spinlock and rwlock substitutions where unlock handling does not preserve the expected non-RT RCU protection semantics.

718) Use-after-free (CVE-ID: CVE-2026-72070)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in lbtf_free_adapter() when handling device removal during a firmware command timeout. A local user can trigger concurrent teardown and timer callback execution to cause a denial of service.

719) Use-after-free (CVE-ID: CVE-2026-72073)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in the vub300_probe error path in drivers/mmc/host/vub300.c when handling a failed mmc_add_host() call after the inactivity timer has been armed. A local user can trigger a probe failure race to cause a use-after-free.

Exploitation requires a failure during device probe after the inactivity timer is armed, and the queued deadwork may continue running after the timer callback has completed.

720) Type Confusion (CVE-ID: CVE-2026-72074)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to type confusion in the CDC union descriptor parser in the ims-pcu driver when parsing a crafted USB CDC union descriptor. An attacker with physical access can provide a device with a manipulated bMasterInterface0 value to cause a denial of service.

721) Out-of-bounds read (CVE-ID: CVE-2026-72076)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in ims_pcu_irq() debug logging when handling a control URB with an actual_length exceeding the input buffer size. A local attacker can trigger the vulnerable debug logging path to disclose sensitive information.

The issue occurs because the debug output reads from the wrong buffer when the interrupt is associated with the control URB.

722) Improper resource shutdown or release (CVE-ID: CVE-2026-72077)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the ims-pcu firmware update handler when processing an asynchronous firmware update. A local user can trigger firmware validation failure to cause a denial of service.

723) Improper input validation (CVE-ID: CVE-2026-72078)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in the ims-pcu driver control endpoint handling when parsing a malicious USB device interface. An attacker with physical access can provide a crafted device with a non-interrupt IN control endpoint to cause a denial of service.

The issue may lead to kernel warnings or undefined behavior.

724) Use-after-free (CVE-ID: CVE-2026-72079)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a use-after-free or double-free.

The vulnerability exists due to a use-after-free and double-free in ims_pcu_disconnect() when handling the disconnection of a crafted USB interface. An attacker with physical access can present a malicious device with a data interface masquerading as the control interface to trigger a use-after-free or double-free.

725) Memory leak (CVE-ID: CVE-2026-72081)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in efct_dispatch_fcp_cmd() in the efct SCSI driver when processing an unsolicited FCP command with an unsupported additional CDB. A remote attacker can send a crafted FCP command to cause a denial of service.

726) Improper resource shutdown or release (CVE-ID: CVE-2026-72082)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in efct_hw_io_abort() when handling an I/O abort request after request tag allocation fails. A local user can trigger this error path to cause a denial of service.

The abort_in_progress flag may remain set even though the abort was never submitted, causing subsequent abort attempts for the same I/O to return an in-progress error and block recovery.

727) Use-after-free (CVE-ID: CVE-2026-72083)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in core_scsi3_emulate_pro_register_and_move() when processing a crafted iSCSI TransportID in a PERSISTENT RESERVE OUT REGISTER AND MOVE parameter list. A remote user can send a specially crafted request to cause a denial of service.

The issue is triggered when the parameter list spans more than one page, causing the ISID pointer to reference an unmapped region after the buffer is torn down.

728) Out-of-bounds read (CVE-ID: CVE-2026-72084)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in iSCSI PR-OUT TransportID parsing in the Linux kernel SCSI target subsystem when processing a crafted PERSISTENT RESERVE OUT TransportID buffer. A remote attacker can send a specially crafted PR OUT request to cause a denial of service.

The issue is reachable through any fabric that delivers a PR OUT to a device exported through an iSCSI target portal group, including a guest via vhost-scsi.

729) Use-after-free (CVE-ID: CVE-2026-72085)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a refcount underflow leading to use-after-free in xen-scsiback request handling when processing pvSCSI requests before command submission. A remote user can submit requests with a bad grant reference or an unknown request type to cause a denial of service.

Under panic_on_warn, triggering the refcount underflow can panic the host. The issue can also leak every command tag of a LUN session, stopping the LUN.

730) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72086)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a resource leak in scsiback_device_action() in the xen scsi backend when submitting task-management requests and handling target_submit_tmr() failures. A remote user can issue VSCSIIF_ACT_SCSI_ABORT or reset requests to cause a denial of service.

The issue affects a pvSCSI guest and can leak command tags for a LUN session, stopping the LUN, when task-management request submission fails.

731) Memory leak (CVE-ID: CVE-2026-72087)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in lpfc_sli4_driver_resource_setup() in the lpfc driver when handling early exit error paths during driver resource setup. A local user can trigger the affected error paths to cause a denial of service.

732) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72088)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in hpsa_scsi_ioaccel2_queue_command() in the hpsa SCSI driver when handling an IOACCEL2 reset condition. A local user can trigger the affected code path to cause a denial of service.

The issue occurs when phys_disk->in_reset is set during command processing.

733) Race condition (CVE-ID: CVE-2026-72096)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to bypass audit logging of corrupted block errors.

The vulnerability exists due to a race condition in dm-verity error handling in drivers/md/dm-verity-target.c when handling concurrent corrupted block errors. A local attacker can trigger concurrent error conditions to bypass audit logging of corrupted block errors.

734) Incorrect calculation (CVE-ID: CVE-2026-72099)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper calculation in dm-integrity when processing integrity metadata tags. A local user can trigger incorrect hash offset handling to cause a denial of service.

735) Double free (CVE-ID: CVE-2026-72102)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in dm_early_create in drivers/md/dm-ioctl.c when resuming a device-mapper device after swapping in a new table. A local user can trigger a dm_resume failure to cause a denial of service.

736) Integer overflow (CVE-ID: CVE-2026-72105)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in create_log_context in drivers/md/dm-log.c when calculating bitmap memory size for large region_count values on 32-bit systems. A local user can trigger the vulnerable code path to cause a denial of service.

Only 32-bit systems are affected.

737) Out-of-bounds read (CVE-ID: CVE-2026-72107)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dm-era writeset handling when processing I/O for tables with a non-zero start sector. A local user can trigger out-of-bounds memory access to cause a denial of service.

The issue occurs because an absolute mapped-device block number is used instead of a target-relative block number during writeset lookup.

738) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72108)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause metadata inconsistency and a denial of service.

The vulnerability exists due to improper state management in dm-thin metadata snapshot handling in drivers/md/dm-thin-metadata.c when reserving or releasing a metadata snapshot and a subsequent metadata commit fails. A local user can issue crafted dmsetup messages to trigger a commit failure and cause metadata inconsistency and a denial of service.

Exploitation requires the ability to manage a thin-pool metadata device and trigger snapshot reserve or release operations under commit-failure conditions.

739) Improper resource shutdown or release (CVE-ID: CVE-2026-72109)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cleanup in sparx5_register_notifier_blocks() in the sparx5 switchdev component when handling initialization failures after workqueue allocation fails. A local user can trigger initialization failure conditions to cause a denial of service.

The issue leaves a switchdev blocking notifier registered on the error path.

740) Use-after-free (CVE-ID: CVE-2026-72110)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in task BPF storage handling in copy_process() and free_task() when handling a fork operation that aborts before task BPF storage is initialized. A local user can trigger a failed fork from a process inserted into a task storage map to cause a denial of service or execute arbitrary code.

Exploitation is reachable when the calling process has been inserted into a task storage map.

741) Race condition (CVE-ID: CVE-2026-72113)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing device reference count in the CAN BCM socket handling code when unregistering CAN filters during concurrent device unregistration. A local user can trigger concurrent socket and device unregistration conditions to cause a denial of service.

The issue can leave a stale CAN filter pointing to a soon-to-be-freed bcm_op or socket.

742) Improper input validation (CVE-ID: CVE-2026-72114)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in bcm_rx_setup() in the CAN BCM subsystem when processing RX_SETUP messages with RX_RTR_FRAME. A local user can supply a crafted RTR-reply frame with an invalid length to cause a denial of service.

The issue affects RTR replies configured through RX_SETUP and involves validation of CAN and CAN FD frame length limits.

743) Race condition (CVE-ID: CVE-2026-72115)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the can bcm rx handler when processing matching frames for an ANYDEV rx operation from multiple interfaces concurrently. A local user can trigger concurrent frame handling to cause a denial of service.

The issue affects ANYDEV rx operations with an active RX timeout and/or throttle timer, and can cause spurious RX_TIMEOUT notifications and corruption of last_frames metadata.

744) Race condition (CVE-ID: CVE-2026-72116)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the net/can/bcm.c CAN broadcast manager rx_ops handling when an RX_SETUP update races with device unregistration. A local user can perform an RX_SETUP update during concurrent device removal to cause a denial of service.

Frame delivery for the updated filter may silently stop for the affected ifindex. This does not apply to rx_ops using ifindex 0 for all CAN devices.

745) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72116)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the net/can/bcm.c CAN broadcast manager tx_ops handling when a CAN device is unregistered while cyclic transmission remains active. A local user can trigger device removal conditions for an existing operation to cause a denial of service.

The issue can leave an hrtimer re-arming indefinitely and may allow injection into a later reused ifindex until an explicit TX_SETUP update occurs.

746) Race condition (CVE-ID: CVE-2026-72117)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose incorrect interface and timestamp metadata to user space.

The vulnerability exists due to a race condition in bcm_rx_handler() when processing CAN frames for rx operations subscribed on all interfaces. A local user can trigger concurrent frame handling on different CPUs to disclose incorrect interface and timestamp metadata to user space.

The issue affects rx operations with ifindex set to 0, where the same operation is registered in the shared per-netns wildcard filter list, and torn 64-bit timestamp stores may occur on 32-bit platforms.

747) Race condition (CVE-ID: CVE-2026-72118)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause incorrect procfs statistics output.

The vulnerability exists due to a race condition in bcm_rx_handler() and related CAN BCM statistics handling in net/can/bcm.c when processing concurrent CAN frame reception on different CPUs for the same rx operation. A local attacker can trigger concurrent CAN frame processing to cause incorrect procfs statistics output.

For rx operations subscribed on all interfaces, concurrent handling on different CPUs can cause frames_filtered to become larger than frames_abs, leading to a bogus or even negative reduction percentage in procfs.

748) Race condition (CVE-ID: CVE-2026-72119)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the net/can/bcm.c CAN BCM transmission handling when updating existing transmit operations from userspace while transmit and timeout processing occur concurrently. A local user can send crafted CAN BCM configuration data to trigger inconsistent frame or timer state and cause a denial of service.

The issue involves partially updated or unvalidated frame data being observable during concurrent transmission processing, and torn 64-bit ktime_t reads on 32-bit platforms.

749) Use-after-free (CVE-ID: CVE-2026-72120)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the net/can/bcm.c broadcast manager operation list handling when traversing and releasing bcm_op structures under RCU protection. A local user can trigger crafted CAN BCM socket operations to cause a denial of service.

The issue involves inconsistent RCU list operations for tx_ops and rx_ops during setup, proc traversal, and socket release.

750) Race condition (CVE-ID: CVE-2026-72121)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in net/can/bcm.c when updating filter and timer values concurrently with handling incoming CAN traffic. A local user can trigger concurrent bcm_rx_setup() and RX handler activity to cause a denial of service.

The issue affects concurrent access to timer, filter, and stored frame state in the broadcast manager CAN implementation.

751) Race condition (CVE-ID: CVE-2026-72122)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the socket to match traffic from unintended CAN interfaces.

The vulnerability exists due to a race condition in bcm_sendmsg() in net/can/bcm.c when processing CAN BCM socket operations concurrently with device unregistration or concurrent socket binding. A local user can trigger concurrent operations on a shared socket to cause the socket to match traffic from unintended CAN interfaces.

Exploitation requires a race with concurrent bcm_notify() or bcm_connect() updates to the socket state.

752) Use-after-free (CVE-ID: CVE-2026-72123)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the can bcm rx operation handling in net/can/bcm.c when tearing down bcm rx operations concurrently with packet reception and timer activity. A local user can trigger a race condition to cause a denial of service.

The issue involves a thrtimer callback dereferencing a deallocated bcm_op object after an RCU grace period elapses.

753) Race condition (CVE-ID: CVE-2026-72124)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the can isotp socket transmission state machine in net/can/isotp.c when handling concurrent send, receive, echo, timer, and socket release events. A local user can trigger concurrent state transitions to cause a denial of service.

The issue affects TX state handling across sendmsg(), the RX path, and hrtimer callbacks.

754) Use-after-free (CVE-ID: CVE-2026-72125)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race in the Linux kernel CAN ISO-TP socket handling in net/can/isotp.c when releasing a socket concurrently with NETDEV_UNREGISTER. A local user can trigger concurrent socket release and device unregistration to cause a denial of service.

The issue can leave a stale CAN filter referencing a freed socket.

755) Use-after-free (CVE-ID: CVE-2026-72126)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the isotp socket release and receive timer handling in net/can/isotp.c when processing concurrent CAN ISO-TP socket release and network device unregister events. A local user can trigger the race condition to cause a denial of service.

The issue occurs because an in-flight receive handler may re-arm a timer on a socket that has already been freed.

756) Out-of-bounds read (CVE-ID: CVE-2026-72129)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in nvmet_rdma_use_inline_sg() and inline scatterlist handling in the NVMe target RDMA component when processing host-controlled inline data with a nonzero offset. A remote user can send crafted inline data offsets and lengths to cause a denial of service.

The issue can be triggered when inline_data_size is configured larger than PAGE_SIZE, and page-spanning in-bounds ranges may also cause the scatterlist to be under-counted.

757) Improper Initialization (CVE-ID: CVE-2026-72133)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in the spi-uniphier driver interrupt handling logic when registering an interrupt handler before initializing the associated completion. A local attacker can trigger an interrupt during driver initialization to cause a denial of service.

This may lead to complete() being called on an uninitialized completion, resulting in undefined behavior.

758) Out-of-bounds read (CVE-ID: CVE-2026-72135)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and corrupt kernel memory.

The vulnerability exists due to an out-of-bounds read and out-of-bounds write in the TPM character device read path when processing positional read operations with a pending response. A local user can issue a crafted pread request with a large offset to disclose sensitive information and corrupt kernel memory.

The issue affects the sequential command/response TPM device interface after a command has left a response pending.

759) Improper access control (CVE-ID: CVE-2026-72136)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify an xfrm interface across network namespace boundaries.

The vulnerability exists due to improper access control in xfrmi_changelink() when handling changelink requests for xfrm interfaces. A local privileged user can send a changelink request from one network namespace to rewrite an interface that lives in another network namespace to modify an xfrm interface across network namespace boundaries.

The issue occurs because the capability check was performed only against dev_net(dev) and not against the interface link network namespace.

760) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72138)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in gntdev_ioctl_map_grant_ref() in the xen grant device driver when handling an ioctl request and copying the operation result to userspace. A local user can trigger a copy_to_user failure after a mapping has been added to the list to cause a denial of service.

The issue can leave a mapping in priv->maps with a dangling list entry and a leaked reference count.

761) Use-after-free (CVE-ID: CVE-2026-72140)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in mlxbf_i2c_init_resource() when handling an error from devm_platform_get_and_ioremap_resource(). A local user can trigger the error path to cause a denial of service.

762) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-72142)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the i2c_imx_atomic_read function when processing SMBus block-read operations with a byte count of 0 or a count above I2C_SMBUS_BLOCK_MAX. A local user can trigger a crafted SMBus block read to cause a denial of service.

The issue can leave the i2c bus stuck with SDA held until a power cycle for the affected controller.

763) Improper Initialization (CVE-ID: CVE-2026-72146)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in the rz-dmac DMA driver interrupt handling path when registering interrupts before channel and driver state is fully initialized. A local attacker can trigger an interrupt during device initialization to cause a denial of service.

The interrupt handler may access an uninitialized channel base pointer and uninitialized descriptor lists.

764) Race condition (CVE-ID: CVE-2026-72148)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dw_edma_v0_core_start() when concurrently starting DMA channels. A local user can trigger concurrent channel operations to cause a denial of service.

The DONE_INT_MASK and ABORT_INT_MASK registers are shared by all DMA channels, and the issue arises from a non-atomic read-modify-write sequence while updating them.

765) Improper locking (CVE-ID: CVE-2026-72152)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of task state and wake-up logic in wait_for_tpm_stat() in the TPM TIS core when waiting for TPM status changes on the IRQ wait path. A local user can trigger TPM operations that exercise the affected wait path to cause a denial of service.

The issue is associated with the IRQ-based wait path and can trigger a kernel warning when CONFIG_DEBUG_ATOMIC_SLEEP is enabled.

766) Out-of-bounds read (CVE-ID: CVE-2026-72153)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in crossbar_domain_free() in the irqchip crossbar component when freeing IRQ domain mappings. A local user can trigger release of a crafted IRQ mapping state to cause a denial of service.

The issue can also leave the crossbar register connection to the source interrupt active because the wrong index is used for the irq_map entry and register update.

767) Improper locking (CVE-ID: CVE-2026-72155)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock state handling in the spi_nor_sr_unlock() function in the spi-nor software protection logic when processing unlock requests for locked blocks at the beginning of the device. A local user can request unlocking of the currently locked block or blocks to cause a denial of service.

The issue occurs when the first block, or a few first blocks, are locked and both top and bottom unlocking paths can achieve the same result.

768) Out-of-bounds write (CVE-ID: CVE-2026-72157)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to an out-of-bounds write in tbnet_poll() when processing a multi-frame ThunderboltIP packet with a peer-supplied frame_count that exceeds the fragment array capacity. A remote attacker can send a specially crafted packet with 19 or more small frames to corrupt memory.

The issue occurs because the first frame is placed in the skb linear area while subsequent frames are added as page fragments.

769) Improper input validation (CVE-ID: CVE-2026-72159)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ocfs2 inode validation when processing a forged dinode on an OCFS2 volume. A local user can provide a malformed inode with non-zero i_size and zero i_clusters to cause a denial of service.

Sparse regular files are exempt on volumes mounted with sparse allocation enabled, while non-inline directories are also affected by this malformed size and cluster state.

770) Improper input validation (CVE-ID: CVE-2026-72160)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in ocfs2_validate_inode_block() and ocfs2_filecheck_validate_inode_block() when processing forged OCFS2 inode metadata. A local user can provide a crafted dinode with non-canonical i_mode type bits to cause a denial of service.

The issue affects the normal read path and the online filecheck read path.

771) NULL pointer dereference (CVE-ID: CVE-2026-72163)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ocfs2_assure_trans_credits() when completing a direct write over unwritten extents after a journal abort. A local user can trigger a direct write operation and cause the kernel to panic to cause a denial of service.

Exploitation requires an ocfs2 direct I/O write path where the journal aborts during I/O completion, such as after an I/O error.

772) Improper access control (CVE-ID: CVE-2026-72164)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite file data belonging to another inode.

The vulnerability exists due to improper allocation of occupied clusters in ocfs2_move_extent() and ocfs2_probe_alloc_group() when processing a non-auto OCFS2_IOC_MOVE_EXT operation with a user-supplied physical goal. A local user can supply a crafted occupied goal value to overwrite file data belonging to another inode.

The issue occurs when the supplied goal is at the end of the target block group or when the free-run start is miscalculated.

773) Out-of-bounds read (CVE-ID: CVE-2026-72165)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds access in nand_select_target() when handling an invalid chip-select target index. A local attacker can trigger the vulnerable code path with an out-of-range cs value to cause a denial of service.

774) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72166)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper signal handling in p9_client_rpc() in net/9p/client.c when handling P9_TFLUSH requests over an fd transport with no peer. A local user can trigger a fatal signal while a thread is blocked in the affected code path to cause a denial of service.

The issue can cause the affected task to sleep indefinitely and, in practice, can stall coredump handling in multi-threaded processes.

775) Improper resource shutdown or release (CVE-ID: CVE-2026-72167)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the pl35x NAND controller probe routine when unloading the affected kernel module after mapping device registers. A local user can trigger the affected probe and unload path to cause a denial of service.

776) Race condition (CVE-ID: CVE-2026-72170)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in v9fs_dec_count in the 9p filesystem inode handling code when processing unlink operations in cacheless mode. A local user can trigger heavy unlink workloads to cause a kernel warning and system instability.

Only systems using the 9p filesystem in cacheless mode are affected.

777) Incomplete cleanup (CVE-ID: CVE-2026-72171)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cleanup in register_device() in the slram driver when handling device registration failures. A local user can trigger allocation or registration failures to cause a denial of service.

The issue occurs after a partially initialized entry has already been linked into the global device list, and a later cleanup can dereference or free invalid state from that failed entry.

778) Out-of-bounds write (CVE-ID: CVE-2026-72181)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to memory corruption in mipsmt_sys_sched_setaffinity when copying a user-supplied CPU mask from user space with CONFIG_CPUMASK_OFFSTACK enabled. A local user can supply a crafted CPU affinity mask to cause memory corruption.

Only systems with CONFIG_CPUMASK_OFFSTACK enabled are vulnerable.

779) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72182)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a refcount leak in is_full_charged() in the charger-manager power supply driver when checking the fuel_gauge power supply state. A local user can trigger the affected code path to cause a denial of service.

780) Out-of-bounds write (CVE-ID: CVE-2026-72191)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in indx_insert_into_buffer in the ntfs3 filesystem code when processing a crafted NTFS filesystem image during file creation in a mounted directory. A local user can mount a specially crafted NTFS image and trigger filesystem operations to cause a denial of service.

Triggering the issue requires local mounting of an attacker-supplied filesystem image, such as via loopback, removable media, or USB, and a filesystem operation such as creating a file in the mounted directory.

781) Out-of-bounds write (CVE-ID: CVE-2026-72192)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite adjacent heap memory.

The vulnerability exists due to an out-of-bounds write in indx_insert_into_root in the ntfs3 index handling code when processing a crafted mounted NTFS image during file creation. A local user can create a sufficiently long file name in a directory with a full resident root to overwrite adjacent heap memory.

The overwritten bytes are copied from on-disk NTFS entries and are attacker-controlled, and exploitation depends on the surrounding slab layout.

782) Infinite loop (CVE-ID: CVE-2026-72193)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop in check_rstbl() in the ntfs3 driver when mounting a crafted NTFS3 disk image. A local user can provide a specially crafted filesystem image to cause a denial of service.

User interaction may be required in environments that automatically mount attached removable media.

783) Stack-based buffer overflow (CVE-ID: CVE-2026-72194)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in indx_find_buffer() in the ntfs3 filesystem driver when mounting a crafted NTFS filesystem and deleting a file that triggers index rebalancing. An attacker with physical access can provide a malicious NTFS image with circular index node references to cause a denial of service.

User interaction may be required in environments where removable media is mounted through desktop automount.

784) Integer underflow (CVE-ID: CVE-2026-72195)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an integer underflow leading to an out-of-bounds read in do_action() UpdateResidentValue handling in fs/ntfs3/fslog.c when processing a crafted on-disk NTFS log record during mount. A local user can supply a crafted filesystem image to trigger an oversized resident attribute data_size and disclose sensitive information.

The issue occurs when attr_off and redo_len from the on-disk log record make aoff + dlen smaller than data_off, causing data_size to wrap to nearly 4 GiB.

785) Out-of-bounds write (CVE-ID: CVE-2026-72197)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in do_action() in fs/ntfs3/fslog.c when processing a crafted NTFS image during mount. An attacker with physical access can provide a specially crafted NTFS image to cause a denial of service.

The issue is triggered in the DeleteIndexEntryAllocation case when an on-disk INDEX_BUFFER entry contains a malformed size value, causing memmove() to use an invalid length. User interaction is required to mount the crafted filesystem image.

786) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72215)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect stack handling in prom_printf() when calling 32-bit firmware code from a kernel thread in 64-bit MIPS configurations. A local user can trigger console output during system bootstrap to cause a denial of service.

The issue occurs when the initial console remains in use late into bootstrap, causing the kernel to hang before startup completes.

787) Memory leak (CVE-ID: CVE-2026-72216)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in qcom_add_minidump_segments() when adding custom dump segments. A local user can trigger minidump segment handling failures to cause a denial of service.

788) Improper update of reference count (CVE-ID: CVE-2026-72218)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper reference count management in lockd nlm_lookup_file() when handling cached file lookups after nlm_do_fopen() failure. A remote user can trigger a failed file-open operation to cause a denial of service.

The issue occurs because the file reference count is incremented but not released, preventing the file from being reaped between requests.

789) Memory leak (CVE-ID: CVE-2026-72219)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in nlm_lookup_file() when processing file handles rejected by the underlying export. A remote attacker can present crafted file handles that trigger nlm_do_fopen() failures to cause a denial of service.

Each failed open attempt leaks one newly allocated nlm_file object.

790) Memory leak (CVE-ID: CVE-2026-72223)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in discover_arenas() in the nvdimm btt subsystem when handling arena discovery failures. A local user can trigger an arena discovery failure to cause a denial of service.

791) Memory leak (CVE-ID: CVE-2026-72224)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of allocated memory in btt_init() in the nvdimm btt subsystem when handling BTT initialization failures. A local user can trigger an initialization failure to cause a denial of service.

792) Integer underflow (CVE-ID: CVE-2026-72225)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer underflow in jbd2_journal_initialize_fast_commit() when initializing fast commit journal metadata. A local user can trigger journal initialization with crafted journal parameters to cause a denial of service.

The issue can corrupt j_last, j_fc_first, and j_free, leading to journal abort.

793) Integer overflow (CVE-ID: CVE-2026-72226)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds read.

The vulnerability exists due to an integer overflow in the batadv_tt_tvlv_unicast_handler_v1 function when processing a TT unicast TVLV containing a crafted number of VLAN entries. A remote attacker can send a specially crafted TVLV message to cause an out-of-bounds read.

794) Improper resource shutdown or release (CVE-ID: CVE-2026-72228)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in batman-adv fragmentation handling in net/batman-adv/fragmentation.c when linearizing packets with a frag_list before splitting them. A local user can trigger a linearization failure with a crafted packet state to cause a denial of service.

795) Improper resource shutdown or release (CVE-ID: CVE-2026-72229)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource shutdown in batman-adv mesh interface cleanup when netdev registration is vetoed after creating the untagged VLAN object. A local user can trigger mesh interface registration failure to cause a memory leak.

The issue occurs because the untagged VLAN object is created during the NETDEV_REGISTER notifier path, and .dellink is not called when registration is aborted.

796) Improper resource shutdown or release (CVE-ID: CVE-2026-72230)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in batadv_frag_send_packet() in the batman-adv fragmentation component when processing packets with an empty payload or a zero fragment size. A local user can trigger the error path with such packet conditions to cause a denial of service.

797) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72231)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper state management in batadv_send_tt_request() in the batman-adv translation table component when handling translation table requests after send buffer allocation failure. A local attacker can trigger repeated translation table requests to cause a denial of service.

The issue can lead to request storms because information about a pending translation table request is lost after a failed send attempt.

798) Out-of-bounds read (CVE-ID: CVE-2026-72232)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in batadv_interface_tx() when processing a truncated packet redirected to a batadv interface through a tc filter. A local user can attach a tc filter that truncates the packet and redirects it to a batadv interface to disclose sensitive information.

Exploitation requires eBPF TC hook access.

799) Use-after-free (CVE-ID: CVE-2026-72233)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in batman-adv BLA handling when processing crafted network packets. A local attacker can send a specially crafted packet to cause a denial of service.

800) Use-after-free (CVE-ID: CVE-2026-72234)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in net/batman-adv/routing.c when processing batman-adv unicast packets. A local user can send a specially crafted packet to cause a denial of service.

801) Use-after-free (CVE-ID: CVE-2026-72235)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in batadv_interface_rx() in the batman-adv soft interface code when processing received packets after a potential skb reallocation. A remote attacker can send a specially crafted packet to cause a denial of service.

802) Division by zero (CVE-ID: CVE-2026-72238)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in early_serial_init() when parsing the console=uart8250 boot parameter. A local user can supply an empty, zero, invalid, or overflowing baud rate value to cause a denial of service.

The issue causes the system to hang during early boot.

803) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72240)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference leak in sm501_register_device() when handling a failed device registration. A local user can trigger platform_device_register() to fail to cause a denial of service.

804) Out-of-bounds read (CVE-ID: CVE-2026-72241)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the uleds_write function when processing a user-supplied LED name string. A local user can supply a non-null-terminated string to disclose sensitive information.

805) NULL pointer dereference (CVE-ID: CVE-2026-72242)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in selinux_sctp_bind_connect() when processing SCTP ASCONF operations from the softirq path. A local user can trigger the vulnerable SCTP bind or connect handling to cause a denial of service.

The issue occurs when the hook is invoked from the ASCONF softirq path, where no file reference guarantees that sk->sk_socket is non-NULL.

806) Improper resource shutdown or release (CVE-ID: CVE-2026-72245)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in host1x_device_add() error handling for host1x_device_parse_dt() when processing device tree data. A local user can trigger a failure in device parsing to cause a denial of service.

807) Improper access control (CVE-ID: CVE-2026-72247)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass connection counting limits.

The vulnerability exists due to improper access control in nf_conncount when processing connection tuples across conntrack zones. A remote attacker can send network traffic that creates connections with matching tuples in different zones to bypass connection counting limits.

The issue affects the tuple dedup logic in __nf_conncount_add(), where original-direction tuples are compared using an incorrect zone direction value.

808) Incorrect calculation (CVE-ID: CVE-2026-72250)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an unset header offset in nf_ct_frag6_reasm() when processing IPv6 fragments on the NF_INET_LOCAL_OUT defragmentation path. A local user can send a specially crafted fragmented IPv6 packet to cause a denial of service.

The issue occurs because skb->mac_header may still hold the unset sentinel value when no link-layer header is present yet.

809) Use-after-free (CVE-ID: CVE-2026-72251)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in nf_nat_sip in net/netfilter/nf_nat_sip.c when handling cloned socket buffers during SIP NAT processing. A local user can trigger packet processing with a cloned skb to cause a denial of service.

The issue occurs in the reply-direction destination port mangling path for SIP traffic.

810) Out-of-bounds write (CVE-ID: CVE-2026-72252)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to out-of-bounds writes in the nft_pipapo_match handling in netfilter nft_set_pipapo when processing set element insertions after a prior memory allocation failure left a cloned match in an invalid state. A local user can trigger an allocation failure and then perform a subsequent insertion in the same batch to cause memory corruption.

The issue can also affect a subsequent transaction because a bad clone may persist when the abort callback is not executed after the initial failure.

811) NULL pointer dereference (CVE-ID: CVE-2026-72253)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the nf_conntrack_sip SIP helper when processing traffic with sip_external_media enabled in subsystems where routing information is unavailable. A local user can send specially crafted network traffic to cause a denial of service.

The issue affects tc ingress and openvswitch when the sip_external_media module parameter is set to 1.

812) Use-after-free (CVE-ID: CVE-2026-72255)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in nf_queue handling of bridge fake dst references when processing bridged packets queued to NFQUEUE. A local user can queue bridged packets to NFQUEUE during bridge device teardown to cause a denial of service.

The issue affects systems with CONFIG_BRIDGE_NETFILTER enabled and involves queued packets carrying a fake rtable associated with a bridge device.

813) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72256)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of template conntrack state in xt_cluster_mt() in the netfilter xt_cluster matcher when processing packets associated with a template conntrack. A local user can trigger packet processing that reaches xt_cluster_hash() with incomplete conntrack state to cause a denial of service.

The issue occurs when the raw table CT target attaches a template conntrack to skb->_nfct before normal conntrack processing.

814) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72260)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in mt8192_afe_pcm_dev_probe() when probing the MT8192 AFE device and reinitializing the regmap cache during runtime power management resume. A local user can trigger device probe under conditions where runtime resume fails to cause a denial of service.

The issue can leave the power management usage count incremented and continue probe while the device may not be accessible.

815) Memory leak (CVE-ID: CVE-2026-72264)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in trident_pci_probe() when handling a PCI device probe error path. A local user can trigger the vulnerable code path to cause a denial of service.

816) Memory leak (CVE-ID: CVE-2026-72265)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in nvidiafb_probe() when handling device initialization errors. A local user can trigger an error path during device probing to cause a denial of service.

817) Memory leak (CVE-ID: CVE-2026-72267)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in alloc_carmine_fb() when handling an error path after converting video modes to a modelist. A local user can trigger the vulnerable code path to cause a denial of service.

818) Memory leak (CVE-ID: CVE-2026-72268)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in tdfxfb_probe() in the tdfxfb driver when handling device initialization error paths. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs when CONFIG_FB_3DFX_I2C is defined.

819) Improper resource shutdown or release (CVE-ID: CVE-2026-72269)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in uvesafb_probe() when handling error paths during device initialization. A local user can trigger an error condition to cause a denial of service.

820) Memory leak (CVE-ID: CVE-2026-72270)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in s3_pci_probe() when probing a PCI device. A local user can trigger the driver initialization error path to cause a denial of service.

821) Memory leak (CVE-ID: CVE-2026-72271)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in i740fb_probe() when handling device initialization error paths. A local user can trigger the vulnerable error conditions to cause a denial of service.

822) Memory leak (CVE-ID: CVE-2026-72272)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in radeonfb_pci_register() when handling error paths after allocating display mode list entries. A local user can trigger the affected code path to cause a denial of service.

823) Improper resource shutdown or release (CVE-ID: CVE-2026-72274)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in hecubafb_probe() when handling device initialization errors. A local user can trigger an error path during initialization to cause a denial of service.

824) Memory leak (CVE-ID: CVE-2026-72275)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in broadsheetfb_probe() when handling device initialization errors. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs because memory allocated for pagerefs in deferred I/O initialization is not released on an error path.

825) Improper resource shutdown or release (CVE-ID: CVE-2026-72276)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in metronomefb_probe() when handling an error path after deferred I/O initialization. A local user can trigger device initialization failure to cause a denial of service.

826) Use-after-free (CVE-ID: CVE-2026-72282)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in kvm_io_bus_get_dev() and vgic_msi_to_its() when processing KVM MMIO bus device lookups for MSI addresses. A local user can trigger access to a matched device after the srcu lock has been dropped to cause a denial of service.

The issue occurs when the returned device matches only by address and is not the expected device type.

827) Race condition (CVE-ID: CVE-2026-72289)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in vgic_prune_ap_list() in the KVM arm64 virtual generic interrupt controller when migrating an interrupt to another vCPU while locks are temporarily dropped. A local user can trigger interrupt migration during this race to cause a denial of service.

The issue can result in list_del() being performed on an interrupt entry that has already been removed from the ap_list.

828) Improper input validation (CVE-ID: CVE-2026-72296)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ife_decode() when processing malformed IFE frames. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue can crash the kernel when the inner Ethernet header is not sufficiently accessible from the linear data area before the packet is passed to eth_type_trans().

829) Out-of-bounds read (CVE-ID: CVE-2026-72297)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in pvc_info() when reading /proc/net/atm/pvc after storing a crafted QoS traffic_class value. A local user can supply out-of-range QoS parameters to trigger an out-of-bounds read and disclose sensitive information.

The issue is caused by invalid traffic_class values being accepted into vcc->qos during QoS validation.

830) Integer overflow (CVE-ID: CVE-2026-72298)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow leading to out-of-bounds write in qrtr_endpoint_post() when processing a crafted incoming qrtr packet. A remote attacker can send a specially crafted packet to cause a denial of service.

Only 32-bit systems are affected; 64-bit systems are unaffected.

831) Use-after-free (CVE-ID: CVE-2026-72299)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in TIPC enqueue tracepoint queue dumping in tipc_sk_enqueue() when dumping socket queues during message enqueue processing. A local user can trigger crafted TIPC socket activity to cause a denial of service.

The issue is reachable while the socket is owned by user context, because the held spinlock protects the backlog queue but does not serialize access to sk_receive_queue.

832) Improper Initialization (CVE-ID: CVE-2026-72305)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in VDUSE bounce page allocation when mapping bounce pages to userspace. A local user can trigger bounce page mappings to disclose sensitive information.

833) Race condition (CVE-ID: CVE-2026-72306)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in vduse_dev_msg_sync and vduse_dev_read_iter in drivers/vdpa/vdpa_user/vduse_dev.c when handling VDUSE device message processing. A local user can trigger concurrent message operations to cause a denial of service.

The issue can lead to a double list_del() crash when a timed-out message is concurrently removed.

834) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72307)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect reference count management in mlxsw_sp_vrs_lpm_tree_replace() when rolling back failed LPM tree replacements for virtual routers. A local user can trigger an error during LPM tree replacement to cause a denial of service.

835) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72308)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in mlxsw_sp_port_lag_join() when handling an error from mlxsw_sp_port_lag_index_get(). A local user can trigger the error path to cause a denial of service.

836) Integer overflow (CVE-ID: CVE-2026-72310)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer overflow in smb2_ioctl_query_info() when validating a PASSTHRU_FSCTL response payload from a malicious server. A remote attacker can send a specially crafted server response to disclose sensitive information.

The out-of-bounds read occurs during a later copy_to_user() operation after a wrapped offset-plus-length check passes.

837) Improper handling of exceptional conditions (CVE-ID: CVE-2026-72314)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in regulator_lock_two() when handling lock contention between two regulators. A local user can trigger lock contention to cause a denial of service.

This issue is exploitable in practice on MIPS systems.

838) NULL pointer dereference (CVE-ID: CVE-2026-72316)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in metadata_open() when handling an allocation failure. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because a NULL return value was treated as a valid metadata pointer instead of an error.

839) Improper input validation (CVE-ID: CVE-2026-72319)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ip_vs_in_icmp in the IPVS subsystem when processing ICMP error packets from tunnels. A remote attacker can send a specially crafted ICMP error packet to cause a denial of service.

The issue involves inner IP headers not being ensured in skb headroom after outer headers are stripped, and additional length checks were required for the inner headers.

840) Use-after-free (CVE-ID: CVE-2026-72322)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the IPv6 MLD delayed work handling in net/ipv6/mcast.c when processing incoming MLD queries during device teardown. A remote attacker can send crafted MLD query traffic to trigger a kernel panic and cause a denial of service.

The issue arises from a race condition between device destruction and packet receive processing under RCU protection.

841) Use-after-free (CVE-ID: CVE-2026-72323)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the IGMP timer callback when processing incoming IGMP queries during device teardown. A remote attacker can send a crafted IGMP query to cause a denial of service.

Exploitation requires a race between device destruction and IGMP query processing.

842) Integer underflow (CVE-ID: CVE-2026-72326)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect rate accounting.

The vulnerability exists due to an integer underflow in the CAKE packet length calculation in net/sched/sch_cake.c when processing packets with a negative overhead adjustment. A local user can configure a crafted overhead value to cause incorrect rate accounting.

Exploitation requires the ability to configure CAKE scheduler parameters.

843) Off-by-one (CVE-ID: CVE-2026-72339)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an off-by-one error in the qede_rx_build_skb() and qede_tpa_rx_build_skb() functions when handling a NULL return from qede_build_skb() under memory pressure. A local user can trigger memory pressure and network receive processing to cause memory corruption.

The issue can desynchronize the BD ring, which can corrupt DMA page reference counts and lead to SLUB freelist corruption.

844) Improper input validation (CVE-ID: CVE-2026-72347)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the xt_connmark CONNMARK target revision 2 handling when evaluating a rule with invalid shift parameters. A local user can install a malformed rule with a shift_bits value of 32 or more or an invalid shift_dir value to cause a denial of service.

The issue is triggered when the malformed rule is evaluated in the packet path.

845) Improper input validation (CVE-ID: CVE-2026-72348)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass packet-filtering rules.

The vulnerability exists due to improper input validation in the ip6tables ah, hbh, and rt IPv6 extension header match handlers when processing malformed IPv6 packets with advertised extension header lengths that exceed the available skb data. A remote attacker can send a specially crafted IPv6 packet to bypass packet-filtering rules.

The issue affects handling of malformed IPv6 authentication, hop-by-hop, and routing extension headers.

846) Integer overflow (CVE-ID: CVE-2026-72349)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended rate-based matching logic.

The vulnerability exists due to integer truncation in xt_rateest_mt() in netfilter xt_rateest when processing rate estimator values on high-speed links. A local user can trigger rate comparisons involving byte rates above 2^32-1 to bypass intended rate-based matching logic.

The issue occurs on links faster than approximately 34 Gbps, where the byte rate may exceed 4.3 GBps and no longer fits in 32-bit variables.

847) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-72350)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds shift operation in u32_match_it() in the xt_u32 netfilter match when evaluating a malformed u32 rule during packet processing. A local user can supply a crafted u32 rule with a shift count of 32 or more to cause a denial of service.

848) Out-of-bounds read (CVE-ID: CVE-2026-72351)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in gue_remcsum() and gue_gro_remcsum() when processing malformed GUE packets with the REMCSUM private flag set but without the required REMCSUM metadata fields. A remote attacker can send a specially crafted packet to disclose sensitive information.

The issue occurs because option validation accepts packets that contain only the private flags field even when additional REMCSUM start and offset fields are expected.

849) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72371)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in afs_insert_volume_into_cell() when replacing an AFS volume entry in the cell volume tree. A local user can trigger volume replacement operations to cause a denial of service.

The issue can cause the old volume to be removed from the tree twice while the new volume is never removed.

850) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72374)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of incomplete message parsing state in afs callback service message parsers when processing callback notification request streams. A remote attacker can send crafted callback messages with incomplete packet sequences to cause a denial of service.

The issue affects the AFS filesystem client callback service that listens through an rxrpc server for callback notifications.

851) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72378)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in afs_extract_vl_addrs() when parsing AFS volume location address data. A local user can trigger processing of malformed address data to cause a denial of service.

852) Use-after-free (CVE-ID: CVE-2026-72389)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the STP timer handling in the Linux kernel bridge subsystem when deleting a bridge while the topology change timer is armed on an administratively down bridge. A local user can trigger bridge topology change detection and delete the bridge to cause a denial of service.

The issue occurs because the IFF_UP check was missing in br_topology_change_detection().

853) NULL pointer dereference (CVE-ID: CVE-2026-72392)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fib6_walk_continue() when resuming a multi-batch IPv6 FIB dump after a concurrent table insertion changes hash-chain ordering. A remote attacker can trigger netlink dump processing to cause a denial of service.

The issue occurs because walker state can become inconsistent, with the root referencing a different table while the node still points into the previous one.

854) Out-of-bounds read (CVE-ID: CVE-2026-72396)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in adm1275_probe() when comparing a device-provided model string returned by i2c_smbus_read_block_data(). A local user can provide a shortened crafted device string to cause the kernel to read uninitialized stack memory and disclose sensitive information.

Exploitation requires access to a device handled by the adm1275 hwmon driver.

855) Out-of-bounds read (CVE-ID: CVE-2026-72400)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in seg6_validate_srh() when processing a BPF program-supplied Segment Routing Header length in the SEG6 encapsulation path. A local user can supply a crafted short SEG6 encapsulation header to disclose sensitive information.

Exploitation is reachable through the BPF SEG6 encap path, including the SEG6 local BPF END_B6 and END_B6_ENCAP actions.

856) Double free (CVE-ID: CVE-2026-72406)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in gem_init_one() in the sungem network driver when handling a failed register_netdev() call during device probe. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs in the probe error cleanup path for a half-registered device.

857) Improper locking (CVE-ID: CVE-2026-72409)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the mvneta resume path when resuming the system while NAPI poll is pending after a per-CPU interrupt has been disabled. A local user can trigger a suspend and resume sequence during this condition to cause a denial of service.

This affects Marvell MPIC platforms using the mvneta driver, where the per-CPU interrupt can remain masked after resume and result in complete loss of network connectivity.

858) Division by zero (CVE-ID: CVE-2026-72414)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in future_base_time() in the sja1105 PTP perout handling code when processing a user-provided period value that becomes zero after conversion to SJA1105 clock ticks. A local user can provide a very small period value to trigger a kernel crash and cause a denial of service.

859) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72418)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state handling in nf_conncount when processing early-confirmed connection tracking entries for reused TIME_WAIT sockets or similar setup packets. A remote attacker can initiate network connections that trigger miscounting to cause a denial of service.

The issue can cause valid new connections to be falsely rejected in connlimit soft-limiting scenarios.

860) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72421)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended unreachable routing behavior.

The vulnerability exists due to improper control flow in fib_lookup() in the IPv4 FIB lookup logic when performing route lookups with CONFIG_IP_MULTIPLE_TABLES enabled and no rule added. A local user can configure routes that trigger lookup of the merged local/main table followed by the default table to bypass intended unreachable routing behavior.

The issue occurs because an error route result from the local or main table can be overwritten by a subsequent lookup in the default table.

861) Use-after-free (CVE-ID: CVE-2026-72422)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in smb3_preauth_hash_rsp() when processing concurrent SMB2 NEGOTIATE requests on the same connection. A remote attacker can send concurrent SMB2 NEGOTIATE requests that trigger a race and dereference freed memory to cause a denial of service.

The issue is a race between the SMB2 NEGOTIATE handler and the response send path, where a NULL check can be bypassed by concurrent freeing of conn->preauth_info before dereference.

862) Incorrect calculation (CVE-ID: CVE-2026-72428)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass Spectre v4 sanitization checks.

The vulnerability exists due to improper index calculation in check_stack_write_fixed_off() in the BPF verifier when handling fixed-offset stack writes. A local user can trigger a crafted stack write pattern to bypass Spectre v4 sanitization checks.

The issue occurs because the sanitization pre-check examines different stack slot bytes than the write path updates.

863) Use of Uninitialized Variable (CVE-ID: CVE-2026-72433)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in nft_meta_bridge_get_eval in nft_meta_bridge.c when evaluating the NFT_META_BRI_IIFPVID metadata expression. A local attacker can trigger processing of a bridge interface PVID query that encounters an error condition to disclose sensitive information.

864) Use-after-free (CVE-ID: CVE-2026-72435)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ipset comment extension handling in netfilter when freeing comment extension pointers. A local user can trigger ipset comment initialization or cleanup operations to cause a denial of service.

865) Use of uninitialized resource (CVE-ID: CVE-2026-72441)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory usage in dgram_recvmsg() when copying a socket address to user space after parsing an IEEE 802.15.4 address with mode IEEE802154_ADDR_NONE. A local user can receive a crafted packet and invoke recvmsg() to disclose sensitive information.

The issue occurs because the pan_id field of struct ieee802154_addr is left uninitialized when the address mode is IEEE802154_ADDR_NONE.

866) Race condition (CVE-ID: CVE-2026-72447)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized kernel memory to userspace.

The vulnerability exists due to a race condition in sctp_diag endpoint dumping when traversing endpoint address lists during diagnostic dumping without holding the socket lock. A local user can trigger concurrent socket operations while requesting SCTP diagnostic endpoint data to disclose uninitialized kernel memory to userspace.

The issue occurs because address counts gathered under RCU protection can become inconsistent before the subsequent copy operation.

867) Improper resource shutdown or release (CVE-ID: CVE-2026-72448)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the otx2_free_sq_res() send-queue resource teardown logic when tearing down a send queue with timestamping enabled. A local user can trigger interface shutdown or device removal to cause a denial of service.

Only send queues using timestamping are affected.

868) Out-of-bounds read (CVE-ID: CVE-2026-72450)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds shift in xfrm_selector_match and address matching helpers when processing xfrm selector matching with an AF_UNSPEC selector and an oversized prefix length. A local attacker can provide a crafted selector with a mismatched family or excessive prefix length to cause a denial of service.

The issue can be triggered when an AF_UNSPEC selector is matched against an IPv4 flow while XFRM_STATE_AF_UNSPEC is set.

869) Improper resource shutdown or release (CVE-ID: CVE-2026-72459)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in aa_label_alloc() in the AppArmor label handling code when allocating a label and the proxy allocation step fails. A local user can trigger an allocation failure condition to cause a denial of service.

870) NULL pointer dereference (CVE-ID: CVE-2026-72460)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in aa_change_profile() when building a replacement label during a profile change. A local user can trigger label build failure handling to cause a denial of service.

The issue occurs in the AppArmor profile transition logic during processing of profile change requests.

871) Out-of-bounds read (CVE-ID: CVE-2026-72466)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read and improper resource management in rpcrdma_is_bcall() when processing a short or malformed reply. A remote attacker can send a specially crafted reply to cause a denial of service.

The issue can misclassify a reply as a backchannel call and orphan a persistently DMA-mapped receive buffer, which can drain the Receive queue and lead to RNR NAKs in the peer.

872) Use-after-free (CVE-ID: CVE-2026-72476)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in dma_release_channel() when releasing a dma channel. A local user can trigger the release of a channel whose device reference may already be freed to cause a denial of service.

873) Use of Uninitialized Variable (CVE-ID: CVE-2026-72479)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in mma8452_read_raw() when handling a failed I2C block read in mma8452_read(). A local user can trigger an I2C read failure and cause the caller to use uninitialized stack memory to disclose sensitive information.

874) Use of Uninitialized Variable (CVE-ID: CVE-2026-72481)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in the ak8975 magnetometer driver when processing i2c block read results that are shorter than the destination buffer. A local user can trigger the driver to forward partially uninitialized buffer contents to IIO buffers to disclose sensitive information.

The leaked data may be exposed from kernel stack memory to userspace.

875) Integer overflow (CVE-ID: CVE-2026-72483)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to a shift-out-of-bounds error in max3421_hub_control() when handling a USBDEVFS_CONTROL ioctl for the root hub with a crafted wValue parameter. A local user can send a specially crafted ioctl request to corrupt kernel memory.

Exploitation requires access to the root hub device via /dev/bus/usb/.../001.

876) Double free (CVE-ID: CVE-2026-72484)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in comp_register_videodev() when handling a video device registration failure. A local user can trigger a device_register() failure during video device registration to cause a denial of service.

The issue occurs in the Linux kernel staging MOST video driver.

877) Use-after-free (CVE-ID: CVE-2026-72489)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in nvec_rx_completed() when handling an incomplete RX transfer. A local user can trigger an incomplete RX transfer to execute arbitrary code.

The freed message slot may be reallocated by a concurrent call to nvec_msg_alloc() before the code reads the message type byte.

878) Race condition (CVE-ID: CVE-2026-72491)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in net/9p RDMA transport state handling in trans_rdma.c when processing RDMA connection events and receive completions concurrently with RDMA requests. A local user can trigger concurrent state transitions to corrupt the connection state machine and cause a denial of service.

The race can lead to lost state transitions during teardown and may result in use-after-free on RDMA request objects.

879) Use-after-free (CVE-ID: CVE-2026-72492)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in same_client_has_lease() and smb_grant_oplock() when handling lease state for existing client oplocks during concurrent close operations. A remote user can trigger a concurrent close condition to cause a denial of service.

The issue occurs because a pointer selected from ci->m_op_list can be used after the last reference is dropped before it is dereferenced.

880) NULL pointer dereference (CVE-ID: CVE-2026-72502)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in skb_segment() when processing a local TCP packet with gso_size set to 0xFFFF. A local attacker can trigger a large MTU condition that causes the MSS clamp to reach 65535 to cause a denial of service.

The issue occurs because the 0xFFFF MSS value collides with the GSO_BY_FRAGS magic value, and local TCP packets do not use frag_list.

881) Use-after-free (CVE-ID: CVE-2026-74255)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to use-after-free in tipc_l2_send_msg() when handling TIPC layer 2 media disable operations concurrently with RCU readers. A local user can trigger concurrent access to a freed device pointer to execute arbitrary code or cause a denial of service.

The issue is caused by a race condition involving b->media_ptr and network-device lifetime management.

882) Integer overflow (CVE-ID: CVE-2026-74256)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in bpf_msg_pop_data() in the sockmap BPF message handling code when processing crafted start and len values. A local user can supply out-of-range values to trigger an out-of-bounds pop operation and cause a denial of service.

Exploitation can cause the pop loop to run past the end of the scatterlist and reach an invalid put_page() on an empty slot.

883) Race condition (CVE-ID: CVE-2026-74262)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in kcm_attach() and kcm_unattach() callback handling in net/kcm/kcmsock.c when changing lower socket callbacks concurrently. A local user can trigger concurrent callback updates and execution to cause a denial of service.

The issue can lead to stale or misdirected wakeups when callback and sk_user_data state become mismatched across CPUs.

884) Improper Initialization (CVE-ID: CVE-2026-74265)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in mana_gd_create_mana_wq_cq() when handling a failed work queue and completion queue creation. A local user can trigger queue creation failure to cause a denial of service.

The issue can clear an in-use completion queue table entry by destroying a queue with an uninitialized id value of 0.

885) Improper Initialization (CVE-ID: CVE-2026-74267)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in sch_codel when peeking queued packets after packet drops. A local user can trigger packet drops during peek to cause a denial of service.

The issue can incorrectly invoke the parent qlen_notify callback while a packet still remains queued, which may deactivate the parent class unexpectedly.

886) Race condition (CVE-ID: CVE-2026-74268)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in tcp_set_state() and tcp_call_bpf() when force-closing a child socket whose inherited sock_ops callback flags remain set after setup failure. A remote attacker can send network traffic that triggers child socket setup failure to cause a denial of service.

The issue occurs before the child socket is ever established and affects forced-close paths that reach tcp_done() without the expected socket lock.

887) Incorrect calculation (CVE-ID: CVE-2026-74276)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper buffer size calculation in the xilinx SPI driver FIFO size detection logic when handling SPI transactions in irq mode. A local user can trigger an SPI transaction of the assumed FIFO size or more to cause a denial of service.

The issue can cause the driver to spin in a while loop forever after one received byte is lost because the RX FIFO is smaller than the incorrectly assumed size.

888) Improper resource shutdown or release (CVE-ID: CVE-2026-74279)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the sg_cleanup error path in setup_sgio_components() when cleaning up DMA mappings after a mapping failure. A local user can trigger the error path to cause a denial of service.

The issue leaks successfully mapped DMA entries while repeatedly unmapping the failed entry.

889) Improper resource shutdown or release (CVE-ID: CVE-2026-74280)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the sg_cleanup path in drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c when cleaning up DMA mappings after a setup failure. A local user can trigger the cleanup path to cause a denial of service.

The issue uses the wrong loop index during DMA unmapping, which can leak successfully mapped entries while repeatedly unmapping the failed one.

890) Improper input validation (CVE-ID: CVE-2026-74281)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in tipc_update_nametbl() when processing peer-advertised PUBLICATION items. A remote attacker can send specially crafted bindings with inverted service ranges to cause a denial of service.

The issue causes unbounded binding-table memory to be leaked for the lifetime of the namespace.

891) Integer underflow (CVE-ID: CVE-2026-74282)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow in tipc_sk_conn_proto_rcv() when processing a CONN_MANAGER/CONN_ACK message. A remote attacker can send a specially crafted connection acknowledgment with an oversized ack count to cause a denial of service.

For a local connection, the connected peer socket can trigger the issue.

892) Improper access control (CVE-ID: CVE-2026-74283)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify TIPC state.

The vulnerability exists due to improper access control in TIPCv2 generic-netlink mutator operations when handling netlink administrative commands. A local user can invoke mutating netlink operations to modify TIPC state.

The issue affects commands that can change the network id and node identity, set or flush key material, and enable or disable a UDP bearer.

893) Race condition (CVE-ID: CVE-2026-74284)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the HFSC scheduler class handling in net/sched/sch_hfsc.c when dequeuing packets from a class whose child qdisc becomes empty. A local user can trigger packet processing that causes a class to be marked passive twice to cause a denial of service.

The issue can incorrectly remove a parent with still-backlogged sibling classes from the virtual time tree, causing queued traffic to stop being dequeued.

894) Out-of-bounds read (CVE-ID: CVE-2026-74287)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in SCTP parameter processing when parsing malformed embedded address parameters in INIT or ASCONF messages. A remote attacker can send a specially crafted SCTP parameter with an embedded address length that exceeds the enclosing parameter bounds to disclose sensitive information.

The issue affects ADD_IP, DEL_IP, and SET_PRIMARY parameters that contain embedded address parameters.

895) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-74288)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in fib_rules_dump() when dumping fib_rule entries during an RCU dump. A local user can trigger fib_rule processing involving a dying fib_rule to cause a denial of service.

896) Out-of-bounds read (CVE-ID: CVE-2026-74292)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in tegra_ahub_put_value_enum() in the tegra210 AHUB ASoC driver when processing a written enumerated control value. A local user can supply an out-of-range enum item value to disclose sensitive information.

897) Improper input validation (CVE-ID: CVE-2026-74293)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src() in the fsl_audmix ASoC driver when handling user-provided enum control values. A local user can supply an out-of-range enum item to cause a denial of service.

The invalid value is converted before bounds checking, and the affected code paths use the converted value in a BIT() test and as an index into a transition table.

898) Out-of-bounds read (CVE-ID: CVE-2026-74295)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the hdac_hdmi_set_pin_port_mux() function when handling a written enumerated control value. A local user can supply an out-of-range enum value to disclose sensitive information.

899) Integer overflow (CVE-ID: CVE-2026-74297)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in set_rq_size() in the RDMA/mlx5 queue pair handling code when processing a user-provided rq_wqe_shift value. A local user can supply a crafted shift value to trigger undefined behavior and cause a denial of service.

900) Improper access control (CVE-ID: CVE-2026-74305)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass intended cgroup storage compatibility checks.

The vulnerability exists due to improper access control in bpf prog-array compatibility checks when validating tail-call chains involving cgroup local storage. A local user can load a storage-less BPF program that performs tail calls to bridge between programs with incompatible storage cookies to bypass intended cgroup storage compatibility checks.

Exploitation requires the ability to load and use BPF programs that participate in tail-call chains.

901) Out-of-bounds read (CVE-ID: CVE-2026-74312)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds access in vhost_vdpa_mmap() and vhost_vdpa_fault() when processing a virtqueue index from vm_pgoff. A local user can provide an out-of-range queue index to trigger driver-specific get_vq_notification() callbacks and cause a denial of service.

The issue may lead to invalid PFN remaps in the callback path.

902) Use-after-free (CVE-ID: CVE-2026-74313)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in vduse_dev_open() when opening a VDUSE device while a concurrent VDUSE_DESTROY_DEV operation removes the same device from the IDR. A local user can trigger concurrent operations on the same device to cause a denial of service.

903) Use-after-free (CVE-ID: CVE-2026-74320)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the sm501fb OF binding code when parsing device tree mode and EDID properties during framebuffer initialization. A local user can supply crafted property values or trigger affected initialization paths to cause a denial of service.

The issue also involves a double free, a buffer overrun, and memory leaks when both CRT and PANEL are enabled or when probe error paths are reached.

904) NULL pointer dereference (CVE-ID: CVE-2026-74321)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an invalid pointer dereference in __btrfs_run_delayed_refs() when processing delayed references. A local user can trigger the vulnerable code path to cause a denial of service.

905) NULL pointer dereference (CVE-ID: CVE-2026-74327)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in is_vm_area_hugepages() when handling an invalid vmalloc address. A local attacker can provide an invalid vmalloc address to trigger a kernel crash to cause a denial of service.

906) Use-after-free (CVE-ID: CVE-2026-74329)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in watchdog_pm_notifier in the Linux kernel watchdog subsystem when processing suspend and resume notifications after watchdog device unregistration. A local user can trigger a suspend or resume event after unregistering a watchdog device to cause a denial of service.

Only watchdog devices with WDOG_NO_PING_ON_SUSPEND set are affected.

907) Race condition (CVE-ID: CVE-2026-74330)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in configfs directory entry child traversal when traversing s_children lists while concurrent cursor movement or freeing can occur. A local user can trigger concurrent configfs operations to cause a denial of service.

The issue affects configfs directory handling in fs/configfs/dir.c.

908) Deadlock (CVE-ID: CVE-2026-74331)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a recursive locking deadlock in firmware_loader power management notification handling when preparing for system suspend or hibernation and caching firmware images. A local attacker can trigger an out-of-memory condition that causes synchronous execution of firmware caching work to cause a denial of service.

The issue occurs when asynchronous work scheduling falls back to synchronous execution after memory allocation for the work entry fails.

909) Use of Uninitialized Variable (CVE-ID: CVE-2026-74339)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in snd_seq_read() when copying queued variable-length event headers to userspace. A local user can write a direct variable event to itself and read back a kernel pointer from the returned header to disclose sensitive information.

The issue affects ALSA sequencer variable-length events that use SNDRV_SEQ_EXT_CHAINED internally.

910) Out-of-bounds read (CVE-ID: CVE-2026-74340)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the wcn36xx_smd_print_reg_info_ind function when processing a firmware PRINT_REG_INFO indication. A remote attacker can provide a firmware-controlled count value that exceeds the actual message data to disclose sensitive information.

The issue occurs because the count field is used as a loop bound for indexing a flexible regs[] array without validation against the received message length.

911) Out-of-bounds read (CVE-ID: CVE-2026-74346)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in irdma_handle_q_mem during CQ memory registration when processing CQ page array data. A local user can trigger CQ MR registration with a crafted page layout to disclose sensitive information.

The issue affects GEN_2 hardware and later when the CQ resize feature is enabled.

912) Use-after-free (CVE-ID: CVE-2026-74348)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ocfs2 dlm locking_state debugfs open and release handling when opening the locking_state debugfs file during concurrent domain teardown. A local user can open and later close the debugfs file to cause a denial of service.

The issue occurs when the open path stores a raw dlm_ctxt pointer even if acquiring a reference fails, and the release path later accesses that context after it has been freed.

913) Integer underflow (CVE-ID: CVE-2026-74349)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unintended block trimming beyond the requested range.

The vulnerability exists due to an integer underflow in ocfs2_trim_mainbm() when processing a FITRIM range shorter than a cluster. A local user can submit a specially crafted FITRIM range to cause unintended block trimming beyond the requested range.

The issue occurs on filesystems where the cluster size is larger than the block size.

914) Use-after-free (CVE-ID: CVE-2026-74351)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a use-after-free in the ocfs2 locking_state debugfs iterator when dumping raw LVB bytes from a copied lock resource after lockres teardown. A local user can read the debugfs locking_state output during a concurrent teardown to disclose sensitive information.

The issue occurs because a copied non-NULL sb_lvbptr can continue to reference the original lock resource after the tracking lock is dropped.

915) Use-after-free (CVE-ID: CVE-2026-74359)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in configfs_lookup() when handling subsequent getdents(2) operations in a directory after inode allocation failure. A local user can trigger inode allocation failure and then access the affected directory to cause a denial of service.

The issue occurs because a dangling pointer remains in the configfs_dirent structure and is later dereferenced to obtain an inode number.

916) Use-after-free (CVE-ID: CVE-2026-74363)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bpffs inode handling when a concurrent unlinkat() drops the last inode reference during RCU path walking. A local user can trigger concurrent path operations to cause a denial of service.

The issue occurs because inode fields and the cached symlink body may still be accessed during RCU pathwalk after the inode is freed.

917) Improper resource shutdown or release (CVE-ID: CVE-2026-74376)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the md/raid10 discard handling logic when reusing an r10bio for discard operations. A local user can trigger discard operations on a reused r10bio to cause a denial of service.

The issue occurs when a discard reuses an r10bio that was previously used for a read, leaving read_slot non-negative and causing cleanup to skip releasing the replacement bio.

918) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74378)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a heap-based buffer overflow.

The vulnerability exists due to a time-of-check time-of-use race in get_srq_wqe() when copying a work queue element from a shared receive queue buffer mapped into userspace. A local user can modify num_sge between validation and size calculation to cause a heap-based buffer overflow.

The issue arises because the num_sge field is read twice from shared userspace-accessible memory.

919) NULL pointer dereference (CVE-ID: CVE-2026-74379)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in dev_dax_kmem_remove() when removing dax kmem ranges after partial success during probing. A local user can trigger removal of a device with ranges whose resources were never added to cause a denial of service.

The issue occurs when dev_dax_kmem_probe() partially succeeds and later probe failures leave some range resources unset while removal still iterates over all ranges.

920) Uncontrolled Recursion (CVE-ID: CVE-2026-74382)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in cls_bpf_offload_cmd() in the cls_bpf traffic control offload path when processing a filter replace operation and attempting rollback after repeated tc_setup_cb_replace() failures. A local user can trigger repeated rollback failures to cause a denial of service.

The issue can exhaust kernel stack space during rollback handling, and it is not limited to netdevsim.

921) Out-of-bounds write (CVE-ID: CVE-2026-74384)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the nvme multipath namespace head flexible array member current_path[] when handling sparse NUMA node IDs during namespace path revalidation. A local user can trigger nvme multipath operations on a system with sparse NUMA node IDs to cause a denial of service.

Only systems using nvme multipath on architectures where NUMA node IDs are sparse are affected.

922) Out-of-bounds write (CVE-ID: CVE-2026-74390)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to out-of-bounds write in irdma_copy_user_pgaddrs when processing user-supplied RDMA memory registration data with lvl set to 0. A local user can provide a umem with more DMA blocks than the supplied page count to cause a denial of service or execute arbitrary code.

The issue affects the lvl==0 case that uses the fixed-size iwmr->pgaddrmem array for QP, CQ, and SRQ rings.

923) Integer overflow (CVE-ID: CVE-2026-74394)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the immediate data length check in the RDMA/srpt subsystem when processing user-supplied immediate data received over the network. A remote attacker can send a specially crafted network request with an oversized length value to cause a denial of service.

The length field is user-controlled and may wrap the computed request size, bypassing the bounds check before a very large length is passed to sg_init_one().

924) NULL pointer dereference (CVE-ID: CVE-2026-74395)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT in drivers/infiniband/hw/mlx5/devx.c when handling devx subscribe-event requests and unwinding an error after eventfd acquisition fails. A local user can trigger the error path with a crafted subscribe-event request to cause a denial of service.

The issue occurs because the subscription object is linked into the pending list before fields needed by cleanup are initialized.

925) Race condition (CVE-ID: CVE-2026-74398)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in addrconf_dad_failure in the IPv6 address configuration subsystem when handling duplicate address detection failure processing concurrently with IPv6 address deletion. A local attacker can trigger concurrent state transitions to cause a denial of service.

The issue can lead to a general protection fault when a deleted IPv6 address entry is processed a second time through scheduled DAD work.

926) Out-of-bounds read (CVE-ID: CVE-2026-74399)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in evm_read_xattrs() when reading the list of enabled EVM xattrs. A local user can trigger a read of the xattrs interface to disclose sensitive information.

The issue occurs when no configured xattrs are enabled, leaving the buffer uninitialized before its length is determined.

927) Improper Initialization (CVE-ID: CVE-2026-74402)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to obtain insufficiently random entropy.

The vulnerability exists due to improper buffer management in the atmel-sha204a hardware random number generator driver when reading random data from the device response buffer. A local user can read from /dev/hwrng to obtain insufficiently random entropy.

The issue affects both the blocking and non-blocking rng paths.

928) Out-of-bounds read (CVE-ID: CVE-2026-74408)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ath_tx_edma_tasklet() when processing a firmware-provided tx status queue ID. A local attacker can provide an invalid queue ID value to trigger an out-of-bounds array access and cause a denial of service.

929) Out-of-bounds read (CVE-ID: CVE-2026-74410)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rtw_pci_rx_napi() when processing firmware RX descriptors on the PCIe transport path. A local attacker can provide a crafted descriptor with a length value that exceeds the DMA buffer size to disclose sensitive information.

The issue occurs because the computed receive length can exceed the size of the pre-allocated DMA buffer before data is copied.

930) Improper resource shutdown or release (CVE-ID: CVE-2026-74416)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in radeon_ring_restore() when handling a failed ring lock during GPU reset. A local user can trigger repeated GPU resets that fail at the lock stage to cause a denial of service.

The issue leaks the ring backup buffer on each failed restore attempt, leading to cumulative kernel memory exhaustion during repeated GPU resets.

931) NULL pointer dereference (CVE-ID: CVE-2026-74424)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in fbcon_new_modelist() and related fbcon console handling in drivers/video/fbdev/core/fbcon.c when processing framebuffer modelist changes for a console without vc_data. A local user can trigger a modelist change on such a console to cause a denial of service.

The issue occurs when fb_display[i].mode remains set after the associated console data has been freed.

932) NULL pointer dereference (CVE-ID: CVE-2026-74426)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in afs_get_tree() when handling a mount operation with a non-null dyn_root context. A local user can trigger the vulnerable code path to cause a denial of service.

933) Improper resource shutdown or release (CVE-ID: CVE-2026-74427)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown handling in the afs network namespace preallocation work logic when tearing down an afs network namespace. A local user can trigger network namespace teardown to cause a denial of service.

The issue involves cancellation and requeue behavior of the preallocated rxrpc call, connection, and peer charger while incoming calls are being disabled.

934) Use-after-free (CVE-ID: CVE-2026-74436)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in rxrpc_kernel_charge_accept() and the rxrpc service backlog handling when concurrent socket teardown and kernel accept preallocation occur. A local attacker can trigger concurrent operations that reuse a freed backlog structure to cause a denial of service.

The issue arises from a race condition between kernel preallocation work and socket teardown in the RxRPC subsystem.

935) Use of insufficiently random values (CVE-ID: CVE-2026-74438)

CWE-ID: CWE-330 - Use of Insufficiently Random Values

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to obtain insufficiently random data.

The vulnerability exists due to improper implementation in sun4i_ss_prng_generate() in the sun4i_ss_prng rng implementation when generating random bytes through the AF_ALG "rng" algorithm interface. A local user can request random output to obtain insufficiently random data.

The function rounds the destination length down and does not wait for the hardware to be ready before reading bytes.

936) Stack-based buffer overflow (CVE-ID: CVE-2026-74438)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in sun4i_ss_prng_seed() in the sun4i_ss_prng rng implementation when processing a seed supplied through the AF_ALG "rng" algorithm interface. A local user can supply an oversized seed to trigger memory corruption and execute arbitrary code or cause a denial of service.

The vulnerable code path is described as only theoretically usable via the "rng" algorithm type of AF_ALG.

937) Out-of-bounds write (CVE-ID: CVE-2026-74443)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify authenticated command fields.

The vulnerability exists due to an out-of-bounds write in vmw_cmd_dma() in the vmwgfx command verifier when processing a dma command with an undersized header body size. A local user can submit a specially crafted command to modify authenticated command fields.

The issue arises from a suffix pointer underflow that can clobber fields in a previously relocated command in the device-visible command stream.

938) Out-of-bounds read (CVE-ID: CVE-2026-74444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in vmw_cmd_draw() when processing a user-supplied command stream containing an undersized DRAW_PRIMITIVES header. A local user can supply a crafted command stream to disclose sensitive information.

The issue is triggered when header->size is smaller than the command body size, causing an unsigned subtraction to wrap and a subsequent bounds check to be bypassed.

939) Improper input validation (CVE-ID: CVE-2026-74453)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in validate_tile_binning_config when processing tile binning configurations with oversized tile state arrays. A local user can submit a crafted tile binning configuration that leaves no room for the tile allocation pool to cause a denial of service.

The tile state data array size is derived from tile count fields and shares the same buffer slot with the tile allocation pool.

940) Improper Initialization (CVE-ID: CVE-2026-74453)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the vc4 tile state data array handling when submitting crafted tile binning configurations. A local user can submit a crafted job that reuses stale tile state data to cause a denial of service.

The issue can result in invalid command streams, invalid primitive streams, and GPU hangs.

941) Improper input validation (CVE-ID: CVE-2026-74455)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper input validation in pcan_usb_fd_decode_buf() and CAN message decoding in the peak_usb USB CAN receive path when processing crafted uCAN records in a USB receive buffer. A local attacker can supply malformed record lengths to trigger kernel message rejection and cause a denial of service.

942) Double free (CVE-ID: CVE-2026-74456)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in peak_usb_start() in the peak_usb CAN USB driver when handling a failed URB submission. A local user can trigger the vulnerable error path to cause a denial of service.

The issue occurs because the transfer buffer is freed explicitly after URB submission failure and then freed again when the URB is released.

943) Out-of-bounds read (CVE-ID: CVE-2026-74457)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error() when processing a crafted USB device payload. A local attacker can supply channel index values outside the bounds of usb_if->dev[] to cause a denial of service.

The channel control index is derived from device-supplied fields and values 2 through 15 exceed the two-entry usb_if->dev[] array, which can lead to a kernel panic in IRQ context.

944) Out-of-bounds read (CVE-ID: CVE-2026-74458)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read and buffer overflow risk in kvaser_usb_leaf_wait_cmd() and the bulk receive path when parsing device-provided variable-length commands from a USB buffer. A local attacker can supply a crafted command with an invalid length to cause a denial of service.

The issue affects command handling for nonzero commands that are shorter than the fixed header or that extend beyond the current USB buffer item.

945) Improper resource shutdown or release (CVE-ID: CVE-2026-74459)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in es58x_read_bulk_callback() in the etas_es58x CAN USB driver when handling a failed RX URB resubmission. A local user can trigger a URB resubmission failure to cause a denial of service.

946) Out-of-bounds read (CVE-ID: CVE-2026-74460)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in ems_usb_read_bulk_callback() in the ems_usb CAN USB driver when processing crafted CPC messages in a USB receive buffer. A local attacker can supply a crafted CPC message with an invalid length to cause a denial of service.

947) Use-after-free (CVE-ID: CVE-2026-74461)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the i2c-imx slave timeout handling in drivers/i2c/busses/i2c-imx.c when unregistering a slave device while a pending interrupt has already started the hrtimer. A local user can trigger the race condition to cause a denial of service.

The issue can also result in a NULL pointer dereference when the timer callback invokes the slave event handler with a NULL slave pointer.

948) Deadlock (CVE-ID: CVE-2026-74463)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in the jz4780 i2c bus driver when handling concurrent i2c transfers involving clock framework operations. A local user can trigger concurrent bus activity to cause a denial of service.

The issue can freeze the system because of a circular dependency between the common clock framework prepare_lock mutex and the i2c adapter lock.

949) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-74464)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in ovs_flow_key_update() handling within net/openvswitch/actions.c when processing connection tracking actions on a packet whose flow key becomes invalid and unparseable. A local user can trigger flow key update failure with a specially crafted packet and action sequence to cause a denial of service.

This requires the packet to become unparseable after actions are applied to a previously parseable skb.

950) Use-after-free (CVE-ID: CVE-2026-74465)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the openvswitch meter handling code when processing crafted netlink requests through the uAPI. A local user can trigger meter attach failure conditions and concurrently access the freed meter to cause a denial of service.

Exploitation is possible with a custom application using the uAPI, while the issue is not triggered in the typical ovs-vswitchd usage pattern described in the advisory.

951) Improper access control (CVE-ID: CVE-2026-74467)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to invoke private ioctl commands.

The vulnerability exists due to improper access control in qeth_siocdevprivate when handling SIOCDEVPRIVATE ioctl commands. A local user can invoke private ioctl commands to invoke private ioctl commands.

The issue affects the SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE, and SIOC_QETH_QUERY_OAT commands.

952) Improper locking (CVE-ID: CVE-2026-74468)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock type selection in the pch_irq_type() callback and gpio-pch register locking logic when configuring IRQ trigger types on PREEMPT_RT kernels. A local user can trigger IRQ type configuration in a non-sleepable context to cause a denial of service.

The issue occurs on PREEMPT_RT kernels because a regular spinlock_t may become an rtmutex-backed sleeping lock in atomic context.

953) Out-of-bounds write (CVE-ID: CVE-2026-74469)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in SCTP sock_diag when processing a diagnostic dump after adding many unique peer transports. A local user can add unique peer addresses until the 16-bit transport_count wraps and trigger a diagnostic dump to cause a denial of service.

The issue occurs when the association accumulates 65,536 unique peer transports, causing transport_count to wrap to zero while peer addresses are still copied from transport_addr_list.

954) Out-of-bounds write (CVE-ID: CVE-2026-74470)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the resp_report_zones() function in the scsi_debug driver when processing a REPORT ZONES command with a crafted allocation length on 32-bit systems. A local user can send a specially crafted REPORT ZONES command to cause a denial of service.

The issue occurs when an allocation length in the 0xFFFFFFC1 through 0xFFFFFFFF range causes a zero-sized allocation to be dereferenced on 32-bit systems.

955) Use-after-free (CVE-ID: CVE-2026-74471)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in trace_module_add_events() and the tracing subsystem when handling failed event registration during module loading. A local user can load a module that triggers event registration failure and subsequently access tracefs or tracing operations to cause a denial of service.

Exploitation requires a module loading scenario in which event registration fails and the module memory is later freed, leaving a stale trace_event_call pointer in trace_event_file.

956) Out-of-bounds read (CVE-ID: CVE-2026-74473)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in route_shortcircuit() in drivers/net/vxlan/vxlan_core.c when processing packets with a non-linear buffer layout. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because the network header may not be fully pulled into the linear buffer before ip_hdr(skb)->daddr or ipv6_hdr(skb)->daddr is dereferenced.

957) Race condition (CVE-ID: CVE-2026-74475)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in route_shortcircuit() in the VXLAN implementation when processing neighbour hardware addresses. A local attacker can trigger concurrent updates to cause a denial of service.

958) Use-after-free (CVE-ID: CVE-2026-74478)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in vector_mmsg_rx() when processing packets with an overlay header that fails verification. A remote attacker can send a specially crafted packet to cause a denial of service.

Only GRE and L2TPv3 transports are affected, and exploitation can be triggered on a cookie or session-id mismatch without authentication.

959) Use-after-free (CVE-ID: CVE-2026-74479)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the pktgen proc entry handling in net/core/pktgen.c when concurrently removing and renaming pktgen devices. A local user can trigger a race condition involving proc_remove() on a stale proc_dir_entry to cause a denial of service.

The issue occurs because pktgen_change_name() and pktgen_remove_device() access the same proc entry with inconsistent locking, and exploitation requires winning a race between those paths.

960) Use-after-free (CVE-ID: CVE-2026-74480)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in br_multicast_leave_group() in the bridge multicast handling code when processing fast-leave operations on port groups. A local user can trigger deletion of a matching port group to cause a denial of service.

The issue can occur when multicast-to-unicast had been enabled, allowing multiple port groups for the same port and group with different source MAC addresses, and is later disabled so entries are matched by port only.

961) Use-after-free (CVE-ID: CVE-2026-74481)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in page_reporting_process and virtballoon_free_page_report when page reporting work continues during power management freeze while virtqueues are being deleted. A local user can trigger suspend or hibernation activity while freed pages are being reported to access deleted virtqueues and cause a denial of service.

The issue can be reached during S3 suspend or S4 hibernation, including cases where memory reclamation returns pages to the buddy allocator during image saving.

962) Use-after-free (CVE-ID: CVE-2026-74482)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __folio_split() in mm/huge_memory.c when handling a split of a shmem transparent huge page during memory failure processing and truncation. A local user can trigger the vulnerable split path to cause a denial of service.

The issue can occur when a poisoned tail beyond EOF is split while truncation and a concurrent final iput() allow the inode to be evicted and RCU-freed before i_mmap_unlock_read() is reached.

963) Out-of-bounds read (CVE-ID: CVE-2026-74485)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the binfmt_misc registration parser when processing a crafted registration string with a flag character used as the field delimiter. A remote attacker can submit a specially crafted registration string to disclose sensitive information.

The issue is reachable by unprivileged users in a user namespace through binfmt_misc mounts.

964) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74487)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in binfmt_misc when removing an entry registered with the MISC_FMT_OPEN_FILE flag. A local user can register and remove such an entry to cause a denial of service.

The issue leaves the interpreter inode with a permanently negative write count until the inode is evicted from the inode cache, causing subsequent write attempts to fail with ETXTBSY.

965) Use-after-free (CVE-ID: CVE-2026-74488)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use-after-free in mwifiex_11n_dispatch_amsdu_pkt() when parsing A-MSDU TDLS frames. A remote attacker can send a specially crafted A-MSDU frame with shorter earlier subframes to disclose sensitive information.

Reaching the vulnerable path requires TDLS support in firmware and the TDLS ethertype on the subframe.

966) Use-after-free (CVE-ID: CVE-2026-74490)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tipc_poll() trace queue dumping when walking live socket queue members from an unlocked poll context. A local user can trigger polling while queue entries are concurrently dequeued and freed to cause a denial of service.

The issue occurs in the TIPC socket trace path during queue state dumping.

967) Use-after-free (CVE-ID: CVE-2026-74492)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in mtype_add() when processing packet-side add operations during ipset table resizing. A remote user can trigger xt_SET --add-set ... --exist updates to cause a denial of service.

The issue occurs when a replacement-table entry and an old-table entry temporarily share the same comment pointer during resize and backlog replay, leading to a stale pointer dereference in strlen().

968) Use-after-free (CVE-ID: CVE-2026-74493)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __smc_lgr_terminate() in the SMC networking subsystem when terminating a link group while a concurrent close unregisters a connection. A local user can trigger overlapping close and link group termination operations to cause a denial of service.

The issue is caused by a race condition involving socket reference handling for a connection stored in lgr->conns_all.

969) Memory leak (CVE-ID: CVE-2026-74494)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in smb2_handle_negotiate() and connection negotiation state handling when sending repeated SMB2 NEGOTIATE requests on one connection before SESSION_SETUP. A remote attacker can send multiple successful SMB2 NEGOTIATE requests to cause a denial of service.

The issue occurs after a dialect has already been selected and before session setup completes.

970) Off-by-one (CVE-ID: CVE-2026-74495)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in the igbvf TX DMA error cleanup logic when handling TX buffer mapping errors. A local user can trigger a DMA mapping failure after one or more successful mappings to cause a denial of service.

The issue can leak exactly one DMA mapping for the packet head when a fragment mapping fails after earlier mappings succeed.

971) Use-after-free (CVE-ID: CVE-2026-74496)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fou_create() and fou_from_sock() when handling concurrent socket activity after a failed FOU port creation. A local user can request local port 0 and trigger concurrent receive processing to cause a denial of service.

The issue is reachable when local port 0 is requested and the creation path fails after the object remains reachable through sk_user_data.

972) Improper input validation (CVE-ID: CVE-2026-74497)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in snd_usb_handle_sync_urb() when processing oversized USB sync packets in implicit-feedback mode. An attacker with physical access can connect a crafted USB device that sends oversized sync packets to cause a denial of service.

973) Out-of-bounds write (CVE-ID: CVE-2026-74498)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in the ALSA USB audio endpoint DMA buffer handling in data_ep_set_params() when processing USB audio endpoints with the fill_max descriptor flag set. A local user can trigger oversized packet transfers to cause a denial of service or corrupt kernel memory.

The issue occurs because the allocated buffer size is based on the original sample-rate-derived value while transfer packets may use the larger maximum packet size.

974) Out-of-bounds write (CVE-ID: CVE-2026-74499)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or execute arbitrary code.

The vulnerability exists due to out-of-bounds write in snd_usbmidi_akai_output() when processing MIDI output for a USB device advertising a tiny bulk-OUT endpoint. An attacker with physical access can connect a crafted USB device and trigger a write to the created MIDI device node to cause a denial of service or execute arbitrary code.

The issue is caused by a signed-to-unsigned conversion in the fill-loop bound calculation, making the loop continue writing past the end of the URB transfer buffer.

975) Use-after-free (CVE-ID: CVE-2026-74505)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the usb6fire_chip_probe function in the ALSA 6fire driver when handling a device probe error path. A local user can trigger the probe sequence with a crafted or malfunctioning USB device to cause a denial of service.

The issue occurs during early error handling in the probe phase after a pending URB is not properly aborted before resources are freed.

976) Out-of-bounds read (CVE-ID: CVE-2026-74507)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in hidp_process_data() when processing a malformed HIDP numbered report response. A remote user can send a specially crafted Bluetooth HIDP data response to cause a denial of service.

Exploitation requires a connected HIDP peer.

977) Use of uninitialized resource (CVE-ID: CVE-2026-74508)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use of uninitialized memory in hidp_recv_ctrl_frame() and hidp_recv_intr_frame() in the HIDP subsystem when processing crafted Bluetooth HIDP frames without a transaction header. A remote user can send a specially crafted empty or malformed frame to cause a denial of service.

The issue can terminate the HIDP session when a malformed lower-layer packet causes an extra byte to be consumed as a virtual cable unplug control value.

978) Use-after-free (CVE-ID: CVE-2026-74512)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in audit_del_rule() when deleting audit rules while concurrent readers access RCU-visible filter lists. A local user can trigger rule deletion during concurrent access to cause a denial of service.

979) Use-after-free (CVE-ID: CVE-2026-74518)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in allocate_file_region_entries() when handling concurrent region cache operations on a shared resv_map. A local user can trigger concurrent region_chg()/region_add()/region_del() activity on the same shared mapping to cause a denial of service.

The issue occurs in shared hugetlbfs mappings and was observed when multiple mappers accessed the same hugetlbfs inode concurrently.

980) Double free (CVE-ID: CVE-2026-74519)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to double free in dt_remember_or_free_map() and dt_free_map() in the pinctrl devicetree code when handling a failed dev_name duplication during map initialization. A local attacker can trigger a memory allocation failure during device binding to cause a denial of service.

Exploitation was demonstrated with failslab injection while binding a pinctrl-consuming device.

981) Deadlock (CVE-ID: CVE-2026-74523)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a deadlock in the qede recovery path when handling a TX timeout on a qede NIC with VXLAN/GENEVE tunnel ports configured. A local attacker can trigger a TX timeout condition to cause a denial of service.

The issue can wedge the rtnetlink control plane of the whole machine while the node may still answer ping.

982) Improper resource shutdown or release (CVE-ID: CVE-2026-74525)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in init_dma_desc_rings() when handling RX descriptor ring allocation failures. A local user can trigger RX allocation failure during device initialization to cause a denial of service.

The issue results in TX ring resources being leaked when RX ring allocation fails after TX rings were allocated earlier in the same function.

983) Use-after-free (CVE-ID: CVE-2026-74540)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in l2cap_le_connect_rsp() in the Bluetooth L2CAP subsystem when handling a crafted LE connect response during channel processing. A remote attacker can trigger a remote disconnect race to cause a denial of service.

984) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74546)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in the adt7470 fan speed read handler when reading cached fan data during fan speed conversion. A local user can trigger concurrent updates of the cached fan value to cause a denial of service.

The issue can lead to a divide-by-zero crash if the fan data changes to 0 between the validity check and the RPM conversion.

985) Improper input validation (CVE-ID: CVE-2026-74547)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the adt7470 hwmon driver sysfs interface and background update thread when processing user-supplied sysfs configuration values. A local user can set 'auto_update_interval' to 0 and cause the update thread to enter a tight busy-loop and flood the I2C bus to cause a denial of service.

The issue requires access to sysfs attributes, and concurrent or prior configuration of 'num_temp_sensors' to 0 triggers the zero-delay temperature read path.

986) Use-after-free (CVE-ID: CVE-2026-74548)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the forcedeth driver txrx_stats handling in nv_remove() when unregistering a network device. A local user can trigger device removal while code paths such as ndo_get_stats64, the NAPI/xmit data path, or nv_close()/drain still access freed memory to cause a denial of service.

The issue occurs because accesses to the per-CPU statistics structure may continue until network device unregistration completes.

987) Out-of-bounds read (CVE-ID: CVE-2026-74549)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in nct6775_update_pwm() in the nct6775-core hwmon driver when iterating over pwm channels for nct6116 weight-control registers. A local user can trigger access to unsupported weight registers to cause a denial of service.

The issue affects nct6116 configurations where bits 3 or 4 of has_pwm are set, causing out-of-bounds values to be used as hardware register addresses for subsequent read and write operations.

988) Heap-based buffer overflow (CVE-ID: CVE-2026-74556)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in iscsi_tcp_hdr_dissect() in libiscsi_tcp when processing a crafted iSCSI SCSI Command Response pdu. A remote attacker can send a specially crafted response with an oversized data segment to cause a denial of service.

The issue occurs because sense or response data for ISCSI_OP_SCSI_CMD_RSP can exceed the fixed 8192-byte connection buffer while remaining within the negotiated maximum receive data segment length.

989) Out-of-bounds read (CVE-ID: CVE-2026-74557)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in iscsi_scsi_cmd_rsp() when processing a target-supplied SCSI Response sense data segment. A remote attacker can send a crafted SCSI Response with a malformed sense length field to disclose sensitive information.

The over-read can copy up to two bytes of stale conn->data contents into the command's sense buffer, which is returned to userspace.

990) Use-after-free (CVE-ID: CVE-2026-74563)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use-after-free in rds_tcp_laddr_check() and ipv6 address checking when processing a bind request with a scoped IPv6 interface. A local user can trigger a concurrent device removal condition and issue a bind operation to disclose sensitive information.

The issue is caused by dereferencing a stale net_device pointer after the RCU read-side lock is released.

991) Use of uninitialized resource (CVE-ID: CVE-2026-74564)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uninitialized memory access in xt_hashlimit when processing hashlimit rule configuration with inconsistent XT_HASHLIMIT_RATE_MATCH usage for the same hashtable. A local user can create specially crafted netfilter rules to cause a denial of service.

The issue arises when different rules referring to the same hashtable use conflicting rate match semantics, and revision values less than 3 are also affected when the flag is used.

992) Improper input validation (CVE-ID: CVE-2026-74566)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the keyring subsystem when processing crafted key descriptions. A local user can add keys with specially crafted descriptions to cause a denial of service.

The issue affects in-memory ordering used to place keys within a keyring, allowing crafted descriptions to collide into one node.

993) Out-of-bounds read (CVE-ID: CVE-2026-74567)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in keyring_get_key_chunk() when processing crafted colliding key descriptions through add_key(2). A local user can add a crafted pair of same-type keys whose index hashes collide to disclose sensitive information.

The issue is triggered when the lookup reaches a description-level chunk after collisions through the hash, x, type, and domain_tag chunks.

994) Out-of-bounds read (CVE-ID: CVE-2026-74569)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ct_sip_get_header() in the nf_conntrack_sip SIP connection-tracking helper when processing NAT-rewritten SIP messages over TCP. A remote attacker can send a specially crafted SIP message with a long Contact list to cause a denial of service.

The issue is triggered by integer wraparound in size-change tracking during repeated URI rewriting, which can produce an invalid length value for a subsequent header parse.

995) Use-after-free (CVE-ID: CVE-2026-74575)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the thunderbolt xdomain delayed work handling in tb_xdp_handle_request() and update_xdomain() when queuing delayed work concurrently with xdomain disconnect and removal. A local user can trigger crafted xdomain requests or state changes during disconnect to cause a denial of service.

The issue arises because the request handler runs on the system workqueue and is no longer serialized with the remove path.

996) Improper Initialization (CVE-ID: CVE-2026-74577)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in mpls_getroute() when handling RTM_GETROUTE requests. A local user can send a crafted netlink route request to disclose sensitive information.

The issue leaks one byte of uninitialized heap memory to user space in the RTM_NEWROUTE reply.

997) Race condition (CVE-ID: CVE-2026-74578)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose plaintext and compromise cryptographic operation integrity.

The vulnerability exists due to improper synchronization of shared cryptographic state in the AIO/async path in skcipher_recvmsg() when handling async skcipher receive operations. A local user can race an asynchronous skcipher receive operation with sendmsg(ALG_SET_IV) to disclose plaintext and compromise cryptographic operation integrity.

The described plaintext recovery applies to CTR/stream modes through IV/keystream reuse.

998) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-74579)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause incorrect netfilter payload offload matching.

The vulnerability exists due to undefined shift behavior in nft_payload_offload_mask() in net/netfilter/nft_payload.c when building an offload match mask for a payload expression that covers only part of a header field. A local privileged user can configure a crafted nftables payload rule with a partial header field match to cause incorrect netfilter payload offload matching.

The issue occurs for partial field matches such as a partial IPv6 address match where the match length is shorter than the header field length.

999) Improper access control (CVE-ID: CVE-2026-74580)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory outside the intended IOTLB-mapped region.

The vulnerability exists due to improper access control in the vhost vring metadata cache in drivers/vhost/vhost.c when reconfiguring vring addresses or vring size through vhost ioctls while a device IOTLB is attached. A local user can issue crafted vring reconfiguration ioctls after populating the metadata cache to access memory outside the intended IOTLB-mapped region.

The issue occurs because stale cached metadata mappings may continue to be used after live vring reconfiguration, causing subsequent used ring updates or descriptor fetches to use translations based on the old mapping.

1000) Use-after-free (CVE-ID: CVE-2026-74581)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib6_rule_lookup() and fib6_rule_suppress() in the IPv6 routing rules handler when processing suppressed IPv6 route lookups. A local user can trigger route lookups involving a suppressing rule to cause a denial of service.

The issue occurs because a stale dst entry can be returned after the released route remains referenced in the lookup result.

1001) Out-of-bounds write (CVE-ID: CVE-2026-74582)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in packet_snd() and packet_sendmsg_spkt() in the Linux kernel AF_PACKET implementation when handling non-ring send paths during concurrent device reconfiguration. A local user can send crafted packets while triggering a change in hard_header_len to cause an out-of-bounds write.

The issue affects SOCK_RAW send handling, and packet_sendmsg_spkt() is affected by the same inconsistent header length usage across allocation and packet construction.

1002) Use-after-free (CVE-ID: CVE-2026-74583)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the route4 fastmap cache in the cls_route classifier when classifying packets concurrently with filter deletion or modification. A local user can trigger concurrent packet classification and filter updates to cause a denial of service.

The issue is caused by a race in which an in-flight reader can republish a stale filter pointer into the fastmap after the entry has been reset and before the deferred free completes.

1003) Use of uninitialized resource (CVE-ID: CVE-2026-74584)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the bnxt_re shared userspace page allocation in bnxt_re_alloc_ucontext() when mapping the shared page to userspace through BNXT_RE_MMAP_SH_PAGE after IB_USER_VERBS_CMD_GET_CONTEXT. A local user can perform a single mmap() on the exposed page to disclose sensitive information.

Exploitation requires access to /dev/infiniband/uverbsX on a host with a bnxt_re device.

1004) Out-of-bounds read (CVE-ID: CVE-2026-74585)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds pointer dereference in tb_drom_parse_entry_port() in the thunderbolt DROM parser when processing a malicious or malformed Thunderbolt device DROM. An attacker with physical access can supply a crafted Thunderbolt device with an invalid dual_link_port_nr value to cause a denial of service.

The invalid pointer is stored and later dereferenced after indexing sw->ports[] beyond the configured maximum port number.

1005) Use-after-free (CVE-ID: CVE-2026-74586)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in SCTP ASCONF handling when processing an authenticated ASCONF chunk that adds and removes a peer transport in the same chunk. A remote user can send a specially crafted authenticated ASCONF message to cause a denial of service.

The issue occurs because a stale new_transport pointer can be used when a queued HEARTBEAT is later processed during local address replacement.

1006) Use-after-free (CVE-ID: CVE-2026-74587)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the SCTP ASCONF handling code when processing a delayed authenticated ASCONF-ACK after peer restart handling purges the ASCONF queue. A remote attacker can send a delayed authenticated ASCONF-ACK to cause a denial of service.

The issue occurs because a cached ASCONF chunk pointer can remain dangling while the association is still alive during peer restart handling.

1007) Use-after-free (CVE-ID: CVE-2026-74588)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in __sctp_outq_flush_rtx() and SCTP transport tracking when processing SCTP SACKs after transport removal. A remote user can send crafted SCTP control traffic to cause a denial of service.

Exploitation requires an SCTP association peer to trigger transport removal through ASCONF Delete-IP and then send a SACK that reneges on the TSN.

1008) Use-after-free (CVE-ID: CVE-2026-74589)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tcp_bpf_send_verdict() and tcp_bpf_sendmsg_redir() when processing concurrent sendmsg() operations with a cached redirect verdict. A local user can trigger concurrent socket send operations to cause a denial of service.

The issue occurs when apply_bytes keeps the cached verdict active, allowing one thread to release the redirect socket reference while another thread still uses a stale pointer.

1009) Use-after-free (CVE-ID: CVE-2026-74594)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in kernel/sched/psi.c when destroying PSI cgroup triggers concurrently with scheduling poll work. A local user can trigger a race that leaves a poll timer pending on freed memory to cause a denial of service.

The issue occurs because a timer may be re-armed during teardown and later execute poll_timer_fn() after the associated group has been freed.

1010) Improper access control (CVE-ID: CVE-2026-74595)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass owner checks and set an encryption policy on a file.

The vulnerability exists due to improper access control in fscrypt_ioctl_set_policy() when handling ioctl requests on idmapped mounts. A local user can issue a crafted ioctl on an idmapped mount to bypass owner checks and set an encryption policy on a file.

The issue occurs because the check uses the unmapped on-disk owner rather than the mapped owner on mounts that support idmapping.

1011) Out-of-bounds write (CVE-ID: CVE-2026-74597)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to an out-of-bounds write in ip6ip6_err() and the IPv6 ICMP error reply path when processing a quoted inner IPv6 packet after cloning an outer IPv6 ICMP error skb with stale inet6_skb_parm metadata. A remote attacker can send a specially crafted IPv6 packet to corrupt memory.

Exploitation requires the outer packet to carry a Home Address Option and a malformed inner destination-options header.

1012) Out-of-bounds read (CVE-ID: CVE-2026-74598)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in rt6_route_rcv() when processing a crafted IPv6 Router Advertisement containing a malformed Route Information option. A remote attacker can send a specially crafted Router Advertisement to disclose sensitive information.

When additional options follow the malformed Route Information option, data from the next option can be incorporated into the installed route and become visible to userspace.

1013) Race condition (CVE-ID: CVE-2026-74599)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ptdump_walk_pgd() and page table walking logic when walking page tables for an mm other than init_mm. A local user can trigger page table dumping for a non-init_mm memory context to cause a denial of service.

The issue affects cases where kernel memory ranges shared across non-kernel memory contexts are walked concurrently with kernel page table freeing.

1014) Race condition (CVE-ID: CVE-2026-74601)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ring_buffer_swap_cpu() when swapping per-cpu ring buffers during an active write operation. A local user can trigger a buffer swap at a moment when the committing counter temporarily drops to zero to cause a denial of service.

The issue can lead to an inconsistent buffer state and trigger the RB_WARN_ON in rb_commit().

1015) Use-after-free (CVE-ID: CVE-2026-74604)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in thermal_add_hwmon_sysfs() when handling the error path during hwmon sysfs device registration. A local user can trigger the vulnerable error-handling condition to cause a denial of service.

1016) Use-after-free (CVE-ID: CVE-2026-74609)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tipc_node_link_down() in the TIPC subsystem when handling link-down events and bearer disable operations concurrently. A local user can trigger a race condition that frees a link object while it is still being dereferenced to cause a denial of service.

The issue can result in both a use-after-free read in tipc_link_is_establishing() and a use-after-free write via tipc_link_reset() during the establishing branch.

1017) Use-after-free (CVE-ID: CVE-2026-74613)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in virtio_transport_rx_work in net/vmw_vsock/virtio_transport.c when processing RX work during device teardown. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can lead to a kernel panic during suspend or freeze operations when queued work continues after virtqueues have been deleted.

1018) Race condition (CVE-ID: CVE-2026-74614)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in virtio vsock worker handling in net/vmw_vsock/virtio_transport.c when processing virtqueue work across freeze and restore operations. A local user can trigger worker activity during suspend and restore state transitions to cause a denial of service.

The issue affects the RX, TX, and event workers when a delayed worker observes a replacement queue state while retaining a pointer to a deleted queue.

1019) Use-after-free (CVE-ID: CVE-2026-74615)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in the vxlan ageing timer handling in drivers/net/vxlan/vxlan_core.c when changing link ageing settings on a device that is down. A remote user can create and delete a VXLAN device in a new user and network namespace to cause a denial of service.

The affected operations are network-namespace scoped.

1020) Out-of-bounds write (CVE-ID: CVE-2026-74616)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in xdpf_clone() and the XDP-to-skb conversion path when converting crafted cloned XDP frames into sk_buffs. A local user can trigger conversion of a crafted clone that overlaps skb_shared_info tailroom to cause memory corruption.

1021) Improper input validation (CVE-ID: CVE-2026-74620)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in act_gact and act_police fallback control action handling when configuring traffic control actions through user-supplied netlink attributes. A local user can supply a crafted fallback control action value to cause a denial of service.

The issue can cause an unbounded sk_buff memory leak for each packet traversing the affected filter chain, including kernel-generated packets.

1022) Improper resource shutdown or release (CVE-ID: CVE-2026-74621)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the act_ct traffic control action when processing malformed fragmented IPv4 or IPv6 packets during header sanity checks. A remote attacker can send a specially crafted malformed packet to cause a denial of service.

The issue can leak one sk_buff and its associated data buffer per malformed packet, which may occur on ingress or egress paths that use the connection tracking action.

1023) Improper resource shutdown or release (CVE-ID: CVE-2026-74622)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in aq_ring_rx_deinit() in the atlantic network driver when deinitializing receive rings. A local user can trigger interface teardown while buffers have been consumed but not yet refilled to cause a denial of service.

The issue occurs because receive buffers in the gap between sw_tail and sw_head can retain live pages and DMA mappings that are not released during ring deinitialization.

1024) Improper resource shutdown or release (CVE-ID: CVE-2026-74623)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the atlantic driver TX ring deinitialization logic when tearing down network interfaces under TX or XDP_TX load. A local user can trigger interface teardown while transmit descriptors remain stranded to cause a denial of service.

Under XDP_TX load, stranded frames can keep the page pool inflight count above zero and prevent pool shutdown, with repeated stall warnings during interface down, XDP detach, or ring resize operations.

1025) Memory leak (CVE-ID: CVE-2026-74625)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in nf_ct_bridge_pre() when processing non-IPv4 and non-IPv6 Ethernet frames after a bridge nftables ct zone set rule has attached a conntrack template. A remote attacker can send specially crafted non-IP traffic to cause a denial of service.

Memory is leaked by making the existing conntrack template reference unreachable, which can exhaust slab memory.

1026) Improper resource shutdown or release (CVE-ID: CVE-2026-74626)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in ntb_netdev_rx_handler() in the ntb_netdev driver when handling received packets and allocating replacement receive buffers. A remote attacker can send packets that trigger allocation failures and exhaust the receive queue to cause a denial of service.

The issue can stall packet reception while the network interface remains up.

1027) Use-after-free (CVE-ID: CVE-2026-74628)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the x25 socket timer handlers when processing timer callbacks during socket teardown. A local user can trigger timer activity on an x25 socket being destroyed to cause a denial of service.

The issue involves a race condition in which a timer callback may rearm after the socket has passed its cancel point, leading to use of freed memory on a subsequent timer expiry.

1028) Use-after-free (CVE-ID: CVE-2026-74630)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to use-after-free in in6_dev_get() and inet6_dev handling when processing IPv6 device state during concurrent device teardown. A local user can trigger network operations that race with device teardown to cause a denial of service or execute arbitrary code.

The issue arises from invalid reference acquisition after the object reference count has already reached zero, and the freed object may be accessed after the RCU read-side section ends.

1029) Use-after-free (CVE-ID: CVE-2026-74631)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in smc_rx_splice when processing splice operations. A local user can trigger a refcount imbalance to cause a denial of service.

The issue can underflow page refcounts in the VM-backed RMB path.

1030) Race condition (CVE-ID: CVE-2026-74632)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in mm/huge_memory.c when handling concurrent page faults and shrinker activity for the huge zero folio. A local user can trigger concurrent memory-management activity to cause a denial of service.

Only systems without CONFIG_PERSISTENT_HUGE_ZERO_FOLIO are affected.

1031) Out-of-bounds read (CVE-ID: CVE-2026-74635)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the bit_cursor() function in drivers/video/fbdev/core/bitblit.c when processing screen buffer values as glyph indexes. A local user can write an arbitrary 16-bit value to /dev/vcsa to disclose sensitive information.

The issue can also be triggered when stale screen buffer data retains high-bit characters after switching from a 512-glyph font to a 256-glyph font.

1032) Race condition (CVE-ID: CVE-2026-74636)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in trace event field handling in the Linux kernel tracing subsystem when loading modules and updating trace event fields concurrently. A local user can load modules concurrently to trigger a kernel panic and cause a denial of service.

Exploitation requires the ability to initiate module loading.

1033) Use-after-free (CVE-ID: CVE-2026-74637)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in perf/core group handling when processing a PERF_IOC_FLAG_GROUP ioctl on a detached sibling event after CPU hotplug detachment. A local user can issue a crafted ioctl on a surviving perf event file descriptor to cause a denial of service.

The issue occurs when a sibling event is detached with DETACH_GROUP and kept alive while its group_leader pointer still references a leader that is later freed.

1034) Improper input validation (CVE-ID: CVE-2026-74641)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read and write arbitrary kernel memory or cause a denial of service.

The vulnerability exists due to improper input validation in snd_us428ctls_vm_fault() and snd_usx2y_hwdep_pcm_vm_fault() when handling mmap page faults with a user-controlled page offset. A local user can supply a crafted mmap() offset to map a kernel page outside the allocated shared memory region to read and write arbitrary kernel memory or cause a denial of service.

Exploitation requires access to the hwdep node of an attached US-X2Y device, and in the us428 control path the FPGA image must be loaded through the same node first.

1035) Race condition (CVE-ID: CVE-2026-74647)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in fastrpc_req_munmap_impl in the fastrpc driver when processing concurrent buffer unmap requests. A local user can trigger concurrent unmap operations to cause a denial of service.

The issue occurs when multiple threads invoke unmap concurrently for the same buffer.

1036) Out-of-bounds read (CVE-ID: CVE-2026-74648)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in rtw_cfg80211_monitor_if_xmit_entry() when processing truncated monitor transmit frames. A local user can send a specially crafted truncated frame to disclose sensitive information or cause a denial of service.

The issue occurs after removal of the radiotap header while handling 802.11 headers and related calculated header spans.

1037) Out-of-bounds write (CVE-ID: CVE-2026-74649)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write out of bounds or disclose sensitive information.

The vulnerability exists due to out-of-bounds write in the OnAuthClient() shared-key authentication handler when processing a malformed WLAN_EID_CHALLENGE element during shared-key authentication. A remote attacker can send a specially crafted wireless authentication frame to write out of bounds or disclose sensitive information.

The issue is reachable over the air before association.

1038) Out-of-bounds read (CVE-ID: CVE-2026-74650)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in WMM_param_handler() when processing a vendor-specific information element carrying the WMM OUI. A remote attacker can send a specially crafted association response or information element blob to disclose sensitive information.

The issue is reachable from a remote peer through association response parsing from the access point.

1039) Out-of-bounds read (CVE-ID: CVE-2026-74651)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in rtw_get_wpa_ie() when parsing vendor-specific information elements from received management frames or WPA IE data. A remote attacker can send a specially crafted management frame or crafted IE data to disclose sensitive information.

The issue can be triggered by a short trailing vendor-specific information element whose length is 0 to 5 bytes.

1040) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74654)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in serial8250_rx_dma_flush() and serial8250_release_dma() when reopening a port after it is closed during an active RX DMA transfer. A local user can close and reopen the serial port to trigger a kernel Oops and cause a denial of service.

The issue occurs because stale RX state can remain set while the RX DMA channel is unavailable.

1041) Use-after-free (CVE-ID: CVE-2026-74656)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fib_nhc_update_mtu() when walking the nexthop exception table during MTU updates. A local user can trigger concurrent updates to access a freed fib_nh_exception object and cause a denial of service.

The issue involves insufficient synchronization with PMTU exception updates, and KASAN reported a read-after-free during the vulnerable code path.

1042) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-74657)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper calculation of buffer size in fib_nlmsg_size() in the IPv4 routing subsystem when generating route notifications for nexthops that use RTA_VIA. A local user can trigger route notification handling involving an IPv6 gateway to cause a denial of service.

The issue can reach a kernel panic if panic_on_warn is set.

1043) Race condition (CVE-ID: CVE-2026-74658)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the robust futex handling in kernel/futex/core.c when processing robust futex exit conditions. A local user can trigger a race condition involving futex waiters to cause a denial of service.

The issue can leave waiting tasks blocked indefinitely due to a lost wakeup.

1044) Use of uninitialized resource (CVE-ID: CVE-2026-74659)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in br_mrp_alloc_test_skb() when constructing MRA MRP_Test frames. A remote attacker can trigger transmission of a specially crafted protocol frame to disclose sensitive information.

Three uninitialized bytes are present in each transmitted MRA MRP_Test frame because the sub-TLV length field and alignment padding are not initialized.

1045) Use-after-free (CVE-ID: CVE-2026-74660)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ebt_nflog netfilter target when processing packets that match an ebtables nflog rule during concurrent unloading of the nfnetlink_log module. A local user can trigger packet logging through a crafted ebtables nflog rule to cause a denial of service.

Exploitation requires a race with module teardown while an ebtables nflog rule remains callable.

1046) Race condition (CVE-ID: CVE-2026-74662)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in inet_frag_create() and the fragment queue timer handling in net/ipv4/inet_fragment.c when processing fragmented packets with a zero or negative fragment timeout. A remote attacker can send specially crafted fragmented network traffic to cause a denial of service.

The issue occurs because the timer may run before the queue is published in the fqdir rhashtable, which can leave a stale hash node after reference handling becomes unbalanced.

1047) Uncontrolled Recursion (CVE-ID: CVE-2026-74663)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in qdisc hierarchy handling in net/sched qdisc grafting logic when creating and grafting a new child qdisc below an already deep parent. A local user can create a deeply nested qdisc hierarchy to cause a denial of service.

The issue affects the create-and-graft path that is not covered by the existing loop check.

1048) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-74664)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of reply buffer sizing in ovs_flow_cmd_new() in net/openvswitch/datapath.c when processing flow update requests with mismatched identifiers. A local user can send a specially crafted flow update request to cause a denial of service.

The issue can occur when a request using a UFID falls back to flow key lookup and the matched flow requires a larger echoed reply identifier than the preallocated reply buffer provides.

1049) Race condition (CVE-ID: CVE-2026-74666)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in packet_set_ring() and pressure clearing logic in af_packet when reconfiguring the ring while packet_poll() or packet_recvmsg() accesses receive state. A local user can reconfigure the packet socket ring and trigger packet polling or receive operations to cause a denial of service.

The issue can cause __packet_rcv_has_room() to dereference stale or NULL ring storage.

1050) Out-of-bounds read (CVE-ID: CVE-2026-74667)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the packet-socket transmit path in net/packet/af_packet.c when transmitting frames through the PACKET_QDISC_BYPASS path. A local user can send a specially crafted packet through a packet socket to cause a denial of service.

The issue occurs when a driver reads eth_hdr(skb) on transmit with an unset MAC header.

1051) Race condition (CVE-ID: CVE-2026-74668)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an inconsistent use of hard_header_len in the tpacket_snd() transmit ring send path in net/packet/af_packet.c when processing tx ring frames during packet transmission. A local user can trigger concurrent netdevice reconfiguration and send crafted ring frames to cause a denial of service.

The issue can make the reserved headroom smaller than the amount later pushed, or make the computed copy length negative.

1052) Stack-based buffer overflow (CVE-ID: CVE-2026-74669)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack out-of-bounds write in ip_vs_in_icmp() when rebasing tunnel ICMP errors and processing IPv4 options. A remote attacker can send a specially crafted ICMP packet with IPv4 timestamp options to cause a denial of service.

The issue is triggered because stale IPv4 option metadata from the outer header is retained after the packet is rebased to the quoted original request.

1053) Out-of-bounds read (CVE-ID: CVE-2026-74671)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in xattr_verify() when verifying a truncated security.ima extended attribute value. A local user can provide a specially crafted truncated extended attribute to disclose sensitive information.

The issue is triggered by an integer underflow caused by mixing signed and unsigned arithmetic in the digest-length check.

1054) Use of Uninitialized Variable (CVE-ID: CVE-2026-74673)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an uninitialized stack-based structure in evdev event handling functions when copying input_event structures to userspace. A local user can read crafted event data from the evdev client buffer to disclose sensitive information.

The issue affects padding bytes in struct input_event on architectures where explicit or implicit padding is present.

1055) Race condition (CVE-ID: CVE-2026-74675)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in kbd_keycode in drivers/tty/vt/keyboard.c when handling keyboard input while accessing vc->port.tty. A local user can trigger the race to cause a denial of service.

1056) Improper access control (CVE-ID: CVE-2026-74676)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify keyboard meta mode on a non-controlling console without authorization.

The vulnerability exists due to improper access control in the KDSKBMETA ioctl handler in vt_k_ioctl() when processing KDSKBMETA ioctl requests. A local user can invoke the KDSKBMETA ioctl to modify keyboard meta mode on a non-controlling console without authorization.

1057) Out-of-bounds read (CVE-ID: CVE-2026-74679)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the usb gadget ncm function when processing a crafted ncm network transfer block from a malicious host. A remote attacker can supply a large offset that becomes negative after signed integer overflow to disclose sensitive information.

1058) Improper resource shutdown or release (CVE-ID: CVE-2026-74680)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in cxacru_cm() in the cxacru usb atm driver when handling error conditions during urb submission and command processing. A local user can trigger an error path that leaves rcv_urb active to cause a denial of service.

The issue can be reached during device initialization when a subsequent status poll invokes the same command path again, leading to a warning when the active urb is resubmitted.

1059) Out-of-bounds write (CVE-ID: CVE-2026-74682)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the ALSA usb-audio endpoint handling code when processing inbound URBs for Type II capture formats after userspace sets hw_params on the stream. A local user can use a device advertising a Type II capture format to trigger an out-of-bounds write and cause memory corruption.

Only capture streams are affected.

1060) Out-of-bounds read (CVE-ID: CVE-2026-74683)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in evdev_get_mask_cnt() when handling EVIOCGMASK or EVIOCSMASK ioctl requests with a user-supplied event type index. A local user can supply a crafted event type index to disclose sensitive information.

The issue arises from speculative execution mispredicting bounds checks during access to the static counts array and can affect subsequent mask handling logic.

1061) Use-after-free (CVE-ID: CVE-2026-74688)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the SCTP control chunk handling logic when transmitting a queued HEARTBEAT ACK after the associated peer transport has been removed. A remote attacker can trigger peer transport removal while a control chunk retains a stale transport pointer to cause a denial of service.

The issue occurs when src_out_of_asoc_ok is enabled and the HEARTBEAT ACK remains queued on control_chunk_list instead of being transmitted immediately.

1062) Incorrect behavior order (CVE-ID: CVE-2026-74691)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown sequence in the thunderbolt networking teardown logic when disabling thunderbolt DMA paths during interface teardown. A local user can trigger interface teardowns to cause a denial of service.

On affected systems, repeated teardowns can eventually take the XDomain control channel down, after which the peer node disappears until the controller is power cycled.

1063) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74692)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in smc_listen_out() in net/smc/af_smc.c when handling TCP connection attempts while a listener is being closed. A remote attacker can open TCP connections during the race window to cause a denial of service.

The issue can leak child smc_sock objects, their clcsock objects, and references, which can exhaust kernel memory.

1064) Out-of-bounds read (CVE-ID: CVE-2026-74693)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in prestera_fw_hdr_parse() when parsing a crafted firmware image. A local user can provide a specially crafted firmware image to cause a denial of service.

1065) Out-of-bounds read (CVE-ID: CVE-2026-74694)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ncsi_send_cmd_nl() and ncsi_cmd_handler_oem() when processing a netlink request containing an NCSI packet header with a forged payload length. A local user can send a specially crafted netlink request to disclose sensitive information.

Exploitation requires a registered NCSI device.

1066) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74696)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in TCP Fast Open listener queue accounting when migrating pending Fast Open children across SO_REUSEPORT listeners. A remote attacker can establish multiple pending Fast Open requests during listener migration to cause a denial of service.

This only occurs with SO_REUSEPORT listener migration involving still-pending TCP Fast Open children.

1067) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-74697)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to improper hardware interaction in the bnxt_en AGG ring handling in the bnxt driver when processing TPA data with EOP and relaxed ordering enabled. A local user can trigger network traffic processing that causes overlapping zero padding to corrupt data.

The issue was reported on some ARM systems using 57508 (P5) chips, and it occurs when TPA is enabled.

1068) Out-of-bounds read (CVE-ID: CVE-2026-74701)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in key_extract() in the Open vSwitch flow extraction logic when processing a packet on an ARPHRD_NONE device with a user-controlled protocol field indicating Ethernet. A local user can send a specially crafted packet with an insufficient linear header to cause a denial of service.

The issue is triggered when the packet is received from devices such as TUN.

1069) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74704)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of malformed packets in sch_cake ACK filter when parsing malformed IP headers. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue may result in warning log flooding, or a kernel panic when panic_on_warn is enabled.

1070) Use-after-free (CVE-ID: CVE-2026-74705)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in __skb_udp_tunnel_segment() in net/ipv4/udp_offload.c when processing tunnel segmentation for skb data after pulling the tunnel header into the skb head. A local attacker can trigger skb head reallocation and subsequent use of a stale UDP header pointer to cause a denial of service.

1071) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-74717)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error conditions in the mlx5 firmware tracer core dump logic when processing a tracer creation failure. A local user can trigger the vulnerable code path to cause a denial of service.

The issue can lead to an ERR_PTR dereference and kernel panic during core dump handling.

1072) Memory leak (CVE-ID: CVE-2026-74719)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in smc_llc_event_handler() when handling duplicate CONFIRM_LINK or ADD_LINK_CONT messages while a local LLC flow is active and a qentry is already pending. A remote attacker can send duplicate crafted messages to cause a denial of service.

The issue affects the SMC_LLC_CONFIRM_LINK and SMC_LLC_ADD_LINK_CONT handling path, while the response direction is not affected.

1073) Improper Initialization (CVE-ID: CVE-2026-74720)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in adjust_ptr_min_max_vals() in the BPF verifier when handling commuted arithmetic involving scalar += pointer operations. A local user can execute a crafted BPF program to cause a denial of service.

The issue occurs because the destination register did not preserve the complete pointer register state, which could leave frame number and parent identity tracking inconsistent for pointer provenance.

1074) Race condition (CVE-ID: CVE-2026-74726)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in bond_alb_monitor in the bonding ALB implementation when handling active slave changes under RTNL. A local user can trigger network interface state changes to cause a denial of service.

The issue can lead to a null pointer dereference and kernel panic, and in failover cases can underflow the new slave's promiscuity counter and leave it stuck in promiscuous mode.

1075) Use-after-free (CVE-ID: CVE-2026-74730)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the NFS FREE_STATEID handling in fs/nfs/nfs4proc.c when processing a delayed FREE_STATEID operation. A local user can trigger a delayed FREE_STATEID operation to cause a denial of service.

1076) Out-of-bounds read (CVE-ID: CVE-2026-74737)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds memory access in the am65-cpsw-nuss packet reception path when processing RX DMA descriptor metadata containing the source tag. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because the driver uses the full 16-bit source tag as the port identifier even though only the lower 8 bits represent the MAC port ID, while the upper 8 bits are hardware-reserved and may contain arbitrary values.

1077) Use-after-free (CVE-ID: CVE-2026-74743)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the macvlan network device handling in drivers/net/macvlan.c when processing packets on a macvlan device backed by a lower device that requires additional headroom or tailroom. A remote attacker can send network traffic that triggers insufficient buffer space handling to execute arbitrary code.

The issue can be triggered when the lower device requires extra header or trailer space, such as with macsec, ipsec, wireguard, tunnels, or veth with rx headroom.

1078) Use-after-free (CVE-ID: CVE-2026-74746)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the netfilter flowtable subsystem when inserting flow tuple nodes into the rhashtable. A remote attacker can trigger garbage collection to observe a partially installed flow to execute arbitrary code.

KASAN reported read and write access to freed slab memory in the flowtable and rhashtable path.

1079) Race condition (CVE-ID: CVE-2026-74748)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in __ip_set_put_byindex() in the netfilter ipset subsystem when list:set garbage collection and set swap operations occur concurrently. A local user can trigger concurrent ipset operations to cause a denial of service.

The issue can lead to a kernel BUG and panic from timer softirq context.

1080) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80527)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in __ceph_get_caps() when handling Ceph capability revocation and reacquisition. A remote attacker can trigger conflicting operations that leave stale mds_wanted state and cause a reader to wait indefinitely to cause a denial of service.

The issue occurs when a cap update requesting FILE_RD does not reach the MDS after mds_wanted has been raised, leaving the client without the wanted file read capability while local state still indicates it is wanted.

1081) Improper resource shutdown or release (CVE-ID: CVE-2026-80528)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a kernel crash.

The vulnerability exists due to improper resource shutdown or release in handle_reply() in fs/ceph/mds_client.c when processing Ceph MDS replies and filling inode and dentry cache data. A remote attacker can send a specially crafted Ceph MDS reply to cause a kernel crash.

The issue occurs because Ceph-private data stored in current->journal_info may be dereferenced by another filesystem during reclaim.

1082) Improper locking (CVE-ID: CVE-2026-80534)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock release in xfs_dq_get_next_id when handling an error from xfs_iread_extents. A local user can trigger the error condition during quota operations to cause a denial of service.

The issue can leave the quota inode locked, causing subsequent quota operations to hang.

1083) Out-of-bounds write (CVE-ID: CVE-2026-80536)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in xlog_recover_do_reg_buffer() when processing a crafted XFS filesystem image during mount-time log recovery. A remote attacker can mount a specially crafted filesystem image to execute arbitrary code.

The issue is reachable during mount-time recovery on production kernels where the bounds check was enforced only by an ASSERT().

1084) Integer overflow (CVE-ID: CVE-2026-80540)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an integer overflow in the amdgpu UVD decode message handler when processing crafted decode parameters. A local user can supply a crafted pitch value to trigger the overflow and execute arbitrary code.

The issue is in the Linux kernel DRM AMDGPU UVD decode path.

1085) Improper input validation (CVE-ID: CVE-2026-80541)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in amdgpu_gem_create_ioctl() when processing GEM create requests with invalid domain combinations. A local user can submit a specially crafted domain combination to cause a denial of service.

The issue is triggered when CPU, GTT, or VRAM domains are combined with DOORBELL, GDS, GWS, or OA domains, causing amdgpu_bo_placement_from_domain() to exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON().

1086) Race condition (CVE-ID: CVE-2026-80547)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to a race condition in the vfio_ccw crw handling logic when processing asynchronous hardware events and userspace reads of the crw region. A local user can trigger concurrent access to the crw list to disclose sensitive information, modify data, or cause a denial of service.

The issue affects the s390 vfio_ccw subsystem and involves the crw queue being accessed from asynchronous hardware-driven paths.

1087) Race condition (CVE-ID: CVE-2026-80548)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges and compromise confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in the vfio_ccw I/O resource handling and channel program lifecycle management when processing concurrent I/O operations and state transitions. A local user can trigger concurrent operations to escalate privileges and compromise confidentiality, integrity, and availability.

The issue affects the s390 vfio_ccw driver.

1088) Out-of-bounds read (CVE-ID: CVE-2026-80550)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ccwchain_calc_length() when processing chained channel command words in a channel program. A remote attacker can supply a crafted channel program to disclose sensitive information.

The issue occurs because the routine may examine a 257th CCW entry before rejecting an oversized chain.

1089) Out-of-bounds write (CVE-ID: CVE-2026-80552)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify memory, or cause a denial of service.

The vulnerability exists due to an out-of-bounds access in vfio_ccw region read and write handlers when processing read or write requests for vfio_ccw regions with an out-of-range region index. A local user can supply a crafted region index to disclose sensitive information, modify memory, or cause a denial of service.

The issue affects vfio_ccw read and write region handling on s390.

1090) Use-after-free (CVE-ID: CVE-2026-80553)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the vfio_ccw device workqueue handling when closing or releasing a device with pending work items. A local user can trigger device close or release while queued work is still pending to execute arbitrary code.

1091) Improper resource shutdown or release (CVE-ID: CVE-2026-80555)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the vfio_ccw channel program initialization logic when processing channel programs containing Transfer in Channel segments. A remote attacker can trigger cp_init() failure during ccwchain construction to cause a denial of service.

The issue occurs because cleanup does not release all allocated CCW segments if initialization fails before the channel program is marked initialized.

1092) Out-of-bounds read (CVE-ID: CVE-2026-80557)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, execute arbitrary code, or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in decode_watchers() when processing a crafted obj_list_watch_response_t reply with struct_len set to 0. A remote attacker can send a specially crafted OSD response to disclose sensitive information, execute arbitrary code, or cause a denial of service.

Exploitation requires a malicious or compromised OSD and can be triggered when a kernel client invokes CEPH_OSD_OP_LIST_WATCHERS.

1093) Out-of-bounds read (CVE-ID: CVE-2026-80558)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, corrupt memory, or cause a denial of service.

The vulnerability exists due to out-of-bounds read in ceph_pg_to_up_acting_osds() and calc_target() when processing a corrupted osdmap containing an invalid primary_temp OSD index. A remote attacker can send a crafted osdmap with a nonexistent OSD index to trigger out-of-bounds array access to disclose sensitive information, corrupt memory, or cause a denial of service.

The issue occurs because the primary_temp OSD index was not properly validated before being used as the target OSD for a request.

1094) Race condition (CVE-ID: CVE-2026-80559)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a system crash.

The vulnerability exists due to a race condition in the sur40 input device initialization and polling path when opening the input device before the V4L2 video device and vb2_queue are fully initialized. A local user can open the device to trigger the polling worker thread and cause a system crash.

The issue is triggered during device initialization ordering in sur40_probe().

1095) Improper privilege management (CVE-ID: CVE-2026-80560)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper access control in restore_sigcontext() in the openrisc signal handling code when returning from a signal handler through a crafted sigframe. A local user can craft a sigframe that modifies privileged SR bits to escalate privileges.

By clearing SPR_SR_DME, data accesses can occur without MMU translation or protection, enabling read and write access to arbitrary physical memory.

1096) Out-of-bounds read (CVE-ID: CVE-2026-80561)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to out-of-bounds read in decode_locker() in net/ceph/cls_lock_client.c when decoding locker data from an OSD response. A remote attacker can send a specially crafted OSD response to disclose sensitive information and cause a denial of service.

Exploitation requires a malicious or compromised OSD to interact with a kernel client issuing the lock.get_info class method, such as during RBD exclusive lock acquisition.

1097) Improper locking (CVE-ID: CVE-2026-80562)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock type selection in the gpio-ml-ioh driver irq callbacks when invoking irq_set_type, irq_enable, or irq_disable while the IRQ descriptor lock is held in a non-sleepable context. A local user can trigger these callbacks to cause a denial of service.

The issue is specific to PREEMPT_RT kernels.

1098) Improper resource shutdown or release (CVE-ID: CVE-2026-80565)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper resource shutdown or release in the qce algorithm registration logic in drivers/crypto/qce/core.c when handling a failure during algorithm registration. A local user can trigger a registration failure to execute arbitrary code.

1099) Unchecked Return Value (CVE-ID: CVE-2026-80567)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper handling of worker errors in rmi_f54_buffer_queue() in the synaptics-rmi4 F54 driver when processing queued V4L2 buffers. A local user can trigger a worker failure to disclose sensitive information.

Stale or uninitialized memory may be delivered to userspace if report acquisition fails.

1100) Heap-based buffer overflow (CVE-ID: CVE-2026-80568)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the synaptics-rmi4 F54 V4L2 input handling when changing the diagnostic report input while streaming. A local user can switch the input mid-stream to trigger a larger report size than the allocated buffers and execute arbitrary code.

The issue occurs because V4L2 buffers are allocated based on the report size at stream start.

1101) Out-of-bounds write (CVE-ID: CVE-2026-80569)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the synaptics-rmi4 F54 diagnostics report handling in rmi_f54_work() when processing a malicious or malfunctioning RMI4 device report with larger F55 electrode counts than F54 counts. A local user can provide a specially crafted device that reports inconsistent electrode counts to execute arbitrary code.

The issue can also cause an out-of-bounds read during the subsequent V4L2 dequeue memcpy().

1102) Heap-based buffer overflow (CVE-ID: CVE-2026-80570)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in rmi_f54_buffer_queue() when handling a failed report operation after the V4L2 format has been changed to a smaller size. A local user can trigger an error path that leaves a stale larger report size and cause it to be copied into a smaller buffer to execute arbitrary code or cause a denial of service.

The issue is caused by failure to clear f54->report_size on certain error paths in rmi_f54_work().

1103) Out-of-bounds read (CVE-ID: CVE-2026-80573)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the iforce input packet processing logic when parsing crafted USB input packets. A local attacker can send crafted short packets to trigger out-of-bounds reads and cause a denial of service.

Exploitation requires delivery of malformed data through a connected USB device.

1104) Out-of-bounds write (CVE-ID: CVE-2026-80574)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in focaltech_process_rel_packet when processing crafted input packets. A remote attacker can trigger a finger index underflow to write before the bounds-checked array and to execute arbitrary code.

The issue occurs because subtracting 1 from a packet finger index of 0 can produce an invalid array index that targets state->fingers[-1].

1105) Out-of-bounds write (CVE-ID: CVE-2026-80583)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify memory, or cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the tx_macro_dec_mode_get() and tx_macro_dec_mode_put() kcontrol handlers in sound/soc/codecs/lpass-tx-macro.c when accessing enumerated control values. A local user can access a crafted enumerated control value through the "DEC0 MODE" to "DEC7 MODE" controls to disclose sensitive information, modify memory, or cause a denial of service.

On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the issue is detected as an access overflow and reads of these controls fail with -EINVAL.

1106) Out-of-bounds write (CVE-ID: CVE-2026-80584)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the qeth SNMP and ARP query ioctl handlers when processing user-supplied buffer lengths. A remote attacker can supply a crafted length value that causes an integer underflow in a bounds check and trigger a memcpy() past the allocated buffer to execute arbitrary code.

The issue occurs because a user-supplied length smaller than the fixed offset can wrap a u32 subtraction, and a zero-length allocation can also result in an invalid zero-sized buffer.

1107) Missing initialization of resource (CVE-ID: CVE-2026-80586)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, corrupt data, or cause a denial of service.

The vulnerability exists due to improper state reset in MPTCP DSS option parsing in net/mptcp/options.c when processing malformed DSS options with an unexpected size. A remote attacker can send crafted MPTCP packets to disclose sensitive information, corrupt data, or cause a denial of service.

The issue can occur when a malformed DSS option is followed by another DSS option or MPC plus data, causing inconsistent state or access to uninitialized data.

1108) Improper input validation (CVE-ID: CVE-2026-80587)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in the MPTCP option parser when processing incoming MPTCP suboptions. A remote attacker can send specially crafted packets with inconsistent suboption combinations to execute arbitrary code.

The issue affects handling of mutually exclusive or unexpected combinations of MPTCP suboptions.

1109) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-80590)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of gso metadata in inet fragment reassembly when processing crafted IP fragments with attached GSO state. A local user can write specially crafted packets to a tap device to cause a denial of service.

The issue can be triggered by an unprivileged user in its own user namespace, and it may also be reachable in environments where virtio_net_hdr metadata is forwarded to a tap device or where CAP_NET_RAW is available in a network namespace.

1110) Out-of-bounds read (CVE-ID: CVE-2026-80591)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in f2fs_listxattr() when processing corrupted xattr entries. A local user can supply a crafted corrupted filesystem image to cause a denial of service.

The issue occurs when an xattr entry lies outside the valid xattr storage area.

1111) Out-of-bounds read (CVE-ID: CVE-2026-80593)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the atk_ec_present() function in the asus_atk0110 hwmon driver when processing a malformed firmware package returned by the GGRP ACPI method. A local attacker can provide a zero-length sub-package to trigger the out-of-bounds read and disclose sensitive information.

1112) Improper input validation (CVE-ID: CVE-2026-80594)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in ims_pcu_get_cdc_union_desc() when parsing CDC union descriptors from a malicious USB device. An attacker with physical access can provide a crafted descriptor with bLength set to 0 to cause a denial of service.

1113) Out-of-bounds read (CVE-ID: CVE-2026-80595)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the ims-pcu driver when processing response data from device buffers. A local user can provide a short device response to disclose sensitive information.

The issue can also result in processing stale data from the buffers.

1114) NULL pointer dereference (CVE-ID: CVE-2026-80597)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the vmu-flash initialization code when initializing the mtd_info device structure without linking it to its parent device. A local user can trigger initialization of the affected component to cause a denial of service.

1115) Out-of-bounds read (CVE-ID: CVE-2026-80598)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in decompress_lznt() when parsing invalid compressed data from a corrupted NTFS3 image. A local user can supply a crafted NTFS3 image to disclose sensitive information.

1116) Out-of-bounds read (CVE-ID: CVE-2026-80599)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in batadv_dat_get_vid() when processing packet data without ensuring the ethernet header is accessible. A local user can provide a specially crafted skb to trigger an out-of-bounds access and cause a denial of service.

The issue affects distributed arp table handling paths.

1117) Use-after-free (CVE-ID: CVE-2026-80600)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in batman-adv distributed arp table handling in net/batman-adv/distributed-arp-table.c when processing DHCP ACK packets. A local user can trigger skb buffer reallocation and subsequent access through stale pointers to cause a denial of service.

1118) Use-after-free (CVE-ID: CVE-2026-80601)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to use-after-free in batman-adv gateway client handling in net/batman-adv/gateway_client.c when processing a crafted skb after buffer reallocation. A local attacker can trigger skb processing that uses stale buffer pointers to cause a denial of service.

1119) Out-of-bounds read (CVE-ID: CVE-2026-80603)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect connection tracking state.

The vulnerability exists due to an out-of-bounds read in the parse_dcc() function in nf_conntrack_irc when parsing DCC command data without a newline present. A remote attacker can send specially crafted IRC DCC command data to cause incorrect connection tracking state.

The stray read may consume an uninitialized or stale byte, which can lead to an incorrect DCC IP address or port being recorded in the conntrack expectation.

1120) Integer overflow (CVE-ID: CVE-2026-80605)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in picolcd_send_and_wait() when processing crafted input to the HID device. A local user can trigger excessive loop iterations to cause a NULL pointer dereference and crash the kernel.

1121) Out-of-bounds read (CVE-ID: CVE-2026-80609)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the qede driver qede_tpa_cont and qede_tpa_end handling of cqe->len_list[] when processing crafted CQE data. A local user can trigger access past the end of the len_list array to cause a denial of service.

1122) Use-after-free (CVE-ID: CVE-2026-80613)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to a use-after-free in the veth XDP enablement error-handling logic when rolling back queue initialization after failed XDP rxq registration. A local user can trigger XDP enablement failure to cause a use-after-free.

The issue occurs because a previously added NAPI structure is left dangling in the device NAPI list and may later corrupt reallocated memory during device teardown.

1123) Use-after-free (CVE-ID: CVE-2026-80619)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the aa_replace_profiles function when processing profile replacement data. A local user can trigger the vulnerable code path to cause a denial of service.

1124) Use-after-free (CVE-ID: CVE-2026-80622)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in tlclk_cleanup() in the tlclk driver when cleaning up the device while user-space processes are still interacting with it. A local user can keep the device in use during module cleanup to cause a denial of service.

The issue is associated with blocked readers in the wait queue and concurrent timer activity during cleanup.

1125) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80626)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in fsl_emb_pmu_del() when removing a perf event with a negative hardware index. A local user can trigger the vulnerable code path to cause a denial of service.

On systems with CONFIG_PREEMPT enabled, the issue can underflow preempt_count and manifest as a "scheduling while atomic" BUG.

1126) Out-of-bounds write (CVE-ID: CVE-2026-80627)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in maar_res_walk() when walking system RAM ranges. A local user can trigger reporting of more than 16 memory ranges to cause a denial of service.

1127) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80630)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the sch_fq_codel queueing discipline when peeking queued packets after packet drops. A local user can trigger packet drops during peek to cause a denial of service.

The issue can incorrectly invoke the parent qlen_notify callback while a packet still remains queued, which may mistakenly deactivate the parent class and lead to wild memory access in sch_qfq.

1128) Reachable assertion (CVE-ID: CVE-2026-80644)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an assertion misuse in ocfs2_journal_toggle_dirty() in fs/ocfs2/journal.c when mounting a crafted OCFS2 image with an invalid journal dinode. A local user can mount a specially crafted filesystem image to cause a denial of service.

The issue is triggered during mount teardown while mount is still in progress.

1129) Improper Initialization (CVE-ID: CVE-2026-80645)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper initialization issue in tsi721_db_dpc() when processing doorbell events. A local user can trigger the vulnerable code path to cause a denial of service.

1130) NULL pointer dereference (CVE-ID: CVE-2026-80646)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in __in6_dev_stats_get() when processing an skb for an l3 master device whose original physical device has been unregistered. A local user can trigger this condition to cause a denial of service.

1131) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-80647)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of completion callbacks in the hns roce completion queue handling logic when processing direct mode completion queues during driver reset. A local user can trigger a driver reset with a direct mode cq present to cause a denial of service.

The issue is triggered specifically when a completion queue is allocated in direct polling mode and the device reset path invokes the completion handler unexpectedly.

1132) Out-of-bounds read (CVE-ID: CVE-2026-80649)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in scmi_power_name_get() in the arm_scmi firmware driver when processing an externally supplied domain number. A local user can supply an invalid domain value to disclose sensitive information or cause a denial of service.

1133) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80652)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a zero-length buffer in sev_ioctl_do_pdh_export() when processing a PDH export request. A local user can send a crafted ioctl request with a zero-length certificate chain buffer to cause a denial of service.

The issue results in a kernel BUG when CONFIG_DEBUG_VIRTUAL=y.

1134) Deadlock (CVE-ID: CVE-2026-80659)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock caused by recursive mutex acquisition in the vub300 mmc host driver when handling a command response timeout and resetting the USB device. A local user can trigger a command timeout that leads to a recursive acquisition of cmd_mutex to cause a denial of service.

The issue occurs because the reset path re-enters vub300_pre_reset() while the worker thread still holds cmd_mutex.

1135) NULL pointer dereference (CVE-ID: CVE-2026-80664)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in xt_nat SNAT and DNAT target handlers when installing an unsupported-family compat rule through nft_compat. A local user can instantiate a bridge-family compat rule to cause a denial of service.

The issue is triggered in nf_nat_setup_info() because the handlers assume IP-family conntrack state is present.

1136) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exceptional condition handling in register_pid() in tools/perf/builtin-sched.c when reallocating sched->tasks while processing untrusted perf.data. A local user can supply crafted input that triggers realloc failure to cause a denial of service.

Direct reassignment of the realloc result can leak the original pointer and leave task state corrupted because the task count is updated before successful reallocation.

1137) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exceptional condition handling in register_pid() in tools/perf/builtin-sched.c when processing untrusted perf.data that triggers allocation failure. A local user can supply crafted input that causes an allocation failure to cause a denial of service.

The issue is triggered because allocation failures are handled with a BUG_ON condition that terminates the process.

1138) Heap-based buffer overflow (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in register_pid() in tools/perf/builtin-sched.c when processing an untrusted comm string from perf.data. A local user can supply a crafted perf.data file containing an oversized comm value to cause a denial of service.

The overflow occurs because the comm value is copied into a fixed 20-byte COMM_LEN buffer without a length check.

1139) Integer overflow (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in register_pid() in tools/perf/builtin-sched.c when processing untrusted perf.data. A local user can supply a crafted perf.data file with a large pid value to cause a denial of service.

The integer overflow can occur on 32-bit systems and may lead to out-of-bounds writes during task array initialization.

1140) Race condition (CVE-ID: CVE-2026-80677)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dev_has_sync_state() in the driver core when checking and dereferencing dev->driver without holding the device lock. A local user can trigger a concurrent unbind condition to cause a denial of service.

1141) Race condition (CVE-ID: CVE-2026-80678)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in i2c_imx_reg_slave() and i2c_imx_isr() when registering an i2c slave device and handling shared interrupts. A local user can trigger concurrent slave registration and interrupt handling to cause a denial of service.

The issue can result in subsequent registration attempts failing with -EBUSY or in a NULL pointer dereference in the interrupt handler.

1142) NULL pointer dereference (CVE-ID: CVE-2026-80679)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in dasd_release_space() in drivers/s390/block/dasd_ioctl.c when handling a release space operation on a DASD device. A local user can trigger the vulnerable code path to cause a denial of service.

1143) Use-after-free (CVE-ID: CVE-2026-80680)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the amd mp2 i2c platform driver callback handling when i2c_add_adapter() fails during adapter registration. A local user can trigger adapter registration failure and subsequent callback dereference to cause a denial of service.

The stale pointer may be dereferenced from IRQ and system-sleep callbacks after the platform I2C context has been freed.

1144) Use-after-free (CVE-ID: CVE-2026-80681)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in vxlan_xmit() in drivers/net/vxlan/vxlan_core.c when processing packets through route_shortcircuit(). A local user can trigger skb head reallocation and subsequent dereference of a stale ethernet header pointer to cause a denial of service.

1145) NULL pointer dereference (CVE-ID: CVE-2026-80689)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mmiotrace logging functions __trace_mmiotrace_rw() and __trace_mmiotrace_map() when handling mmiotrace events while mmio_trace_array is NULL. A local user can trigger the affected tracing functionality to cause a denial of service.

This can occur before initialization or after the tracing facility has been disabled.

1146) Out-of-bounds write (CVE-ID: CVE-2026-80706)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the application Softing CAN firmware loader staging copy when processing firmware-provided record data for DPRAM staging. A local user can provide a crafted firmware record to cause a denial of service.

The application loader does not bound the staging copy against the mapped DPRAM before copying.

1147) Out-of-bounds write (CVE-ID: CVE-2026-80706)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the generic Softing CAN firmware loader DPRAM copy logic when processing firmware-provided DPRAM addresses and lengths. A local user can supply crafted address and length values to cause a denial of service.

The bounds check uses wrap-prone mixed signed arithmetic for generic DPRAM records.

1148) Out-of-bounds read (CVE-ID: CVE-2026-80706)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in fw_parse() in the Softing CAN firmware loader when parsing a crafted firmware blob. A local user can provide a truncated firmware record to cause a denial of service.

The issue is triggered while processing firmware records composed of a header, payload, and trailing checksum.

1149) Improper Initialization (CVE-ID: CVE-2026-80707)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in j1939_session_fresh_new() in the can j1939 transport component when allocating a receive buffer. A local user can trigger allocation of a buffer containing residual data to disclose sensitive information.

1150) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-80708)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper clearing of sensitive information in _ip_cprb_helper() and cca_clr2cipherkey() when processing clear key import requests. A local user can trigger clear key import operations and expose residual clear key material from reused memory to disclose sensitive information.

The issue affects internal CPRB buffer memory as well as the random EXOR buffer used during the clear key to secure key token import process.

1151) Use-after-free (CVE-ID: CVE-2026-80714)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ipvs connection handling logic when binding synced connections to a destination. A local user can trigger creation and expiry of a crafted synced connection state to cause a denial of service.

The issue occurs when a synced connection inherits the one-packet flag after it is already hashed, which can leave stale hash nodes pointing to a freed struct ip_vs_conn.

1152) Improper locking (CVE-ID: CVE-2026-80715)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in igc_down() when tearing down an AF_XDP zero-copy application abruptly. A local user can abruptly terminate an AF_XDP zero-copy application to cause a denial of service.

The issue occurs because NAPI keeps polling and the network interface may never go down.

1153) Use-after-free (CVE-ID: CVE-2026-80716)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in snd_pcm_drain() and snd_pcm_unlink() in the ALSA PCM subsystem when unlinking a drained or draining linked stream while a drain wait is pending. A local user can trigger stream unlinking to cause a denial of service.

The issue occurs when group membership changes during the wait and the wait ends by signal or timeout, leaving an on-stack wait entry queued on a sleep list.

1154) Out-of-bounds read (CVE-ID: CVE-2026-80717)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in sctp_process_param() when processing a malformed SCTP Adaptation Layer Indication parameter in an INIT chunk. A remote attacker can send a specially crafted SCTP INIT request to disclose sensitive information.

When the malformed parameter is the last parameter in the INIT chunk, four bytes from the receive-buffer tail may be copied into the state cookie returned in the INIT ACK.

1155) Out-of-bounds write (CVE-ID: CVE-2026-80718)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in pcpu_create_chunk() when initializing the populated bitmap for percpu chunks with more than one unit. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because a total backing allocation page count is used to update a bitmap sized only for per-unit page offsets.

1156) Out-of-bounds read (CVE-ID: CVE-2026-80722)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in mac80211 TWT setup handling when processing a received S1G TWT setup frame. A remote attacker can send a specially crafted TWT setup frame with an individual agreement and a truncated parameters block to cause a denial of service.

Broadcast agreements are rejected locally after accessing only req_type.

1157) Out-of-bounds write (CVE-ID: CVE-2026-80731)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in dev_validate_header when validating short link-layer headers after a network device's hard_header_len increases. A local privileged user can trigger zero-padding of a short link-layer header to cause memory corruption.

The affected path is limited to variable-length layer-2 protocols where the header length is at least min_header_len but shorter than hard_header_len.

1158) Use-after-free (CVE-ID: CVE-2026-80732)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in the sl82c105_bridge_revision function of the pata_sl82c105 driver when reading a PCI bridge revision after releasing the PCI device reference. A local user can trigger bridge revision handling to access freed memory.

1159) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80733)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper handling of unsupported socket families in sk_mc_loop() when sending packets through an AF_PACKET socket over a virtual device. A local user can send packets through a raw or packet socket to trigger a kernel warning.

The issue affects non-INET sockets, including AF_PACKET sockets used with virtual devices such as VRF or ipvlan.

1160) Use-after-free (CVE-ID: CVE-2026-80737)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in the AMBA PL011 serial driver's DMA shutdown handling when DMA activity is being terminated. A local user can trigger DMA shutdown while TX callbacks or RX polling remain active to cause memory corruption.

1161) Improper input validation (CVE-ID: CVE-2026-80742)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper input validation in tpacket_fill_skb() in the AF_PACKET subsystem when sending zero-byte packets through a TPACKET ring buffer. A local user can send a zero-byte packet through the TPACKET ring buffer to trigger a kernel warning.

The issue occurs on devices with no hard header.

1162) NULL pointer dereference (CVE-ID: CVE-2026-80743)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization of IRQ handler data in the Xilinx formatter PCM IRQ handlers when an interrupt occurs after IRQ registration and before driver data is set. A local user can trigger an interrupt during device probing to cause a denial of service.

1163) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80744)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel warning.

The vulnerability exists due to improper handling of expected memory allocation failures in nft_flow_rule_offload_abort() in nf_tables_offload when processing a netfilter transaction rollback. A local user can process a netfilter transaction that encounters an -ENOMEM error to cause a kernel warning.

Exploitation requires memory pressure or fault injection to cause the memory allocation failure.

1164) NULL pointer dereference (CVE-ID: CVE-2026-80752)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the psxpad_spi_suspend() function of the psxpad-spi driver when the system suspends. A local user can trigger a system suspend to cause a denial of service.

1165) Out-of-bounds write (CVE-ID: CVE-2026-80754)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect transmitter electrode count assignment in the Synaptics RMI4 F55 driver when F55 sensor detection handles a device with more receiver than transmitter electrodes. A local user can trigger F55 sensor detection to cause a denial of service.

The incorrect transmitter count is propagated to F54 for diagnostic report size calculations.

1166) NULL pointer dereference (CVE-ID: CVE-2026-80756)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in selinux_policy_cancel() when writing a policy during an initial SELinux policy load that fails while building the selinuxfs tree. A local user can write policy data to /sys/fs/selinux/load to cause a denial of service.

1167) Out-of-bounds write (CVE-ID: CVE-2026-80757)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause memory corruption.

The vulnerability exists due to an out-of-bounds heap write in the SELinux security_get_permissions() function when loading a crafted SELinux policy. A local privileged user can load a policy containing a class whose permission count is lower than that of its inherited common to cause memory corruption.

1168) Out-of-bounds read (CVE-ID: CVE-2026-80765)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in mousevsc_on_receive_device_info() in the Hyper-V HID driver when processing SYNTH_HID_INITIAL_DEVICE_INFO messages. A local privileged user can send a short initial device-info message with an oversized HID report descriptor length to cause a denial of service.

Exploitation requires control of the Hyper-V host or backend.

1169) Use-after-free (CVE-ID: CVE-2026-80766)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a use-after-free condition.

The vulnerability exists due to a race condition in the uclogic HID driver's in-range timer teardown when processing pen reports during device removal. An attacker with physical access can send pen reports during device removal to trigger a use-after-free condition.

The freed memory is dereferenced in timer-softirq context.

1170) Use-after-free (CVE-ID: CVE-2026-80767)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the HID sensor custom driver's enable_sensor sysfs attribute handling when writing to the enable_sensor sysfs attribute while the driver is being initialized or removed. A local user can write to the enable_sensor sysfs attribute during this condition to cause a denial of service.

1171) Use-after-free (CVE-ID: CVE-2026-80768)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to a race condition causing a stack-use-after-return write in the FT260 HID driver's I2C read handling when a device response arrives after an I2C read times out. An attacker with physical access can provide a delayed device response containing an attacker-influenced payload to cause memory corruption.

1172) Out-of-bounds read (CVE-ID: CVE-2026-80781)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read memory beyond the bounds of a HID usage array.

The vulnerability exists due to an out-of-bounds read in hid_set_field() when processing an offset for a HID field. An attacker with physical access can attach a HID device that registers a field with fewer usages than the offsets used by picolcd_fb_send_tile() to read memory beyond the bounds of a HID usage array.

The out-of-bounds dereference occurs when CONFIG_DEBUG_FS is enabled during framebuffer deferred-io work.

1173) Use-after-free (CVE-ID: CVE-2026-80782)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to use-after-free in the HID magicmouse driver when processing input reports after HID input-device connection failure. An attacker with physical access can cause a subsequent input report to be processed to cause a denial of service.

The affected execution paths are for USB Magic Mouse 2 and Magic Trackpad 2 devices, where hidraw and hiddev remain claimed.

1174) Stack-based buffer overflow (CVE-ID: CVE-2026-80783)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or memory corruption.

The vulnerability exists due to a stack-based buffer overflow in magicmouse_raw_event() when processing a crafted HID report containing nested DOUBLE_REPORT_ID packets. An attacker with physical access can send a crafted HID report to cause a denial of service or memory corruption.

1175) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-80788)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in nvmet_tcp_map_data() when processing a command containing an oversized SGL. A remote attacker can send a command with an oversized SGL to cause a denial of service.

Systems configured to panic on kernel warnings can panic when the allocation triggers a page-allocator warning.

1176) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-80789)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in nvmet_tcp_map_data() when processing write commands containing non-inline transport SGL data-block descriptors. A remote attacker can submit a crafted NVMe/TCP command with an oversized SGL length to cause a denial of service.

For write commands, the target waits for host data after issuing an R2T response.

1177) Release of invalid pointer or reference (CVE-ID: CVE-2026-80790)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an invalid memory free.

The vulnerability exists due to improper pointer handling in nvmet_fc_alloc_ls_iodlist() when handling request-buffer allocation or response-buffer DMA mapping failures while initializing the LS IOD array. A local user can create a target port under these failure conditions to trigger an invalid memory free.

1178) Use-after-free (CVE-ID: CVE-2026-80792)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or cause a denial of service.

The vulnerability exists due to a use-after-free in ip6_finish_output2() when lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE after reallocating the skb head. A local user can trigger IPv6 packet output through an affected lwtunnel transmission path to disclose sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or cause a denial of service.

1179) Infinite loop (CVE-ID: CVE-2026-80793)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of the effective MTU in ip_do_fragment() when fragmenting IPv4 packets with an effective MTU smaller than the IPv4 header length plus 8 bytes. A remote attacker can send a packet requiring fragmentation over an affected route or device to cause a denial of service.

The issue can occur while forwarding packets to a device with an MTU of 20 bytes.

1180) Use of Uninitialized Variable (CVE-ID: CVE-2026-80794)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized stack memory in the RF discover and RF interface activated notification handlers when processing notifications with zero-length RF technology-specific parameters. A remote attacker can cause the kernel to process a notification reporting zero-length RF technology-specific parameters to disclose sensitive information.

The copied target data is exposed to user space through NFC_CMD_GET_TARGET.

1181) Out-of-bounds write (CVE-ID: CVE-2026-80795)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a slab out-of-bounds write.

The vulnerability exists due to a missing bounds check in nci_target_auto_activated() when processing RF_INTF_ACTIVATED_NTF notifications after repeated discovery cycles. A local user can trigger repeated NFC discovery cycles with auto-activated targets to cause a slab out-of-bounds write.

The target list remains populated when RF_DISCOVER_RSP re-enters NCI_DISCOVERY.

1182) Out-of-bounds read (CVE-ID: CVE-2026-80796)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read kernel memory beyond activation parameter data.

The vulnerability exists due to improper bounds checking in the NCI activation parameter extractors when processing a crafted NCI RF_INTF_ACTIVATED_NTF notification. A remote attacker can send a crafted NCI notification with an inconsistent inner length byte to read kernel memory beyond activation parameter data.

1183) Memory leak (CVE-ID: CVE-2026-80797)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to leak memory.

The vulnerability exists due to improper cleanup of queued fragment skbs in pn53x_common_clean() when a device is removed while transmit fragments are queued. An attacker with physical access can remove a device while transmit fragments are queued to leak memory.

1184) Out-of-bounds read (CVE-ID: CVE-2026-80798)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read memory out of bounds.

The vulnerability exists due to insufficient length validation in the LLCP receive path when processing an LLCP PDU shorter than the LLCP header. A remote attacker can send a crafted undersized LLCP PDU to read memory out of bounds.

LLCP link activation occurs automatically after NFC-DEP.

1185) Out-of-bounds read (CVE-ID: CVE-2026-80799)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory or cause a denial of service.

The vulnerability exists due to improper bounds checking and integer wraparound in the nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() functions when processing remote LLCP general bytes. A remote attacker can send malformed TLV data to trigger out-of-bounds reads or infinite parsing loops.

1186) Out-of-bounds read (CVE-ID: CVE-2026-80800)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in nfc_llcp_connect_sn() when processing received CONNECT and CC PDUs. A remote attacker can send a malformed NFC LLCP PDU to read out-of-bounds memory.

LLCP link activation occurs automatically after NFC-DEP.

1187) Out-of-bounds read (CVE-ID: CVE-2026-80801)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in microread_target_discovered() when processing malformed NFC target discovery payloads. A remote attacker can send a malformed target discovery payload to read out-of-bounds memory.

1188) Memory leak (CVE-ID: CVE-2026-80802)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper memory management in fdp_nci_i2c_read() when processing multiple data packets in one call. An attacker with physical access can send two data packets in one call to cause a denial of service.

1189) Out-of-bounds read (CVE-ID: CVE-2026-80802)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper validation of a device-reported length in fdp_nci_i2c_read() when processing a packet with a declared length below the minimum frame size. An attacker with physical access can provide a packet with a declared length below the minimum frame size to cause a denial of service.

1190) Stack-based buffer overflow (CVE-ID: CVE-2026-80802)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper validation of a device-reported length in fdp_nci_i2c_read() when processing a packet with an oversized declared length. An attacker with physical access can provide a packet with an oversized declared length to cause a denial of service.

1191) Stack-based buffer overflow (CVE-ID: CVE-2026-80803)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt stack memory.

The vulnerability exists due to improper length validation in the digital_in_recv_sensf_res() function when processing an NFC-F device response. A remote attacker can send an oversized SENSF_RES response to corrupt stack memory.

1192) Out-of-bounds read (CVE-ID: CVE-2026-80805)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in xfs_attr3_leaf_verify_entry() when validating crafted XFS attribute entries. A local user can provide a crafted name index to read out-of-bounds memory.

1193) Missing Encryption of Sensitive Data (CVE-ID: CVE-2026-80806)

CWE-ID: CWE-311 - Missing Encryption of Sensitive Data

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause sensitive data to be stored without encryption.

The vulnerability exists due to incorrect initialization order of encryption flags in the ext4 __ext4_new_inode() function when creating a new encrypted regular file on an ext4 filesystem mounted with dax=always. A local user can create a new encrypted regular file and write data to it to cause sensitive data to be stored without encryption.

1194) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-80807)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause list corruption.

The vulnerability exists due to improper range validation in the nilfs2 GC ioctl when processing crafted virtual block descriptors. A local user can submit a crafted GC ioctl request to cause list corruption.

The crafted descriptor can specify an invalid virtual block number or offset that results in a page index of ULONG_MAX.

1195) Infinite loop (CVE-ID: CVE-2026-80808)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite retry loop in ext4_xattr_block_set() when reusing a saturated extended attribute cache entry on a corrupted filesystem. A local user can trigger repeated selection of the unusable cache entry to cause a denial of service.

Concurrent rmdir callers can remain blocked while the spinning task holds the parent directory's i_rwsem.

1196) Reachable assertion (CVE-ID: CVE-2026-80809)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing metadata reservation in the OCFS2 extended attribute allocation code when setting a large extended attribute value on a fragmented filesystem for a file that already has an external extended attribute block. A local user can set a large extended attribute value to cause a denial of service.

1197) Out-of-bounds read (CVE-ID: CVE-2026-80812)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to improper validation in snd_dummy_probe() of the ALSA dummy driver when a platform device is manually bound through the sysfs interface with an invalid card index. A local user can bind a platform device with a card index of -1 to cause an out-of-bounds read.

1198) Out-of-bounds read (CVE-ID: CVE-2026-80814)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read out-of-bounds data.

The vulnerability exists due to an integer overflow in the rndis_rx_fixup() function when processing a crafted RNDIS message received over USB. An attacker with physical access can supply a crafted RNDIS message with overflowing data offset and length values to read out-of-bounds data.

1199) NULL pointer dereference (CVE-ID: CVE-2026-80819)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper synchronization in the RFCOMM deferred setup acceptance path when processing a recvmsg call after a remote DISC frame is received for a deferred data link connection. A remote attacker can send a DISC frame to a deferred RFCOMM data link connection to cause a denial of service.

1200) Out-of-bounds read (CVE-ID: CVE-2026-80823)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose kernel memory or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the st21nfca_tm_recv_atr_req() and st21nfca_tm_send_atr_res() ATR_REQ handling path when handling ATR_REQ frames whose declared length exceeds the received frame length. A remote attacker can send a short ATR_REQ frame with an oversized declared length to disclose kernel memory or cause a denial of service.

Exploitation requires an RF peer.

1201) Use-after-free (CVE-ID: CVE-2026-80824)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in usbdev_release() in usbfs when draining completed asynchronous URBs after a USB device is disconnected. A local user can mmap a usbfs device node and submit an asynchronous URB using a mapped buffer before unmapping and closing the associated file descriptor to cause a denial of service.

1202) Use-after-free (CVE-ID: CVE-2026-80826)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to use-after-free in c67x00_add_iso_urb() when processing an isochronous URB whose final packet encounters TD creation failure. A local user can submit such an isochronous URB to cause a use-after-free condition.

1203) Out-of-bounds read (CVE-ID: CVE-2026-80827)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read memory out of bounds.

The vulnerability exists due to improper length validation in the option_instat_callback interrupt URB callback when processing a short interrupt IN packet from a USB device. An attacker with physical access can provide a USB device that sends a crafted short interrupt IN packet to read memory out of bounds.

1204) Improper handling of exceptional conditions (CVE-ID: CVE-2026-80828)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper handling of exceptional conditions in the ALSA USB-audio usb_audio_resume() function when processing system-resume failures. An attacker with physical access can trigger a system resume while a USB audio component resume operation fails to cause a denial of service.

The condition applies to system-resume errors; runtime-resume errors follow a distinct error path.

1205) Out-of-bounds write (CVE-ID: CVE-2026-80829)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in snd_usbmidi_novation_output() when handling USB MIDI output from a device with an undersized bulk OUT endpoint. An attacker with physical access can connect a malicious USB device that advertises a one-byte bulk OUT endpoint to cause memory corruption.

1206) Use-after-free (CVE-ID: CVE-2026-80830)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a race condition in usb_wakeup_notification() when an xHCI IRQ invocation occurs concurrently with hub_disconnect(). A local user can trigger concurrent wakeup notification and device disconnection activity to trigger a use-after-free condition.

1207) Incorrect calculation (CVE-ID: CVE-2026-80831)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause encryption and decryption operations to process an incorrect number of bytes.

The vulnerability exists due to improper use of an unmapped DMA scatterlist length in mxs_dcp_aes_block_crypt() when processing source scatterlists. A local user can trigger processing of affected source scatterlists to cause encryption and decryption operations to process an incorrect number of bytes.

The issue occurs when CONFIG_NEED_SG_DMA_LENGTH is enabled.

1208) Out-of-bounds read (CVE-ID: CVE-2026-80832)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect CCM authentication tags.

The vulnerability exists due to buffer underallocation in qce_aead_ccm_prepare_buf_assoclen() when preparing CCM associated data. A local user can submit a CCM request with associated data to cause incorrect CCM authentication tags.

1209) Out-of-bounds read (CVE-ID: CVE-2026-80833)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the sun8i-ss PRNG generate function when updating the PRNG seed after generating random data. A local user can invoke the PRNG generate function to read out-of-bounds memory.

The issue is limited to systems with sun8i-ss PRNG support enabled.

1210) Use-after-free (CVE-ID: CVE-2026-80833)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to failure to stop a DMA operation after an interrupted wait in the sun8i-ss PRNG generate function when a PRNG generation operation is interrupted by a signal. A local user can interrupt a pending PRNG generation operation by sending a signal to cause a use-after-free.

The issue is limited to systems with sun8i-ss PRNG support enabled.

1211) Use-after-free (CVE-ID: CVE-2026-80834)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the sun8i-ce crypto_rng interface generate function when an in-progress DMA operation is interrupted by a signal. A local user can interrupt an in-progress PRNG generation operation with a signal to trigger a use-after-free condition.

1212) Out-of-bounds write (CVE-ID: CVE-2026-80840)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds write.

The vulnerability exists due to improper initialization of the IPv4 control block in the IPv6 Segment Routing decapsulation path when processing a specially crafted IPv6 packet containing an encapsulated IPv4 TCP SYN packet. A remote attacker can send a specially crafted packet with controlled IPv6 extension-header and IPv4 option data to cause an out-of-bounds write.

1213) Use-after-free (CVE-ID: CVE-2026-80842)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the Linux bridge multicast handling for master VLANs when processing IGMP traffic during master VLAN teardown. A remote attacker can send IGMP traffic to the bridge device while a master VLAN is being removed to cause memory corruption.

1214) Memory leak (CVE-ID: CVE-2026-80843)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in xfrm_state_construct() when constructing an XFRM state with a truncated authentication algorithm. A local user can trigger XFRM state construction using a truncated authentication algorithm to cause a denial of service.

The issue occurs when the selected authentication algorithm has no sadb_alg_id, such as cmac(aes).

1215) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-80844)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of routing header segments_left values in ipv6_rearrange_rthdr() when processing raw IPv6 HDRINCL packets with a segments_left value larger than the number of addresses described by hdrlen. A local user can send a crafted packet with an oversized segments_left value to cause an out-of-bounds memory access.

1216) NULL pointer dereference (CVE-ID: CVE-2026-80846)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the handle_esp function when processing queued ESP-in-TCP data after its ingress device has been removed. A remote attacker can send ESP-in-TCP records to cause a denial of service.

The condition can occur during veth or network namespace teardown.

1217) Use-after-free (CVE-ID: CVE-2026-80848)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the espintcp_close routine when closing espintcp sockets while queued reinjection work is running. A local user can race socket closure against queued reinjection work to trigger a use-after-free condition.

1218) Use-after-free (CVE-ID: CVE-2026-80854)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the USB gadget f_tcm session teardown path when concurrently unlinking the last LUN and removing a nexus. A local user can overlap last-LUN removal with nexus removal to cause a denial of service.

1219) Improper locking (CVE-ID: CVE-2026-80855)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in fuse_open() in fs/fuse/file.c when fuse_dax_break_layouts() fails after a signal interrupts the wait for busy DAX pages to drain during an O_TRUNC open of a DAX-enabled file. A local user can trigger the affected open operation to cause a denial of service.

The stale lock can stall later faults or truncates on the same file.

1220) Improper locking (CVE-ID: CVE-2026-80856)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock release in fuse_do_setattr() when processing a DAX truncate operation that requires a writeback flush. A local user can initiate such a setattr operation when the writeback flush fails to cause a denial of service.

1221) Out-of-bounds write (CVE-ID: CVE-2026-80863)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in free_rd_atomic_resources() in the RXE RDMA driver when modifying a queue pair's max_dest_rd_atomic setting. A local user can modify a queue pair's max_dest_rd_atomic setting to cause a denial of service.

1222) Improper access control (CVE-ID: CVE-2026-80867)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to conduct DMA attacks.

The vulnerability exists due to improper access control in the Alpha-specific pci_mmap_resource() function when mapping PCI BARs while kernel lockdown is enabled. A local user can map a PCI BAR to conduct DMA attacks.

1223) Incorrect calculation (CVE-ID: CVE-2026-80875)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect TCP state handling.

The vulnerability exists due to an incorrect transport-header offset calculation in the IPVS TCP state lookup when processing IPv6 packets with extension headers. A remote attacker can send a crafted IPv6 packet with extension headers to cause incorrect TCP state handling.

1224) Incorrect calculation (CVE-ID: CVE-2026-80876)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect ring-buffer event data length reporting.

The vulnerability exists due to an improper length calculation in ring_buffer_event_length() when handling small ring-buffer events on architectures with forced 8-byte alignment. A local user can trigger processing of small ring-buffer events to cause incorrect ring-buffer event data length reporting.

The issue was observed on a riscv64 kernel with CONFIG_HAVE_64BIT_ALIGNED_ACCESS enabled.

1225) Memory leak (CVE-ID: CVE-2026-80877)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource management in afs_update_cell() when processing a cell update with an empty server list. A local user can trigger processing of an empty server list during a cell update to cause a memory leak.

1226) Deadlock (CVE-ID: CVE-2026-80879)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a circular locking dependency in ocfs2_dio_end_io_write when completing direct I/O writes involving unwritten extents and orphan cleanup. A local user can perform filesystem operations that trigger conflicting lock acquisition to cause a denial of service.

1227) Race condition (CVE-ID: CVE-2026-80880)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a race condition.

The vulnerability exists due to a race condition in implicit ODP memory region re-registration when reregistering an implicit ODP memory region without specifying a translation. A local user can reregister an implicit ODP memory region to trigger a race condition.

The race involves implicit child mkeys accessing the memory region's protection domain.

1228) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80881)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause OCFS2 to process metadata that previously failed validation.

The vulnerability exists due to improper handling of validation failures in ocfs2_read_blocks() when reusing buffer heads returned by sb_getblk(). A local user can trigger reuse of buffer heads retaining BH_Uptodate status after failed validation to cause OCFS2 to process metadata that previously failed validation.

1229) Race condition (CVE-ID: CVE-2026-80886)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the MSM serial driver console UART when userspace writes to the TTY device concurrently with kernel console output. A local user can write to the TTY device while the kernel printk path reconfigures the UART controller to cause a denial of service.

The issue is most likely to occur during system startup or shutdown.

1230) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-80888)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource release in ttm_prime_fd_to_handle() in the vmwgfx DRM driver when importing a non-vmwgfx PRIME file descriptor through the DRM_VMW_GB_SURFACE_REF or DRM_VMW_GB_SURFACE_REF_EXT path. A local user can pass a non-vmwgfx PRIME file descriptor to cause a denial of service.

1231) Insufficient Session Expiration (CVE-ID: CVE-2026-80890)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to restart an SCTP association.

The vulnerability exists due to improper validation of cookie expiration in sctp_unpack_cookie() when processing an expired State Cookie for an existing association with mismatched Verification Tags. A remote attacker can replay an expired State Cookie with mismatched Verification Tags to restart an SCTP association.

1232) Memory leak (CVE-ID: CVE-2026-80902)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper reclamation of active descriptors in the sun6i DMA driver's DMA termination handling when terminating DMA transfers. A local user can terminate DMA transfers to cause a memory leak.

Non-cyclic descriptors and their linked-list item chains are affected.

1233) Incorrect behavior order (CVE-ID: CVE-2026-80906)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect transport header handling.

The vulnerability exists due to incorrect behavior order in packet_parse_headers() when processing a VLAN-tagged frame. A remote attacker can send a VLAN-tagged frame to cause incorrect transport header handling.

1234) Integer overflow (CVE-ID: CVE-2026-80908)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an integer overflow in DPB size calculations.

The vulnerability exists due to integer overflow in the amdgpu UVD message decoder when processing a UVD message with dimensions exceeding 4096. A local user can submit a UVD message with oversized dimensions to trigger an integer overflow in DPB size calculations.

1235) Integer overflow (CVE-ID: CVE-2026-80909)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an integer overflow during minimum DPB size calculation.

The vulnerability exists due to improper validation of the H.265 reference count in the AMDGPU UVD message decoder when decoding UVD messages. A local user can submit a UVD message with an invalid number of H.265 references to cause an integer overflow during minimum DPB size calculation.

1236) Type Confusion (CVE-ID: CVE-2026-80910)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access of an enumerated control value through an integer union member in the lpass-wsa-macro codec driver when reading affected enumerated controls. A local user can read an affected control to cause a denial of service.

The issue occurs on 64-bit kernels with CONFIG_SND_CTL_DEBUG enabled.

1237) NULL pointer dereference (CVE-ID: CVE-2026-80912)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in security_get_classes() when processing an SELinux policy with an unclaimed class value. A local user can provide a policy with sparse class values to cause a denial of service.

1238) NULL pointer dereference (CVE-ID: CVE-2026-80913)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the SELinux boolean value mapping array when processing a policy image that declares undefined boolean values. A local privileged user can load a crafted SELinux policy to cause a denial of service.

1239) Memory corruption (CVE-ID: CVE-2026-80916)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of allocation failure in KCOV initialization and remote-start handling when remote KCOV collection is initiated after initialization buffer allocation fails. A local user can invoke remote KCOV collection from a non-task context to cause a denial of service.

Out-of-bounds access requires the configured remote coverage size to be smaller than CONFIG_KCOV_IRQ_AREA_SIZE.

1240) Race condition (CVE-ID: CVE-2026-80916)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data corruption.

The vulnerability exists due to a race condition in the KCOV remote coverage state handling when nested softirq preemption occurs during remote KCOV collection. A local user can trigger nested softirq preemption during remote KCOV collection to cause data corruption.

The issue affects PREEMPT_RT kernels.

1241) NULL pointer dereference (CVE-ID: CVE-2026-80917)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the generic PCI host CAM operations when enumerating PCI buses on 32-bit CAM systems. A local user can trigger PCI configuration-space access during bus enumeration to cause a denial of service.

Only 32-bit hosts using the "pci-host-cam-generic" compatible are affected.

1242) Type Confusion (CVE-ID: CVE-2026-80918)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose kernel pointer information.

The vulnerability exists due to type confusion in item_udata() and item_sdata() in the HID core when processing long-format HID descriptor items. An attacker with physical access can connect a HID device containing a crafted long-format report size item to disclose kernel pointer information.

The issue affects hid_scan_report(); hid_parse_collections() stops processing when it encounters a long item.

1243) Improper access control (CVE-ID: CVE-2026-80921)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access a device that is no longer available.

The vulnerability exists due to improper access control in KVM s390 VSIE APCB shadowing when shadowing crypto access bits from a format 0 APCB. A local user can use stale crypto access bits to access a device that is no longer available.

The issue affects nested guest environments.

1244) Use-after-free (CVE-ID: CVE-2026-80923)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a use-after-free.

The vulnerability exists due to a dangling pointer in the xHCI debug tty driver when tty driver registration fails and the module is subsequently unloaded. A local privileged user can unload the module after a tty driver registration failure to trigger a use-after-free.

1245) Use-after-free (CVE-ID: CVE-2026-80928)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free of struct cred.

The vulnerability exists due to a use-after-free in smack_file_send_sigiotask() when accessing the credentials of another task during signal delivery. A local user can trigger the affected credential access during a concurrent credential change to trigger a use-after-free of struct cred.

1246) Improper handling of exceptional conditions (CVE-ID: CVE-2026-80930)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an IRQ enable/disable imbalance.

The vulnerability exists due to improper handling of exceptional conditions in the TPM I2C Nuvoton driver's i2c_nuvoton_wait_for_stat() function when waiting for a TPM status interrupt times out or is interrupted. A local user can cause a wait to time out or be interrupted to cause an IRQ enable/disable imbalance.

1247) Out-of-bounds write (CVE-ID: CVE-2026-80931)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause an out-of-bounds write.

The vulnerability exists due to improper bounds checking in w1_f19_i2c_master_transfer() in the DS28E17 1-Wire-to-I2C bridge driver when handling an I2C_M_RECV_LEN read with an oversized device-controlled length. An attacker with physical access can supply an oversized length byte through a downstream I2C device to cause an out-of-bounds write.

1248) Use-after-free (CVE-ID: CVE-2026-80932)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to improper workqueue synchronization in virtio_vsock_remove() when removing a virtio vsock device. A local user can trigger device removal while dependent work items are queued to cause a use-after-free condition.

The race involves tx_work, send_pkt_work, and rx_work.

1249) Deadlock (CVE-ID: CVE-2026-80938)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in mt7615_suspend() when synchronously canceling mac_work while holding the mt76 mutex. A local user can initiate system suspend while mac_work is running to cause a denial of service.

1250) Memory leak (CVE-ID: CVE-2026-80941)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to failure to free memory in rtw_txq_push_skb() when handling a failed HCI transmission. A local user can trigger the transmission path during an HCI write failure to cause a denial of service.

1251) Expired pointer dereference (CVE-ID: CVE-2026-80944)

CWE-ID: CWE-825 - Expired pointer dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an expired pointer dereference in the mwifiex synchronous command response handler when a synchronous command wait is interrupted before a late firmware response is processed. A local user can interrupt a synchronous command wait to cause a denial of service.

The issue was observed during repeated association and disassociation cycles.

1252) Memory leak (CVE-ID: CVE-2026-80949)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of memory in brcmf_sdio_read_control() when handling error paths during control-frame reads. A local user can trigger the affected error paths to cause a denial of service.

1253) Out-of-bounds write (CVE-ID: CVE-2026-80951)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to write beyond the bounds of the IBI pool.

The vulnerability exists due to improper bounds checking in svc_i3c_master_handle_ibi() when processing in-band interrupt payloads from an I3C device. An attacker with physical access can send an IBI payload larger than the requested maximum payload length to write beyond the bounds of the IBI pool.

1254) Use-after-free (CVE-ID: CVE-2026-80952)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel stack contents and cause a use-after-free.

The vulnerability exists due to improper device descriptor lifetime management in i3c_master_unregister_i3c_devs() when unregistering I3C devices. A local user can trigger device unregistration while a modalias is generated to disclose kernel stack contents and cause a use-after-free.

A racing modalias operation can observe a NULL device descriptor and use an uninitialized stack i3c_device_info structure.

1255) NULL pointer dereference (CVE-ID: CVE-2026-80963)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the dm-stat_free cleanup function when freeing dm-stats data after per-cpu data allocation fails. A local user can trigger a failed per-cpu data allocation to cause a denial of service.

1256) Out-of-bounds read (CVE-ID: CVE-2026-80964)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the ALSA virmidi driver probe function when manually binding a device through the sysfs interface with an invalid card index. A local user can manually bind a device with an invalid card index to perform an out-of-bounds read.

1257) Improper Validation of Array Index (CVE-ID: CVE-2026-80965)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds access.

The vulnerability exists due to improper validation of a card index in the ALSA serial-u16550 driver's snd_serial_probe function when manually binding a device through the sysfs interface. A local user can bind a device with an invalid card index to cause an out-of-bounds access.

1258) Improper Validation of Array Index (CVE-ID: CVE-2026-80966)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds access.

The vulnerability exists due to improper validation of an array index in the ALSA portman2x4 driver when binding the driver through sysfs with a negative card index. A local user can supply a negative card index to perform an out-of-bounds access.

1259) Improper initialization (CVE-ID: CVE-2026-80967)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization of mutexes in the pcxhr_probe() function when handling an early interrupt during device probe. A local user can trigger an early interrupt during device probe to cause a denial of service.

1260) Improper Validation of Array Index (CVE-ID: CVE-2026-80968)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds access.

The vulnerability exists due to improper validation of an array index in the ALSA mts64 driver's snd_mts64_probe function when binding a device through sysfs with a negative card index. A local user can provide a negative card index to cause an out-of-bounds access.

1261) Improper Validation of Array Index (CVE-ID: CVE-2026-80969)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of an array index in the ALSA mpu401 driver probe routine when manually binding a device through the sysfs interface with an invalid card index. A local user can set an invalid card index to cause an out-of-bounds memory access.

1262) Use-after-free (CVE-ID: CVE-2026-80971)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a use-after-free condition.

The vulnerability exists due to use-after-free in the ALSA bcd2000 driver's URB handling when a BCD2000 USB device is disconnected while a rawmidi substream remains open. An attacker with physical access can disconnect the device while the substream remains open to cause a use-after-free condition.

1263) Improper Validation of Array Index (CVE-ID: CVE-2026-80972)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds memory access.

The vulnerability exists due to improper validation of a card index in the ALSA aloop driver's loopback_probe function when manually binding a device through the sysfs interface. A local user can provide an invalid card index to perform an out-of-bounds memory access.

1264) Out-of-bounds read (CVE-ID: CVE-2026-80973)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose kernel memory.

The vulnerability exists due to an out-of-bounds read in usb6fire_comm_receiver_handler() when processing MIDI events from a connected USB device. An attacker with physical access can provide a MIDI event with an excessive length value to disclose kernel memory.

The receiver is submitted during device probing, and forwarding data through the rawmidi read path requires an open MIDI input substream.

1265) Out-of-bounds read (CVE-ID: CVE-2026-80976)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to stale IPv6 control block state in the decap_and_validate() function of the seg6 local processing component when processing a decapsulated IPv6 packet through an End.DX6 or End.DT6 route. A local user can install a local SID and inject a crafted outer IPv6 packet to cause an out-of-bounds read.

The outer packet contains Hop-by-Hop and Destination Options headers followed by an SRH and a minimal inner IPv6 packet.

1266) Use-after-free (CVE-ID: CVE-2026-80977)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to improper handling of shared zerocopy state in skb_tx_error() when processing cloned socket buffers. A remote attacker can trigger processing of cloned socket buffers to corrupt memory.

The issue can be reached when Open vSwitch processes a non-last OVS_ACTION_ATTR_RECIRC action, the clone encounters a flow miss, and a later local ESP delivery decrypts data in place.

1267) Integer overflow (CVE-ID: CVE-2026-80978)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause skb header offsets to wrap.

The vulnerability exists due to an integer overflow in IP tunnel device headroom configuration when configuring a stack of user-created IP tunnel devices. A local user can create a stacked tunnel-device configuration with excessive headroom to cause skb header offsets to wrap.

The affected skb header offsets use a 16-bit representation.

1268) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-80983)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in smc_switch_conns() when handling connection switches during SMC link failover. A local user can initiate a connection switch during link failover to cause a denial of service.

The target link must go down or the connection must be killed while the switch is in progress.

1269) Memory leak (CVE-ID: CVE-2026-80987)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak memory.

The vulnerability exists due to improper error handling in the NTB transport transmit queue when submitting an oversized transmit buffer. A local user can submit an oversized transmit buffer to leak memory.

1270) Memory leak (CVE-ID: CVE-2026-80988)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in ntb_transport_tx_enqueue() when transmitting packets while the QP link is down. A local user can submit packets during the link-down condition to cause a denial of service.

1271) Use-after-free (CVE-ID: CVE-2026-80994)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Open vSwitch flow deletion handling code when processing flow deletion commands. A local user can issue a flow deletion command during a race window to cause a denial of service.

1272) Integer underflow (CVE-ID: CVE-2026-81000)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write packet data outside allocated memory.

The vulnerability exists due to an integer underflow in TUN and TAP interface handling in tun_get_user() when processing an oversized headroom request propagated by an OVS port. A local user can configure an OVS port to propagate an oversized headroom request to a TUN or TAP device to write packet data outside allocated memory.

1273) Use-after-free (CVE-ID: CVE-2026-81001)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sl_sync() in the SLIP driver when opening a SLIP line discipline concurrently with SLIP device teardown. A local user can trigger a race between SLIP device opening and teardown to cause a denial of service.

1274) Out-of-bounds write (CVE-ID: CVE-2026-81002)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in xdp_convert_zc_to_xdp_frame() when processing an AF_XDP zero-copy packet redirected through cpumap. A local user can submit a crafted AF_XDP zero-copy packet to cause a denial of service.

1275) Improper access control (CVE-ID: CVE-2026-81003)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to inject data into existing AF_IUCV sockets and cause a denial of service.

The vulnerability exists due to improper ingress device validation in afiucv_hs_rcv() socket selection when processing a raw ETH_P_AF_IUCV frame received on a network device. A local user can send a crafted raw ETH_P_AF_IUCV frame through its loopback device to inject data into existing AF_IUCV sockets and cause a denial of service.

Exploitation requires CAP_NET_RAW in an unprivileged user and network namespace.

1276) NULL pointer dereference (CVE-ID: CVE-2026-81005)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown state management in the IPMI message handler failed-registration rollback path when asynchronous redo_bmc_reg work retries BMC device-ID probing after a failed registration. A local user can cause BMC device-ID retrieval to fail and trigger a NULL pointer dereference to cause a denial of service.

The issue occurs after the lower driver's shutdown callback has cleared the SI state machine data.

1277) Use of Uninitialized Variable (CVE-ID: CVE-2026-81007)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized stack memory.

The vulnerability exists due to improper length validation in the ipmb_write() function when writing a zero or short IPMB message. A local user can write a zero or short IPMB message to disclose uninitialized stack memory.

1278) Use-after-free (CVE-ID: CVE-2026-81008)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to use-after-free in icc_get() and of_icc_get_by_index() when handling a failed dynamic allocation of a path name. A local user can invoke subsequent interconnect path operations to cause memory corruption.

1279) Out-of-bounds write (CVE-ID: CVE-2026-81017)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read from and write to memory out of bounds.

The vulnerability exists due to improper bounds checking in cros_ec_sensorhub_ring_handler() when processing EC-reported FIFO events. A local user can trigger processing of an EC FIFO event containing an out-of-range sensor number to read from and write to memory out of bounds.

1280) Use-after-free (CVE-ID: CVE-2026-89440)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the via-sdmmc card-detect interrupt handler and carddet_work when handling a card-detect interrupt after mmc_add_host() fails. A local user can trigger card-detect interrupt handling against a freed host object to cause a denial of service.

1281) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-89444)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in the dell-wmi-sysman set_attribute() function when setting BIOS attributes. A local user can cause a BIOS attribute request buffer containing a plaintext administrator password to be logged to disclose sensitive information.

1282) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89456)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to receive zeroed data for unread portions of a request.

The vulnerability exists due to improper handling of partial-completion length in dasd_default_erp_postaction() when recovering a partially completed ESE read through the ERP chain. A local user can issue a read request that is partially completed and recovered through the ERP chain to receive zeroed data for unread portions of a request.

1283) NULL pointer dereference (CVE-ID: CVE-2026-89457)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in s390 DASD sysfs discipline callbacks when reading world-readable sysfs attributes during device initialization. A local user can read a sysfs attribute before private device data is allocated to trigger a kernel panic and cause a denial of service.

1284) Unchecked Return Value (CVE-ID: CVE-2026-89458)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an unchecked return value in dasd_int_handler when handling an NRF read of an unallocated ESE track. A local user can trigger a failed ESE read that is completed successfully to disclose sensitive information.

A failed sense-data parse or a current track outside the requested range can leave destination pages untouched.

1285) Race condition (CVE-ID: CVE-2026-89461)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause the polling callback to continue accessing the fuel gauge after system suspend.

The vulnerability exists due to improper synchronization in the max17040 fuel-gauge driver's suspend handler when system suspend races with the polling callback. A remote attacker can cause system suspend to race with the polling callback to cause the polling callback to continue accessing the fuel gauge after system suspend.

The polling work requeues itself after each poll.

1286) Use-after-free (CVE-ID: CVE-2026-89463)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to use-after-free in the ucs1002 health_poll delayed work when unbinding the ucs1002 driver while health polling work is queued. A local privileged user can cause the driver to be unbound while health polling work is queued to cause a denial of service.

The delayed work can reschedule itself while the chip reports a bad-health condition.

1287) Use-after-free (CVE-ID: CVE-2026-89464)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to use-after-free in the twl4030_charger driver's bci work handlers when removing the device while a worker is pending. A local user can trigger device removal while a worker is pending to cause a use-after-free condition.

The USB transceiver notifier can reschedule work after device removal returns.

1288) Use-after-free (CVE-ID: CVE-2026-89469)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to improper synchronization in lp8727_release_irq() when the IRQ handler queues delayed work during IRQ release. A local user can trigger a race between IRQ handling and IRQ release to cause a use-after-free condition.

1289) Out-of-bounds write (CVE-ID: CVE-2026-89470)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the cros_usbpd-charger driver probe when processing a raw charger port count returned by the embedded controller. An attacker with physical access can cause the embedded controller to report an inaccurate port count to cause memory corruption.

The embedded controller can report a port count of up to 255.

1290) Out-of-bounds write (CVE-ID: CVE-2026-89471)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in cros_usbpd_charger_probe() in the cros_usbpd-charger driver when processing EC-reported USB PD and charger port counts. A local privileged user can cause a compromised EC to report port counts exceeding the fixed ports[] array capacity to corrupt kernel memory.

The ports[] array contains eight entries.

1291) Use-after-free (CVE-ID: CVE-2026-89474)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the bq256xx charger driver's usb_work handler when queued usb_work executes during device cleanup. A local user can trigger device cleanup while usb_work is queued to cause a denial of service.

1292) Use-after-free (CVE-ID: CVE-2026-89475)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the bq24257 charger driver when device removal races with the STAT-pin interrupt handler. A local user can cause the interrupt handler to reschedule delayed work during device removal to cause a denial of service.

The issue applies when input-current-limit autosetting is enabled.

1293) Integer underflow (CVE-ID: CVE-2026-89476)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an integer underflow.

The vulnerability exists due to improper tracking of outstanding stream reconfiguration request parameters in SCTP stream reconfiguration response handling when processing duplicate RECONF responses. A remote attacker can send duplicate RECONF responses to cause an integer underflow.

A cached RECONF chunk containing multiple request parameters must have another parameter still outstanding.

1294) NULL pointer dereference (CVE-ID: CVE-2026-89477)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in SCTP stream reconfiguration request handling when processing specially crafted SCTP RECONF chunks. A remote attacker can send a specially crafted SCTP RECONF packet to cause a denial of service.

A RECONF chunk containing incoming SSN reset, outgoing SSN reset, and response parameters, or two RECONF chunks in one packet, can trigger the issue.

1295) Use-after-free (CVE-ID: CVE-2026-89478)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to access freed memory.

The vulnerability exists due to a use-after-free in the SCTP input queue when processing a DATA chunk after an authenticated ASCONF DEL-IP removes its transport. A remote user can cause a delayed SACK to read the freed transport's state to access freed memory.

1296) Use-after-free (CVE-ID: CVE-2026-89479)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access freed memory.

The vulnerability exists due to use-after-free in the SCTP endpoint receive loop when processing a specially crafted SCTP packet containing bundled chunks. A remote attacker can send an SCTP packet that deletes an association before subsequent chunks are processed to access freed memory.

Exploitation requires the packet to be processed from the socket backlog in task context.

1297) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-89480)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper validation of the received data length in the NVMe/TCP host driver when processing a short C2HData PDU from an NVMe/TCP controller. A remote attacker can respond to a read request with fewer bytes than requested to disclose sensitive information.

1298) Out-of-bounds write (CVE-ID: CVE-2026-89482)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of C2HData requests in the NVMe/TCP receive path when handling C2HData for a WRITE_ZEROES command with a residual iterator on the same tag. A remote attacker can send a C2HData request to trigger a wild memory write and cause a denial of service.

1299) Use of uninitialized resource (CVE-ID: CVE-2026-89483)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the NVMe discard fallback page when processing discard commands. A local user can trigger a discard command that causes uninitialized DSM payload data to be sent to the controller to disclose sensitive information.

Exploitation requires the discard-range allocation to fail under memory pressure.

1300) Use-after-free (CVE-ID: CVE-2026-89485)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the lockd nlm_traverse_files() file traversal routine when a concurrent nlm_release_file() frees the saved next file while nlm_file_mutex is dropped. A local user can trigger concurrent file release during file traversal to trigger a use-after-free condition.

1301) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89487)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify page-cache data.

The vulnerability exists due to improper handling of zero-copy packet buffer flags in the Open vSwitch datapath when a failed USERSPACE upcall is followed by local ESP-in-UDP delivery. A local user can trigger a failed USERSPACE upcall followed by local ESP-in-UDP delivery to modify page-cache data.

Exploitation requires a MSG_ZEROCOPY packet carrying page-cache fragments.

1302) Use-after-free (CVE-ID: CVE-2026-89488)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a slab use-after-free.

The vulnerability exists due to a race condition leading to use-after-free in the Open vSwitch conntrack limit state when tearing down a network namespace while packet processing accesses the state. A local user can tear down a network namespace while packet processing accesses CT limit state to trigger a slab use-after-free.

Exploitation requires a user and network namespace.

1303) Untrusted Pointer Dereference (CVE-ID: CVE-2026-89489)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code in kernel context.

The vulnerability exists due to improper validation of user pointers in the sys_or1k_atomic syscall when processing syscall arguments. A local user can supply kernel addresses as syscall pointers to execute arbitrary code in kernel context.

1304) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-89490)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering indefinite directory re-enumeration.

The vulnerability exists due to an incorrect integer conversion in ocfs2_dir_foreach_blk_el() when reading a non-inline directory that crosses the 4 GiB boundary on a 32-bit kernel. A local user can invoke readdir() on an affected directory to cause a denial of service by triggering indefinite directory re-enumeration.

64-bit kernels are unaffected.

1305) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89491)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave heartbeat regions unprotected on subsequent mounts.

The vulnerability exists due to improper error handling in o2hb_region_inc_user() when heartbeat region pinning fails partway through processing. A local user can invoke heartbeat region user registration during a pinning failure to leave heartbeat regions unprotected on subsequent mounts.

Partially pinned regions are not released, and the dependent-user counter remains incremented.

1306) Deadlock (CVE-ID: CVE-2026-89491)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a lock order inversion in o2hb_region_pin() when it is invoked from the configfs drop_item callback. A local user can trigger heartbeat-region removal processing to cause a denial of service.

1307) Improper locking (CVE-ID: CVE-2026-89491)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in o2hb_region_pin() when calling o2nm_depend_item() while holding o2hb_live_lock. A local user can trigger heartbeat region pinning to cause a denial of service.

The issue manifests as a sleeping-in-atomic-context BUG under CONFIG_DEBUG_ATOMIC_SLEEP.

1308) Out-of-bounds write (CVE-ID: CVE-2026-89493)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to perform out-of-bounds memory reads and writes.

The vulnerability exists due to improper validation of refcount record bounds in ocfs2_validate_refcount_block() when processing crafted refcount blocks during reflink operations. A local privileged user can mount a crafted or corrupted ocfs2 image and issue a reflink operation to perform out-of-bounds memory reads and writes.

A raw write to the block device backing an already-mounted ocfs2 filesystem can also introduce a malicious refcount block.

1309) Out-of-bounds write (CVE-ID: CVE-2026-89494)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause memory corruption.

The vulnerability exists due to a heap out-of-bounds write in dlm_init_lockres() when processing a DLM_MIG_LOCKRES message with an oversized lock name length. A remote user can send a specially crafted DLM_MIG_LOCKRES message to cause memory corruption.

The sending node must belong to the DLM domain.

1310) Out-of-bounds read (CVE-ID: CVE-2026-89494)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dlm_process_recovery_data() when processing a DLM_MIG_LOCKRES message whose claimed number of locks exceeds the message payload. A remote user can send a specially crafted DLM_MIG_LOCKRES message to cause a denial of service.

The sending node must belong to the DLM domain.

1311) Out-of-bounds read (CVE-ID: CVE-2026-89495)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dlm_process_recovery_data when processing recovery data whose lock count exceeds the message payload. A remote user can send a malformed recovery message with an invalid number of lock entries to cause a denial of service.

1312) Heap-based buffer overflow (CVE-ID: CVE-2026-89495)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to corrupt memory or cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in dlm_mig_lockres_handler when processing recovery data with an oversized lock name. A remote user can send a malformed recovery message with an oversized lock name length to corrupt memory or cause a denial of service.

1313) Heap-based buffer overflow (CVE-ID: CVE-2026-89495)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to corrupt memory or cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in dlm_migrate_request_handler when processing a DLM_MIGRATE_REQUEST message with an oversized name. A remote user can send a malformed migration request with an oversized name length to corrupt memory or cause a denial of service.

1314) Memory leak (CVE-ID: CVE-2026-89496)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource release in OCFS2 copy-on-write completion when performing copy_file_range() within the same filesystem. A local user can invoke copy_file_range() to cause a memory leak.

1315) Heap-based buffer overflow (CVE-ID: CVE-2026-89497)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write past the end of an allocated keyword buffer.

The vulnerability exists due to a heap-based buffer overflow in orangefs_prepare_cdm_array() when processing a client debug entry that begins with a space. A local user can supply a client debug entry beginning with a space to write past the end of an allocated keyword buffer.

1316) Double free (CVE-ID: CVE-2026-89498)

CWE-ID: CWE-415 - Double Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a double-free.

The vulnerability exists due to double free in the OrangeFS readdir downcall handling when processing a readdir downcall with a declared trailer size that exceeds the supplied data. A local user can send a readdir downcall with insufficient trailer data to trigger a double-free.

1317) Use-after-free (CVE-ID: CVE-2026-89504)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger use of a dangling device-tree node pointer.

The vulnerability exists due to improper reference counting in as3722_get_regulator_dt_data() when parsing regulator device-tree data. A local user can cause the dangling pointer to be used to trigger use of a dangling device-tree node pointer.

1318) Race condition (CVE-ID: CVE-2026-89508)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in ucma_set_ib_path() when concurrently handling SET_OPTION requests and context migration. A local user can trigger a race condition to cause a denial of service.

A bound and address-resolved cm_id and an RDMA device are required.

1319) Use-after-free (CVE-ID: CVE-2026-89510)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a use-after-free condition.

The vulnerability exists due to a race condition in the RDMA/cxgb4 device removal and registration work handling when removing an RDMA device while registration work is pending or running. A local privileged user can remove the device while the registration work accesses the device object to cause a use-after-free condition.

1320) NULL pointer dereference (CVE-ID: CVE-2026-89511)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the qede driver's TPA fragment processing when handling TPA continuation fragments under memory pressure. A remote attacker can send network traffic that is processed as TPA continuation fragments during memory pressure to cause a denial of service.

1321) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89512)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of a resource after effective lifetime in the scp_get function in drivers/remoteproc/mtk_scp.c when looking up SCP driver data before the driver has been bound. A local user can trigger a failed SCP driver-data lookup to cause a denial of service.

1322) Use of uninitialized resource (CVE-ID: CVE-2026-89515)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized memory contents.

The vulnerability exists due to use of uninitialized memory in scsi_alloc_sgtables() when processing the last unaligned element of a scatterlist requiring DMA padding. A local user can issue an SCSI generic I/O request with an unaligned final scatterlist element to disclose uninitialized memory contents.

1323) Integer underflow (CVE-ID: CVE-2026-89524)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer underflow in ath6kl_cfg80211_connect_event() when handling association events with request or response lengths shorter than their fixed information element offsets. A remote attacker can trigger such an association event to disclose sensitive information.

1324) Out-of-bounds read (CVE-ID: CVE-2026-89525)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in udf_get_pblock_virt15() when processing a crafted UDF image. A local user can mount a crafted UDF image to cause a denial of service.

The issue affects UDF 1.50 virtual partition mappings that use a VAT.

1325) Out-of-bounds read (CVE-ID: CVE-2026-89532)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow resulting in an out-of-bounds read in the pcl_for_each_segment macro when processing a Write or Reply chunk with zero segments. A remote attacker can send a crafted Write or Reply chunk advertising zero segments to cause a denial of service.

The transport must have negotiated Send-With-Invalidate.

1326) Integer underflow (CVE-ID: CVE-2026-89533)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer underflow in svc_rdma_read_chunk_range() when processing a Read chunk segment list with crafted offsets and lengths. A remote attacker can submit a crafted Read chunk to cause a denial of service.

1327) Improper input validation (CVE-ID: CVE-2026-89538)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in gss_krb5_unwrap_v2() when processing Kerberos v2 wrap tokens with oversized extra count fields. A remote user can send a malformed Kerberos v2 wrap token to cause a denial of service.

The token must be encrypted using a valid GSS context.

1328) Race condition (CVE-ID: CVE-2026-89540)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to an initialization race condition in the use-gss-proxy proc entry initialization when writing to the newly published proc entry before gssp_lock is initialized. A local user can win the initialization race and write to the proc entry to cause a resource leak.

The race window can widen when the auth_rpcgss module is loaded for live network namespaces.

1329) Out-of-bounds read (CVE-ID: CVE-2026-89541)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to improper length validation in gss_unwrap_resp_priv() when processing a crafted RPCSEC_GSS reply. A remote attacker can return a crafted RPCSEC_GSS reply from a krb5p NFS server to read out-of-bounds memory.

1330) Out-of-bounds read (CVE-ID: CVE-2026-89542)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper length validation in gss_krb5_unwrap_v2() and its rotation helpers when processing a short or malformed GSS token. A remote user can provide a token shorter than the required header or with a declared length exceeding the buffer bounds to cause a denial of service.

The flawed length arithmetic can result in an out-of-bounds read, an unsigned underflow during cleanup, or a divide-by-zero during buffer rotation.

1331) Use-after-free (CVE-ID: CVE-2026-89548)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper synchronization in the SUNRPC cache cleanup routine when tearing down a network namespace. A local user can cause cache_clean() to access a freed cache_detail to trigger a use-after-free condition.

1332) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89549)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a service connection to hang indefinitely.

The vulnerability exists due to improper handling of threadless service pools in svc_pool_for_cpu() when routing a transport to a service pool. A remote attacker can initiate a connection that is enqueued on a pool with no service threads to cause a service connection to hang indefinitely.

The condition can occur when a service has fewer threads than configured pools.

1333) Integer underflow (CVE-ID: CVE-2026-89551)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause downstream XDR decoders to use an incorrect stream bound.

The vulnerability exists due to an integer underflow in xdr_buf_trim() when processing GSS Kerberos v2 data whose recorded buffer length is smaller than the associated I/O vector lengths. A remote attacker can cause xdr_buf_trim() to consume more bytes than buf->len records to cause downstream XDR decoders to use an incorrect stream bound.

1334) Use of Uninitialized Variable (CVE-ID: CVE-2026-89554)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt the path manager's id-based subflow bookkeeping.

The vulnerability exists due to use of an uninitialized local_id field in mptcp_token_join_cookie_init_state() when reconstructing MP_JOIN request sockets for fourth acknowledgments under SYN cookies. A remote attacker can send concurrent MP_JOIN SYNs to influence the stale address ID and corrupt the path manager's id-based subflow bookkeeping.

1335) Use-after-free (CVE-ID: CVE-2026-89555)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to use-after-free in mpls_multipath_hash when processing MPLS packets with inner IP headers in non-linear data and insufficient tailroom in the linear head. A remote attacker can send a legal Geneve packet through a bareudp/MPLS multipath setup to trigger a use-after-free.

The IPv6 processing path can perform a second pull for the larger header.

1336) Integer overflow (CVE-ID: CVE-2026-89557)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an integer overflow.

The vulnerability exists due to improper input validation in the super_1_load() MD superblock loader when processing a crafted on-disk superblock. A local user can supply a crafted on-disk superblock to trigger an integer overflow.

1337) Integer overflow (CVE-ID: CVE-2026-89559)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds write.

The vulnerability exists due to an integer overflow in __nd_label_validate() in the libnvdimm label handler when processing a crafted nslot namespace index value. A local user can supply crafted configuration data through ND_CMD_SET_CONFIG_DATA to perform an out-of-bounds write.

The nslot field may also originate from DIMM label storage.

1338) Missing Authorization (CVE-ID: CVE-2026-89560)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass Landlock filesystem access restrictions.

The vulnerability exists due to improper access control in Landlock whiteout creation checks when creating whiteout objects with mknod(2) or renameat2(2) using RENAME_WHITEOUT. A local user can create a whiteout object despite denied required Landlock access rights to bypass Landlock filesystem access restrictions.

Normal renames within layered OverlayFS mounts are not affected.

1339) Incorrect calculation (CVE-ID: CVE-2026-89562)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect tunnel hardware header length handling.

The vulnerability exists due to improper hardware header length calculation in ip6_gre tunnel configuration when configuring an NBMA ip6gre tunnel. A local user can configure an NBMA ip6gre tunnel to cause incorrect tunnel hardware header length handling.

ip6gretap and ip6erspan use fixed Ethernet hardware header lengths.

1340) Double free (CVE-ID: CVE-2026-89563)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in ip6_tnl_xmit() when handling errors after expanding packet headroom. A local user can trigger an error after packet headroom expansion to cause a denial of service.

The issue is reachable when collect_md tunnels reject a non-NONE encapsulation type or when ip6_tnl_encap() fails.

1341) Use-after-free (CVE-ID: CVE-2026-89569)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access freed RFCOMM session and data link connection objects.

The vulnerability exists due to use-after-free in the RFCOMM security confirmation handler rfcomm_security_cfm() when processing Bluetooth security confirmations concurrently with RFCOMM session teardown. A remote attacker can trigger the concurrent processing to access freed RFCOMM session and data link connection objects.

1342) Out-of-bounds read (CVE-ID: CVE-2026-89573)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to improper validation of array block value sizes in dm-array's get_ablock() and __shadow_ablock() functions when processing crafted dm-cache metadata. A local user can cause a mappings array to reference a hint block with a smaller value size to read out-of-bounds memory.

1343) Heap-based buffer overflow (CVE-ID: CVE-2026-89575)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a heap-based buffer overflow.

The vulnerability exists due to improper buffer size calculation in build_constructor_string() when formatting a maximum-length u64 value. A local privileged user can cause sprintf() to write a terminating NUL byte beyond the allocated buffer space to cause a heap-based buffer overflow.

1344) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89576)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through metadata block exhaustion.

The vulnerability exists due to improper resource release in metadata_take_snap() when incrementing metadata block references fails after allocating a shadow superblock. A local user can cause snapshot creation to fail after a shadow block is allocated to cause a denial of service through metadata block exhaustion.

1345) Double free (CVE-ID: CVE-2026-89582)

CWE-ID: CWE-415 - Double Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a double free.

The vulnerability exists due to a double free in bnx2x_init_firmware() when firmware initialization fails and bnx2x_release_firmware() is subsequently called. A local user can cause firmware initialization to fail and invoke the affected cleanup path to trigger a double free.

1346) Use-after-free (CVE-ID: CVE-2026-89585)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in the charlcd registration error-handling path when a character LCD registration attempt fails while backlight flashing is enabled. A local user can trigger delayed backlight work after the charlcd object is freed to access freed memory.

1347) Incorrect calculation (CVE-ID: CVE-2026-89586)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect calculation in ata_scsi_write_same_xlat() and ata_format_dsm_trim_descr() when issuing SCSI WRITE SAME commands with the UNMAP bit set. A local user can issue a SCSI WRITE SAME command with the UNMAP bit set to cause a denial of service.

The issue affects devices whose logical sector size exceeds 2048 bytes.

1348) Improper initialization (CVE-ID: CVE-2026-89594)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the OMAP SSI controller device when performing DMA mapping operations. A local user can trigger DMA mapping operations to cause a denial of service.

1349) Race condition (CVE-ID: CVE-2026-89595)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause filesystem monitoring events to be missed.

The vulnerability exists due to a race condition in cached fsnotify object mask recalculation when concurrently updating fanotify or inotify marks on the same connector. A local user can issue concurrent mark updates to cause filesystem monitoring events to be missed.

1350) Off-by-one (CVE-ID: CVE-2026-89596)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in the forcedeth driver's nv_suspend() and nv_resume() functions when suspending or resuming the system. A local user can trigger a system suspend and resume cycle to cause a denial of service.

On systems built with CONFIG_UBSAN_TRAP=y, the out-of-bounds access aborts the running kernel code.

1351) Improper resource shutdown or release (CVE-ID: CVE-2026-89597)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leave a v86d connector callback registered after initialization fails.

The vulnerability exists due to improper resource shutdown or release in uvesafb_init() when platform driver registration fails after registering the v86d connector callback. A local privileged user can initialize uvesafb to leave the callback registered.

1352) Race condition (CVE-ID: CVE-2026-89599)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a dsicm callback to use an uninitialized mutex.

The vulnerability exists due to a race condition in the dsicm_probe() function of the panel-dsi-cm display driver when a consumer reaches a dsicm callback after the display is registered but before ddata->lock is initialized. A local user can trigger a dsicm callback during this interval to cause a dsicm callback to use an uninitialized mutex.

1353) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89605)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to failure to release a message context in ecryptfs messaging when sending a message to the userspace daemon fails. A local user can trigger message delivery failures to exhaust reusable message contexts.

1354) Integer underflow (CVE-ID: CVE-2026-89606)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an integer underflow.

The vulnerability exists due to an integer underflow in ecryptfs_parse_tag_70_packet() when parsing malformed tag 70 packets. A local user can provide a tag 70 packet with a body smaller than the required fixed metadata fields to trigger an integer underflow.

1355) Out-of-bounds write (CVE-ID: CVE-2026-89607)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to out-of-bounds writes in parse_tag_3_packet() and decrypt_passphrase_encrypted_session_key() when processing a crafted Tag 3 packet through the passphrase decryption path. A local user can supply a crafted Tag 3 packet with an oversized encrypted key size to cause memory corruption.

Only the AES-192 cipher configuration enables exploitation because its key size is set independently of the encrypted key size.

1356) Out-of-bounds read (CVE-ID: CVE-2026-89608)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to improper bounds checking in ecryptfs_parse_packet_set() when parsing an eCryptfs version 1 file header. A local user can trigger parsing of an eCryptfs version 1 file header to perform an out-of-bounds read.

1357) Improper locking (CVE-ID: CVE-2026-89609)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a race condition.

The vulnerability exists due to improper locking in ecryptfs_exorcise_daemon() when cleaning queued messages from a dying daemon. A local user can move queued message contexts to the free list without holding the required global list lock to trigger a race condition.

1358) Out-of-bounds write (CVE-ID: CVE-2026-89615)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in the page_lcns[] array handling of the NTFS3 log replay code when processing a crafted log record. A local user can provide a crafted log record with an lcns_follow count that exceeds the target entry's capacity to perform an out-of-bounds write.

1359) Use of uninitialized resource (CVE-ID: CVE-2026-89616)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in ni_read_frame() when reading a crafted compressed NTFS file. A local user can trigger partial LZNT decompression to disclose sensitive information.

Disclosed data can include recently freed kernel page memory and kernel pointers.

1360) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-89617)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of an on-disk array length in DIR_PAGE_ENTRY entries during NTFS3 log replay when replaying a crafted NTFS log. A local user can provide a crafted lcns_follow value that exceeds the page_lcns[] entry bounds to cause an out-of-bounds memory access.

1361) Out-of-bounds read (CVE-ID: CVE-2026-89621)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose uninitialized kernel memory.

The vulnerability exists due to an out-of-bounds read in mcp2221_raw_event() in the MCP2221 HID driver when handling a short MCP2221_I2C_GET_DATA HID report. An attacker with physical access can send a crafted HID report with a length value exceeding the received report size to disclose uninitialized kernel memory.

1362) Use-after-free (CVE-ID: CVE-2026-89626)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to improper cleanup in hid_sensor_custom_add_attributes() when creating sysfs groups for custom sensor fields. A local user can trigger a sysfs group creation failure to cause a use-after-free.

1363) Memory leak (CVE-ID: CVE-2026-89627)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory release in the ROCcat HID device destruction paths when destroying a device with buffered reports stored in its circular buffer. A local user can trigger the affected device destruction path while buffered reports remain stored to cause a denial of service.

Up to ROCCAT_CBUF_SIZE report buffers per device can become unreachable.

1364) Out-of-bounds read (CVE-ID: CVE-2026-89628)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in picolcd_debug_eeprom_read() when reading EEPROM data through the debugfs "eeprom" file. A local privileged user can use a crafted or spoofed picoLCD device to supply an oversized length value to disclose sensitive information.

The debugfs file is accessible only to root.

1365) Use-after-free (CVE-ID: CVE-2026-89643)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in audit_del_rule() when fsnotify automatically removes mixed AUDIT_DIR and AUDIT_EXE rules that share an audit tree. A local privileged user can trigger fsnotify autoremove events to cause a denial of service.

1366) Out-of-bounds read (CVE-ID: CVE-2026-89649)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the CephFS __build_xattrs() function when processing metadata-server-supplied extended attribute blobs. A remote privileged user can provide a crafted extended attribute blob with a final attribute value length that exceeds the available data to disclose sensitive information.

A local user must invoke getxattr(2) on a CephFS file.

1367) Out-of-bounds read (CVE-ID: CVE-2026-89650)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds read in the kernel.

The vulnerability exists due to an out-of-bounds read in ceph_mdsmap_decode() in fs/ceph/mdsmap.c when processing an MDS map with a per-mds info version of 2 or 3 and an oversized num_export_targets field. A remote attacker can send a specially crafted MDS map to cause an out-of-bounds read in the kernel.

On-path exploitation applies to unsigned or unencrypted messenger sessions.

1368) Out-of-bounds write (CVE-ID: CVE-2026-89653)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause an out-of-bounds write.

The vulnerability exists due to improper bounds checking in the fixed stack bitmap used by check_new_map() when processing a decoded MDSMap whose export_targets entries contain an out-of-range rank. A remote user can cause an MDSMap containing an out-of-range export target rank to be decoded to cause an out-of-bounds write.

1369) Use-after-free (CVE-ID: CVE-2026-89655)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in __kick_flushing_caps() when processing FLUSH_ACK messages during cap flushing. A remote attacker can send a FLUSH_ACK message during cap flushing to trigger a use-after-free condition.

Exploitation requires the FLUSH_ACK to be processed after i_ceph_lock is released and before list iteration resumes.

1370) Out-of-bounds write (CVE-ID: CVE-2026-89656)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write beyond the CRUSH workspace.

The vulnerability exists due to improper validation of bucket IDs in the libceph CRUSH map decoder, crush_decode(), when processing a malformed CRUSH map containing a bucket ID that does not match its array slot. A local user can cause the kernel to process such a map and write past a permutation array into memory beyond the CRUSH workspace.

1371) Use-after-free (CVE-ID: CVE-2026-89662)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the NFSD __destroy_client() function when processing DESTROY_CLIENTID requests. A remote attacker can trigger client teardown while blocked locks are reaped to cause a denial of service.

The race can result in a NULL dereference in remove_blocked_locks().

1372) Use-after-free (CVE-ID: CVE-2026-89663)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the NFS server copy-notify stateid revocation logic when revoking copy-notify stateids while concurrent holders retain references. A remote attacker can trigger concurrent copy-notify stateid revocation to cause a denial of service.

The issue involves parent-stateid draining, OFFLOAD_CANCEL handling, and laundromat expiry.

1373) Integer overflow (CVE-ID: CVE-2026-89665)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause improper filesystem timestamp handling.

The vulnerability exists due to an integer overflow in the NFSv2 sattr decoder in svcxdr_decode_sattr() when decoding NFSv2 SETATTR or CREATE time attributes. A remote attacker can send a crafted NFSv2 request containing an out-of-range useconds value to cause improper filesystem timestamp handling.

The overflow affects 32-bit ILP32 platforms.

1374) Use-after-free (CVE-ID: CVE-2026-89669)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in copy-notify state initialization when racing a crafted OFFLOAD_CANCEL request against COPY_NOTIFY processing. A remote attacker can send a crafted OFFLOAD_CANCEL request to trigger a use-after-free condition.

Exploitation requires a matching client ID and a guessable state object ID.

1375) Improper Handling of Length Parameter Inconsistency (CVE-ID: CVE-2026-89673)

CWE-ID: CWE-130 - Improper Handling of Length Parameter Inconsistency

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose stale reply-page content.

The vulnerability exists due to an incorrect XDR padding calculation in nfsd4_ff_encode_getdeviceinfo() when encoding flexfile GETDEVICEINFO replies. A remote attacker can send a GETDEVICEINFO request to disclose stale reply-page content.

The incorrect declared address-body length can also mis-align decoding of the subsequent version list.

1376) Out-of-bounds write (CVE-ID: CVE-2026-89674)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.

The vulnerability exists due to an incorrect XDR buffer size calculation in nfsd4_ff_encode_layoutget() when encoding layoutget responses with short user or group strings and an odd-sized file handle. A remote attacker can request a layoutget operation to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.

1377) Race condition (CVE-ID: CVE-2026-89684)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in the NFS server copy-notification state handling when processing concurrent NFSv4.2 OFFLOAD_CANCEL requests. A remote attacker can send racing OFFLOAD_CANCEL requests to cause a denial of service.

1378) Missing Authorization (CVE-ID: CVE-2026-89694)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in the NFS server copy-notify state management function when processing OFFLOAD_CANCEL requests. A remote user can send an OFFLOAD_CANCEL request for another client's copy-notify stateid to cause a denial of service.

Copy-notify stateid object identifiers are allocated cyclically and are guessable.

1379) NULL pointer dereference (CVE-ID: CVE-2026-89696)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the NFS server compound request dispatch loop when processing a crafted NFSv4 COMPOUND request involving an inter-SSC COPY operation. A remote attacker can send a crafted NFSv4 COMPOUND request with an operation between a foreign PUTFH and SAVEFH to cause a denial of service.

Only systems with CONFIG_NFSD_V4_2_INTER_SSC enabled are affected.

1380) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89697)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a SETATTR operation without a mount write reference.

The vulnerability exists due to missing mount write reference acquisition in nfsd_proc_setattr() when processing a SETATTR request in the BOTH_TIME_SET branch. A remote attacker can submit a SETATTR request with both time attributes set to perform a SETATTR operation without a mount write reference.

1381) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-89699)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in nfsd4_decode_create() when processing NFSv4 CREATE requests for symbolic links. A remote attacker can send crafted requests containing an oversized symbolic-link target length to cause a denial of service.

The allocation can persist until COMPOUND operation teardown.

1382) Race condition (CVE-ID: CVE-2026-89704)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause silent data loss.

The vulnerability exists due to a race condition in _nfsd_copy_file_range() when processing asynchronous NFS COPY operations. A remote user can issue concurrent COPY and COMMIT or stable WRITE operations to cause silent data loss.

1383) Improper handling of exceptional conditions (CVE-ID: CVE-2026-89706)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause copied data to be silently lost.

The vulnerability exists due to improper handling of writeback errors in the NFS server async COPY operation in _nfsd_copy_file_range() when processing an asynchronous COPY request whose writeback fails. A remote attacker can issue an asynchronous COPY request that encounters a writeback failure to cause copied data to be silently lost.

1384) Memory leak (CVE-ID: CVE-2026-89710)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a memory leak.

The vulnerability exists due to improper resource cleanup in pnfs_layout_process() in the NFSv4.1 pNFS implementation when processing a new layout stateid returned while a valid stateid is still held. A remote attacker can operate an NFSv4.1 server that returns a new layout stateid to cause a memory leak.

1385) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89711)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a kernel warning.

The vulnerability exists due to an incorrect warning condition in nfsd_mode_check when processing NFS client LOOKUP requests for exported NFS filesystems that lack a lookup method. A remote attacker can issue a LOOKUP request to trigger a kernel warning.

The condition can occur when reexporting an NFS filesystem.

1386) Use-after-free (CVE-ID: CVE-2026-89712)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in nfsd4_ssc_expire_umount() when processing concurrent NFS server operations while an expired inter-server source mount is being unmounted. A remote attacker can trigger concurrent operations that cause the expiration walk to dereference a freed nfsd4_ssc_umount_item to cause a denial of service.

1387) Out-of-bounds read (CVE-ID: CVE-2026-89720)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond allocated memory.

The vulnerability exists due to an out-of-bounds read in ubifs_sb_verify_signature() when mounting a crafted signed UBIFS image. A local user can provide an image with an inflated signature length to read beyond allocated memory.

The signature is processed before it is cryptographically checked.

1388) Out-of-bounds read (CVE-ID: CVE-2026-89723)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds memory access.

The vulnerability exists due to improper deletion of an intermediate B-tree node in the NILFS2 block mapping implementation when truncating a file causes a B-tree mapping to collapse into a direct mapping. A local user can truncate a file to cause a residual B-tree node to be processed as a direct mapping entry and trigger an out-of-bounds memory access.

The residual node remains dirty in the B-tree node cache and can subsequently be processed by the log writer.

1389) Out-of-bounds write (CVE-ID: CVE-2026-89724)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt adjacent kernel heap memory.

The vulnerability exists due to an out-of-bounds write in the vicodec FWHT encoder when encoding a four-component pixel format whose planes take the unencoded fallback. A local user can submit a crafted frame to corrupt adjacent kernel heap memory.

1390) Out-of-bounds write (CVE-ID: CVE-2026-89725)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write peer-controlled bytes out of bounds into surrounding memory.

The vulnerability exists due to an out-of-bounds write in stm32_rx_done() in the STM32 CEC driver when processing an overlong CEC message from a peer. A remote attacker can send a CEC message without ending it to write peer-controlled bytes out of bounds into surrounding memory.

The driver must be probed and receiving must be enabled.

1391) Out-of-bounds read (CVE-ID: CVE-2026-89726)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory beyond the specified length.

The vulnerability exists due to an off-by-one out-of-bounds read in ucs2_strnlen() in lib/ucs2_string.c when processing a UCS-2 string that is not NUL-terminated within the caller-provided maximum length. A local user can supply a non-NUL-terminated UCS-2 string to read memory beyond the specified length.

1392) Out-of-bounds write (CVE-ID: CVE-2026-89729)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in sensor_hub_get_feature() when processing a malicious HID descriptor. An attacker with physical access can provide a HID descriptor advertising a large feature field size to cause an out-of-bounds write.

An IIO caller supplying a small stack buffer can be affected.

1393) Out-of-bounds read (CVE-ID: CVE-2026-89730)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in altera_cvp_send_block() in the Altera CvP FPGA driver when processing an input buffer with one to three trailing bytes. A local user can provide a crafted FPGA image with trailing bytes to cause a denial of service.

1394) Deadlock (CVE-ID: CVE-2026-89732)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in ffs_ep0_read() in the FunctionFS USB gadget function when a userspace daemon repeatedly reads ep0 while the gadget is asynchronously torn down via configfs. A local user can repeatedly read ep0 during asynchronous gadget teardown to cause a denial of service.

1395) Use-after-free (CVE-ID: CVE-2026-89733)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in the UVC gadget function cleanup paths when handling bind errors or unbinding the function. A local user can trigger the affected cleanup paths to access freed memory.

1396) Use-after-free (CVE-ID: CVE-2026-89736)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to use-after-free in the USB gadget u_audio sound card cleanup handling when accessing or closing open ALSA control file descriptors after sound card teardown is initiated. A local user can access or close open ALSA control file descriptors to cause memory corruption.

ALSA control callbacks can dereference private data associated with a freed sound card context.

1397) Double free (CVE-ID: CVE-2026-89741)

CWE-ID: CWE-415 - Double Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a double-free condition.

The vulnerability exists due to a double free in __video_register_device() when handling a device_register() failure. A local user can trigger a device registration failure to cause a double-free condition.

1398) Use-after-free (CVE-ID: CVE-2026-89742)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in dma_req_free() when freeing DMA requests through the RapidIO mport character device interface. A local user can trigger the release of a mapping whose final reference is dropped and subsequently unlock a mutex through the freed mapping to cause a denial of service.

1399) Unchecked Return Value (CVE-ID: CVE-2026-89749)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an unchecked return value in event_test_stuff() when kthread creation fails. A local user can trigger a kthread creation failure that results in an error pointer being passed to kthread_stop() to cause a denial of service.

The failure can occur under memory pressure during the boot-time event self-test.

1400) Race condition (CVE-ID: CVE-2026-89752)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the memory.high and memory.max limit update handlers when concurrently updating memory cgroup limits through separate open files. A local user can lower a memory.max limit and restore it through another open file to cause a denial of service.

Exploitation requires a cgroup populated with anonymous memory and swapping disabled.

1401) Improper locking (CVE-ID: CVE-2026-89753)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause RCU Tasks stalls.

The vulnerability exists due to improper RCU quiescent-state handling in shrink_lruvec() in mm/vmscan.c when performing direct memory reclaim. A local user can trigger direct memory reclaim to cause RCU Tasks stalls.

The issue occurs on PREEMPTION kernels, where cond_resched() does not report a Tasks-RCU quiescent state.

1402) Use of Uninitialized Variable (CVE-ID: CVE-2026-89765)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose uninitialized kernel stack memory.

The vulnerability exists due to use of uninitialized memory in put_itimerval() when calling getitimer() on native sparc64 systems. A remote attacker can invoke getitimer() to disclose uninitialized kernel stack memory.

1403) Use-after-free (CVE-ID: CVE-2026-89774)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in the Bluetooth SCO socket connection handling code when handling SCO connection-ready events concurrently with socket closure. A remote attacker can trigger a race between connection setup and socket release to compromise confidentiality, integrity, and availability.

1404) Use-after-free (CVE-ID: CVE-2026-89777)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free caused by a dangling pointer in vfio pci MSI permission-table handling when MSI permission-table initialization fails. A local user can cause MSI permission-table initialization to fail and subsequently access MSI configuration to compromise system confidentiality, integrity, and availability.

The per-device structure persists across open and close cycles.

1405) Out-of-bounds read (CVE-ID: CVE-2026-89778)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in zisofs_fill_pages() when reading a compressed file on a mounted ISO9660 image containing a crafted ZF Rock Ridge record. A remote attacker can provide a crafted ISO9660 image to read memory out of bounds.

The issue is triggered when an empty zisofs block follows a sub-page block with a nonzero page offset.

1406) Out-of-bounds read (CVE-ID: CVE-2026-89779)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper bounds validation in the NTFS3 extended-attribute record parser when processing a crafted NTFS image. A remote attacker can provide an extended-attribute record with an undersized size field to disclose sensitive information.

1407) NULL pointer dereference (CVE-ID: CVE-2026-89780)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rmnet_map_deaggregate() when processing an aggregated frame containing a flow-control command. A local user can write a crafted aggregated frame to a tap device file descriptor to cause a denial of service.

Exploitation requires an rmnet link over a tap device with ingress deaggregation and ingress MAP commands enabled.

1408) Out-of-bounds read (CVE-ID: CVE-2026-89781)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper validation of an on-disk offset in read_log_rec_buf() when mounting a crafted NTFS image. A remote attacker can mount a crafted NTFS image to compromise confidentiality, integrity, and availability.

1409) Numeric Truncation Error (CVE-ID: CVE-2026-89782)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds memory access.

The vulnerability exists due to integer truncation in the NTFS3 restart table handling in fs/ntfs3/fslog.c when replaying a crafted NTFS $LogFile. A remote attacker can mount a crafted NTFS image to cause an out-of-bounds memory access.

1410) Out-of-bounds write (CVE-ID: CVE-2026-89783)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to an out-of-bounds write in xfrm6_input_addr() when processing an inner IPv6 packet containing a destination-options HAO option or a type-2 routing header. A remote attacker can send a specially crafted packet to compromise confidentiality, integrity, and availability.

Exploitation requires the transport-mode receive path to re-enter IPv6 input with a secpath whose length is at the maximum depth.

1411) NULL pointer dereference (CVE-ID: CVE-2026-89784)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rpcb_register_inet4() and rpcb_register_inet6() when an in-kernel RPC service registers with the local rpcbind after an address-string allocation fails. A local user can cause an in-kernel RPC service to register with the local rpcbind to cause a denial of service.

Exploitation requires sufficient memory pressure for a small GFP_KERNEL allocation to fail.

1412) Out-of-bounds read (CVE-ID: CVE-2026-89785)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read beyond the allocated buffer.

The vulnerability exists due to an out-of-bounds read in ntfs_reparse_init() and ntfs_objid_init() when mounting a crafted NTFS filesystem image containing a malformed resident INDEX_ROOT attribute. A local privileged user can mount a crafted filesystem image to read beyond the allocated buffer.

Exploitation requires CAP_SYS_ADMIN.

1413) Out-of-bounds read (CVE-ID: CVE-2026-89786)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ext4_read_inline_dir() when processing inline directory entries during getdents64() calls. A remote attacker can cause the kernel to process an inline directory entry whose header extends beyond the inline buffer to disclose sensitive information and cause a denial of service.

1414) Out-of-bounds read (CVE-ID: CVE-2026-89787)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in ext4_search_dir() when processing a crafted directory entry during a directory lookup. A local user can provide a crafted directory entry to read out-of-bounds memory.

The issue affects casefolded encrypted directories that store hash values in directory entries on the sb_no_casefold_compat_fallback() path.

1415) Use-after-free (CVE-ID: CVE-2026-89789)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose and modify sensitive information and cause a denial of service.

The vulnerability exists due to use-after-free in the gtp_newlink() error path in drivers/net/gtp.c when handling gtp_newlink() error paths concurrently with gtp encapsulation receive operations. A local user can trigger the race condition to disclose and modify sensitive information and cause a denial of service.

1416) Out-of-bounds read (CVE-ID: CVE-2026-89792)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to out-of-bounds read in the ksmbd share configuration response handling when processing IPC share configuration responses with malformed variable-length fields. A local user can provide a crafted share configuration response to disclose sensitive information and cause a denial of service.

1417) Integer overflow (CVE-ID: CVE-2026-89796)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in kdamond_merge_regions() in the DAMON core when merging DAMON regions after online parameter updates. A local user can configure DAMON with an excessively large aggregation interval and numerous non-contiguous regions to cause a denial of service.

Exploitation requires the region count to remain above the user-defined upper limit after aggressive merging.

1418) Improper update of reference count (CVE-ID: CVE-2026-89816)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper reference counting in complete_signaling() in the DRM atomic UAPI when an atomic DRM ioctl using DRM_MODE_PAGE_FLIP_EVENT is blocked while waiting for fences. A local user can issue the atomic DRM ioctl with a sw_sync fence and send a signal to the blocked thread to cause a memory leak.

The condition was observed with amdgpu and vkms.

1419) Improper Null Termination (CVE-ID: CVE-2026-89817)

CWE-ID: CWE-170 - Improper Null Termination

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to perform an out-of-bounds read.

The vulnerability exists due to improper null termination in gud_connector_add_tv_mode() when processing TV mode names received from a USB device. An attacker with physical access can provide TV mode names that are not NUL-terminated to perform an out-of-bounds read.

1420) Division by zero (CVE-ID: CVE-2026-89821)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a divide-by-zero error in the __is_lut_linear() function when processing a single-entry lookup table. A local user can trigger processing of a single-entry lookup table to cause a denial of service.

1421) Race condition (CVE-ID: CVE-2026-89823)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in drm_dev_register() error handling when a partially registered DRM minor is opened and an ioctl is processed. A local user can open the registered minor and issue an ioctl while device resources are being torn down to compromise confidentiality, integrity, and availability.

1422) Use of uninitialized resource (CVE-ID: CVE-2026-89843)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized stack memory in qla2xxx BSG handlers when processing a short user-supplied BSG request payload. A local user can submit a specially crafted short BSG request to disclose sensitive information.

The information leak occurs in qla2x00_read_fru_status() and qla2x00_read_i2c().

1423) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-89845)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check to time-of-use race condition in qla2x00_error_entry() when handling error entries during request-queue teardown. A local user can trigger processing of an error entry while the request queue is being torn down to cause a denial of service.

The response-queue interrupt can remain registered while request queues are being torn down.

1424) Out-of-bounds read (CVE-ID: CVE-2026-89846)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in qla2x00_status_entry() in the qla2xxx SCSI driver when processing an FCP response containing an oversized response information length. A remote attacker can send a crafted FCP response with an oversized rsp_info_len value to disclose sensitive information.

1425) Use-after-free (CVE-ID: CVE-2026-89847)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in qla2x00_async_iocb_timeout() in the qla2xxx SCSI driver when an async IOCB timeout races with response interrupt completion. A remote attacker can trigger the race condition to compromise confidentiality, integrity, and availability.

1426) Type Confusion (CVE-ID: CVE-2026-89849)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a wild pointer dereference.

The vulnerability exists due to type confusion in the qla2x00_status_entry() SCSI fast path when processing an unexpected STATUS_TYPE IOCB for a non-SCSI handle. A remote attacker can cause an unexpected STATUS_TYPE IOCB for a non-SCSI handle to be processed to cause a wild pointer dereference.

1427) Improper locking (CVE-ID: CVE-2026-89850)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in qla2x00_fw_state_show() when querying firmware state while the chip is down or EEH is busy. A local user can query the firmware state to cause a denial of service.

1428) NULL pointer dereference (CVE-ID: CVE-2026-89851)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in qla2x00_dfs_fce_write() when parsing a value written to the debugfs FCE trace interface. A local user can write a valid numeric value to the interface to cause a denial of service.

Invalid values can unintentionally enable FCE tracing.

1429) Use of Uninitialized Variable (CVE-ID: CVE-2026-89852)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of an uninitialized variable in qla2x00_get_firmware_state() when querying firmware state through sysfs during a mailbox command failure. A local user can read firmware state through the fw_state or mpi_fw_state sysfs handlers during such a failure to disclose sensitive information.

1430) Use-after-free (CVE-ID: CVE-2026-89853)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a race condition in qla2xxx FCE trace buffer handling when a debugfs FCE disable occurs during firmware dump processing. A local user can disable FCE tracing through debugfs during a firmware dump to trigger a use-after-free.

1431) Use-after-free (CVE-ID: CVE-2026-89854)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in the qla2xxx driver's 84xx_fw_version sysfs attribute handler when concurrently reading the attribute during host teardown. A local user can read the 84xx_fw_version sysfs attribute during host teardown to compromise confidentiality, integrity, and availability.

1432) Race condition (CVE-ID: CVE-2026-89855)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause corruption of flash version reads.

The vulnerability exists due to improper synchronization in the qla2x00_sysfs_write_reset reset handler when the update cache versions without reset sysfs reset operation is invoked concurrently with a VPD or optrom flash operation. A local user can invoke the reset operation while a concurrent flash operation accesses the same hardware flash registers to cause corruption of flash version reads.

1433) Numeric Truncation Error (CVE-ID: CVE-2026-89856)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory or cause a denial of service.

The vulnerability exists due to numeric truncation in the qla2xxx MSI-X queue-count calculation when deriving queue counts from MSI-X vector counts. A remote attacker can cause a zero queue count to be used for queue allocation to corrupt memory or cause a denial of service.

Target mode can also underflow the queue count after decrementing it.

1434) Out-of-bounds read (CVE-ID: CVE-2026-89858)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel stack memory to a device.

The vulnerability exists due to an out-of-bounds read in qla2x00_update_fru_versions() when processing BSG requests with an oversized declared image count. A local user can submit a crafted BSG request to disclose kernel stack memory to a device.

1435) Use-after-free (CVE-ID: CVE-2026-89861)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in qla24xx_report_id_acquisition() in the qla2xxx SCSI driver when a virtual port is concurrently deallocated after it is found in the virtual port list. A remote attacker can trigger the race condition to compromise confidentiality, integrity, and availability.

1436) NULL pointer dereference (CVE-ID: CVE-2026-89863)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in qla_chk_edif_rx_sa_delete_pending() when processing a firmware status completion for a command that has already been returned or aborted. A remote attacker can trigger processing of such a status completion to cause a denial of service.

The kernel crash occurs in interrupt context.

1437) Out-of-bounds write (CVE-ID: CVE-2026-89864)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel heap and stack memory.

The vulnerability exists due to improper bounds checking in the qla2x00_write_i2c() and qla2x00_read_i2c() I2C BSG handlers when processing a user-supplied I2C length. A local privileged user can submit a crafted I2C BSG request with an oversized length to corrupt kernel heap and stack memory.

Exploitation requires CAP_SYS_RAWIO.

1438) Use of uninitialized resource (CVE-ID: CVE-2026-89865)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and modify device flash contents.

The vulnerability exists due to use of uninitialized memory in the qla2xxx FRU and I2C BSG handlers when processing a user-controlled payload that overrides the transfer length. A local user can send a crafted BSG request to disclose sensitive information and modify device flash contents.

1439) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89871)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the video-i2c driver's streaming functions when a capture-thread startup fails. A local user can invoke streaming operations after a capture-thread startup failure to cause a denial of service.

1440) Memory leak (CVE-ID: CVE-2026-89872)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak fwnode references.

The vulnerability exists due to a missing reference release in v4l2_fwnode_parse_link when parsing a link. A local user can trigger link parsing to leak fwnode references.

1441) Integer overflow (CVE-ID: CVE-2026-89876)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger undefined behavior.

The vulnerability exists due to an integer overflow in the tda18250 media driver when exp equals zero. A local user can cause exp to equal zero to trigger undefined behavior.

1442) Out-of-bounds read (CVE-ID: CVE-2026-89878)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in s2255_probe() when processing a firmware blob shorter than eight bytes. A local user can supply a firmware blob shorter than eight bytes to read out-of-bounds memory.

1443) Out-of-bounds write (CVE-ID: CVE-2026-89879)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to write beyond the destination buffer.

The vulnerability exists due to an out-of-bounds write in the s2255_fillbuff() JPEG/MJPEG frame handling code when processing a device-supplied JPEG frame header. An attacker with physical access can provide a crafted frame header with an oversized jpg_size value to write beyond the destination buffer.

1444) Improper resource shutdown or release (CVE-ID: CVE-2026-89880)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper error-path resource cleanup in rtl2832_sdr_start_streaming() when starting streaming after a prior failed streaming attempt. A local user can initiate streaming again after a failed streaming attempt to compromise confidentiality, integrity, and availability.

The out-of-bounds access occurs during URB cleanup when urbs_initialized exceeds MAX_BULK_BUFS.

1445) Memory leak (CVE-ID: CVE-2026-89881)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by leaking DMA resources.

The vulnerability exists due to improper resource cleanup in the rtl2832_sdr driver removal handling when a USB device is disconnected while streaming remains active. A local user can close a file descriptor after the disconnection to cause a denial of service by leaking DMA resources.

1446) Improper resource shutdown or release (CVE-ID: CVE-2026-89883)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper resource cleanup in the sunxi-cir driver when probe initialization fails after rc device registration. A local user can trigger a probe failure to compromise confidentiality, integrity, and availability.

1447) Double free (CVE-ID: CVE-2026-89887)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel panic.

The vulnerability exists due to improper resource lifecycle management in the ov7740_remove() function when removing the ov7740 driver. A local user can trigger driver removal to cause a kernel panic.

1448) Use-after-free (CVE-ID: CVE-2026-89888)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code, disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to use-after-free in the ov02a10_check_hwcfg() function of the ov02a10 media I2C driver when handling endpoint configuration. A local user can trigger hardware configuration checking to execute arbitrary code, disclose sensitive information, modify data, or cause a denial of service.

1449) Use-after-free (CVE-ID: CVE-2026-89890)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in go7007 ALSA PCM callbacks when a capture PCM remains open during V4L2 device release. A local user can retain an open capture PCM during V4L2 device release to compromise confidentiality, integrity, and availability.

1450) Use-after-free (CVE-ID: CVE-2026-89891)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to use-after-free in the em28xx device-list handling during extension closure when disconnecting a dual transport-stream device through the audio-only path. An attacker with physical access can connect a USB device with crafted endpoint descriptors to cause a denial of service.

1451) Use-after-free (CVE-ID: CVE-2026-89892)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a use-after-free.

The vulnerability exists due to improper device list management in the em28xx audio-only extension registration path when connecting and disconnecting a dual-TS board. An attacker with physical access can connect and disconnect a dual-TS board to trigger a use-after-free.

The condition affects audio-only paths on dual-TS boards.

1452) Use-after-free (CVE-ID: CVE-2026-89893)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read or modify sensitive information and cause a denial of service.

The vulnerability exists due to a use-after-free in the NetUP CI status work handling in drivers/media/pci/cx23885/cimax2.c when tearing down a NetUP CI device while CI status work is pending or running. A local user can trigger device teardown while the queued status worker can still access freed state to read or modify sensitive information and cause a denial of service.

1453) Out-of-bounds write (CVE-ID: CVE-2026-89894)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a heap-based out-of-bounds write.

The vulnerability exists due to a heap-based buffer overflow in cx231xx VBI buffer handling in cx231xx_do_vbi_copy() when changing video geometry while a VBI stream is running. A local user can allocate a small VBI buffer and change the video width or standard to write past the allocated buffer.

Exploitation requires the device to deliver a field-2 VBI payload.

1454) Double free (CVE-ID: CVE-2026-89895)

CWE-ID: CWE-415 - Double Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in the cobalt ALSA initialization error cleanup path when initializing cobalt ALSA support. A local user can cause cobalt_alsa_init() to fail after snd_cobalt_card_create() to cause a denial of service.

1455) Memory leak (CVE-ID: CVE-2026-89896)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the V4L2 control handler in cedrus_init_ctrls() when allocation of ctx->ctrls fails. A local user can trigger the allocation failure path to cause a denial of service.

1456) Race condition (CVE-ID: CVE-2026-89897)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in cec_receive_notify() when handling CEC messages concurrently with follower mode changes or release. A remote attacker can send CEC messages during concurrent follower mode changes or release to compromise confidentiality, integrity, and availability.

1457) NULL pointer dereference (CVE-ID: CVE-2026-89901)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the Airspy USB driver when closing a streaming device after it has been disconnected. A local user can close the streaming device after disconnection to cause a denial of service.

1458) Memory leak (CVE-ID: CVE-2026-89923)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in KVM s390 vCPU destruction when destroying a vCPU while hardware breakpoints remain armed. A local user can destroy a vCPU with armed hardware breakpoints to cause a denial of service.

The leaked allocations are charged to memory cgroups and can pin dying memory cgroups.

1459) Memory leak (CVE-ID: CVE-2026-89924)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the s390 KVM guest debug watchpoint import error path when importing watchpoint data from a KVM_SET_GUEST_DEBUG request. A local user can submit a KVM_SET_GUEST_DEBUG request in which a later watchpoint fails to import to cause a denial of service.

The request can be repeated, leaking up to MAX_BP_COUNT - 1 buffers of up to MAX_WP_SIZE bytes per failed request.

1460) Memory leak (CVE-ID: CVE-2026-89925)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of memory in KVM s390 guest debug handling when successfully processing KVM_SET_GUEST_DEBUG requests. A local user can repeatedly issue successful KVM_SET_GUEST_DEBUG requests to cause a denial of service.

1461) Numeric Truncation Error (CVE-ID: CVE-2026-89926)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to numeric truncation in the KVM s390 __import_wp_info() function when importing user-supplied hardware breakpoint information. A local user can supply an oversized breakpoint length value to trigger a kernel warning.

1462) Integer overflow (CVE-ID: CVE-2026-89927)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow in the KVM x86 Hyper-V synthetic timer deadline calculation when programming a synthetic timer with a count value close to U64_MAX. A remote attacker can program a synthetic timer with a crafted count value to cause a denial of service.

1463) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89930)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause stale TLB translations to be used.

The vulnerability exists due to failure to service queued local TLB flush requests in KVM nVMX nested VM-entry handling when a nested VM entry fails after switching to the L2 context. A remote attacker can change L2's VPID and trigger a failed nested VM entry to cause stale TLB translations to be used.

1464) Improper initialization (CVE-ID: CVE-2026-89932)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose or modify sensitive information, or cause a denial of service.

The vulnerability exists due to improper initialization of last_vpid in KVM nested VMX VPID management when reusing a VPID after an L1 guest transitions from VMXOFF to VMXON and runs an L2 guest. A local user can cause stale TLB entries associated with a previous VPID lifetime to be used to disclose or modify sensitive information, or cause a denial of service.

1465) Improper resource shutdown or release (CVE-ID: CVE-2026-89936)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave the Vcc regulator enabled indefinitely.

The vulnerability exists due to improper resource shutdown or release in m62332_set_value() when writing successive non-zero values to a channel before writing zero. A local user can write successive non-zero values to a channel before writing zero to leave the Vcc regulator enabled indefinitely.

1466) Unchecked Return Value (CVE-ID: CVE-2026-89937)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an error return in the SGP30 driver sgp_probe() and sgp_remove() functions when IAQ thread creation fails. A local user can cause IAQ thread creation to fail and subsequently trigger device removal to cause a denial of service.

1467) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89939)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent the device from autosuspending.

The vulnerability exists due to a missing release of a runtime PM reference in atlas_buffer_postenable() when enabling an IIO buffer and interrupt configuration fails. A local user can enable an IIO buffer to prevent the device from autosuspending.

1468) Race condition (CVE-ID: CVE-2026-89945)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause improper hardware register operations.

The vulnerability exists due to a race condition in the cs35l34 runtime suspend handler when runtime power management suspends the codec while critical fault IRQs remain unmasked. A local user can trigger runtime power management to cause improper hardware register operations.

1469) Race condition (CVE-ID: CVE-2026-89946)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect processing of amplifier fault release paths.

The vulnerability exists due to a race condition in the cs35l33 codec driver's runtime suspend and threaded IRQ handling when a threaded IRQ handler executes after runtime suspend has disabled live register access. A local user can cause a threaded IRQ handler to execute during runtime suspend to cause incorrect processing of amplifier fault release paths.

Critical fault IRQs must remain unmasked during runtime power management.

1470) Out-of-bounds read (CVE-ID: CVE-2026-89947)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, modify data, and cause a denial of service.

The vulnerability exists due to an incorrect parent count in the gxbb_32k_clk_sel clock mux when registering the clock mux. A remote attacker can trigger registration of the affected clock mux to disclose sensitive information, modify data, and cause a denial of service.

1471) Incomplete cleanup (CVE-ID: CVE-2026-89948)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause bridge loop avoidance claims to remain after mesh interface deletion.

The vulnerability exists due to incomplete cleanup of claims in the batman-adv bridge loop avoidance claim cleanup logic when deleting a mesh interface. A local user can delete a mesh interface to cause bridge loop avoidance claims to remain after mesh interface deletion.

1472) Reliance on undefined behavior (CVE-ID: CVE-2026-89949)

CWE-ID: CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of unaligned memory access in the batman-adv distributed ARP table IP extraction functions when processing ARP packets with unaligned data in socket buffers. A remote attacker can send an ARP packet to cause a denial of service.

Only hardware without native support for unaligned reads is affected.

1473) Use-after-free (CVE-ID: CVE-2026-89951)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in batadv_batman_skb_recv() when processing reassembled fragmented packets. A remote attacker can send fragmented packets to compromise confidentiality, integrity, and availability.

Exploitation requires a hard interface to be deleted before fragment reassembly completes.

1474) Out-of-bounds read (CVE-ID: CVE-2026-89952)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read beyond allocated memory.

The vulnerability exists due to an out-of-bounds read in nand_flash_detect_ext_param_page() when parsing an ONFI extended parameter page with invalid section lengths. An attacker with physical access can supply a malformed ONFI extended parameter page to read beyond allocated memory.

1475) Memory leak (CVE-ID: CVE-2026-89953)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a memory leak in the mtdoops notification removal handler when a configured backing MTD device is removed and registered again while mtdoops remains loaded. A local privileged user can repeatedly remove and register the configured backing MTD device to exhaust vmalloc memory.

The issue is only exposed when the backing MTD device can disappear and later be registered again; typical static MTD configurations do not expose it.

1476) Out-of-bounds read (CVE-ID: CVE-2026-89954)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, modify data, or cause a denial of service through an out-of-bounds memory access.

The vulnerability exists due to improper bounds checking in the AFS v2 parser when parsing a crafted AFS v2 image. A remote attacker can supply an image with a footer offset or region count that exceeds expected bounds to disclose sensitive information, modify data, or cause a denial of service through an out-of-bounds memory access.

1477) Infinite loop (CVE-ID: CVE-2026-89964)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to failure to advance the parsing position in eisa_irq_setup() when processing an invalid eisa_irq_edge kernel command line parameter. A local privileged user can supply an invalid comma-separated IRQ value to cause a denial of service.

1478) Out-of-bounds write (CVE-ID: CVE-2026-89965)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the nvdimm/btt arena I/O path when processing a crafted or foreign arena whose nfree value is below the lane count. A local user can provide a crafted or foreign arena to write past per-lane freelist and rtt array allocations and execute arbitrary code.

1479) Improper Enforcement of Behavioral Workflow (CVE-ID: CVE-2026-89968)

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of protocol state in nvmet_tcp_handle_h2c_data_pdu() when processing an unsolicited H2CData PDU before transmitting a requested data transfer (R2T). A remote attacker can send an H2CData PDU for a write command before the R2T is transmitted to cause a denial of service.

The affected subsystem must be configured with allow_any_host.

1480) Out-of-bounds write (CVE-ID: CVE-2026-89969)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in nvmet_tcp_try_recv_pdu() when receiving an over-long NVMe/TCP PDU. A remote attacker can send a duplicate ICReq PDU after header digest negotiation to execute arbitrary code.

The attacker-controlled overflow can overwrite the adjacent header and data digest fields before the duplicate ICReq is rejected.

1481) Improper input validation (CVE-ID: CVE-2026-89973)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in nvme_tcp_handle_c2h_data() when processing a C2HData PDU for a write command. A remote attacker can send a C2HData PDU in response to a write command to cause a denial of service.

On hosts booted with panic_on_warn, the triggered kernel warning is fatal.

1482) Race condition (CVE-ID: CVE-2026-89979)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause inconsistent PCM state transitions.

The vulnerability exists due to a race condition in ALSA PCM trigger-start handling when concurrently performing non-atomic PCM operations. A local user can concurrently issue a PCM start trigger and non-atomic PCM operations to cause inconsistent PCM state transitions.

1483) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89982)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to missing release of a Device Tree channel node reference in i2c_mux_add_adapter() when adapter registration fails. A local user can trigger an adapter registration failure to cause a memory leak.

1484) Use-after-free (CVE-ID: CVE-2026-89983)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the I2C core adapter debugfs directory handling when a write to the new_device sysfs attribute races with adapter removal. A local user can write to the new_device sysfs attribute during adapter removal to cause a denial of service.

1485) Improper access control (CVE-ID: CVE-2026-89984)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel addresses.

The vulnerability exists due to improper privilege-level validation in the intel_pmu_lbr_filter() LBR stack filtering function when filtering sampled LBR entries for user-only branch stacks. A local user can request a user-only branch stack through perf to disclose kernel addresses.

The issue affects systems where architectural LBR lacks CPL filtering support.

1486) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89989)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error return values in validate_hash_algo() in IMA appraisal when processing a dentry path that exceeds the buffer. A local user can trigger an extended attribute operation that causes dentry_path() to return an error pointer to cause a denial of service.

1487) NULL pointer dereference (CVE-ID: CVE-2026-89993)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a null pointer dereference.

The vulnerability exists due to improper initialization of IRQ data in dw_edma_irq_request() when a shared interrupt is handled before dw_edma_channel_setup() initializes the back pointer. A local user can trigger a shared interrupt during initialization to trigger a null pointer dereference.

1488) Race condition (CVE-ID: CVE-2026-89997)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a race condition in the device-mapper resume and remove handling when issuing resume and remove ioctls concurrently. A local user can issue resume and remove ioctls concurrently to cause a use-after-free condition.

In the dm-integrity target, the reboot notifier can remain registered after device removal.

1489) Out-of-bounds read (CVE-ID: CVE-2026-89999)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in wacom_intuos_pro2_bt_irq in the HID Wacom driver when processing undersized Bluetooth reports. A remote attacker can send a crafted undersized Bluetooth report to disclose sensitive information and cause a denial of service.

The peripheral must be paired or spoofed and advertise a matching VID/PID.

1490) Out-of-bounds write (CVE-ID: CVE-2026-90000)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, corrupt memory, or cause a denial of service.

The vulnerability exists due to out-of-bounds read and write operations in the hid-rmi driver when handling undersized RMI reports. A remote attacker can send specially crafted RMI reports to disclose sensitive information, corrupt memory, or cause a denial of service.

A zero-length reply can cause the read loop to run indefinitely with page_mutex held.

1491) Improper resource shutdown or release (CVE-ID: CVE-2026-90007)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave previously registered interrupt handlers installed.

The vulnerability exists due to incorrect rollback index handling in the pm8001_request_msix() function when handling a request_irq() failure during MSI-X vector registration. A local user can trigger the faulty rollback loop to leave previously registered interrupt handlers installed.

1492) Out-of-bounds read (CVE-ID: CVE-2026-90011)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the iSCSI target login payload buffer when processing a crafted login PDU without a terminating null byte. A remote attacker can send a crafted login PDU to disclose sensitive information and cause a denial of service.

Exploitation is reachable through the CHAP authentication path on a portal configured for CHAP.

1493) Improper resource shutdown or release (CVE-ID: CVE-2026-90015)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data corruption and leak DMA mappings.

The vulnerability exists due to improper handling of bounce buffers in the xHCI transfer descriptor bounce-buffer cleanup logic when processing sufficiently large fragmented bulk USB transfers that span multiple ring segments. A local user can submit a crafted bulk transfer to cause data corruption and leak DMA mappings.

For IN transfers, unreturned bounce-buffer data can leave a wMaxPacketSize-sized region of the destination buffer containing its previous contents.

1494) Out-of-bounds read (CVE-ID: CVE-2026-90017)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rtw_action_frame_parse() in the rtl8723bs driver when processing a short management action frame. A remote attacker can send a crafted management action frame to cause a denial of service.

The frame can be as short as the 24-byte IEEE 802.11 three-address header.

1495) Stack-based buffer overflow (CVE-ID: CVE-2026-90018)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a stack-based buffer overflow in rtw_get_wps_attr() when processing a crafted WPS information element in a wireless management frame. A remote attacker can send a crafted beacon or probe response during scanning to compromise confidentiality, integrity, and availability.

1496) NULL pointer dereference (CVE-ID: CVE-2026-90019)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in usb_put_function_instance() when handling an error during UVC function instance allocation. A remote attacker can trigger the error path to cause a denial of service.

The issue occurs before the fd member of the function instance is allocated.

1497) Race condition (CVE-ID: CVE-2026-90020)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in gadget_dev_ioctl() when handling ioctl requests concurrently with device binding. A local user can issue ioctl requests during a concurrent bind operation to cause a denial of service.

1498) Out-of-bounds read (CVE-ID: CVE-2026-90025)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the UCSI DisplayPort driver's port altmode array when processing an invalid GET_CURRENT_CAM response from the PPM. A remote attacker can cause the PPM to return an altmode array index above UCSI_MAX_ALTMODES to cause a denial of service.

1499) Race condition (CVE-ID: CVE-2026-90031)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a warning that a URB is already active.

The vulnerability exists due to a race condition in the ENE UB6250 USB-storage driver when delayed scan work runs concurrently with card-type probing. An attacker with physical access can cause concurrent access to us->current_urb during device probing to trigger a warning that a URB is already active.

1500) Use-after-free (CVE-ID: CVE-2026-90032)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in snd_usbtv_pcm_close() in the usbtv audio driver when closing an ALSA PCM file after USB disconnect. A local user can close a previously opened ALSA PCM file after USB disconnect to compromise confidentiality, integrity, and availability.

1501) Out-of-bounds write (CVE-ID: CVE-2026-90033)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in snd_usbmidi_us122l_output() when processing MIDI output for a USB device that declares a bulk endpoint smaller than the expected transfer count. An attacker with physical access can connect a crafted USB device to cause a denial of service.

1502) Use of uninitialized resource (CVE-ID: CVE-2026-90034)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the mdc800 USB driver buffer initialization when receiving shorter messages. An attacker with physical access can send a shorter message to disclose sensitive information.

1503) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-90049)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause data corruption.

The vulnerability exists due to improper resource lifetime management in skb_zerocopy() when processing a packet through Open vSwitch's OVS_ACTION_ATTR_USERSPACE path after skb_orphan_frags() fails. A remote attacker can trigger the error path to cause data corruption.

1504) Infinite loop (CVE-ID: CVE-2026-90053)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop in the HTB packet classifier htb_classify() when processing packets with cyclic inner-class filter selections. A local user can configure cyclic HTB filters and send a packet to cause a denial of service.

Exploitation is reachable through an unprivileged user namespace that provides CAP_NET_ADMIN.

1505) Incorrect calculation (CVE-ID: CVE-2026-90054)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt TCP stream data.

The vulnerability exists due to incorrect calculation of the retransmission length in the TCP retransmission path when retransmitting TCP urgent data across multiple segments. A remote attacker can send TCP urgent data that is retransmitted across multiple segments to corrupt TCP stream data.

1506) Reliance on undefined behavior (CVE-ID: CVE-2026-90055)

CWE-ID: CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger undefined behavior.

The vulnerability exists due to improper initialization of ci_range bit counts in usbatm_atm_init() when processing ATM PVC bind requests. A remote attacker can bind an ATM PVC to trigger undefined behavior.

1507) Use of uninitialized resource (CVE-ID: CVE-2026-90056)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of an uninitialized resource in the FEC Ethernet driver PTP cleanup paths when handling failed device initialization or device removal. A local user can trigger failed device initialization or device removal to cause a denial of service.

PTP initialization is performed only when extended buffer descriptors are available.

1508) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-90058)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of user-supplied size table values in __qdisc_calculate_pkt_len() when processing a crafted TCA_STAB configuration that amplifies packet length values. A local user can configure a DRR or ETS qdisc with a crafted size table, set a tiny quantum, and send a small packet to cause a denial of service.

The issue requires NET_SCHED and either the DRR or ETS scheduler to be enabled.

1509) Incorrect behavior order (CVE-ID: CVE-2026-90062)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an inconsistent state between hardware-offloaded and software rulesets.

The vulnerability exists due to incorrect behavior order in nf_tables commit processing when committing rulesets with hardware flow-rule offload. A local user can commit a ruleset with hardware flow-rule offload to cause an inconsistent state between hardware-offloaded and software rulesets.

The inconsistency can occur if chain blob preparation fails after the hardware ruleset has been offloaded.

1510) Integer overflow (CVE-ID: CVE-2026-90063)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a 16-bit gso_segs field overflow.

The vulnerability exists due to improper validation of gso_size in virtio_net_hdr_to_skb when processing TCP packets crafted through an AF_PACKET PACKET_VNET_HDR socket. A local user can submit a TCP packet with a gso_size smaller than TCP_MIN_GSO_SIZE to cause a 16-bit gso_segs field overflow.

The condition applies to TCP packets; UDP GSO permits a gso_size of 1.

1511) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-90067)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a kernel warning.

The vulnerability exists due to improper validation of banner payload length in the Ceph messenger v2 banner parser when parsing a crafted protocol banner. A remote attacker can send a banner with a zero-length payload to trigger a kernel warning.

The protocol requires banner payloads to contain at least two 64-bit feature fields.

1512) Off-by-one (CVE-ID: CVE-2026-90068)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to an off-by-one error in snd_soc_dapm_put_enum_double() when writing a second enum channel value. A local user can set the second enum channel value equal to the number of enum items to read one element past the end of the value table.

The affected adav80x control reports two values, and core input validation is disabled by default.

1513) Unchecked Return Value (CVE-ID: CVE-2026-90070)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause TPM status checks to complete spuriously.

The vulnerability exists due to an unchecked return value in the st33zp24_status callback when processing failed TPM transport reads. A local user can trigger a TPM status read to cause TPM status checks to complete spuriously.

On I2C transports, this can occur when the register-select write is short or fails.

1514) Use-after-free (CVE-ID: CVE-2026-90071)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to failure to restore the skb->dev device pointer in the sch_teql TEQL scheduler when transmitting packets through TEQL slave devices. A local user can cause a packet to retain a stale device pointer after a slave transmission failure.

Exploitation requires a later slave device without a resolved neighbour and deletion of the previous slave while the packet remains queued.

1515) Integer overflow (CVE-ID: CVE-2026-90072)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in sfq_init() of the SFQ queueing discipline when initializing SFQ on a device with an MTU that wraps psched_mtu() into the sign bit. A local user can configure a device with a crafted MTU value to cause a denial of service.

Exploitation requires CAP_NET_ADMIN in a user namespace.

1516) Integer overflow (CVE-ID: CVE-2026-90073)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in the HHF queuing discipline's hhf_dequeue() function when configuring an HHF qdisc on a device with an oversized MTU. A local user can configure the HHF qdisc to trigger an infinite loop to cause a denial of service.

Exploitation requires CAP_NET_ADMIN in a user namespace and a device whose MTU plus hard-header length wraps psched_mtu() into the sign bit.

1517) Integer overflow (CVE-ID: CVE-2026-90074)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to signed integer overflow in the fq_pie queuing discipline when initializing the default quantum from a device MTU. A local privileged user can configure a device with a huge MTU to cause a denial of service.

Exploitation requires CAP_NET_ADMIN in a user namespace and a device whose MTU plus hard header length causes psched_mtu() to wrap into the sign bit.

1518) Integer overflow (CVE-ID: CVE-2026-90075)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an integer overflow in the fq_codel queueing discipline initialization when initializing fq_codel on a device whose MTU causes psched_mtu() to wrap into the sign bit. A local privileged user can configure a device with an oversized MTU to cause a denial of service.

1519) Integer underflow (CVE-ID: CVE-2026-90078)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper length calculation in tcf_skbmod_act() when processing short IP packets at TC ingress. A remote attacker can send a short IP packet to cause a denial of service.

Exploitation requires the skbmod action to process ECN modifications at TC ingress.

1520) Race condition (CVE-ID: CVE-2026-90081)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in rds_cong_map_updated() when handling congestion map updates. A local user can race congestion map updates with waiter registration to cause a denial of service.

A sender waiting on a congested port can remain blocked until another congestion update arrives or a signal is delivered, and poll() waiters can miss map-update notifications.

1521) Improper input validation (CVE-ID: CVE-2026-90088)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in rfcomm_apply_pn() when processing remote parameter negotiation frames. A remote attacker can send a parameter negotiation frame with an MTU value of zero to cause a denial of service.

1522) NULL pointer dereference (CVE-ID: CVE-2026-90102)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper cache keying in the NFSv4 pNFS data server cache when processing GETDEVICEINFO data. A remote attacker can supply device information for two device IDs using the same data server address with different major NFS versions to cause a denial of service.

1523) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-90103)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to incorrect buffer size calculation in the NFSv4.2 flexfiles layoutstats encoder when encoding layout statistics for a flexfiles layout. A remote attacker can provide crafted server-controlled filehandle and network-address data to exhaust the send buffer and leave a lock permanently held to cause a denial of service.

1524) Memory leak (CVE-ID: CVE-2026-90107)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in smc_llc_flow_stop() when a late duplicate CONFIRM_LINK or ADD_LINK_CONT message arrives before the flow completes. A remote attacker can send a duplicate message during this window to cause a denial of service.

1525) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-90114)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unpredictable request return values.

The vulnerability exists due to an incorrect signed-to-unsigned conversion in br_process_vlan_tunnel_info when processing bridge VLAN tunnel range requests. A local user can submit a bridge VLAN tunnel range with descending VLAN IDs to cause unpredictable request return values.

1526) Memory leak (CVE-ID: CVE-2026-90126)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the pcf8563 RTC driver's CLKOUT clock provider registration when repeatedly binding and unbinding a device. A local privileged user can repeatedly bind and unbind a device or reload the module to cause a denial of service.

1527) Memory leak (CVE-ID: CVE-2026-90128)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through memory resource exhaustion.

The vulnerability exists due to improper resource cleanup in add_direct_chain() in the vdpa/mlx5 memory-region handling code when handling allocation errors while creating a direct memory-region chain. A local user can trigger an allocation error to cause a denial of service through memory resource exhaustion.

Newly allocated direct memory-region entries are kept on a temporary list until the operation succeeds.

1528) Use-after-free (CVE-ID: CVE-2026-90140)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the cuse module's pending RCU callback handling when unloading the cuse module while a fuse connection release callback remains pending. A local privileged user can close /dev/cuse and unload the cuse module before the callback executes to cause a denial of service.

1529) Integer overflow (CVE-ID: CVE-2026-90141)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause the FTP helper to configure a data connection with a truncated port or address.

The vulnerability exists due to integer overflow in the ip_vs_ftp_get_addrport() function of the IPVS FTP helper when parsing a crafted FTP PASV or EPSV response. A remote attacker can send a crafted FTP PASV or EPSV response to cause the FTP helper to configure a data connection with a truncated port or address.

1530) Improper locking (CVE-ID: CVE-2026-90143)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel warning.

The vulnerability exists due to improper locking in kcm_parse_func_strparser() when executing a KCM strparser BPF program. A local user can invoke BPF map operations from the program to cause a kernel warning.

1531) Use-after-free (CVE-ID: CVE-2026-90151)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the NFSv4 callback identifier IDR when an NFSv4.0 callback lookup occurs after a client allocation failure. A remote attacker can trigger an NFSv4.0 callback lookup using the stale callback identifier to trigger a use-after-free.

Exploitation requires an NFSv4.0 client allocation to fail after a callback identifier has been allocated.

1532) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-90157)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a hardened usercopy warning.

The vulnerability exists due to an improper signed-to-unsigned conversion in __cgroup_bpf_run_filter_getsockopt_kern() when a cgroup getsockopt BPF program modifies ctx.optlen after the kernel getsockopt handler has run. A local user can set ctx.optlen to a negative value to trigger a hardened usercopy warning.

The issue affects the kernel-buffer getsockopt path used by TCP_ZEROCOPY_RECEIVE.

1533) Off-by-one (CVE-ID: CVE-2026-90160)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an off-by-one headroom validation error in the lwt_bpf bpf_xmit() path when an LWT_XMIT BPF program modifies skb headroom. A local privileged user can call bpf_skb_change_head() to leave insufficient headroom and cause a denial of service.

On Ethernet, cached hardware-header output requires 16 bytes of headroom although the device hard-header length is 14 bytes.

1534) Use-after-free (CVE-ID: CVE-2026-90198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in snd_card_do_free() when a managed sound card is unbound while an application retains an open file descriptor. A local user can close the open file descriptor while the managed sound card is being unbound to trigger a use-after-free.

1535) NULL pointer dereference (CVE-ID: CVE-2026-90202)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the _base_release_memory_pools() function of the mpt3sas driver when releasing PCIe SGL buffers after a partial allocation failure. A local user can trigger memory-pool cleanup after a partial allocation failure to cause a denial of service.

1536) Memory corruption (CVE-ID: CVE-2026-90203)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of a negative block offset in squashfs_copy_data() when reading a crafted file from a mounted crafted Squashfs filesystem. A local user can read a crafted file with a negative offset to cause an out-of-bounds memory access.

Mounting the crafted Squashfs filesystem requires CAP_SYS_ADMIN.

1537) Deadlock (CVE-ID: CVE-2026-90209)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in the s390 debug subsystem's debug area unregistration handling when a debugfs file associated with a debug area is written concurrently with debug area unregistration. A local user can write to an associated debugfs file while debug area unregistration occurs to cause a denial of service.

1538) Use-after-free (CVE-ID: CVE-2026-90214)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper error handling in xlnx_formatter_pcm_open() in the ASoC Xilinx formatter PCM driver when handling errors during PCM stream initialization. A local user can open a PCM stream that encounters a constraint setup error to trigger a use-after-free condition.

ALSA does not invoke the close callback when opening a stream fails.

1539) Incomplete cleanup (CVE-ID: CVE-2026-90216)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leave UBI devices attached after failed module initialization.

The vulnerability exists due to incomplete cleanup in ubi_init_attach() when rolling back initialization after an mtd= parameter specifies an explicit UBI device number. A local privileged user can configure an explicit UBI device number and trigger a later initialization failure to leave UBI devices attached after failed module initialization.

1540) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-90218)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper handling of an error condition in the RDMA connection manager addr_handler() function when asynchronous address resolution fails to acquire an RDMA device. A local user can initiate asynchronous address resolution for which RDMA device acquisition fails to trigger a kernel warning.

1541) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90219)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to missing release of debugfs resources in c4iw_dealloc() when RDMA device registration fails. A local user can trigger a failed RDMA device registration to cause a resource leak.

1542) Use of uninitialized resource (CVE-ID: CVE-2026-90221)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read uninitialized slab memory.

The vulnerability exists due to improper length validation in the nci_core_init_rsp_packet_v1() and nci_core_init_rsp_packet_v2() CORE_INIT_RSP parsers when processing a malformed CORE_INIT_RSP packet injected through virtual_ncidev. A local user can inject a malformed response with an inflated number of supported RF interfaces to read uninitialized slab memory.

1543) Use-after-free (CVE-ID: CVE-2026-90222)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the PN533 NFC driver send path when command completion races frame transmission. A local user can trigger the race condition to cause a denial of service.

1544) Out-of-bounds read (CVE-ID: CVE-2026-90223)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in nfc_llcp_recv_snl() when processing malformed SNL TLVs. A remote attacker can send a malformed SNL frame to perform an out-of-bounds read.

LLCP link activation occurs automatically after NFC-DEP.

1545) Use-after-free (CVE-ID: CVE-2026-90224)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a race condition in nci_data_exchange_complete when concurrently closing an NCI device and processing received data. A local user can race device closure with received-data processing to trigger a use-after-free condition.

1546) Use-after-free (CVE-ID: CVE-2026-90225)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in nfc_llcp_getsockopt() when racing a getsockopt call with an in-flight bind operation. A local user can invoke getsockopt() while bind() modifies and frees the cached local pointer to trigger a use-after-free condition.

1547) Out-of-bounds write (CVE-ID: CVE-2026-90226)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write past a user-supplied buffer.

The vulnerability exists due to improper validation of option-buffer length in nfc_llcp_getsockopt() when handling getsockopt calls with an option length smaller than four bytes. A local user can supply an option buffer with an option length smaller than four bytes to write past a user-supplied buffer.

The issue affects all five supported option names.

1548) NULL pointer dereference (CVE-ID: CVE-2026-90228)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in nvmet_execute_identify_ns_zns() when processing a host-supplied Identify command with CNS 05h and CSI 02h targeting a file-backed namespace. A remote attacker can send a crafted Identify command targeting a file-backed namespace to cause a denial of service.

The issue is reachable only when CONFIG_BLK_DEV_ZONED is enabled.

1549) Integer overflow (CVE-ID: CVE-2026-90245)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect overlay viewport register configuration.

The vulnerability exists due to integer overflow in the kyro framebuffer driver's overlay viewport coordinate calculations when processing oversized overlay viewport coordinates. A local user can supply oversized viewport coordinate values to cause incorrect overlay viewport register configuration.

1550) Race condition (CVE-ID: CVE-2026-90248)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to silently unlink an active traffic classifier.

The vulnerability exists due to improper ownership tracking in tc_new_tfilter() when handling concurrent traffic-control filter insertions. A local user can race another request to insert a traffic-control filter at the same chain and priority to silently unlink an active traffic classifier.

1551) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-90249)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper runtime power-management reference handling in the gp2ap002_write_event_config() function when writing duplicate event enable values. A local user can write the same event enable state twice to cause a denial of service.

1552) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-90251)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause the kernel to read data beyond the controller response.

The vulnerability exists due to improper validation of an event prefix length in the Bluetooth MSFT read_supported_features() handler when handling an MSFT read supported features response from a Bluetooth controller. A remote attacker can provide a response whose declared event-prefix length exceeds its actual length to cause the kernel to read data beyond the controller response.

The copied data is later used to match incoming vendor events.

1553) Out-of-bounds read (CVE-ID: CVE-2026-90257)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in virtbt_setup_zephyr() when processing a status-only Read Build Information response from a Bluetooth virtio backend. A local user can provide a response containing only a status byte to disclose sensitive information.

Adjacent slab memory bytes may be exposed through the kernel log and the firmware-info debugfs file.

1554) Integer underflow (CVE-ID: CVE-2026-90274)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds memory access.

The vulnerability exists due to an integer underflow in the ETM4x CoreSight trace driver when handling sequencer state transition controls. A local user can configure sequence state controls to trigger an out-of-bounds memory access.

The issue occurs on trace units for which TRCIDR5.NUMSEQSTATE is zero.

1555) NULL pointer dereference (CVE-ID: CVE-2026-90281)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the Qualcomm SNPS Femto v2 PHY driver's runtime PM callbacks when a runtime suspend callback runs during PHY initialization. A local user can trigger a runtime suspend callback before the PHY instance is ready to cause a denial of service.

1556) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90283)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause huge page reservations to remain charged.

The vulnerability exists due to improper resource cleanup in the hugetlbfs_fill_super() failure path when initiating a hugetlbfs mount with size or min_size options and root dentry creation fails. A local user can trigger the mount failure path to cause huge page reservations to remain charged.

1557) Race condition (CVE-ID: CVE-2026-90284)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the firmware sysfs fallback loader when a userspace helper completes a firmware request after the loading interface is exposed but before the request is added to the pending request list. A local user can write 0 to the loading attribute to cause a denial of service.

1558) Race condition (CVE-ID: CVE-2026-90285)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger concurrent flash access operations.

The vulnerability exists due to improper synchronization in qla2x00_sysfs_read_vpd() in the qla2xxx driver when reading VPD data through sysfs while concurrent optrom operations are occurring. A local user can read VPD data through sysfs during concurrent optrom operations to trigger concurrent flash access operations.

1559) Race condition (CVE-ID: CVE-2026-90286)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause GPU command submissions to execute out of order.

The vulnerability exists due to improper synchronization in the AMDGPU GFX6 compute queue handling when submitting GPU compute workloads. A local user can submit GPU compute workloads to cause GPU command submissions to execute out of order.

GFX6 compute queues share the command processing path used by graphics queues.

1560) Improper handling of exceptional conditions (CVE-ID: CVE-2026-90290)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper handling of exceptional conditions in swsusp_arch_suspend() when handling a failure from swsusp_mte_save_tags(). A local privileged user can trigger the hibernation error path to cause a denial of service.

1561) Use-after-free (CVE-ID: CVE-2026-90292)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to improper reference counting in the RDMA/siw siw_accept() function when handling a userspace-supplied queue pair that is already in the RTS state. A local user can supply such a queue pair to cause a use-after-free condition.

1562) Race condition (CVE-ID: CVE-2026-90293)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in the iSER target login receive-buffer handling when processing a SCSI command before the final Login Response. A remote attacker can send a SCSI command before receiving the final Login Response to cause a denial of service.

1563) Race condition (CVE-ID: CVE-2026-90294)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in iSER target login-response handling when an initiator submits a SCSI command immediately after receiving the final Login Response. A remote attacker can send a specially timed SCSI command to cause a denial of service.

1564) Out-of-bounds write (CVE-ID: CVE-2026-90295)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the imx6q cpufreq driver when probing the driver after it has been unbound. A local user can rebind the driver to cause memory corruption.

1565) Memory leak (CVE-ID: CVE-2026-90296)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the imx6q cpufreq driver when rebinding the driver. A local user can repeatedly rebind the driver to cause a denial of service.

1566) NULL pointer dereference (CVE-ID: CVE-2026-90297)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in sun4i_crtc_init() when initializing display layers. A local user can trigger a layer initialization failure to cause a denial of service.

1567) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90298)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak device references.

The vulnerability exists due to improper resource release in the sun8i_r40_tcon_tv_set_mux function when configuring the TCON TV multiplexer. A local user can trigger TCON TV multiplexer configuration to leak device references.

1568) Use-after-free (CVE-ID: CVE-2026-90302)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the OCFS2 o2net heartbeat callback handling when local-node teardown overlaps heartbeat node-down callback processing. A local user can initiate local-node teardown during heartbeat callback processing to cause a denial of service.

1569) Use-after-free (CVE-ID: CVE-2026-90303)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in show_pte() when handling user faults concurrently with munmap() calls. A local user can trigger a user fault while another thread in the same process calls munmap() to cause a denial of service.

Exploitation requires CONFIG_DEBUG_USER=y and the user_debug=31 command-line setting.

1570) Out-of-bounds read (CVE-ID: CVE-2026-90307)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the SRP response-processing handlers when processing truncated SRP requests. A remote attacker can send a crafted truncated SRP_CRED_REQ or SRP_AER_REQ to disclose sensitive information.

Exploitation requires an SRP target to advertise a small max_ti_iu_len value during login.

1571) Out-of-bounds read (CVE-ID: CVE-2026-90314)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to improper signedness handling in rsc_table_for_each_entry() when processing a firmware resource table. A local user can provide a crafted firmware resource table containing an offset interpreted as negative to read memory out of bounds.

1572) Use-after-free (CVE-ID: CVE-2026-90316)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in OMAP DSI interrupt service routine table handling when unregistering interrupts while they are being handled. A local user can unregister interrupts during interrupt handling to trigger a use-after-free condition.

1573) Improper resource shutdown or release (CVE-ID: CVE-2026-90318)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a resource leak.

The vulnerability exists due to improper resource release in fat_rebuild_parent() when rebuilding parent inodes through the nostale_ro NFS export path. A remote user can trigger parent inode reconstruction without releasing the buffer head to cause a resource leak.

1574) Use-after-free (CVE-ID: CVE-2026-90319)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the RapidIO rio_scan_alloc_net() failure path when handling a rio_add_net() failure. A local user can trigger a subsequent mport unregister path to dereference a dangling mport->net pointer and attempt to free the rio_net object again.

1575) Out-of-bounds write (CVE-ID: CVE-2026-90327)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write up to three bytes beyond a user-supplied buffer.

The vulnerability exists due to an out-of-bounds write in the phonet PEP socket option handler pep_getsockopt() when calling getsockopt() with an optlen smaller than sizeof(int). A local user can invoke getsockopt() with a small optlen to write up to three bytes beyond a user-supplied buffer.

1576) Use-after-free (CVE-ID: CVE-2026-90329)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in HID failed-probe cleanup when a HID report callback runs concurrently with a failed device probe. A local user can cause a HID report to be processed while a device probe fails to trigger a use-after-free.

1577) Use-after-free (CVE-ID: CVE-2026-90334)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in tty_cdev_add() when handling a cdev_add() failure. A local user can trigger tty device unregistration after cdev_add() fails to cause a use-after-free.

1578) Integer overflow (CVE-ID: CVE-2026-90341)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory outside the platform resource.

The vulnerability exists due to integer overflow and insufficient bounds validation in coreboot_table_probe() when processing a malformed coreboot table. A local user can supply a malformed coreboot table to access memory outside the platform resource.

1579) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-90348)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper handling of device-memory mappings in ath10k_msa_dump_memory() when collecting an MSA firmware crash dump. A local privileged user can cause firmware crash dump collection to cause a denial of service.

1580) Race condition (CVE-ID: CVE-2026-90360)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning during system suspend.

The vulnerability exists due to a race condition involving a non-freezable workqueue in the regulator core when delayed regulator cleanup runs concurrently with system suspend. A local user can cause system suspend to overlap with delayed regulator cleanup to trigger a kernel warning during system suspend.

The cleanup work runs approximately 30 seconds after boot to disable unused regulators via I2C. If the I2C adapter is already suspended, the transfer triggers a -ESHUTDOWN warning in __i2c_transfer().

1581) Memory leak (CVE-ID: CVE-2026-90361)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory cleanup in ath11k_service_ready_ext_event() when parsing service-ready extension TLVs. A local user can cause parsing to fail after mac_phy_caps has been allocated to cause a denial of service.

1582) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-90362)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the DSI link clock to run without necessary power backing.

The vulnerability exists due to improper power-state management in dsi_link_clk_disable_6g() when disabling DSI link clocks. A local user can trigger the DSI link clock disable path to cause the DSI link clock to run without necessary power backing.

1583) Integer underflow (CVE-ID: CVE-2026-90372)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-range spatial-stream value to be written to firmware beamforming fields.

The vulnerability exists due to an integer underflow in mt7915_mcu_get_sta_nss when processing a peer VHT/HE MCS map with no supported spatial streams. A remote attacker can advertise a crafted VHT/HE MCS map to cause an out-of-range spatial-stream value to be written to firmware beamforming fields.

1584) Memory leak (CVE-ID: CVE-2026-90378)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper memory management in the mt76 SDIO transmit path when tx_prepare_skb() returns an error while processing zero-length frames. A local user can submit a zero-length frame to cause a memory leak.

1585) Reachable assertion (CVE-ID: CVE-2026-90382)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a kernel panic and denial of service.

The vulnerability exists due to a reachable assertion in the mt76x02 receive-processing path when processing a corrupted wireless frame with a receive descriptor length larger than the received buffer. A remote attacker can transmit a corrupted over-the-air frame to cause a kernel panic and denial of service.

Exploitation requires monitor mode with the fcsfail filter enabled and panic_on_warn set.

1586) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-90386)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a shift-out-of-bounds condition.

The vulnerability exists due to an incorrect bitwise shift calculation in the DesignWare I3C master DAA handler when ENTDAA assigns no devices on an empty I3C bus. A local user can initiate dynamic address assignment on an empty I3C bus to trigger a shift-out-of-bounds condition.

1587) Unchecked Return Value (CVE-ID: CVE-2026-90388)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an IOMMU mapping to be attempted after an allocation failure.

The vulnerability exists due to improper check of an allocation return value in iommu_dma_alloc when executing the non-blocking, non-coherent allocation path. A local user can invoke the affected allocation path during an allocation failure to cause an IOMMU mapping to be attempted after an allocation failure.

The affected path requires CONFIG_DMA_DIRECT_REMAP and non-coherent allocation.

1588) Infinite loop (CVE-ID: CVE-2026-90391)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in dmirror_fault() in lib/test_hmm.c when handling dmirror read or write ioctl operations after the mirrored mm has exited. A local user can issue dmirror read or write ioctl operations to cause a denial of service.

The loop is reached after a missing device page table entry is encountered.

1589) Use-after-free (CVE-ID: CVE-2026-90393)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a race condition in bpf_netns_link_update_prog when concurrently executing BPF_LINK_UPDATE operations on the same network namespace link. A local user can race program updates to trigger a use-after-free condition.

1590) Use-after-free (CVE-ID: CVE-2026-90394)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed driver data.

The vulnerability exists due to use-after-free in the sc2731_charger driver's remove path when queued or running work executes after driver data is released. A local user can cause the driver to be removed while work remains queued or running to access freed driver data.

1591) Use-after-free (CVE-ID: CVE-2026-90395)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to access freed power supply state.

The vulnerability exists due to a use-after-free in the isp1704 charger driver's remove path when queued or running work executes during device removal. A local privileged user can cause work scheduled by USB notification or initial VBUS detection to execute after the power supply state is torn down to access freed power supply state.

1592) Incomplete cleanup (CVE-ID: CVE-2026-90403)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.

The vulnerability exists due to incomplete cleanup caused by an incorrect goto label in the rtl_pci_probe() function when handling an IRQ handler registration failure. A local user can trigger this error path to compromise system confidentiality, integrity, and availability.

1593) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90411)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a DMA mapping resource leak.

The vulnerability exists due to improper resource cleanup in __nvme_fc_init_request() when handling a response IU DMA mapping failure. A local user can trigger request initialization with a response IU DMA mapping failure to cause a DMA mapping resource leak.

1594) Out-of-bounds read (CVE-ID: CVE-2026-90413)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the iSER login PDU handling code when processing a login PDU whose declared data segment length exceeds the received payload length. A remote attacker can send a crafted login PDU with an oversized declared data segment length to read out-of-bounds memory.

The issue can be triggered before authentication.

1595) Out-of-bounds read (CVE-ID: CVE-2026-90414)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause an out-of-bounds read and write heap contents beyond the receive descriptor to backing storage.

The vulnerability exists due to missing validation of the declared data segment length in isert_recv_done() when processing iSER/iSCSI PDUs. A remote user can send a PDU that declares a data segment larger than the received data to cause an out-of-bounds read and write heap contents beyond the receive descriptor to backing storage.

Exploitation requires the full feature phase and negotiated parameters that permit unsolicited or immediate data.

1596) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90415)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the RDMA/cxgb4 write_tpt_entry() function when programming a TPT entry. A local user can trigger a failed TPT entry write to cause a denial of service.

1597) Out-of-bounds read (CVE-ID: CVE-2026-90416)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the get_param() function of the cc_params debugfs interface when reading a congestion parameter. A local user can read a crafted congestion parameter value through the debugfs interface to disclose sensitive information.

The issue is triggered when the parameter value has bit 31 set.

1598) Out-of-bounds read (CVE-ID: CVE-2026-90419)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to improper input validation in nilfs2 super-root block parsing when processing a malformed filesystem image. A local user can supply a malformed filesystem image to perform an out-of-bounds read.

1599) Infinite loop (CVE-ID: CVE-2026-90420)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of terminal errors in nilfs_clean_segments() when the cleaner ioctl encounters repeated -EROFS errors from nilfs_segctor_construct(). A local user can invoke the cleaner ioctl to cause a denial of service.

The issue can occur when the device is remounted read-only after an I/O error.

1600) Use-after-free (CVE-ID: CVE-2026-90431)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the remoteproc crash-handler work when crash reporting races with remoteproc deletion. A local user can trigger concurrent crash reporting and remoteproc removal to cause a denial of service.

1601) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90434)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust buffer-head resources.

The vulnerability exists due to failure to release a buffer-head reference in zisofs_fill_pages() when successfully reading compressed block pointer tables. A local user can cause zisofs_fill_pages() to read compressed block pointer tables to exhaust buffer-head resources.

1602) Integer overflow (CVE-ID: CVE-2026-90435)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to integer overflow in the mlx5 RDMA driver's set_user_buf_size() function when processing user-supplied QP buffer parameters. A local user can supply an excessively large rq.wqe_cnt value to cause memory corruption.

The same unchecked shift calculation is also used to compute qp->sq.offset during user QP creation.

1603) Use of uninitialized resource (CVE-ID: CVE-2026-92476)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger use of an uninitialized completion.

The vulnerability exists due to use of an uninitialized resource in the Keem Bay OCS AES driver's kmb_ocs_aes_probe() routine when a device interrupt occurs after IRQ registration and before completion initialization. A local user can trigger a device interrupt during this initialization window to trigger use of an uninitialized completion.

1604) Memory leak (CVE-ID: CVE-2026-92494)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a buffer_head reference leak.

The vulnerability exists due to improper resource release in ext4_init_orphan_info() when processing orphan file blocks with an invalid magic value or checksum. A local user can cause ext4_init_orphan_info() to process such orphan file blocks to cause a buffer_head reference leak.

1605) Out-of-bounds read (CVE-ID: CVE-2026-92496)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in ath11k_wmi_tlv_op_rx() when processing a firmware buffer shorter than a WMI command header. A local user can supply a malformed firmware buffer to read out-of-bounds memory.

1606) Out-of-bounds read (CVE-ID: CVE-2026-92498)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read beyond the bounds of WMI event buffers.

The vulnerability exists due to an out-of-bounds read in ath6kl WMI event handlers when processing undersized WMI events. A remote attacker can provide a malformed WMI event to read beyond the bounds of event buffers.

1607) Race condition (CVE-ID: CVE-2026-92501)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ext4_buffered_write_iter() when a direct I/O write falls back to buffered I/O while concurrent direct I/O completes. A local user can issue concurrent direct I/O operations to cause a denial of service.

The issue can also occur when non-overlapping direct I/O writes share a large folio and the block size is smaller than the folio size.

1608) Improper resource shutdown or release (CVE-ID: CVE-2026-92504)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to improper resource cleanup in the int3400 thermal driver's ODVP handling when driver probing fails after evaluate_odvp() has created ODVP sysfs files. A local user can trigger a driver probe failure after ODVP evaluation to cause a resource leak.

1609) Use-after-free (CVE-ID: CVE-2026-92508)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in the RDMA/core ib_free_cq() completion queue destruction function when accessing a completion queue through the netlink path while it is being destroyed. A local user can access a completion queue through netlink during its destruction to trigger a use-after-free condition.

1610) Use-after-free (CVE-ID: CVE-2026-92521)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger use of freed memory.

The vulnerability exists due to a use-after-free in ACPI PCI root handling when processing hot-add failures or root bridge removal. A local user can invoke a later acpi_pci_find_root() lookup to trigger use of freed memory.

The freed root object remains referenced by device->driver_data.

1611) Out-of-bounds read (CVE-ID: CVE-2026-92522)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read out-of-bounds memory.

The vulnerability exists due to improper bounds validation in the ACPI IOAPIC hotplug lookup when parsing MADT and _MAT records. A local privileged user can provide a malformed record with a truncated header, an oversized declared length, or an incomplete IOAPIC body to read out-of-bounds memory.

Only builds with CONFIG_ACPI_HOTPLUG_IOAPIC enabled include the affected code.

1612) Improper resource shutdown or release (CVE-ID: CVE-2026-92524)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in its_vpe_irq_domain_alloc() when an interrupt allocation fails. A local user can trigger an allocation failure to cause a denial of service.

1613) Unchecked Return Value (CVE-ID: CVE-2026-93037)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause improper processing of a request.

The vulnerability exists due to an unchecked return value in the set_txreq_header_ahg() function when initializing an accelerated header generation transmit request. A local user can submit a request for which sdma_txinit_ahg() fails to cause improper processing of a request.

1614) Use-after-free (CVE-ID: CVE-2026-93039)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free and double free.

The vulnerability exists due to a stale pointer after reallocation in meson_card_reallocate_links() when handling failure of the second memory reallocation after the first reallocation moves the DAI link array. A local user can cause the second memory reallocation to fail after the first reallocation moves the DAI link array to trigger a use-after-free and double free.

1615) Race condition (CVE-ID: CVE-2026-93040)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the DesignWare eDMA channel state handling when pause(), resume(), or issue_pending() evaluates channel state concurrently with interrupt handlers. A local user can invoke DMA channel operations during a concurrent state transition to cause a denial of service.

1616) Race condition (CVE-ID: CVE-2026-93041)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the dw-edma abort interrupt handler when aborting a DMA request while queued descriptors are being started. A local user can trigger an abort during the state transition to leave queued descriptors unprocessed and the channel idle.

1617) Memory corruption (CVE-ID: CVE-2026-93046)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory out of bounds.

The vulnerability exists due to improper bounds checking in software_node_get_reference_args() when handling a reference argument index value of UINT_MAX. A local user can provide an index value of UINT_MAX to access memory out of bounds.

1618) Integer underflow (CVE-ID: CVE-2026-93048)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to integer underflow in mtd_add_partition() when processing BLKPG ioctl requests on NAND devices. A local user can pass MTDPART_OFS_RETAIN (-3) as a partition offset to trigger a kernel warning.

Depending on the size calculation, an empty disabled partition can be created.

1619) Double free (CVE-ID: CVE-2026-93049)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in mtdswap_add_mtd() cleanup handling when debugfs setup fails after blktrans device registration. A local user can trigger the debugfs failure sequence to cause a denial of service.

1620) Use-after-free (CVE-ID: CVE-2026-93051)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel ad525x_dpot driver's sysfs attribute handling when removing a device without removing its command sysfs attributes before freeing driver data. A local user can access command sysfs attributes that remain exposed after the driver data is freed to cause a denial of service.

The command sysfs attributes are exposed only for devices supporting the F_CMD_INC feature.

1621) Race condition (CVE-ID: CVE-2026-93052)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access message queues using stale cached queue information.

The vulnerability exists due to improper synchronization in the bcm-vk message queue initialization and driver access checks when initializing message queues concurrently with driver access. A local user can race message queue initialization with driver access to access message queues using stale cached queue information.

1622) Out-of-bounds write (CVE-ID: CVE-2026-93053)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause an out-of-bounds write.

The vulnerability exists due to improper validation of function-name initial characters in the speakup keyhelp letter_offsets[] handling when processing function names overridden through sysfs. A local privileged user can override a function name with an initial character outside the a-z range to cause an out-of-bounds write.

1623) Use-after-free (CVE-ID: CVE-2026-93054)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the __uio_register_device() UIO registration failure path when an opener races with a failed registration after device_add(). A local user can race opening /dev/uioX with a failed device registration to cause a denial of service.

1624) Out-of-bounds read (CVE-ID: CVE-2026-93055)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in udf_pc_to_char() when processing malformed UDF symlink data containing a partial pathComponent header. A local user can provide malformed UDF symlink data containing a partial pathComponent header to cause an out-of-bounds read.

1625) NULL pointer dereference (CVE-ID: CVE-2026-93056)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the f_uac1_legacy configfs string attribute store handler when writing to the fn_play, fn_cap, or fn_cntl attribute during a memory-allocation failure. A local user can write to an affected configfs attribute while memory allocation fails to cause a denial of service.

1626) Buffer Over-read (CVE-ID: CVE-2026-93061)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in host1x_debug_output() and host1x_debug_cont() when generating debug output longer than 256 bytes. A local user can access affected debugfs output to disclose sensitive information.

Only debugfs files are affected; the printk debug sink ignores the supplied byte count.

1627) Stack-based buffer overflow (CVE-ID: CVE-2026-93067)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a stack-based buffer overflow.

The vulnerability exists due to improper validation of controller-reported AUX byte counts in tc_aux_transfer() and tc_aux_read_data() when handling AUX read transfers. A local user can trigger processing of an AUX read response that reports a byte count larger than requested to cause a stack-based buffer overflow.

The controller-reported byte count can be as high as 255 despite the 16-byte auxrdata stack buffer.

1628) Out-of-bounds write (CVE-ID: CVE-2026-93095)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds write.

The vulnerability exists due to improper validation of catalog thread records in hfsplus_delete_cat() when rebuilding a catalog key from a corrupted HFS+ image. A local user can supply a corrupted HFS+ image with an oversized thread name length to cause an out-of-bounds write.

1629) Deadlock (CVE-ID: CVE-2026-93098)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a deadlock in GLINK endpoint destruction when detaching an rpmsg driver. A local privileged user can trigger driver detachment to cause a denial of service.

1630) Memory leak (CVE-ID: CVE-2026-93102)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the hfi1 init_one() cleanup path when hfi1_init() or hfi1_register_ib_device() fails after RX support allocation. A local user can trigger a late probe failure to cause a denial of service.

1631) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-93103)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an allocation failure in hfi1_free_devdata() when allocating a unit ID for an HFI1 device. A local user can cause unit ID allocation to fail to cause a denial of service.

The issue occurs when cleanup runs before the device has been inserted into the unit table.

1632) Race condition (CVE-ID: CVE-2026-93108)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper synchronization in the IPoIB module teardown path when unloading the module while RCU callbacks remain pending. A local privileged user can initiate module teardown before queued RCU callbacks complete to cause a denial of service.

The condition can also occur after client registration failure removes already-added devices and queues callbacks.

1633) Use-after-free (CVE-ID: CVE-2026-93109)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a failure to wait for queued RCU callbacks in mlx5_ib module teardown when closing a DevX event file or detaching auxiliary driver devices. A local user can close a DevX event file to cause a denial of service.

The issue can also occur during registration error unwinding after driver registration attaches existing devices before failing.

1634) Use-after-free (CVE-ID: CVE-2026-93110)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free condition in the RDMA core ib_core cleanup routine when unloading the ib_core module after RCU callbacks have been queued. A local privileged user can cause queued callbacks to invoke unloaded module code to cause a denial of service.

Exploitation requires RCU callbacks queued by put_gid_ndev() before module unloading.

1635) NULL pointer dereference (CVE-ID: CVE-2026-93114)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in san_probe when the Surface ACPI notification driver is force-bound to a device without an ACPI companion. A local user can force-bind the driver to such a device to cause a denial of service.

1636) NULL pointer dereference (CVE-ID: CVE-2026-93115)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mlxbf_pmc_probe() function of the mlxbf-pmc driver when force-binding the driver to a device without an ACPI companion object. A local user can force-bind the driver to such a device to cause a denial of service.

1637) Out-of-bounds read (CVE-ID: CVE-2026-93120)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in os_desc_qw_sign_show() in the USB gadget configfs implementation when converting a stored signature from UTF-16 to UTF-8. A local user can store a signature that fills the buffer without a NUL terminator and read the configfs attribute to disclose sensitive information.

1638) Improper resource shutdown or release (CVE-ID: CVE-2026-93130)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a resource leak.

The vulnerability exists due to improper resource shutdown or release in the dell-wmi-base module initialization routine when module initialization fails. A local privileged user can trigger a module load failure to cause a resource leak.

1639) Use-after-free (CVE-ID: CVE-2026-93131)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to a use-after-free race condition in the Dell privacy WMI driver when accessing the features_present field without holding the list mutex. A local user can trigger concurrent access to the field while the associated privacy data is freed to access freed memory.

1640) Race condition (CVE-ID: CVE-2026-93138)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access incompletely initialized vmlinux BTF data.

The vulnerability exists due to a race condition in bpf_get_btf_vmlinux when concurrently invoking the function during first-time vmlinux BTF parsing. A local user can invoke the affected function concurrently to access incompletely initialized vmlinux BTF data.

The race can occur on weakly ordered architectures when CONFIG_DEBUG_INFO_BTF is enabled.

1641) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-93140)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a spurious kernel warning.

The vulnerability exists due to improper handling of an exceptional I/O condition in the UDF Logical Volume Integrity Descriptor buffer when marking the buffer dirty after a write I/O error. A local user can remount the filesystem read-write or synchronize it to trigger a spurious kernel warning.

1642) Double free (CVE-ID: CVE-2026-93141)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in r8a66597_probe() when usb_add_gadget_udc() fails. A local user can trigger the probe error path to cause a denial of service.

1643) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-93145)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to failure to release generic power-domain structures in gdsc_unregister() when performing a provider unbind and rebind cycle. A local privileged user can trigger a provider unbind and rebind cycle to cause a denial of service.

1644) Memory leak (CVE-ID: CVE-2026-93151)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a memory leak.

The vulnerability exists due to failure to release response resources in the nvmet-rdma queue teardown routine when an RDMA connection is forcefully disconnected while I/O operations are in flight. A remote attacker can disconnect an RDMA connection while I/O operations are in flight to cause a memory leak.

1645) Unchecked Return Value (CVE-ID: CVE-2026-93158)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause crypto request setup failures.

The vulnerability exists due to unchecked return value handling in sa_ul_probe() when security-context DMA pool creation fails. A local user can initiate use of the driver after DMA pool creation fails to cause crypto request setup failures.

1646) Incomplete cleanup (CVE-ID: CVE-2026-93159)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to incomplete cleanup in the atmel-sha204a nonblocking RNG path when an asynchronous I2C transfer fails. A local user can make subsequent read attempts after a failed I2C transfer to disclose sensitive information.

1647) Key management errors (CVE-ID: CVE-2026-93160)

CWE-ID: CWE-320 - Key Management Errors

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to derive a shared secret using a private key not generated for the current transform context.

The vulnerability exists due to improper cryptographic key management in atmel_ecdh_compute_shared_secret() when processing hardware ECDH shared-secret requests without a cached public key. A local user can submit a hardware ECDH shared-secret request without a cached public key to derive a shared secret using a private key not generated for the current transform context.

1648) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-93161)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive key material.

The vulnerability exists due to failure to clear sensitive information from stack memory in qat_alg_xts_reverse_key() when expanding a forward XTS AES key. A local user can access residual AES key material in stack memory to disclose sensitive key material.

1649) Out-of-bounds read (CVE-ID: CVE-2026-93165)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to overread memory.

The vulnerability exists due to an out-of-bounds read in cros_ec_sensorhub_ring_handler() when processing FIFO information responses from EC firmware. A local privileged user can cause the handler to process a response whose length is shorter than expected to overread memory.

The condition can occur when EC firmware reports inconsistent maximum response and sensor-count values.

1650) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2026-93167)

CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect stack offset handling in the C-SKY syscall trace path when tracing system calls with fifth or sixth arguments. A local user can trace a process executing a system call with five or six arguments to cause a denial of service.

The issue is limited to the C-SKY ABIv2 syscall trace path.

1651) Race condition (CVE-ID: CVE-2026-93170)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause descriptor corruption or missed DMA completions.

The vulnerability exists due to a race condition in the Xilinx AXIDMA and MCDMA interrupt handlers when handling descriptor-completion interrupts. A local user can queue multiple active descriptors before a completion interrupt occurs to cause descriptor corruption or missed DMA completions.

Exploitation requires descriptors to remain in the active list after completed descriptors are moved to the done list.

1652) Out-of-bounds read (CVE-ID: CVE-2026-93177)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the Vega10 PowerPlay hardware manager when parsing VBIOS-provided voltage dependency tables. A local user can provide voltage table entries containing out-of-range lookup indices to read out-of-bounds memory.

1653) Out-of-bounds read (CVE-ID: CVE-2026-93178)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the SMU7 powerplay voltage lookup handling when processing VBIOS-parsed voltage table entries containing out-of-range voltage indices. A local user can provide VBIOS-parsed table entries with out-of-range voltage indices to perform an out-of-bounds read.

1654) Improper initialization (CVE-ID: CVE-2026-93183)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization order in lima_device_init() when initializing the Lima device. A local user can trigger creation of an empty Lima VM before its allocation range is configured to cause a denial of service.

The kernel BUG condition is triggered when DRM_DEBUG_MM is enabled.

1655) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-93185)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause active timer or work objects to remain after device removal.

The vulnerability exists due to improper cancellation of delayed work in rt700_sdw_remove() when removing an RT700 SoundWire codec after the SoundWire slave becomes unattached while jack work is pending. A local privileged user can cause the remove path to skip cancellation of pending jack work.

Practical reachability depends on SoundWire core remove ordering after an unattached status update.

1656) Out-of-bounds read (CVE-ID: CVE-2026-93188)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose out-of-bounds data.

The vulnerability exists due to an out-of-bounds read in the Roccat Kone HID driver's profile handling when processing a device-supplied profile index. An attacker with physical access can connect a malicious USB device claiming the Roccat Kone ID and send a switch-profile event or provide a startup profile value during probing to disclose out-of-bounds data.

The out-of-bounds read result is exposed through the actual_dpi sysfs attribute.

1657) Use-after-free (CVE-ID: CVE-2026-93189)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to failure to quiesce HID input before freeing objects in hid_hw_stop() in the HID core when a driver probe unwinds after HID input has been enabled while HID reports are in flight. A local user can trigger a failed driver initialization while HID reports are being processed to trigger a use-after-free condition.

1658) Incorrect authorization (CVE-ID: CVE-2026-93191)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose messages to an unauthorized receiver.

The vulnerability exists due to improper authorization in smack_msg_queue_msgrcv when processing messages through the pipelined_send optimization for a waiting receiver. A local user can send a message to a queue while an unauthorized target task is waiting to receive it to disclose messages to an unauthorized receiver.

1659) Race condition (CVE-ID: CVE-2026-93203)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt backbone gateway CRC values.

The vulnerability exists due to a race condition in batadv_bla_add_claim() when processing concurrent CLAIM frames for the same client. A remote attacker can send concurrent CLAIM frames to corrupt backbone gateway CRC values.

1660) Race condition (CVE-ID: CVE-2026-93204)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to poison an ARP cache.

The vulnerability exists due to a race condition caused by non-atomic MAC address updates in batadv_dat_entry_add() in the batman-adv distributed ARP table when a MAC address is updated concurrently with a reader accessing the entry. A remote attacker can cause a MAC address update to race with a reader to poison an ARP cache.

1661) Incorrect authorization (CVE-ID: CVE-2026-93206)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose PCI configuration-space information.

The vulnerability exists due to improper authorization using the credentials of the calling task rather than the opening process in proc_bus_pci_read() when reading PCI configuration space through procfs. A local privileged user can pass a file descriptor opened with CAP_SYS_ADMIN to an unprivileged process to disclose PCI configuration-space information.

1662) Out-of-bounds read (CVE-ID: CVE-2026-93213)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the of_alias_scan() stem parser when parsing a property name that is empty or consists only of digits. A local user can trigger parsing of such a property name to perform an out-of-bounds read.

1663) Deadlock (CVE-ID: CVE-2026-93214)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock ordering in usbg_make_tpg() when performing configfs dependency operations across subsystems. A local user can trigger concurrent configfs operations to cause a denial of service.

Exploitation requires a circular lock dependency involving configfs_rmdir().

1664) Incorrect calculation (CVE-ID: CVE-2026-93219)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an incorrect minimum interval calculation in the sun4i clockevent timer driver when processing timer events. A local user can trigger timer events to cause a denial of service.

The issue can leave the next timer event stuck during oneshot, high-resolution, or nohz timer operation.

1665) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-93222)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause signal sender identifiers to be incorrectly rewritten.

The vulnerability exists due to improper handling of shared siginfo data in the signal delivery logic when delivering group signals across namespaces. A local user can send a group signal to cause sender identifiers rewritten for one recipient to affect subsequent recipients.

1666) Race condition (CVE-ID: CVE-2026-93226)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a race condition.

The vulnerability exists due to an unsafe iteration of an RCU-protected list in rt6_nh_dump_exceptions() when dumping IPv6 route exceptions while exception entries are concurrently added. A local user can initiate an IPv6 route dump during concurrent route exception insertion to trigger a race condition.

1667) Out-of-bounds read (CVE-ID: CVE-2026-93234)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in gud_connector_add_tv_mode() when processing TV mode names returned by a GUD device. An attacker with physical access can provide a device response containing a TV mode name without a NUL terminator to perform an out-of-bounds read.

1668) NULL pointer dereference (CVE-ID: CVE-2026-93236)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in vdec_try_fmt_common() when processing a VIDIOC_TRY_FMT request with an unsupported pixel format on the OUTPUT queue. A local user can submit a crafted VIDIOC_TRY_FMT request to cause a denial of service.

The issue occurs when MPEG2 support has been locally removed and is absent from the platform format table.

1669) Off-by-one (CVE-ID: CVE-2026-93242)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause legitimate firmware responses to be dropped.

The vulnerability exists due to an off-by-one error in __qla_consume_iocb() in the qla2xxx response queue handler when processing response queue IOCBs. A local user can trigger response queue processing to consume an unrelated IOCB and cause legitimate firmware responses to be dropped.

1670) Improper initialization (CVE-ID: CVE-2026-93245)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper initialization of list heads in AppArmor policy initialization when handling a profile creation failure before initialization completes. A local user can attempt to load a profile that fails during creation to trigger a kernel warning.

1671) Deadlock (CVE-ID: CVE-2026-93252)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock ordering in the OCFS2 ACL initialization and extended attribute handling paths when concurrently performing extended attribute updates and filesystem node-creation operations. A local user can perform concurrent extended attribute updates and mkdir or mknod operations to cause a denial of service.

Exploitation depends on a pending writer on the journal transaction barrier causing the conflicting lock acquisition paths to block.

1672) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-93256)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper exception masking in the arm64 hibernation resume code when resuming from hibernation. A local privileged user can resume a hibernated system while exceptions are unmasked to cause a denial of service.

Pseudo-NMI support can permit pseudo-NMI exceptions during the resume process.

1673) NULL pointer dereference (CVE-ID: CVE-2026-93261)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing null check in __lock_set_class() when register_lock_class() returns NULL. A local user can cause lock class registration to fail to cause a denial of service.

Lock class registration can fail when the lock class pool is exhausted, graph_lock() fails, or key validation fails.

1674) Use-after-free (CVE-ID: CVE-2026-93262)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in ppl_do_flush() when processing RAID5 PPL flushes. A local user can cause ppl_io_unit_finished() to free the io object while the loop continues accessing io->pending_flushes to trigger a use-after-free condition.

1675) Out-of-bounds read (CVE-ID: CVE-2026-93264)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory registration to be rejected.

The vulnerability exists due to an incorrect chunk length calculation in the EFA RDMA driver's pbl_chunk_list_create function when registering a memory region whose PBL page count is a multiple of 510. A local user can register such a memory region to cause memory registration to be rejected.

The issue can also result in an out-of-bounds access to the chunks array.

1676) Improper locking (CVE-ID: CVE-2026-93268)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper lock management in ext4_try_to_expand_extra_isize() when expanding inode extra isize during filesystem mount. A local privileged user can trigger orphan processing during mount to cause a denial of service.

The circular lock dependency involves s_writepages_rwsem, an active jbd2 handle, and xattr_sem.

1677) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-93271)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper range validation in ath11k_dp_rx_h_rate() when processing HT, VHT, or HE frames with a reported MCS above the corresponding mac80211 rate-space maximum. A remote attacker can send a wireless frame with an out-of-range reported MCS value to cause a denial of service.

The affected frame decodes correctly despite its reported MCS value exceeding the corresponding mac80211 rate space.

1678) NULL pointer dereference (CVE-ID: CVE-2026-93274)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in bcm2835_pinctrl_probe() when handling a failed pin controller registration. A local user can trigger a failed pin controller registration to cause a denial of service.

1679) Out-of-bounds read (CVE-ID: CVE-2026-93280)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the Greybus audio topology parser when parsing a topology blob supplied by a connected module. An attacker with physical access can supply a topology blob with section sizes exceeding the fetched size to read out-of-bounds memory.

1680) Use-after-free (CVE-ID: CVE-2026-93283)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in i3c_master_register_new_i3c_devs() when handling a device_register() failure. A local user can trigger a device registration failure followed by device unregistration to cause a denial of service.

1681) NULL pointer dereference (CVE-ID: CVE-2026-93286)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing null pointer check in aarp_send_ddp() when sending AppleTalk packets through the LocalTalk fast path on a device without an AppleTalk interface configured. A local user can send an AppleTalk packet to cause a denial of service.

1682) Memory corruption (CVE-ID: CVE-2026-93287)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper bounds checking in the i2c-stub driver's stub_xfer function when processing caller-supplied I2C_SMBUS_I2C_BLOCK_DATA transfers. A local user can issue a crafted SMBus block transfer with an oversized length to cause a denial of service.

1683) Out-of-bounds read (CVE-ID: CVE-2026-93287)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in the smbus_write tracepoint when processing caller-supplied oversized SMBus block writes. A local user can issue an SMBus block write with an oversized length to read memory out of bounds.

1684) Use-after-free (CVE-ID: CVE-2026-93288)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to failure to wait for an RCU grace period in nfnetlink_log per-network state when processing packets concurrently with network namespace teardown. A local user can trigger concurrent packet processing and network namespace teardown to trigger a use-after-free.

1685) Race condition (CVE-ID: CVE-2026-93782)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write response data to an unrelated userspace object.

The vulnerability exists due to a race condition in vhost-scsi ioctl handling when replacing the memory table while commands are in flight. A local user can submit commands and issue VHOST_SET_MEM_TABLE to write response data to an unrelated userspace object.

1686) Out-of-bounds read (CVE-ID: CVE-2026-93783)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read uninitialized memory.

The vulnerability exists due to an out-of-bounds read in rfcomm_recv_frame() when processing truncated Bluetooth RFCOMM frames. A remote attacker can send a truncated Bluetooth RFCOMM frame to read uninitialized memory.

A zero-length frame can cause a length underflow and make skb_tail_pointer() read past the buffer.

1687) Out-of-bounds read (CVE-ID: CVE-2026-93784)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of information element buffers in cfg80211_wext_siwgenie() when storing a malformed buffer through SIOCSIWGENIE. A local user can submit a malformed information element buffer and trigger a connection attempt to cause a denial of service.

The issue is triggered when a subsequent SIOCSIWESSID operation initiates connection processing.

1688) Numeric Truncation Error (CVE-ID: CVE-2026-93785)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause inconsistent payload length interpretation.

The vulnerability exists due to improper validation of payload length in the cifs.idmap key type when processing oversized preparsed payloads. A local user can provide an oversized preparsed payload to cause inconsistent payload length interpretation.

1689) Integer underflow (CVE-ID: CVE-2026-93789)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a length underflow.

The vulnerability exists due to improper validation of aligned TLV lengths in the iwlwifi firmware parser when processing malformed TLVs in a firmware image. A local user can cause the parser to process a firmware image containing malformed TLVs to cause a length underflow.

1690) Memory leak (CVE-ID: CVE-2026-93795)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause resource exhaustion.

The vulnerability exists due to improper reference count management in the blkg_create() error path when radix_tree_insert() fails. A local user can trigger a radix_tree_insert() failure during blkcg creation to cause resource exhaustion.

The blkcg group may be marked online despite not being fully inserted.

1691) Out-of-bounds read (CVE-ID: CVE-2026-93797)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in the iwl_mvm_check_he_obss_narrow_bw_ru_iter function when processing an extended capability information element shorter than 11 bytes. A remote attacker can supply a malformed extended capability information element to read memory out of bounds.

1692) Race condition (CVE-ID: CVE-2026-93798)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause inconsistent relocation-root state.

The vulnerability exists due to improper synchronization in merge_reloc_roots() when merging relocation roots. A local user can trigger relocation-root cleanup to cause inconsistent relocation-root state.

The issue occurs when a root has zero root references in its root item.

1693) Use-after-free (CVE-ID: CVE-2026-93800)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the btrfs relocation root cleanup logic when handling errors returned by btrfs_update_reloc_root() during relocation. A local user can trigger relocation that encounters an error and unmount the filesystem to cause a denial of service.

1694) Out-of-bounds write (CVE-ID: CVE-2026-93802)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in rsi_prepare_beacon() when preparing an oversized beacon frame. A local user can provide an oversized beacon frame to cause a denial of service.

1695) Out-of-bounds read (CVE-ID: CVE-2026-93803)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in libipw_rx() when processing crafted Wi-Fi frames. A remote attacker can send a specially crafted Wi-Fi frame to read out-of-bounds memory.

1696) Out-of-bounds read (CVE-ID: CVE-2026-93805)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to improper frame length validation in the cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() callbacks when processing truncated MLME management frames. A local user can supply a truncated management frame to read out-of-bounds memory.

1697) Out-of-bounds read (CVE-ID: CVE-2026-93807)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in rsi_hal_load_key() in the rsi wireless driver when processing non-TKIP cipher keys. A local user can provide a non-TKIP cipher key with a shorter key layout to cause an out-of-bounds read.

1698) Out-of-bounds read (CVE-ID: CVE-2026-93808)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause an out-of-bounds read.

The vulnerability exists due to improper length validation in the ALSA USB CAIAQ EP1 reply handling code when processing undersized EP1 replies. An attacker with physical access can provide a malformed EP1 reply to cause an out-of-bounds read.

1699) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-93811)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak and an incorrect success result.

The vulnerability exists due to improper exceptional-condition handling in ksmbd_vfs_get_sd_xattr() when validating a decoded security descriptor size. A local user can trigger validation of a security descriptor smaller than struct smb_ntsd to cause a memory leak and an incorrect success result.

1700) Memory leak (CVE-ID: CVE-2026-93811)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper error-path resource cleanup in ksmbd_vfs_get_sd_xattr() when decoding an NT ACL. A local user can trigger an ndr_decode_v4_ntacl() failure to cause a memory leak.

1701) Memory leak (CVE-ID: CVE-2026-93812)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper memory release in ksmbd_vfs_set_sd_xattr when encoding NT ACL data. A remote attacker can cause an encoding operation to return an error after memory allocation to cause a denial of service.

1702) Out-of-bounds read (CVE-ID: CVE-2026-93813)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Btrfs INODE_REF item handler when processing a crafted Btrfs image. A local user can provide a crafted Btrfs image with an oversized INODE_REF name length to cause a denial of service.

1703) Improper locking (CVE-ID: CVE-2026-93815)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an invalid wait context.

The vulnerability exists due to improper locking in au1000_close() in the au1000 Ethernet driver when stopping the network device. A local user can invoke the affected close operation to trigger an invalid wait context.

1704) Out-of-bounds read (CVE-ID: CVE-2026-93816)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the f2fs inline dentry conversion routine when processing a corrupted filesystem image. A local user can provide a corrupted filesystem image containing an overlong inline dentry name to read out-of-bounds memory.

1705) Use-after-free (CVE-ID: CVE-2026-93819)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the MediaTek PCIe controller driver's root bus removal routine when stopping and removing a root bus concurrently with rescan or hotplug operations triggered via sysfs. A local user can trigger concurrent rescan or hotplug operations via sysfs to cause a denial of service.

1706) Use-after-free (CVE-ID: CVE-2026-93820)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race condition in Rockchip PCIe host controller root bus removal when rescan or hotplug operations are triggered concurrently via sysfs. A local user can race root bus removal with concurrent rescan or hotplug operations to cause a denial of service.

1707) Race condition (CVE-ID: CVE-2026-93821)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the Altera PCIe controller driver's root bus removal routine when concurrent rescan or hotplug operations are triggered through sysfs. A local user can trigger concurrent rescan or hotplug operations through sysfs to cause a denial of service.

1708) Use-after-free (CVE-ID: CVE-2026-93822)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a system crash.

The vulnerability exists due to a race condition in PCI iProc root bus removal when concurrently triggering sysfs rescan or hotplug operations. A local user can trigger concurrent sysfs rescan or hotplug operations to cause a system crash.

1709) NULL pointer dereference (CVE-ID: CVE-2026-93825)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing null pointer check in spi_get_device_match_data() when processing an SPI device using driver_override without a matching SPI ID entry. A local user can use driver_override without a matching SPI ID entry to cause a denial of service.

1710) Resource exhaustion (CVE-ID: CVE-2026-93830)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper interrupt masking in the XGMAC2 stmmac driver when the DMA runs out of receive descriptors under heavy receive pressure. A remote attacker can generate heavy receive traffic to cause a denial of service.

1711) Unchecked Return Value (CVE-ID: CVE-2026-97407)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access hardware registers while the device state is undefined.

The vulnerability exists due to an unchecked return value in rockchip_pdm_set_fmt() when resuming runtime power management. A local user can request an audio interface format change during a runtime resume failure to access hardware registers while the device state is undefined.

1712) Out-of-bounds read (CVE-ID: CVE-2026-97408)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read beyond the advertised skb payload.

The vulnerability exists due to an out-of-bounds read in l2cap_recv_frame() when processing malformed connectionless L2CAP frames. A remote attacker can send a connectionless frame with an incomplete PSM payload to read beyond the advertised skb payload.

The read can use tailroom bytes as part of the PSM.

1713) Infinite loop (CVE-ID: CVE-2026-97411)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper state management in the mal_remove() function of the IBM EMAC MAL driver when removing the affected module after NAPI has not been enabled or has already been disabled. A local privileged user can remove the affected module to cause a denial of service.

The condition can occur when no MACs were registered or when registered MACs were subsequently unregistered.

1714) Integer underflow (CVE-ID: CVE-2026-97413)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds memory access.

The vulnerability exists due to integer underflow in the rtrs-srv process_read and process_write functions when processing a network-supplied RDMA message with usr_len greater than off. A remote attacker can send a crafted RDMA message with usr_len greater than off to cause an out-of-bounds memory access.

1715) NULL pointer dereference (CVE-ID: CVE-2026-97416)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in btrfs_may_alloc_data_chunk() when processing corrupted Btrfs metadata during a balance operation. A local user can trigger a Btrfs balance operation on a filesystem whose chunk tree contains a chunk without a corresponding block group to cause a denial of service.

The issue occurs when CONFIG_BTRFS_ASSERT is disabled.

1716) Type conversion (CVE-ID: CVE-2026-97417)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an unaligned memory access.

The vulnerability exists due to an unsafe pointer cast in the tcp_sack() timestamp-only fast path when processing TCP options. A remote attacker can send a TCP packet containing unaligned options to trigger an unaligned memory access.

1717) NULL pointer dereference (CVE-ID: CVE-2026-97418)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in snd_es18xx_mixer when handling control allocation failures. A local user can trigger mixer control creation during an allocation failure to cause a denial of service.

1718) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-97419)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to improper network namespace isolation in HSR generic netlink notification handling when broadcasting ring error and node down events. A local privileged user can listen for notifications from HSR devices in other network namespaces in init_net to disclose sensitive information.

The notifications expose the peer node MAC address and slave port interface index.

1719) Out-of-bounds read (CVE-ID: CVE-2026-97420)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read out-of-bounds memory.

The vulnerability exists due to a missing NUL terminator in the bpf_sysctl_set_new_value helper when replacing a pending sysctl value through a cgroup/sysctl BPF program. A local privileged user can provide a replacement sysctl value without a terminating NUL byte to read out-of-bounds memory.

1720) Integer overflow (CVE-ID: CVE-2026-97421)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect page-size selection.

The vulnerability exists due to integer overflow in ib_umem_find_best_pgsz() in the RDMA/umem subsystem when handling a virtual address and length. A local user can provide values that trigger boundary conditions to cause incorrect page-size selection.

The issue is especially important on 32-bit systems.

1721) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-97430)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to queue new commands on the command ring while the xHC is inaccessible.

The vulnerability exists due to an improper check for an inaccessible hardware state in the xHCI command-ring queueing logic when the controller is suspended or resumed. A local user can initiate command queueing while the xHC is inaccessible to queue new commands on the command ring.

1722) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97434)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause active NAPI instances to be deleted.

The vulnerability exists due to improper resource lifecycle management in the dpaa2-switch device removal path when removing a DPSW device. A local privileged user can trigger the device removal path to cause active NAPI instances to be deleted.

All NAPI instances are attached to the first switch port's net_device but are shared by all switch ports.

1723) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-97435)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to redirect traffic to an unintended port or trigger an out-of-bounds access.

The vulnerability exists due to improper validation of a destination port index in the SJA1105 flower classifier when configuring a redirect action to a switch port on a different switch chip. A local privileged user can configure a redirect action referencing a port from another switch chip to redirect traffic to an unintended port or trigger an out-of-bounds access.

1724) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97436)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause multiple ports to share a forwarding database.

The vulnerability exists due to improper forwarding database state management in dpaa2_switch_port_set_fdb() when a port leaves a bridge while other ports continue to use the same forwarding database. A local privileged user can change bridge membership to cause multiple ports to share a forwarding database.

The issue occurs when multiple bridges have ports from the same DPSW instance.

1725) Out-of-bounds read (CVE-ID: CVE-2026-97437)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to improper bounds validation in the NTFS3 directory enumeration and index lookup paths when processing crafted NTFS index entries. A local user can provide a crafted NTFS image to cause an out-of-bounds read.

1726) Out-of-bounds read (CVE-ID: CVE-2026-97438)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a slab out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the NTFS3 index entry processing when processing a malformed NTFS directory index entry during directory lookup. A local user can trigger directory lookup on an entry whose key_size exceeds the bytes available in its NTFS_DE payload to cause a slab out-of-bounds read.

1727) NULL pointer dereference (CVE-ID: CVE-2026-97439)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the ntfs3 extended attribute handler when modifying system.ntfs_attrib and system.dos_attrib on the same file in a corrupted ntfs3 image. A local user can toggle system.ntfs_attrib, overwrite system.dos_attrib, and write to the file to cause a denial of service.

1728) Memory leak (CVE-ID: CVE-2026-97440)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing reference release in qrtr_send_resume_tx() when allocation of a QRTR control packet fails. A local user can trigger the allocation failure path to cause a denial of service.

1729) Improper input validation (CVE-ID: CVE-2026-97441)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper validation of the mapped BAR size in the AHCI driver when probing an AHCI controller whose HOST_CAP register claims more ports than fit within the mapped BAR region. An attacker with physical access can trigger access to port registers beyond the BAR boundary to cause a denial of service.

1730) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-97443)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper state validation in perf_ftrace_function_unregister() when cleaning up a perf event whose ftrace operations registration failed or was already torn down. A local user can cause perf event cleanup to invoke unregister_ftrace_function() for ftrace operations that are not enabled to trigger a kernel warning.

1731) Out-of-bounds read (CVE-ID: CVE-2026-97444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds access.

The vulnerability exists due to missing boundary checks in the ACPICA AML parser when parsing ACPI AML input. A local user can supply malformed AML input to cause an out-of-bounds access.

1732) Out-of-bounds read (CVE-ID: CVE-2026-97445)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond the end of a buffer.

The vulnerability exists due to improper buffer validation in acpi_ut_walk_aml_resources() when processing malformed AML resource descriptors. A local user can provide a malformed AML resource descriptor whose length exceeds the remaining buffer size to read beyond the end of a buffer.

1733) NULL pointer dereference (CVE-ID: CVE-2026-97446)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in acpi_ns_custom_package() when processing a firmware-provided _BIX package whose first element is an unresolvable reference. A local user can cause the kernel to process such a package to cause a denial of service.

1734) Use-after-free (CVE-ID: CVE-2026-97448)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper validation of a namespace node in acpi_ns_build_normalized_path() when processing an invalid ACPI namespace node. A local user can cause the function to process an invalid namespace node to trigger a use-after-free condition.

1735) Memory corruption (CVE-ID: CVE-2026-97449)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds access.

The vulnerability exists due to improper restriction of operations within bounds in ACPICA parser functions when parsing package data with invalid package limits. A local user can trigger parsing of package data with invalid package limits to perform an out-of-bounds access.

1736) Type Confusion (CVE-ID: CVE-2026-97450)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access fields of a handler object without validating its type.

The vulnerability exists due to improper type validation in the ACPICA handler-list processing routines when walking handler lists. A local user can cause ACPICA to process a handler object with an invalid type to access fields of a handler object without validating its type.

1737) Integer overflow (CVE-ID: CVE-2026-97451)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an integer overflow in acpi_ex_opcode_3A_1T_1R() when calculating the truncation length for a String or Buffer operand. A local user can trigger the vulnerable operation with values that cause Index + Length to overflow to cause memory corruption.

1738) Improper input validation (CVE-ID: CVE-2026-97452)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of reference classes in acpi_ut_copy_simple_object() when copying local, argument, or debug ACPI reference objects. A local user can cause the function to add a reference to an invalid object pointer to cause a denial of service.

1739) Out-of-bounds read (CVE-ID: CVE-2026-97453)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond the bounds of an ACPI package buffer.

The vulnerability exists due to improper validation of an encoded package length byte count in acpi_ps_get_next_package_length() when parsing ACPI package lengths. A local user can cause the function to process an encoded byte count exceeding the remaining available bytes to read beyond the bounds of an ACPI package buffer.

1740) Out-of-bounds read (CVE-ID: CVE-2026-97454)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond buffer bounds.

The vulnerability exists due to an out-of-bounds read in acpi_ps_get_next_field() when parsing malformed AML field data. A local user can cause malformed AML field data to be parsed to read beyond buffer bounds.

1741) Use-after-free (CVE-ID: CVE-2026-97455)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in acpi_ds_terminate_control_method() when terminating a control method whose return value is a ref_of reference. A local user can cause a control method to return a ref_of reference to trigger a use-after-free condition.

The affected reference can point to a method local variable or argument.

1742) Out-of-bounds read (CVE-ID: CVE-2026-97456)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory out of bounds.

The vulnerability exists due to an out-of-bounds read in acpi_ps_parse_loop() when checking for AML_ELSE_OP after skipping a While/If block. A local user can trigger the affected AML parsing condition to access memory out of bounds.

1743) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97472)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to prevent generation of temporary IPv6 privacy addresses for an IPv6 prefix.

The vulnerability exists due to improper state management in the IPv6 addrconf temporary address management logic when handling router advertisements that deprecate and later restore an IPv6 prefix. A remote attacker can send router advertisements that temporarily deprecate and later restore a prefix to prevent temporary address regeneration.

1744) Use-after-free (CVE-ID: CVE-2026-97475)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a use-after-free.

The vulnerability exists due to failure to unregister thermal cooling devices in the Tegra SoCTherm driver when the platform driver is removed. A local privileged user can cause the driver to be removed and trigger use of a stale thermal framework reference to trigger a use-after-free.

The stale cooling-device references retain devdata pointers to memory freed during platform-device cleanup.

1745) Missing Authorization (CVE-ID: CVE-2026-97476)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive network and socket information.

The vulnerability exists due to improper access control in the RDS_INFO_* getsockopt handlers when querying RDS information from a separate network namespace. A local user can call getsockopt with RDS_INFO_* options to disclose sensitive network and socket information.

Exploitation requires a fresh user namespace and network namespace.

1746) Improper handling of exceptional conditions (CVE-ID: CVE-2026-97481)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper handling of FIFO error interrupts in the 8250 serial driver when the serial interface receives a flood of messages during startup and encounters a FIFO error with no data ready. An attacker with physical access can send a flood of messages to the serial interface during startup to cause a denial of service.

1747) NULL pointer dereference (CVE-ID: CVE-2026-97482)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the goku_irq() interrupt handler when handling an INT_USBRESET event before a gadget driver is bound. An attacker with physical access can trigger an INT_USBRESET event before a gadget driver is bound to cause a denial of service.

1748) Deadlock (CVE-ID: CVE-2026-97483)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of memory allocation flags in USB core root hub control transfer handling when processing root hub control transfers during device-reset handling. A local user can trigger device-reset handling that submits a root hub control transfer to cause a denial of service.

The condition occurs in SCSI error-handler paths involving UAS or the storage driver.

1749) NULL pointer dereference (CVE-ID: CVE-2026-97484)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in status_show_vhci() in drivers/usb/usbip/vhci_sysfs.c when reading VHCI status after a VHCI host controller probe failure. A local user can read the VHCI status sysfs entry to cause a denial of service.

1750) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-97485)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of set_blocksize failures in the OMFS filesystem superblock initialization routine when mounting an OMFS filesystem with a block size larger than PAGE_SIZE. A local user can mount a specially crafted OMFS filesystem to cause a denial of service.

1751) Unchecked Return Value (CVE-ID: CVE-2026-97486)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an unchecked return value in the HPFS superblock mount handler when mounting an HPFS filesystem on a device with a block size greater than the page size. A local privileged user can mount the filesystem to trigger a kernel BUG condition and cause a denial of service.

1752) Unchecked Return Value (CVE-ID: CVE-2026-97487)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an unchecked return value in the JFS superblock initialization function jfs_fill_super when mounting a JFS filesystem with a block size greater than the page size. A local user can mount such a filesystem to cause a denial of service.

1753) Unchecked Return Value (CVE-ID: CVE-2026-97488)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an unchecked return value in qnx4_fill_super when mounting a QNX4 filesystem on a device whose block size causes sb_set_blocksize to fail. A local privileged user can mount the filesystem to trigger a kernel BUG.

1754) Unchecked Return Value (CVE-ID: CVE-2026-97489)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an unchecked return value in the bfs filesystem superblock initialization routine when mounting a BFS file system on a block device with a block size greater than PAGE_SIZE. A local user can mount a BFS file system on such a block device to cause a denial of service.

1755) Unchecked Return Value (CVE-ID: CVE-2026-97490)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of block size configuration failures in the AFFS filesystem mounting code when mounting an AFFS filesystem with a block size greater than PAGE_SIZE. A local user can mount a specially crafted AFFS filesystem to cause a denial of service.

1756) Resource exhaustion (CVE-ID: CVE-2026-97491)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in rds_ib_conn_path_shutdown when tearing down InfiniBand network configurations. A local user can initiate teardown of InfiniBand network configurations to cause a denial of service.

1757) Expired pointer dereference (CVE-ID: CVE-2026-97492)

CWE-ID: CWE-825 - Expired pointer dereference

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave drivers with dangling pointers.

The vulnerability exists due to improper state cleanup in the mac80211 ieee80211_reconfig NAN reconfiguration failure handling when handling a failed NAN reconfiguration while other interfaces are present. A local user can trigger NAN reconfiguration processing that fails to leave drivers with dangling pointers.

The stale pointers can reference station and link objects.

1758) NULL pointer dereference (CVE-ID: CVE-2026-97502)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the mmc_davinci_irq() handler in the DaVinci MMC host driver when processing read data timeout or data CRC error interrupt status while no data request is present. A local user can trigger the affected interrupt handling condition to cause a denial of service.

1759) NULL pointer dereference (CVE-ID: CVE-2026-97506)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a null-pointer dereference.

The vulnerability exists due to improper handling of an allocation failure in chainup_buffers() in the ixp4xx crypto driver when constructing a buffer descriptor chain for a scatterlist. A local user can submit a crypto request that encounters an allocation failure to trigger a null-pointer dereference.

1760) Unchecked Return Value (CVE-ID: CVE-2026-97507)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an unchecked return value in dm1105_hw_init() when initializing dm1105 hardware after DMA memory allocation fails. A local user can trigger dm1105 hardware initialization to cause a denial of service.

1761) Use-after-free (CVE-ID: CVE-2026-97508)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the Thunderbolt XDomain request handler when handling a request from a remote host while a domain is stopped. A remote attacker can send a request during domain shutdown to cause a denial of service.

1762) Use-after-free (CVE-ID: CVE-2026-97509)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference counting in the Thunderbolt XDomain service lifetime handling when releasing an XDomain service. A local user can trigger service release after the parent XDomain is released to cause a denial of service.

1763) Memory leak (CVE-ID: CVE-2026-97510)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to a missing release of allocated memory in __tb_xdomain_response() when tb_cfg_request() fails to set up a request. A local user can trigger the failed request setup to cause a memory leak.

The issue can occur when the control channel has already been shut down.

1764) Race condition (CVE-ID: CVE-2026-97523)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in the mptcp scheduler when subflow socket states change. A remote attacker can trigger the race condition to cause a denial of service.

1765) Deadlock (CVE-ID: CVE-2026-97524)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in the MPTCP receive path when processing a subflow reset under exceptional error conditions. A remote attacker can trigger the exceptional error condition during MPTCP receive processing to cause a denial of service.

1766) Use of Uninitialized Variable (CVE-ID: CVE-2026-97568)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect handling of MPTCP backup state.

The vulnerability exists due to use of an uninitialized variable in MPTCP syncookie state handling when copying MPTCP subflow information. A remote attacker can trigger copying of MPTCP subflow information to cause incorrect handling of MPTCP backup state.

1767) Unchecked Return Value (CVE-ID: CVE-2026-97572)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a zeroed DMA address to be handed out.

The vulnerability exists due to an unchecked return value in bnxt_init_nic() when initializing RX rings after an allocation failure. A local user can trigger NIC initialization after RX ring allocation fails to cause a zeroed DMA address to be handed out.

1768) Unchecked Return Value (CVE-ID: CVE-2026-97573)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a loss of confidentiality, integrity, and availability.

The vulnerability exists due to unchecked return value in bnxt_rx_ring_reset() when resetting receive ring buffers after a buffer allocation failure. A remote attacker can trigger the vulnerable receive-ring reset to cause a loss of confidentiality, integrity, and availability.

1769) Out-of-bounds read (CVE-ID: CVE-2026-97576)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to an out-of-bounds read in stateless HEVC decoder tile processing when processing a V4L2 HEVC PPS control with excessive tile counts. A local user can submit a crafted HEVC PPS control to compromise confidentiality, integrity, and availability.

1770) Use-after-free (CVE-ID: CVE-2026-97582)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in the gpio-fan alarm work handler when unbinding a GPIO fan device while alarm work is pending. A local user can unbind the device after alarm work has been queued to access freed memory.

1771) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-97592)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to failure to clear sensitive data from memory in the s390 AES CTR and GCM cryptographic routines when processing cryptographic requests. A local user can process cryptographic requests that leave sensitive data in temporary buffers to disclose sensitive information.

1772) Improper Validation of Array Index (CVE-ID: CVE-2026-97596)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an out-of-bounds transition table access.

The vulnerability exists due to improper validation of array indices in IPVS connection template synchronization record processing when processing a crafted IPVS synchronization record containing an invalid template state. A remote attacker can send a crafted IPVS synchronization record with an invalid template state to trigger an out-of-bounds transition table access.

The version 1 synchronization path handles both IPv4 and IPv6 records.

1773) Resource exhaustion (CVE-ID: CVE-2026-97598)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in fib_empty_table() in IPv4 FIB rules when adding an IPv4 rule with automatic table assignment. A local user can populate table IDs and add a table-0 rule to cause a denial of service.

Only the IPv4 automatic table-assignment path is affected.

1774) NULL pointer dereference (CVE-ID: CVE-2026-97601)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the lowpan_newlink function when processing an RTM_NEWLINK request for a TUN device whose link-layer type has been changed to ARPHRD_IEEE802154. A local privileged user can issue an RTM_NEWLINK request to cause a denial of service.

1775) Use-after-free (CVE-ID: CVE-2026-97604)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a use-after-free in vfb colormap cleanup when a concurrent driver unbind occurs while FBIOGETCMAP copies a colormap to userspace. A local user can retain an open framebuffer file reference and invoke FBIOGETCMAP during a driver unbind to disclose sensitive information.

1776) Use-after-free (CVE-ID: CVE-2026-97608)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service, disclose sensitive information, or modify data.

The vulnerability exists due to a race condition leading to a use-after-free in the netfilter nf_log logger backends when unregistering logger backends during per-network namespace teardown. A local user can rebind a logger through a sysctl or netlink writer after the prior per-network logger selection has been cleared to cause a denial of service, disclose sensitive information, or modify data.

1777) Use-after-free (CVE-ID: CVE-2026-97611)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code, disclose sensitive information, or cause a denial of service.

The vulnerability exists due to a use-after-free in the Open vSwitch flow table mask array when processing packets during flow table statistics lookup. A local user can trigger concurrent flow table mask array reallocation and packet processing to execute arbitrary code, disclose sensitive information, or cause a denial of service.

1778) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-97612)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to stale inner protocol state in skb_mpls_pop() when Open vSwitch re-pushes MPLS after all labels have been popped and the packet has been recirculated. A local user can trigger MPLS label push, pop, recirculation, and a subsequent label push to cause memory corruption.

1779) Memory leak (CVE-ID: CVE-2026-97899)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper memory release in query_perf_config_list() when memory reallocation fails. A local user can trigger a performance configuration list query when memory reallocation fails to cause a memory leak.

1780) Improper initialization (CVE-ID: CVE-2026-97904)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to an uninitialized semaphore.

The vulnerability exists due to improper initialization in cpufreq_policy_alloc() when accessing policy sysfs attributes during policy creation. A local user can access a policy sysfs attribute before policy->rwsem is initialized to trigger access to an uninitialized semaphore.

1781) Use of uninitialized resource (CVE-ID: CVE-2026-97905)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to invoke sysfs attribute callbacks on an uninitialized cpufreq policy.

The vulnerability exists due to use of uninitialized memory in the policy->cpus cpumask in cpufreq_policy_alloc() when a cpufreq policy is published to sysfs before initialization completes. A local user can access sysfs attributes during this initialization window to invoke callbacks on the uninitialized policy.

Only systems configured with CONFIG_CPUMASK_OFFSTACK=y are affected by the uninitialized separately allocated bitmap.

1782) Use of uninitialized resource (CVE-ID: CVE-2026-97909)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger use of an uninitialized IRQ lock.

The vulnerability exists due to improper initialization in the ASoC STI UniPerif reader initialization routine when a pending shared interrupt is handled before the IRQ lock is initialized. A local user can cause the shared interrupt handler to run during initialization to trigger use of an uninitialized IRQ lock.

1783) Out-of-bounds write (CVE-ID: CVE-2026-97910)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper validation of buffer sizes in sprd_platform_compr_copy() in the ASoC sprd PCM compression driver when handling user-configured compression buffer parameters and write data. A local user can configure oversized compression buffer parameters and write data to overflow fixed IRAM or DDR buffer allocations.

The copy callback can be reached while the stream is in the setup state without starting it.

1784) Memory leak (CVE-ID: CVE-2026-97923)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper memory management in create_var_ref() in the tracing histogram implementation when initialization of a VAR_REF histogram field fails. A local user can trigger VAR_REF histogram field initialization failure to cause a memory leak.

1785) Out-of-bounds write (CVE-ID: CVE-2026-97926)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of cylinder group metadata in ufs_read_cylinder() when processing a crafted UFS filesystem image. A remote attacker can provide malformed cylinder group metadata to cause an out-of-bounds memory access.

User interaction is required.

1786) NULL pointer dereference (CVE-ID: CVE-2026-97927)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in UFS superblock teardown when mounting a crafted writable UFS filesystem image whose first cylinder group cannot be read. A local user can mount a crafted UFS filesystem image to cause a denial of service.

1787) Out-of-bounds read (CVE-ID: CVE-2026-97930)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read memory beyond the source buffer.

The vulnerability exists due to an out-of-bounds read in the ALSA usbusx2y driver when handling USB interrupt data during initialization. An attacker with physical access can trigger the initialization path to read three bytes past the end of the in04_buf allocation.

1788) Improper privilege management (CVE-ID: CVE-2026-97931)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to improper memory mapping permission handling in the ALSA us122l hwdep mmap callback when using mprotect() on a read-buffer mapping after opening the hwdep node O_RDWR. A local user can upgrade the read-buffer mapping to writable and modify the read_size member to cause memory corruption.

The read VMA remains expandable because pcm_usb_stream uses mremap() after reading read_size.

1789) Use-after-free (CVE-ID: CVE-2026-97940)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service, disclose sensitive information, or modify information.

The vulnerability exists due to a use-after-free in the IPv6 FIB route iterator walker handling when stopping an IPv6 route iterator while routes are deleted. A local user can trigger a race that leaves a freed walker on the IPv6 FIB walker list to cause a denial of service, disclose sensitive information, or modify information.

The same stop helper is used by /proc/net/ipv6_route and the BPF IPv6 route iterator.

1790) Deadlock (CVE-ID: CVE-2026-97948)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to recursive locking in eeh_rmv_device when handling EEH error events. A local user can trigger the affected EEH error-handling path to cause a denial of service.

The issue occurs for errors detected directly on the PHB or when a driver requests a reset but does not provide EEH error handlers.

1791) Deadlock (CVE-ID: CVE-2026-97951)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper command completion in the iSCSI target dataout handler when processing final dataout PDUs for a WRITE command aborted by a LUN reset. A remote user can send remaining dataout PDUs to cause a denial of service.

1792) Out-of-bounds read (CVE-ID: CVE-2026-97954)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt the TCP RDS stream.

The vulnerability exists due to an out-of-bounds read in rds_message_map_pages() when transmitting RDS-TCP data on systems with page sizes greater than 8192 bytes. A remote attacker can trigger transmission of the congestion map to corrupt the TCP RDS stream.

1793) Heap-based buffer overflow (CVE-ID: CVE-2026-97957)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a heap-based buffer overflow.

The vulnerability exists due to improper bounds checking in check_mbox_seq_id_and_seg_len() in the hinic driver mailbox receive handler when processing mailbox segments. A local user can send a mailbox segment whose final sequence segment exceeds the remaining receive-buffer space to cause a heap-based buffer overflow.

1794) Infinite loop (CVE-ID: CVE-2026-97958)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of EAGAIN errors in tc_ctl_chain() when processing repeated RTM_GETCHAIN requests without consuming netlink responses. A local user can send repeated RTM_GETCHAIN requests without reading the responses to cause a denial of service.

1795) Memory leak (CVE-ID: CVE-2026-97959)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to a failure to free an emptied route4 bucket in net/sched/cls_route.c route4_change when moving an existing route filter to a different top-level bucket and deleting it. A local user can move an existing route filter to a different top-level bucket and then delete it to cause a memory leak.

The issue requires CONFIG_NET_CLS_ROUTE4, CONFIG_NET_SCH_INGRESS, and CONFIG_NET_CLS_ACT to be enabled.

1796) Improper initialization (CVE-ID: CVE-2026-97963)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger undefined behavior.

The vulnerability exists due to improper initialization in the stmmac driver's ptp_lock when offloading a TAPRIO schedule while the interface is down. A local user can configure a TAPRIO schedule to trigger undefined behavior.

The issue occurs when the interface has never been opened.

1797) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97964)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify data visible to an AF_PACKET socket.

The vulnerability exists due to failure to ensure a writable skb header in ppp_sync_txmunge() when bridging a received PPP frame to a synchronous tty channel. A remote attacker can send a PPPoE frame that is bridged to a synchronous tty channel to modify data visible to an AF_PACKET socket.

Exploitation requires the frame buffer to be shared with a clone queued to an AF_PACKET socket.

1798) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-97969)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in msc313e_wdt_settimeout() when setting a watchdog timeout. A local user can set a watchdog timeout to cause a denial of service.

1799) Division by zero (CVE-ID: CVE-2026-97970)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to division by zero in the msc313e watchdog driver's msc313e_wdt_probe function when initializing a watchdog device with a zero clock rate. A local privileged user can trigger watchdog device initialization with a zero clock rate to cause a denial of service.

1800) Resource exhaustion (CVE-ID: CVE-2026-97981)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper NAPI work budget accounting in the Cortina Gemini Ethernet driver's gmac_rx receive loop when processing malformed Ethernet frames. A remote attacker can send a stream of malformed Ethernet frames to cause a denial of service.

1801) Incorrect calculation (CVE-ID: CVE-2026-97982)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to incorrect budget accounting in gmac_rx() and gmac_napi_poll() when handling received packets during NAPI polling. A remote attacker can cause an idle poll to report a full budget and remain scheduled to cause a denial of service.

1802) Out-of-bounds write (CVE-ID: CVE-2026-97991)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read from and write to out-of-bounds memory.

The vulnerability exists due to improper range validation in vdpasim_blk_check_range() when processing virtio block requests with an out-of-range sector start. A local user can submit a crafted virtio block request to read from and write to out-of-bounds memory.

1803) Race condition (CVE-ID: CVE-2026-97993)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in vhost_vdpa_set_config_call() when installing a configuration eventfd context. A local user can supply an invalid eventfd descriptor while setting the configuration callback to cause a denial of service.

A configuration interrupt delivered during the error-handling window can pass an error pointer to eventfd_signal().

1804) Out-of-bounds read (CVE-ID: CVE-2026-97995)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause an out-of-bounds read.

The vulnerability exists due to type confusion in the virtio_console remove_vqs() function when unbinding a device with a control message remaining on the control-out virtqueue. A local privileged user can unbind the device while the control message is queued to cause an out-of-bounds read.

1805) Race condition (CVE-ID: CVE-2026-97998)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the nfnetlink_log instance destruction handler when concurrently processing a netlink close event and an UNBIND request from sockets using the same port ID. A local user can trigger concurrent instance destruction and unbinding to cause a denial of service.

1806) Use-after-free (CVE-ID: CVE-2026-98006)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the ALSA caiaq USB driver's ep1_in_urb and midi_out_urb handling when processing a command timeout after a submitted URB is unlinked by the dummy HCD driver. A local user can trigger the affected initialization failure to trigger a use-after-free.

1807) Infinite loop (CVE-ID: CVE-2026-98009)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of ETS quantum values in the ETS queuing discipline when configuring an ETS qdisc with crafted quantum values. A local user can configure a crafted ETS qdisc to cause a denial of service.

The issue requires CONFIG_NET_SCH_ETS and CAP_NET_ADMIN; namespace-local capabilities are sufficient.

1808) Resource exhaustion (CVE-ID: CVE-2026-98010)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of DRR quantum values in drr_change_class() when configuring DRR qdisc classes with a low quantum value. A local user can configure a DRR qdisc class with the quantum set to 1 to cause a denial of service.

Exploitation requires CONFIG_NET_SCH_DRR=y and CAP_NET_ADMIN; the capability can be namespace-local through unshare -Urn.

1809) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-98011)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of the quantum value in the HHF queueing discipline when configuring an HHF qdisc with quantum set to 1 and a crafted size table. A local user can configure the qdisc with these values to cause a deficit-refill loop to spin under the qdisc lock and cause a denial of service.

Exploitation requires CONFIG_NET_SCH_HHF=y and CAP_NET_ADMIN in a network namespace.

1810) Improper input validation (CVE-ID: CVE-2026-98012)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the SFQ qdisc change path when processing crafted qdisc configuration. A local user can configure a quantum value of 1 with a crafted size table to cause a denial of service.

The SFQ scheduler must be enabled, and exploitation requires CAP_NET_ADMIN, which can be namespace-local.

1811) Resource exhaustion (CVE-ID: CVE-2026-98013)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of quantum values in fq_pie_change() when changing fq_pie qdisc configuration with a crafted size table. A local user can configure a quantum value of 1 and a crafted size table to cause a denial of service.

Exploitation requires CONFIG_NET_SCH_FQ_PIE to be enabled.

1812) Use-after-free (CVE-ID: CVE-2026-98014)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cleanup ordering in the mlx5 E-Switch vport disable path when handling firmware-fatal recovery. A local user can trigger a PCI device reset to cause a denial of service.

1813) Use-after-free (CVE-ID: CVE-2026-98015)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in mlx5_eswitch_termtbl_put when two callers concurrently release the same mlx5_termtbl_handle. A local user can invoke concurrent calls on the same handle to access freed memory.

1814) Use-after-free (CVE-ID: CVE-2026-98016)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to a use-after-free race in sample_restore_put() when concurrently tearing down TC sample rules sharing the same restore context. A local user can concurrently tear down shared TC sample rules to access freed memory.

1815) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-98022)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits in netif_change_tx_queue_len() when processing tx queue length changes. A local user can set an oversized tx_queue_len value to cause a denial of service.

User and network namespaces must be enabled.

1816) Use-after-free (CVE-ID: CVE-2026-98023)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to use-after-free in the VXLAN forwarding database entry handling when configuring dynamic FDB entries that reference an FDB nexthop. A local user can configure dynamic entries on VXLAN devices that share an FDB nexthop to cause memory corruption.

The race can occur when an entry is aged while another device adds or deletes an entry associated with the shared FDB nexthop.

1817) Heap-based buffer overflow (CVE-ID: CVE-2026-98025)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to corrupt memory.

The vulnerability exists due to a heap-based buffer overflow in the cx82310_rx_fixup function of the cx82310_eth USB network driver when processing a crafted USB network receive URB beginning with the 0xffff reboot sentinel. An attacker with physical access can send a crafted USB network receive URB to corrupt memory.

1818) Out-of-bounds write (CVE-ID: CVE-2026-98027)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or compromise confidentiality and integrity.

The vulnerability exists due to an out-of-bounds write in the mv88e6xxx_get_rxnfc() policy rule dump handler when processing an ETHTOOL_GRXCLSRLALL request with fewer caller-provided slots than policy rules. A local user can issue a request specifying an insufficient rule count to write beyond the allocated buffer.

Exploitation requires policy rules to have been installed for the targeted port.

1819) Out-of-bounds write (CVE-ID: CVE-2026-98030)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to an out-of-bounds write in bcm_sf2_cfp_rule_get_all() in the Broadcom Starfighter 2 DSA driver when processing ETHTOOL_GRXCLSRLALL ioctl requests with a caller-supplied rule count. A local user can request fewer rule slots than installed CFP rules to compromise confidentiality, integrity, and availability.

Exploitation requires CFP rules to have already been installed.

1820) Access of Uninitialized Pointer (CVE-ID: CVE-2026-98031)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to access of an uninitialized pointer in remove_nh_grp_entry() when replacing a reduced nexthop group after a listener allocation failure. A local user can trigger removal of a nexthop group entry to cause a denial of service.

1821) NULL pointer dereference (CVE-ID: CVE-2026-98063)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in btf_var_show() when bpf_snprintf_btf() renders a BTF_KIND_VAR from base vmlinux BTF. A local user can load and run a BPF program that passes the type ID of a BTF_KIND_VAR to bpf_snprintf_btf() to cause a denial of service.

1822) NULL pointer dereference (CVE-ID: CVE-2026-98064)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in btf_modifier_show() when processing a BPF program-supplied const void BTF type. A local user can supply a BPF program with a const void BTF type to bpf_snprintf_btf() to cause a denial of service.

1823) Double free (CVE-ID: CVE-2026-98066)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in the ALSA caiaq driver's audio resource cleanup when handling audio initialization errors. A local user can trigger an audio initialization error after URB resources have been freed to cause a denial of service.

1824) Race condition (CVE-ID: CVE-2026-98068)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in RDS TCP connection path shutdown handling when connection teardown races with acceptance of a new socket. A remote attacker can trigger concurrent connection teardown and socket acceptance to cause a denial of service.

The affected path can remain in RDS_CONN_DOWN with an established socket and a growing receive queue.

1825) Race condition (CVE-ID: CVE-2026-98069)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper synchronization in rds_conn_shutdown() in the RDS networking subsystem when tearing down an RDS connection path. A remote attacker can race transmission or receive-refill operations with connection teardown to cause a denial of service.

Exploitation occurs on weakly ordered architectures.

1826) Race condition (CVE-ID: CVE-2026-98070)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in rds_tcp_reset_callbacks() in the RDS TCP transport when concurrent transmit and connection-reset operations access connection state. A remote attacker can trigger concurrent RDS transmission and connection-reset activity to compromise confidentiality, integrity, and availability.

1827) Race condition (CVE-ID: CVE-2026-98071)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause connection state updates to be lost.

The vulnerability exists due to a data race in rds_conn_path_reset() when resetting RDS connection path flags concurrently with atomic flag operations. A local user can trigger concurrent connection reset and transmission operations to cause connection state updates to be lost.

1828) Race condition (CVE-ID: CVE-2026-98072)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory ordering in release_in_xmit() in the RDS networking component when concurrently releasing transmit state and checking for waiters. A local user can trigger a race between waiter registration and transmit-state release to cause a denial of service.

A lost wake-up can leave shutdown workers waiting indefinitely in uninterruptible wait operations.

1829) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98074)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leave a physical device in promiscuous mode after bond teardown.

The vulnerability exists due to improper state management in __bond_release_one() when releasing all slaves during bond destruction. A local privileged user can destroy a bond containing active and backup slaves to leave a physical device in promiscuous mode after bond teardown.

The backup slave must be released before the active slave.

1830) Improper input validation (CVE-ID: CVE-2026-98075)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the BPF verifier when loading a BPF program that references the main program as a callback. A local user can load a crafted BPF program using a BPF_PSEUDO_FUNC reference to the main program to cause a denial of service.

1831) Use-after-free (CVE-ID: CVE-2026-98076)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to use-after-free in probe-based dynamic event field handling when looking up event fields after removing the first of several attached probes. A local user can create multiple probes for an event, remove the probe that defined its fields, and perform a field lookup to trigger a use-after-free.

1832) Out-of-bounds read (CVE-ID: CVE-2026-98077)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in sip_skip_whitespace() in nf_conntrack_sip when processing a SIP payload containing a recognized header name followed by whitespace at the end of the payload. A remote attacker can send such a crafted SIP payload to trigger an out-of-bounds read.

1833) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-98078)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose stale heap data and corrupt connection sequence state.

The vulnerability exists due to incorrect function call argument ordering in the version 1 IPVS synchronization sender when serializing connection sequence data. A remote attacker can send traffic that causes connection sequence data to be synchronized to disclose stale heap data and corrupt connection sequence state.

Only connections with sequence-state flags set are affected.

1834) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98080)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause filesystem metadata corruption and force the filesystem read-only.

The vulnerability exists due to improper reloc root creation in the Btrfs qgroup snapshot accounting path when accounting snapshots during block-group relocation. A local user can perform Btrfs operations that account snapshots during relocation to cause filesystem metadata corruption and force the filesystem read-only.

The issue occurs on Btrfs filesystems with quotas enabled.

1835) Out-of-bounds read (CVE-ID: CVE-2026-98088)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to improper handling of an invalid NUMA node value in _base_assign_reply_queues() when assigning high IOPS reply queues for a PCI device without NUMA-node affinity. A local user can trigger reply queue assignment to cause an out-of-bounds read.

The issue occurs when dev_to_node() returns NUMA_NO_NODE (-1).

1836) Use-after-free (CVE-ID: CVE-2026-98090)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Btrfs active device pointers when handling a failed sprout setup. A local user can trigger a failed sprout setup to cause a denial of service.

1837) Use-after-free (CVE-ID: CVE-2026-98091)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel warning.

The vulnerability exists due to use-after-free in the btrfs device transaction update list when system chunk creation fails while creating the first metadata chunk for a sprout filesystem. A local user can create a sprout filesystem that encounters a system chunk creation failure to cause a kernel warning.

1838) Deadlock (CVE-ID: CVE-2026-98094)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an IRQ-unsafe locking mechanism in the fbtft dirty_lock handling in fbtft_mkdirty() and fbtft_deferred_io() when framebuffer console rendering occurs in hardirq context concurrently with deferred I/O workqueue processing. A local user can trigger concurrent framebuffer console rendering and deferred I/O processing to cause a denial of service.

1839) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-98095)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper numeric type conversion in tpacket_parse_header() in af_packet when processing a user-provided tpacket_hdr with tp_len larger than INT_MAX. A local user can provide a crafted packet header to cause a denial of service.

1840) Out-of-bounds write (CVE-ID: CVE-2026-98096)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption or a denial of service.

The vulnerability exists due to improper network header offset restoration in the Linux kernel ipv6_srh_rcv() function when processing IPv6 Segment Routing Header packets preceded by another extension header. A remote attacker can send a specially crafted IPv6 packet to cause memory corruption or a denial of service.

1841) NULL pointer dereference (CVE-ID: CVE-2026-98098)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in tipc_named_node_up() when processing node state publications after the local publication limit is reached. A local user can bind a large number of local-scope service addresses to sockets to cause a denial of service.

Subscribers to node or link up/down events may stop receiving notifications.

1842) Stack-based buffer overflow (CVE-ID: CVE-2026-98108)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to a stack-based buffer overflow in the Bluetooth L2CAP deferred enhanced credit-based response handling when processing L2CAP LE connection requests. A remote attacker can send specially crafted L2CAP LE connection requests to cause memory corruption.

The issue involves deferred-setup channels and listening parent channels configured for extended flow control.

1843) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-98113)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to flood the kernel log.

The vulnerability exists due to missing rate limiting in the ksmbd DACL SID mapping error logging path when processing a DACL containing unmapped SIDs. A remote user can submit a DACL with many structurally valid but unmapped SIDs to flood the kernel log.

1844) Use-after-free (CVE-ID: CVE-2026-98116)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a use-after-free in ALSA PCM mmap handling when concurrently mapping PCM data during buffer reallocation. A local user can race an mmap operation against buffer reallocation to obtain a stale writable mapping of freed pages and escalate privileges.

1845) NULL pointer dereference (CVE-ID: CVE-2026-98121)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the msc313e watchdog driver's power management callbacks when handling system suspend or resume operations. A local user can trigger the power management callbacks to cause a denial of service.

1846) Out-of-bounds read (CVE-ID: CVE-2026-98123)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in sctp_get_asconf_response() when processing a truncated SCTP_PARAM_ERR_CAUSE parameter in an ASCONF-ACK. A remote user can send a crafted ASCONF-ACK containing an error-cause parameter without a complete error header to read memory out of bounds.

The association must have ADD-IP enabled and an outstanding ASCONF request.

1847) Infinite loop (CVE-ID: CVE-2026-98123)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper parameter iteration in sctp_get_asconf_response() when processing a crafted ASCONF-ACK. A remote user can send an ASCONF-ACK containing an odd-length parameter that causes the parameter-processing loop to make no progress and spin in softirq context to cause a denial of service.

The association must have ADD-IP enabled and an outstanding ASCONF request.

1848) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-98130)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to a time-of-check to time-of-use race condition in the SCTP_CMD_TIMER_START handler when processing SCTP timer start commands. A remote attacker can trigger the race condition to trigger a use-after-free.

1849) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98154)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper cleanup of completed requests in the nvme_rdma_queue_rq function when handling an -EIO error in the NVMe RDMA queue request path. A local user can trigger an -EIO error during queue request processing to compromise confidentiality, integrity, and availability.

1850) Numeric Truncation Error (CVE-ID: CVE-2026-98157)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to numeric truncation and insufficient input validation in the poll_msec sysfs store handler when processing user-supplied polling-delay values. A local user can write a zero value or an oversized value that truncates to zero to cause a denial of service.

1851) Out-of-bounds write (CVE-ID: CVE-2026-98158)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of skb headroom in ppp_async's process_input_packet() when processing a bad-FCS PPP frame followed by a crafted frame. A remote attacker can send malformed PPP frames to cause a denial of service.

When CCP compression is enabled, decompression can read before the skb head.

1852) Mismatched Memory Management Routines (CVE-ID: CVE-2026-98160)

CWE-ID: CWE-762 - Mismatched Memory Management Routines

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to mismatched memory management routines in rtw_sdio_if1_init() when handling an initialization failure after allocating HalData. A local user can trigger the initialization error path to cause memory corruption.

1853) Out-of-bounds write (CVE-ID: CVE-2026-98181)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to write beyond the bounds of an allocated properties array.

The vulnerability exists due to incorrect indexing that causes an out-of-bounds write in the GUD plane property loop when processing properties advertised by a USB device. An attacker with physical access can advertise the maximum number of properties through a USB device to write beyond the bounds of an allocated properties array.

1854) Integer underflow (CVE-ID: CVE-2026-98185)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger out-of-bounds reads.

The vulnerability exists due to integer underflow in mwifiex_ret_802_11_scan() when processing firmware-provided scan responses. A local user can supply a short response or a response with an oversized BSS length to trigger out-of-bounds reads.

The affected processing handles both normal and background scan responses.

1855) Out-of-bounds read (CVE-ID: CVE-2026-98186)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read beyond the bounds of a kernel beacon buffer.

The vulnerability exists due to an out-of-bounds read in mwifiex_search_oui_in_ie() when processing RSN or WPA information elements in beacon or probe-response frames during scan-result parsing. A remote attacker can transmit a crafted information element with a pairwise-cipher count exceeding the element's available length to read beyond the bounds of a kernel beacon buffer.

1856) Out-of-bounds read (CVE-ID: CVE-2026-98187)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the p54_parse_eeprom() function when parsing a truncated trailing record in a PDR_INTERFACE_LIST entry. A local user can provide a malformed EEPROM buffer to disclose sensitive information.

The variant value read from the record also feeds synth front-end selection.

1857) Out-of-bounds read (CVE-ID: CVE-2026-98188)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds reads past the EEPROM buffer.

The vulnerability exists due to an out-of-bounds read in p54_convert_rev0() and p54_convert_rev1() when processing device-supplied EEPROM calibration curve entries with channel and points-per-channel counts that exceed the available entry data. A local user can supply an EEPROM entry declaring more calibration curve data than it contains to cause out-of-bounds reads past the EEPROM buffer.

Exploitation requires control over the device-supplied EEPROM entry.

1858) Out-of-bounds write (CVE-ID: CVE-2026-98189)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to corrupt neighboring kernel memory.

The vulnerability exists due to an out-of-bounds write in wilc_wlan_handle_isr_ext() in the wilc1000 wireless driver when processing receive transfers whose device-reported size exceeds the receive buffer capacity. An attacker with physical access can supply an oversized transfer containing controlled data through a bogus SDIO device to corrupt neighboring kernel memory.

The receive buffer is 96 KiB, while the device-reported transfer size can reach 131068 bytes. An oversized transfer can also leave the buffer offset beyond its end, allowing subsequent overflows to repeat.

1859) Out-of-bounds read (CVE-ID: CVE-2026-98190)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the wilc1000 driver's wilc_wfi_p2p_rx() and mgmt_tx() functions when processing public action frames shorter than the 32-byte P2P public action header. A remote attacker can transmit a specially crafted 25- to 31-byte public action frame over the air to cause a denial of service.

Exploitation through the receive path requires the host to be in P2P listen mode. No wireless association is required.

1860) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98191)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a runtime power-management reference leak.

The vulnerability exists due to failure to release a runtime power-management reference in wlcore_regdomain_config() when handling a failed regulatory-domain command. A local user can trigger a regulatory-domain command failure to cause a runtime power-management reference leak.

The recovery worker acquires a separate runtime power-management reference and cannot release the reference held by this function.

1861) Use-after-free (CVE-ID: CVE-2026-98194)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the kernel to dereference freed memory.

The vulnerability exists due to use-after-free in lbtf_free_adapter() in the libertas_tf wireless driver when freeing command buffers while the command timer callback is still running. A local user can cause adapter cleanup to overlap with an active command timer callback to cause the kernel to dereference freed memory.

The command_timer_fn callback accesses priv->cur_cmd->cmdbuf.

1862) Double free (CVE-ID: CVE-2026-98195)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in the iwlegacy driver's broadcast station deallocation when handling an error during driver startup. A local user can toggle RF_KILL during driver startup to cause a denial of service.

1863) Use-after-free (CVE-ID: CVE-2026-98196)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause access to freed kernel memory.

The vulnerability exists due to use-after-free in the brcmsmac driver's brcms_free_timer() function when freeing a timer while its delayed-work callback is still running. A local user can trigger this overlapping timer cleanup and callback execution to cause access to freed kernel memory.

The non-synchronous cancel_delayed_work() call returns without waiting for an already-running callback, which accesses the timer structure through container_of().

1864) Use-after-free (CVE-ID: CVE-2026-98197)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger accesses to freed driver data.

The vulnerability exists due to use-after-free in the w83791d driver's fan/pwm 4-5 sysfs callbacks when accessing leftover sysfs files after driver unbind. A local user can access these leftover files to trigger accesses to freed driver data.

The optional sysfs group is created only when the fan/pwm 4-5 pins are not used as GPIO.

1865) Out-of-bounds write (CVE-ID: CVE-2026-98199)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to out-of-bounds writes in the PMBus core when probing chips with more than 10 phases per page. A local user can trigger probing of an affected chip to corrupt kernel memory.

The mp2975 driver supports up to 14 phases per page, and the mp2856 driver supports up to 12 phases per page.

1866) Use of Uninitialized Variable (CVE-ID: CVE-2026-98201)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel stack memory.

The vulnerability exists due to use of an uninitialized stack variable in input_ff_effect_from_user() when copying a smaller compatibility structure into the native struct ff_effect. A local user can submit a force feedback effect through EVIOCSFF and retrieve the stored native structure through UI_BEGIN_FF_UPLOAD to disclose kernel stack memory.

The readback path requires a uinput-based force feedback daemon.

1867) NULL pointer dereference (CVE-ID: CVE-2026-98202)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the synaptics-rmi4 driver's rmi_driver_suspend() and rmi_driver_resume() functions when handling system power management events for an unbound RMI device. A local user can trigger system suspend or resume to cause a denial of service.

1868) Out-of-bounds read (CVE-ID: CVE-2026-98203)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in soc_button_get_button_info() in drivers/input/misc/soc_button_array.c when processing an empty ACPI button descriptor package. A local user can trigger access to btns_desc->package.elements[0] with a zero package count to trigger an out-of-bounds read.

1869) Out-of-bounds read (CVE-ID: CVE-2026-98204)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to incorrect block-length calculation in rmi_smb_write_block() when splitting writes into SMBus blocks. A local user can trigger a write with an input length greater than 32 bytes and a partial final block to cause an out-of-bounds read.

The final partial block causes smb_block_write() to read 32 bytes even when fewer bytes remain in the input buffer.

1870) Use of Uninitialized Variable (CVE-ID: CVE-2026-98205)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of an uninitialized stack variable in the evdev_do_ioctl() function when processing EVIOCSABS ioctl requests with user-supplied sizes. A local user can submit an EVIOCSABS request with a short size and retrieve the resulting absolute axis information through EVIOCGABS to disclose sensitive information.

The disclosed data consists of stale kernel stack bytes left in the portion of the input_absinfo structure not supplied by the caller.

1871) Incorrect calculation (CVE-ID: CVE-2026-98207)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause transfer completion accounting to report incorrect byte counts.

The vulnerability exists due to failure to reset the transferred-byte counter in mmc_spi_request() when retrying a multi-block request after a data CRC error. A local user can issue a multi-block transfer request that encounters a CRC error followed by a successful internal retry to cause transfer completion accounting to report incorrect byte counts.

The data itself is retried. Exploitation depends on an MMC-over-SPI system encountering a data CRC error during the transfer.

1872) Memory leak (CVE-ID: CVE-2026-98208)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to consume kernel memory through a transmit FIFO leak.

The vulnerability exists due to failure to release allocated memory in sdio_uart_add_port() when attempting to add a port after all UART_NR slots in sdio_uart_table[] are occupied. A local user can trigger a port-addition attempt with a full port table to consume kernel memory through a transmit FIFO leak.

1873) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98209)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave SDHCI child devices registered after their parent resources have been released.

The vulnerability exists due to improper resource lifecycle management in the Aspeed SDHCI controller driver when probe failure or device removal occurs. A local user can trigger these lifecycle paths to leave SDHCI child devices registered after their parent resources have been released.

The released parent resources include the controller clock and managed resources.

1874) Use-after-free (CVE-ID: CVE-2026-98210)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to freed host memory.

The vulnerability exists due to use-after-free in the mxcmmc driver's asynchronous callbacks when removing the driver without draining pending work and the watchdog timer. A local user can trigger driver removal while asynchronous callbacks remain pending to trigger access to freed host memory.

The watchdog is armed on the DMA path with a 10-second timeout. The datawork callback is scheduled by the IRQ handler on the PIO path.

1875) Use-after-free (CVE-ID: CVE-2026-98217)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free during device cleanup.

The vulnerability exists due to use-after-free in the mlx4 InfiniBand driver's pkey sysfs cleanup when cleaning up a device after a per-slave pkey sysfs registration failure. A local user can trigger cleanup of a failed slave tree with stale parent kobject pointers to trigger a use-after-free.

Registration continues for the remaining slaves despite per-slave registration errors.

1876) Out-of-bounds read (CVE-ID: CVE-2026-98221)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds memory reads.

The vulnerability exists due to incorrect bounds checking in tpm2_load_cmd() when loading an ASN.1-encoded TPM 2.0 trusted key blob. A local user can supply a crafted trusted key blob to cause out-of-bounds memory reads.

The boundary checks use the ASN.1-encoded payload size rather than the decoded blob size.

1877) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98233)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service in packet ring reception.

The vulnerability exists due to failure to release ring slot ownership in tpacket_rcv() when virtio-net header conversion fails for an unsupported UDP GSO packet. A local user can send an unsupported UDP GSO packet to cause a denial of service in packet ring reception.

With a one-frame TPACKET_V2 ring, the only slot becomes unavailable and the next valid packet is dropped. TPACKET_V3 is not affected by this error path.

1878) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-98234)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits in the heavy-hitter filter (HHF) queuing discipline when processing heavy-hitter flows with an excessively large configured flow limit. A local user can configure an oversized hh_limit and generate spoofed traffic to cause a denial of service.

Exploitation requires CAP_NET_ADMIN in a user namespace.

1879) Unchecked Return Value (CVE-ID: CVE-2026-98236)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel heap memory to the network stack.

The vulnerability exists due to an unchecked return value from skb_copy_bits() in mhi_mbim_rx() when processing modem-supplied network transfer blocks. A local user can supply a datagram pointer entry that references data outside the received socket buffer, causing a failed copy and subsequent delivery of an uninitialized buffer to netif_rx(), to disclose kernel heap memory to the network stack.

1880) Infinite loop (CVE-ID: CVE-2026-98237)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop caused by unchecked cyclic NDP chains in mhi_mbim_rx() when processing modem-supplied NTBs. A local user can supply a crafted NTB containing an NDP that points to itself or an earlier NDP to cause a denial of service.

1881) Out-of-bounds read (CVE-ID: CVE-2026-98241)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger out-of-bounds reads in kernel memory.

The vulnerability exists due to out-of-bounds reads caused by treating request sockets as full IPv6 sockets in xfrm6_local_rxpmtu() and xfrm6_local_error() when accessing inet_sock or ipv6_pinfo state through skb->sk. A remote attacker can trigger local PMTU or error handling for TCP SYN-ACK packets owned by a request socket to trigger out-of-bounds reads in kernel memory.

The vulnerable path is reachable when rerouting selects an IPv6 XFRM tunnel route with a lower MTU while a TCP_NEW_SYN_RECV request socket remains attached to the packet.

1882) Use-after-free (CVE-ID: CVE-2026-98251)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause access to freed kernel memory.

The vulnerability exists due to use-after-free in ovs_ct_get_conn_labels() when adding a labels extension to a confirmed conntrack entry while another CPU accesses its extension block. A local user can trigger label extension allocation during concurrent access to cause access to freed kernel memory.

Exploitation requires a confirmed conntrack entry that does not already have a labels extension.

1883) Race condition (CVE-ID: CVE-2026-98252)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in reference count initialization in iwpm_get_nlmsg_request() in the Linux kernel RDMA core when publishing a request to a global list before initializing its reference count. A local user can trigger concurrent access to the incompletely initialized request to compromise system confidentiality, integrity, and availability.

1884) Use-after-free (CVE-ID: CVE-2026-98253)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to a use-after-free in ucma_process_join() in the RDMA/ucma subsystem when handling concurrent multicast joins and a copy_to_user() failure. A local user can issue concurrent JOIN_MCAST calls for the same address and trigger a response-copy failure to trigger a use-after-free in the kernel.

Multicast leave operations match entries by socket address and destroy the first matching entry. This can cancel the newer RoCE work while an older worker still references the freed ucma_multicast object.

1885) Improper input validation (CVE-ID: CVE-2026-98255)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to improperly modify TCP connection state.

The vulnerability exists due to improper acknowledgment validation in the TCP receive fast path of tcp_rcv_established() when processing segments with acknowledgment sequence numbers before SND.UNA. A remote attacker can send a TCP segment carrying payload and an excessively old acknowledgment to improperly modify TCP connection state.

The segment's sequence number must match RCV.NXT, and its TCP flags must match the fast-path prediction flags.

1886) Deadlock (CVE-ID: CVE-2026-98257)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by permanently stalling the RDS connection workqueues.

The vulnerability exists due to a deadlock between synchronous connection teardown and shutdown work in rds_ib_cm_connect_complete() when a peer negotiates a protocol version older than RDS_PROTOCOL_COMPAT_VERSION. A remote attacker can negotiate such a protocol version to cause a denial of service by permanently stalling the RDS connection workqueues.

1887) Improper initialization (CVE-ID: CVE-2026-98262)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization of the PxCLBU and PxFBU registers in ahci_start_fis_rx() in drivers/ata/libahci.c when probing the ahci driver. A local user can trigger initialization of an affected AHCI controller to cause a denial of service.

The issue occurs on HBAs that support 64-bit addressing but operate with the AHCI_HFLAG_32BIT_ONLY flag. The reported failure leaves a JMicron JMB585 controller unusable.

1888) Memory corruption (CVE-ID: CVE-2026-98272)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory.

The vulnerability exists due to a buffer overflow in the mvpp2 driver's page_pool array during mvpp2_bm_init() when changing the network interface MTU triggers a switch to per-CPU buffering without checking the pool count. A local user can trigger this buffering switch with a receive-queue configuration that exceeds the array capacity to corrupt memory.

The per-CPU buffering scheme requires two pools per receive queue and supports a maximum of eight pools.

1889) Incorrect calculation (CVE-ID: CVE-2026-98275)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave RX overrun interrupts unacknowledged.

The vulnerability exists due to incorrect interrupt acknowledgment bit selection in the Cortina Gemini Ethernet driver's gmac_irq() function when handling RX overrun interrupts. A local user can trigger RX overrun interrupt handling to leave RX overrun interrupts unacknowledged.

For GMAC0, the acknowledgment writes the GMAC1 overrun bit instead; for GMAC1, the shift leaves no bit set in the 32-bit register.

1890) Use-after-free (CVE-ID: CVE-2026-98276)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sock_gettstamp() in net/core/sock.c when non-atomic socket flag updates race without holding the socket lock. A local user can race a SIOCGSTAMPNS_NEW ioctl with bind() on a UDP socket to cause a denial of service.

1891) Integer overflow (CVE-ID: CVE-2026-98282)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass I/O bus address range validation.

The vulnerability exists due to incomplete integer overflow and range validation in iommu_tce_check_ioba() in the PowerPC IOMMU code when validating multi-page requests for H_STUFF_TCE or H_PUT_TCE_INDIRECT. A local user can supply a multi-page range that causes arithmetic overflow or exceeds the TCE table capacity to bypass I/O bus address range validation.

The affected validation function is shared by KVM and VFIO.

1892) Use of Uninitialized Variable (CVE-ID: CVE-2026-98287)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger reads of uninitialized packet headroom or corrupt packet-buffer state.

The vulnerability exists due to an unsafe protocol-compression undo heuristic in pppoatm_send() when transmit admission fails with protocol compression enabled. A local user can submit packets that encounter transmit admission failure to trigger reads of uninitialized packet headroom or corrupt packet-buffer state through an unbalanced skb_push() operation.

The affected protocol-compression option is SC_COMP_PROT.

1893) Out-of-bounds read (CVE-ID: CVE-2026-98287)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds memory read.

The vulnerability exists due to an out-of-bounds read in pppoatm_send() when inspecting the first data byte of zero-length or non-linear packet buffers. A local user can submit zero-length or non-linear frames to trigger an out-of-bounds memory read.

Frames can reach the affected function through PPP channel bridging (PPPIOCBRIDGECHAN).

1894) Memory corruption (CVE-ID: CVE-2026-98287)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt shared packet headers.

The vulnerability exists due to failure to ensure that packet headers are writable in pppoatm_send() when applying LLC encapsulation to packets received through PPP channel bridging. A local user can submit packets with shared headers through a bridged PPP channel to corrupt shared packet headers.

The affected encapsulation operation prepends a four-byte LLC header.

1895) Deadlock (CVE-ID: CVE-2026-98290)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to lock order inversion in rfcomm_sock_cleanup_listen() when closing unaccepted child sockets concurrently with RFCOMM worker activity. A local user can initiate shutdown of an RFCOMM listening socket while the worker handles connections or DLC state changes to cause a denial of service.

1896) Out-of-bounds read (CVE-ID: CVE-2026-98298)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds reads and silent data loss.

The vulnerability exists due to incorrect scatterlist entry length selection in mmp_pdma_prep_slave_sg() when preparing DMA transfers from scatterlists containing entries of different lengths. A local user can trigger processing of such a scatterlist to cause out-of-bounds reads and silent data loss.

1897) Division by zero (CVE-ID: CVE-2026-98299)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to division by zero in the Linux kernel functions tcp_rcvbuf_grow() and tcp_rcv_space_adjust() when processing incoming TCP data with a zero receive-queue space value. A remote attacker can send TCP data that triggers a kernel crash to cause a denial of service.

Exploitation requires tcp_rmem[1] to be configured to a very small value, such as 1.

1898) Race condition (CVE-ID: CVE-2026-98300)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to a race condition in tcp_v6_do_rcv() when processing incoming IPv6 TCP packets concurrently with closure of a listening socket. A local user can close a listening socket during the race window between tcp_v6_rcv() and tcp_v6_do_rcv() to trigger a kernel warning.

The affected path requires IPv6 receive options to be enabled through np->rxopt.all.

1899) NULL pointer dereference (CVE-ID: CVE-2026-98302)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the Linux kernel skfp FDDI driver's adapter reset path when setting the MAC address on a down interface that has never been brought up. A local privileged user can set the interface's MAC address to trigger a kernel oops and cause a denial of service.

Exploitation requires the CAP_NET_ADMIN capability.

1900) Improper access control (CVE-ID: CVE-2026-98306)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass VRF socket isolation.

The vulnerability exists due to improper access control caused by failure to propagate the VRF interface flag in decap_and_validate() in net/ipv6/seg6_local.c when decapsulating IPv4 traffic from SRv6 packets received on VRF-enslaved interfaces. A remote attacker can send SRv6 packets carrying IPv4 traffic that is delivered to an unbound socket outside the ingress VRF to bypass VRF socket isolation.

The behavior is observable with the End.DX4 action during delivery to a local address of the node.

1901) NULL pointer dereference (CVE-ID: CVE-2026-98308)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the ALSA HDA PCM open tracepoint when stream assignment fails because hardware streams are exhausted. A local user can attempt to open a PCM substream under these conditions to cause a denial of service.

The tracepoint payload accesses the assigned stream tag before checking whether stream assignment succeeded.

1902) Use-after-free (CVE-ID: CVE-2026-98311)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to use-after-free in virt_wifi_newlink() when transferring operational state before device registration. A local user can attempt to create a virtual wireless device with an invalid name while its lower device is dormant to trigger a use-after-free in the kernel.

Exploitation requires device registration to fail and a subsequent linkwatch_fire_event() call to access the queued list entry after the device object has been freed.

1903) NULL pointer dereference (CVE-ID: CVE-2026-98314)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ALSA PCM timer initialization when concurrent timer callbacks execute before the registered timer's private data is initialized. A local user can read /proc/asound/timers concurrently with PCM timer initialization to cause a denial of service.

1904) Memory leak (CVE-ID: CVE-2026-98319)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to deplete kernel memory.

The vulnerability exists due to a memory leak caused by incomplete error-path cleanup in prepare_signaling() in the DRM subsystem when handling a request that provides an out_fence_ptr without DRM_MODE_PAGE_FLIP_EVENT and encounters an allocation failure or a failure in setup_out_fence(). A local user can trigger an error path that leaves a drm_pending_vblank_event unreleased to deplete kernel memory.

1905) Use-after-free (CVE-ID: CVE-2026-98320)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in the netfilter flowtable component when the flowtable datapath accesses connection-tracking state after its reference has been released. A local user can access prematurely released connection-tracking state to compromise confidentiality, integrity, and availability.

RCU typesafe semantics also allow a flowtable datapath reference to resolve to the wrong connection-tracking object.

1906) Use of Uninitialized Variable (CVE-ID: CVE-2026-98322)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause uninitialized stack data to be used during IPv4 address mapping.

The vulnerability exists due to use of an uninitialized variable in nft_nat_setup_netmap() when constructing an IPv4 netmap address. A local user can trigger IPv4 netmap processing to cause uninitialized stack data to be used during IPv4 address mapping.

Only the 4-byte IPv4 member of the 16-byte address union is initialized before the entire union is copied into the address range passed to nf_nat_setup_info(). The IPv6 path initializes all 16 bytes and is not affected.

1907) Out-of-bounds write (CVE-ID: CVE-2026-98323)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt receive-state memory.

The vulnerability exists due to an out-of-bounds write in the Linux kernel RDMA/siw siw_get_hdr() function when receiving an extended DDP/RDMAP header across multiple TCP callbacks. A remote attacker can send a fragmented extended DDP/RDMAP header to corrupt receive-state memory.

1908) Incorrect comparison (CVE-ID: CVE-2026-98339)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a kernel warning.

The vulnerability exists due to incorrect BSS type comparison in cfg80211_update_assoc_bss_entry() when updating an associated access point's BSS entry after a channel change. A remote attacker can operate a rogue access point that switches to a channel containing an existing BSS entry with a mismatched advertised type to trigger a kernel warning.

The retained entry collides with the associated access point's entry in the BSS red-black tree during cfg80211_rehash_bss().

1909) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98340)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger kernel warnings and prevent beacon data from being populated or updated for grouped BSS entries.

The vulnerability exists due to improper validation of beacon data presence in cfg80211 BSS grouping when processing probe responses and subsequent hidden-SSID beacons. A remote attacker can transmit probe responses that cause entries without beacon data to be grouped, followed by a hidden-SSID beacon with the same BSSID and channel, to trigger kernel warnings and prevent beacon data from being populated or updated for grouped BSS entries.

A hidden SSID can be zero-length or NUL-filled.

1910) Use-after-free (CVE-ID: CVE-2026-98342)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel DMA engine when releasing a DMA device while concurrent RCU readers traverse the device list. A local user can trigger concurrent device release and list traversal to trigger a use-after-free.

Holding a dmaengine reference to the provider module no longer guarantees that the DMA device remains alive.

1911) Use-after-free (CVE-ID: CVE-2026-98343)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free read in the kernel.

The vulnerability exists due to use-after-free in dma_chan_put() and dma_release_channel() when releasing a DMA channel drops the last reference to its device and frees the device and its channels. A local user can trigger DMA channel release to trigger a use-after-free read in the kernel.

1912) Improper update of reference count (CVE-ID: CVE-2026-98344)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference counting in dma_chan_put() in drivers/dma/dmaengine.c when releasing DMA channels acquired through the fast path. A local user can cycle dmaengine_get() and dmaengine_put() to cause a denial of service.

Exploitation requires a non-private DMA provider with a persistent client keeping chan->client_count greater than zero.

1913) Use of Uninitialized Variable (CVE-ID: CVE-2026-98345)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect classification of transmitted IP frames.

The vulnerability exists due to use of uninitialized memory caused by missing IP header length checks in cfg80211_classify8021d() when processing outgoing frames with undersized IP headers. A local user can transmit a frame marked as IPv4 or IPv6 with an incomplete IP header to cause incorrect classification of transmitted IP frames.

1914) Race condition (CVE-ID: CVE-2026-98347)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the Linux kernel IPoIB interface state handling when a light multicast flush overlaps with interface shutdown. A local user can bring an IPoIB interface down during a multicast flush to cause a denial of service by leaving IPOIB_FLAG_OPER_UP set after shutdown, resulting in endless workqueue retries and an interface teardown deadlock.

1915) Out-of-bounds read (CVE-ID: CVE-2026-98348)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an out-of-bounds read.

The vulnerability exists due to unsigned length arithmetic wrapping in libipw_handle_assoc_resp() when processing association response frames shorter than the 30-byte fixed prefix. A remote attacker can send a truncated association response frame to trigger an out-of-bounds read.

The ipw2100 and ipw2200 management receive paths check only for the generic 24-byte three-address header before reaching this function. The wrapped length is truncated to a 16-bit value near 64 KiB and passed to libipw_parse_info_param(), which reads beyond the receive buffer.

1916) Out-of-bounds read (CVE-ID: CVE-2026-98349)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger reads beyond the allocated receive buffer.

The vulnerability exists due to an out-of-bounds read in libipw_network_init() and libipw_parse_info_param() when processing beacon or probe response frames shorter than the required 36-byte prefix. A remote attacker can send a specially crafted wireless management frame to trigger reads beyond the allocated receive buffer.

A 24-byte frame causes the information element length calculation to wrap and truncate to 65524, making the parser treat the buffer as containing almost 64 KiB of information elements.

1917) Memory leak (CVE-ID: CVE-2026-98351)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause kernel memory leaks.

The vulnerability exists due to failure to free socket buffers in virt_wifi_start_xmit() when transmitting packets while the simulated link is disconnected. A local user can send packets through the disconnected simulated link to cause kernel memory leaks.

1918) Race condition (CVE-ID: CVE-2026-98352)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a shared completion queue credit leak.

The vulnerability exists due to a race condition in the Linux kernel RDMA RTRS client when handling address resolution concurrently with connection teardown after an interrupted connection attempt. A local user can interrupt a connection attempt while the address resolution handler races with teardown to cause a shared completion queue credit leak.

Subsequent RDMA device unregistration triggers a kernel warning in ib_cq_pool_cleanup() if completion queue credits remain allocated.

1919) Memory leak (CVE-ID: CVE-2026-98354)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service through memory exhaustion.

The vulnerability exists due to a receive buffer memory leak in ib_mad_complete_recv() in the RDMA MAD subsystem when processing management datagrams that fail PKey enforcement. A remote attacker can repeatedly send management datagrams with an incorrect PKey to cause a denial of service through memory exhaustion.

Each rejected datagram leaks approximately 300 bytes for an InfiniBand port or approximately 2 KB for OPA.

1920) Use-after-free (CVE-ID: CVE-2026-98357)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Linux kernel iSER target's deferred control PDU completion handling when queued completion work executes after connection teardown has freed the connection objects. A local user can trigger connection teardown while control PDU completions remain queued to cause a denial of service.

The affected completion states are ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and ISTATE_SEND_TEXTRSP. ISTATE_SEND_LOGOUTRSP follows a separate logout wait path.

1921) NULL pointer dereference (CVE-ID: CVE-2026-98358)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the iSER initiator's iser_check_remote_inv() and iser_inv_desc() functions when processing remote invalidations for unregistered data directions. A remote attacker can respond to a write command with IB_WR_SEND_WITH_INV to cause a denial of service.

The triggering write command sends all of its data as immediate data. Exploitation requires control of the target responding to the initiator.

1922) Out-of-bounds read (CVE-ID: CVE-2026-98362)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect clock rates to be reported to consumers.

The vulnerability exists due to an out-of-bounds read in scpi_dvfs_recalc_rate() in the SCPI clock driver when recalculating a clock rate using an out-of-range DVFS index returned by SCP firmware. A local user can trigger clock-rate recalculation using such an index to cause incorrect clock rates to be reported to consumers.

The SCP firmware may supply the invalid index because it is buggy or returns a stale value.

1923) Out-of-bounds read (CVE-ID: CVE-2026-98363)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds reads and populate the operating performance point table with invalid entries.

The vulnerability exists due to an out-of-bounds read caused by a missing upper-bound check in scpi_dvfs_get_info() when processing operating performance point counts from SCP firmware replies. A local user can supply a firmware reply with a count greater than MAX_DVFS_OPPS to cause out-of-bounds reads and populate the operating performance point table with invalid entries.

1924) Use-after-free (CVE-ID: CVE-2026-98367)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to use-after-free in the RDMA/siw siw_accept() function when cleaning up after a failed siw_qp_modify() call. A local user can trigger a concurrent queue pair transition to the error state to corrupt kernel memory.

Exploitation requires the concurrent transition to occur after the queue pair state lock is released but before connection endpoint cleanup completes.

1925) Improper locking (CVE-ID: CVE-2026-98369)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger kernel RCU lockdep warnings.

The vulnerability exists due to missing RCU read-side locking and insufficient object lifetime management in xfrm_trans_reinject() and xfrm_trans_queue_net() when reinjecting transport-mode packets through a workqueue. A local user can cause transport-mode packets to undergo deferred reinjection to trigger kernel RCU lockdep warnings.

Under CONFIG_PREEMPT_RCU, workqueue workers run in process context where local_bh_disable() does not establish an RCU read-side critical section. Queued packets may carry non-reference-counted destination entries, and network-device unregistration can replace a destination's device with blackhole_netdev.

1926) Use-after-free (CVE-ID: CVE-2026-98370)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to use-after-free in xfrm_alloc_userspi() and xfrm_user_rcv_msg() when processing compat ALLOCSPI requests. A local user can submit a compat ALLOCSPI request that causes a translated child buffer to be attached to the inbound request to trigger a use-after-free in the kernel.

Exploitation depends on a multicast clone sharing skb_shared_info with the request and a compat receiver still copying from the translated child when the request handler frees it.

1927) Use-after-free (CVE-ID: CVE-2026-98374)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tcp_send_synack() when replacing a cloned SYN socket buffer in the retransmit queue without updating the retransmission hint. A local user can initiate a TCP Fast Open connection using sendmsg(MSG_FASTOPEN) and supply an ICMP fragmentation-needed message to cause a denial of service.

Exploitation requires a simultaneous open after the retransmission hint has been armed.

1928) NULL pointer dereference (CVE-ID: CVE-2026-98379)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to a null pointer dereference in the Linux kernel IPv6 reverse-path filtering component when processing a route without an inet6_dev. A local user can use rtnetlink to lower an external nexthop device's MTU below IPV6_MIN_MTU and trigger an IPv6 reverse-path filtering lookup to cause a denial of service by triggering a kernel panic.

An unprivileged user can construct the required state within a private user namespace and network namespace.

1929) Race condition (CVE-ID: CVE-2026-98380)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition and improper error-pointer validation in tcf_idr_delete_index() in net/sched/act_api.c when deleting traffic control actions. A local user can trigger concurrent action deletion and reservation of the same IDR slot to cause a denial of service.

1930) Use-after-free (CVE-ID: CVE-2026-98381)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the veth driver's XDP program handling when resizing receive channels and detaching or replacing an XDP program. A local user can reduce the receive channel count, detach or replace the XDP program, and subsequently increase the channel count to cause a denial of service.

1931) Use-after-free (CVE-ID: CVE-2026-98383)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to use-after-free in BPF LWT_SEG6LOCAL handling when performing post-program SRH validation. A local user can run an LWT_SEG6LOCAL program that invalidates its cached SRH with bpf_lwt_seg6_adjust_srh() and then calls bpf_skb_pull_data() to corrupt kernel memory.

Reallocation of skb->head leaves the per-CPU SRH pointer dangling, and subsequent SRH validation writes through that pointer.

1932) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98398)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt kernel lock dependency validation.

The vulnerability exists due to insufficient validation of stale lock-class cache entries in the kernel lock dependency validator when acquiring locks whose cached classes have been invalidated. A local user can trigger acquisition of a lock retaining a stale class-cache entry to disrupt kernel lock dependency validation.

The issue can arise after module unloading or lock-key unregistration. Reported behavior includes kernel warnings; reuse of an invalidated class slot can also cause an unrelated lock class to be matched.

1933) NULL pointer dereference (CVE-ID: CVE-2026-98404)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in drm_mode_addfb2() when virtio_gpu_user_framebuffer_create() returns a null pointer on an error path. A local user can trigger the framebuffer creation error path to cause a denial of service.

1934) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98406)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to insufficient validation of the interface's driver-presence state in ieee80211_set_bitrate_mask() when handling wireless bitrate-setting requests. A local user can issue a SIOCSIWRATE ioctl for an interface marked as running but absent from the driver to trigger a kernel warning.

The affected state can occur during interface teardown or during bringup before the interface is added to the driver.

1935) Out-of-bounds write (CVE-ID: CVE-2026-98407)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt unrelated kernel heap objects.

The vulnerability exists due to incorrect pointer arithmetic resulting in an out-of-bounds write in the rsi_hal_load_key() function when removing a key with a null data pointer. A local user can trigger a key-removal operation to corrupt unrelated kernel heap objects.

The write occurs on every DISABLE_KEY callback, including during disconnects, roaming, and interface teardown. It writes 144 zero bytes approximately 2.4 KB beyond the end of a 160-byte heap buffer.

1936) Use of Uninitialized Variable (CVE-ID: CVE-2026-98413)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause SELinux to use uninitialized access-decision data.

The vulnerability exists due to use of an uninitialized stack variable in the SELinux avc_has_perm_noaudit() function when handling an empty requested permission set. A local user can trigger a permission check with an empty requested permission set to cause SELinux to use uninitialized access-decision data.

Callers pass the resulting decision to avc_audit(), and the inode hook also stores it in the per-task decision cache.

1937) NULL pointer dereference (CVE-ID: CVE-2026-98416)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in k3_udma_glue_release_rx_chn() in the Linux kernel TI K3 UDMA glue driver when handling a receive-channel request after memory allocation fails. A local user can trigger the affected cleanup path to cause a denial of service.

The failure occurs when devm_kcalloc() cannot allocate the receive-channel flow array and cleanup subsequently calls k3_udma_glue_release_rx_flow().

1938) Numeric Truncation Error (CVE-ID: CVE-2026-98417)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a kernel warning.

The vulnerability exists due to integer truncation in the handle_esp() function in net/xfrm/espintcp.c when processing ESP-in-TCP packets after the stream parser trims the TCP envelope. A remote attacker can supply packets whose transport header offset cannot be represented to trigger a kernel warning.

1939) Out-of-bounds write (CVE-ID: CVE-2026-98419)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in reset_per_cpu_data() in the Linux kernel drop_monitor component when zeroing an alert message buffer. A local user can trigger an oversized memset() operation to corrupt kernel memory.

The write extends four bytes beyond the allocated buffer and corrupts skb_shared_info.

1940) Improper initialization (CVE-ID: CVE-2026-98422)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper reinitialization of the crypto_tx_tailroom_needed_cnt counter in mac80211 AP_VLAN interface handling when bringing an AP_VLAN interface down. A local user can repeatedly bring the same AP_VLAN interface down and up while its parent AP interface remains up to trigger a kernel warning.

The sanity check detects a mismatch between the AP_VLAN interface's counter and the parent AP interface's counter.

1941) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98426)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak interrupt resources.

The vulnerability exists due to incorrect resource cleanup using the wrong context index in mwifiex_pcie_request_irq() when handling an MSI-X interrupt registration failure. A local user can trigger this error path to leak interrupt resources.

1942) Memory leak (CVE-ID: CVE-2026-98433)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by exhausting secure memory resources.

The vulnerability exists due to a memory leak in the Linux kernel KVM PowerPC Book3S HV kvmppc_svm_page_in() function when uv_page_in() fails after a secure device page has been allocated. A local user can trigger page-in operations that encounter this error to leave secure device pages and associated metadata unreclaimed, potentially exhausting the firmware-bounded secure memory pool and making affected guest frame numbers unusable for the lifetime of the VM.

The issue is reachable on POWER9/10 systems using Ultravisor/PEF.

1943) NULL pointer dereference (CVE-ID: CVE-2026-98455)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service by triggering a Linux kernel crash.

The vulnerability exists due to a null pointer dereference in the Bluetooth RFCOMM_CONNINFO getsockopt handler when processing an accepted socket whose deferred setup flag remains set after its session has been removed. A remote attacker on the local network can send a Bluetooth RFCOMM DISC frame for a channel accepted with BT_DEFER_SETUP enabled to cause a kernel crash if a local application subsequently calls getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on that socket.

1944) Out-of-bounds read (CVE-ID: CVE-2026-98457)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to trigger out-of-bounds reads that may cause a denial of service or disclose kernel memory.

The vulnerability exists due to out-of-bounds reads in the Linux kernel Bluetooth L2CAP receive path when processing short ERTM or streaming-mode frames. A remote attacker on the local network can send a frame with an incomplete two-byte or four-byte control field, or an insufficient CRC16 frame check sequence, to trigger reads beyond the frame boundary. In the CRC16 case, subtracting two from the remaining length can wrap, leaving the buffer unchanged before the frame check sequence is read.

1945) Incorrect authorization (CVE-ID: CVE-2026-98460)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass Bluetooth HCI command restrictions and submit reserved opcodes through an unprivileged raw HCI socket.

The vulnerability exists due to improper authorization in the Linux kernel Bluetooth raw HCI socket security filter when checking command opcodes. A local user can submit a reserved opcode whose 10-bit opcode command field (OCF) aliases an allowlisted command after masking with 127 to bypass the command security filter.

A conforming controller should reject reserved opcodes.

1946) Out-of-bounds read (CVE-ID: CVE-2026-98461)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering an out-of-bounds read in the kernel.

The vulnerability exists due to an out-of-bounds read in the Bluetooth is_filtered_packet() function when filtering event packets before their lengths are validated. A local user can supply a malformed event through a controller or vhci device to trigger reads beyond an empty event buffer or a truncated command event, potentially causing a kernel crash.

1947) NULL pointer dereference (CVE-ID: CVE-2026-98476)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel null pointer dereference.

The vulnerability exists due to a missing null-pointer check in ccw_device_get_util_str() in the Linux kernel s390 channel I/O subsystem when a subchannel's PMCW still references a CHPID whose channel path registry entry has been removed. A local user can trigger the affected lookup under this condition to potentially crash the kernel when the null pointer returned by chpid_to_chp() is dereferenced.

1948) Improper input validation (CVE-ID: CVE-2026-98479)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt application write buffers and cached file data on an iSCSI initiator.

The vulnerability exists due to insufficient validation of command data direction in the Linux kernel's libiscsi_tcp component when processing a Data-In PDU referencing a WRITE command. A remote attacker can operate a malicious iSCSI target and send a Data-In PDU naming an outstanding WRITE command's initiator task tag to overwrite the caller's pinned pages for a direct write or page cache pages for a buffered write with target-supplied data.

1949) Out-of-bounds read (CVE-ID: CVE-2026-98481)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to trigger an out-of-bounds kernel memory read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel NFC port100 driver when validating device-supplied response frames without checking their declared length against the actual received length. An attacker with physical access to system can supply a response with a 16-bit datalen value exceeding the received data length to make port100_data_checksum() read past the transfer buffer, potentially causing a kernel crash.

1950) Use of Uninitialized Variable (CVE-ID: CVE-2026-98482)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause the kernel to process uninitialized memory as NFC LLCP sequence data.

The vulnerability exists due to use of uninitialized memory in nfc_llcp_recv_hdlc() when processing truncated NFC LLCP PDUs without checking that the sequence byte is present. A remote attacker on the local network can send a two-byte I, RR or RNR PDU to cause the kernel to read uninitialized skb tailroom and use the byte as N(R)/N(S) sequence data.

1951) Use-after-free (CVE-ID: CVE-2026-98483)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel NFC functions nfc_llcp_general_bytes() and nfc_get_local_general_bytes() when retrieving local general bytes. Releasing the local object's reference can free the object before callers access the returned pointer. A local user can potentially trigger affected NFC operations that dereference this stale pointer to cause a kernel crash and denial of service.

1952) Out-of-bounds read (CVE-ID: CVE-2026-98485)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to an out-of-bounds read in the Linux kernel netfilter rt_mt6() function when processing IPv6 routing addresses under a non-strict address-matching rule with IP6T_RT_FST_MASK set and rtinfo->addrnr equal to zero. A remote attacker can send a crafted IPv6 packet containing matching routing addresses to advance the address index beyond the 16-entry array and cause a denial of service through a kernel panic.

1953) Infinite loop (CVE-ID: CVE-2026-98488)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a CPU soft lockup.

The vulnerability exists due to an unreachable loop termination condition in the Linux kernel atl1e driver's atl1e_clean_tx_irq() function when hardware reports an out-of-range hw_next_to_clean value during a PCIe link or MAC reset. A local user can trigger the affected transmit cleanup path under these conditions to cause an infinite loop and a CPU soft lockup.

1954) Infinite loop (CVE-ID: CVE-2026-98489)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service through a kernel CPU soft lockup.

The vulnerability exists due to an infinite loop with an unreachable exit condition in the Linux kernel atl1c driver's transmit cleanup routine when the hardware reports an out-of-range transmit descriptor consumer index during a PCIe link or MAC reset. A remote attacker on the local network can trigger a link reset by rebooting a directly connected network device to cause the cleanup loop to spin indefinitely if the hardware returns the invalid index.

1955) Use-after-free (CVE-ID: CVE-2026-98491)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to use-after-free in the Linux kernel Open vSwitch connection-tracking component when cloned packets sharing an unconfirmed connection-tracking entry are committed with different extension sets. A remote attacker can trigger packet processing through the affected commit sequence to invalidate an extension pointer in the expectation list, potentially causing a kernel crash when the entry is later destroyed.

1956) Infinite loop (CVE-ID: CVE-2026-98494)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a soft lockup.

The vulnerability exists due to an unreachable loop exit condition in the Linux kernel atl1 driver's atl1_intr_tx() function when hardware reports an out-of-range transmit descriptor consumer index during a PCIe link or MAC reset. A local user can potentially induce an infinite transmit cleanup loop to cause a denial of service if able to trigger this hardware condition.

1957) Out-of-bounds read (CVE-ID: CVE-2026-98495)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read of kernel stack memory, potentially causing a denial of service.

The vulnerability exists due to missing NUL termination of the arp_dev field in the Linux kernel ARP ioctl handler when looking up a user-supplied interface name. A local user can submit a struct arpreq containing IFNAMSIZ bytes without a NUL terminator in arp_dev to cause strcmp() to read beyond the stack object during lookup through dev_get_by_name_rcu() or __dev_get_by_name() when a matching alternative interface name exists.

1958) Improper update of reference count (CVE-ID: CVE-2026-98498)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause resource retention that may lead to a denial of service.

The vulnerability exists due to a missing reference count decrement in mlx5_tc_ct_shared_counter_get() in the Linux kernel mlx5 driver when a reverse entry is found but its counter is already being released. A local user can trigger shared counter lookups under this condition to leave reverse entries permanently referenced, potentially exhausting resources and causing a denial of service.

1959) Out-of-bounds read (CVE-ID: CVE-2026-98499)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel memory contents.

The vulnerability exists due to an out-of-bounds read in the Linux kernel Wacom HID driver's wacom_wac_pen_serial_enforce() function when processing reports whose HID descriptor declares more usages than its report count reserves space for. A local user can supply a crafted HID descriptor and report to cause hid_field_extract() to read beyond the report buffer and expose the extracted value to userspace through an MSC_SERIAL event.

1960) Use-after-free (CVE-ID: CVE-2026-98501)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel ALPS HID driver when handling input reports after input device registration fails. A local user can trigger processing of a U1_SP_ABSOLUTE_REPORT_ID report during the registration failure window to cause u1_raw_event() to dereference the freed input2 device, potentially causing a kernel crash.

1961) Improper update of reference count (CVE-ID: CVE-2026-98511)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning during buffer-object release.

The vulnerability exists due to incorrect pin-count accounting in the nouveau driver's buffer-object pinning logic when processing a re-pin request for an already pinned buffer object in an incompatible memory domain. A local user can trigger a failed re-pin request that nevertheless increments the pin count, leaving an unmatched pin that triggers a warning in ttm_bo_release() when the buffer object is released.

1962) Memory leak (CVE-ID: CVE-2026-98514)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust kernel resources, potentially causing a denial of service.

The vulnerability exists due to an unreleased GEM object reference in the Linux kernel nouveau driver's validate_init() function when ttm_bo_reserve() fails or a virtual memory area lookup returns no matching entry. A local user can trigger these error paths repeatedly to accumulate unreleased objects and potentially exhaust kernel resources, causing a denial of service.

1963) Double free (CVE-ID: CVE-2026-98515)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to a double-free in the nouveau driver's nvif_vmm_dtor() function when handling client initialization failure while opening a DRM device. A local user can trigger the affected failure path to cause repeated cleanup calls that free the same vmm->page allocation twice, corrupting kernel memory and potentially causing a denial of service.

1964) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98516)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak that may degrade system availability.

The vulnerability exists due to a missing release of a PCI device reference in the nouveau driver's nv1a_ram_new() function when reading the memory size from the PCI bridge's configuration space. A local user can potentially trigger the affected initialization path to leave the bridge reference unreleased, which may retain resources and degrade system availability.

1965) Use-after-free (CVE-ID: CVE-2026-98524)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the affected system.

The vulnerability exists due to use-after-free in the Linux kernel RDS InfiniBand memory-region handling code when a failed mapping or registration leaves a freed scatterlist referenced by a pooled memory region. A local user can trigger this failure condition and subsequent memory-region teardown to access freed memory, potentially escalating privileges.

1966) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-98526)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to potentially cause a denial of service by triggering a kernel socket-buffer headroom underflow.

The vulnerability exists due to insufficient link-layer headroom allocation in llc_alloc_frame() when allocating LLC response frames for stacked Ethernet devices such as VLAN devices. A remote attacker on the local network can send LLC traffic that elicits a response through an affected device to trigger a headroom underflow in eth_header() and potentially cause a denial of service.

1967) Improper update of reference count (CVE-ID: CVE-2026-98527)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent the Zynq GPIO controller from entering runtime suspend, leaving its clock enabled.

The vulnerability exists due to failure to release a runtime power management reference in zynq_gpio_request() when pm_runtime_get_sync() fails during a GPIO request. A local user can trigger a GPIO request that encounters this failure to leave the usage counter incremented and prevent the controller from entering runtime suspend.

1968) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98529)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to interfere with runtime power management, potentially preventing a parent device from entering runtime suspend.

The vulnerability exists due to a missing runtime power-management reference release in arizona_gpio_direction_out() in the Linux kernel's Arizona GPIO driver when a register update fails while switching a persistent GPIO line from input to output. A local user can initiate this direction change and, if regmap_update_bits() fails, leave an outstanding reference that may prevent the parent device from entering runtime suspend.

1969) Out-of-bounds read (CVE-ID: CVE-2026-98531)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose uninitialized kernel heap memory.

The vulnerability exists due to an out-of-bounds read in the Linux kernel IPv6 segment routing Generic Netlink interface when processing a SEG6_ATTR_DST attribute shorter than an IPv6 address. A local privileged user can send a SEG6_CMD_SET_TUNSRC message containing a zero-length SEG6_ATTR_DST attribute, followed by SEG6_CMD_GET_TUNSRC, to disclose 16 bytes of uninitialized kernel heap memory because the attribute policy enforces only a maximum length while seg6_genl_set_tunsrc() copies a full 16-byte address.

1970) Out-of-bounds write (CVE-ID: CVE-2026-98532)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to out-of-bounds memory access in the Linux kernel's ipv6_find_hdr() function when processing IPv6 extension headers whose declared lengths exceed the remaining packet data. A local user can submit a specially crafted IPv6 packet for processing through Open vSwitch to cause update_ipv6_checksum() to read and write a transport checksum field outside the packet buffer, corrupting kernel memory and potentially causing a kernel crash.

1971) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98535)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a clock reference leak that may contribute to resource exhaustion.

The vulnerability exists due to failure to release a clock reference in the read_dts_node() function of the Freescale FMan Ethernet driver when reading a clock rate during device-tree processing. A local privileged user can trigger the affected processing path to leave an incremented clock reference unreleased, potentially contributing to resource exhaustion.

1972) Resource exhaustion (CVE-ID: CVE-2026-98536)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through prolonged task stalls and a possible kernel panic.

The vulnerability exists due to failure to report Tasks-RCU quiescent states in cleanup_offline_cgwbs_workfn() when draining offline cgroup writeback domains on kernels where cond_resched() is disabled by the preemption configuration. A local user can cause prolonged draining of a writeback domain with many attached inodes to delay concurrent BPF or ftrace detach operations, blocking tasks and potentially triggering a kernel panic.

1973) NULL pointer dereference (CVE-ID: CVE-2026-98537)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to a NULL pointer dereference in the Linux kernel workqueue function check_flush_dependency() when checking flush dependencies for a worker that is not executing a work item. A local user can potentially trigger this condition during worker creation when memory allocation invokes an out-of-memory notifier, causing the function to dereference worker->current_pwq while it is NULL and potentially cause a denial of service.

1974) Memory leak (CVE-ID: CVE-2026-98541)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to exhaust kernel memory and cause a denial of service.

The vulnerability exists due to a failure to release packet buffers in the Linux kernel FOU receive handler when a direct encapsulation socket has a zero protocol value. A local privileged user can submit a FOU_CMD_ADD Generic Netlink request with FOU_ATTR_TYPE set to FOU_ENCAP_DIRECT while omitting FOU_ATTR_IPPROTO, then send UDP packets to the resulting socket to leak an sk_buff for each received packet and potentially exhaust kernel memory.

1975) Integer overflow (CVE-ID: CVE-2026-98547)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by exhausting CPU resources.

The vulnerability exists due to integer overflow in the Linux kernel's prb_calc_retire_blk_tmo() function when calculating the block retirement timeout for TPACKET_V3 packet rings. A local user can use CAP_NET_RAW privileges to configure a packet ring with a specially crafted block size, causing a negative timeout that makes the retirement timer repeatedly fire at the maximum rate and consume CPU resources.

The demonstrated trigger requires a 1 Gbps NIC; QEMU e1000 is a working example.

1976) Use-after-free (CVE-ID: CVE-2026-98548)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service through kernel memory corruption.

The vulnerability exists due to a use-after-free in the Linux kernel SCTP implementation when processing a bundled stale-cookie ERROR chunk and DATA chunk received from a non-primary peer address while an association is in the COOKIE-ECHOED state. A remote attacker can send this crafted packet as an SCTP peer to leave the association referencing a freed transport object, which a subsequent FWD-TSN chunk or delayed SACK timer can cause the kernel to access, potentially resulting in memory corruption and a denial of service.

1977) Improper synchronization (CVE-ID: CVE-2026-98550)

CWE-ID: CWE-662 - Improper Synchronization

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to potentially cause a denial of service by leaving a TIPC group socket blocked after a group member departs.

The vulnerability exists due to improper synchronization in tipc_group_delete_member() when a departing member causes the outstanding broadcast acknowledgment counter to reach zero without restoring the group's open state or triggering a socket wakeup. A remote attacker on the local network can potentially cause a member departure under this condition to leave socket operations blocked despite completion of the outstanding acknowledgment accounting.

1978) Integer underflow (CVE-ID: CVE-2026-98550)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service by blocking future TIPC group broadcasts on an affected socket.

The vulnerability exists due to integer underflow caused by incomplete acknowledgment validation in tipc_group_proto_rcv() when processing TIPC group acknowledgment messages. A remote attacker on the local network can send unexpected or incorrectly sequenced GRP_ACK_MSG messages to decrement the broadcast acknowledgment counter improperly, potentially wrapping it to 65535 and causing persistent congestion on the affected socket.

1979) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98553)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through kernel resource exhaustion.

The vulnerability exists due to missing release of a pipe file reference in the Linux kernel autofs subsystem when mount setup fails or is abandoned before AUTOFS_SBI_CATATONIC is cleared. A local privileged user can trigger repeated unsuccessful mount setup operations to accumulate leaked file references and potentially exhaust kernel resources. During cleanup, autofs_kill_sb() calls autofs_catatonic_mode(), which returns early because the flag remains set, leaving the sbi->pipe reference unreleased.

1980) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-98554)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to insufficient packet buffer headroom in vlan_dev_hard_header() when constructing VLAN headers with VLAN_FLAG_REORDER_HDR unset. A local user can trigger packet transmission using buffers with insufficient reserved headroom to cause an skb_under_panic() kernel panic.

1981) Use-after-free (CVE-ID: CVE-2026-98555)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through kernel memory corruption or memory exhaustion.

The vulnerability exists due to use-after-free, double-free, and memory leaks in the Linux kernel LLC subsystem when llc_mac_hdr_init() fails during packet handling. A local user can trigger the affected error-handling paths to potentially cause a kernel crash or exhaust kernel memory through leaked packet buffers.

1982) Use-after-free (CVE-ID: CVE-2026-98559)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through invalid kernel memory access.

The vulnerability exists due to use-after-free in the Linux kernel SMC function smcr_port_err() when traversing smc_lgr_list.list without holding smc_lgr_list.lock. A local user can potentially trigger a race between this traversal and concurrent smc_lgr_terminate_sched() execution to cause a denial of service by dereferencing a freed link group.

1983) Out-of-bounds write (CVE-ID: CVE-2026-98567)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an out-of-bounds write in __netif_set_xps_queue() when updating transmit packet steering (XPS) mappings after reducing the number of traffic classes. A local privileged user can trigger an XPS mapping update for a transmit queue whose stale traffic class is outside the current valid range to write beyond the allocated mapping array and potentially cause a kernel crash.

1984) Improper input validation (CVE-ID: CVE-2026-98569)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by disrupting metadata receive lookup for GRE, GRETAP, or ERSPAN tunnel devices.

The vulnerability exists due to missing validation of metadata tunnel uniqueness in ipgre_netlink_parms() when enabling collect_md on an existing tunnel device through changelink. A local privileged user can convert a non-metadata device to metadata mode, replacing another device's metadata receive entry of the same type in the same network namespace, and then delete either device to disrupt metadata receive lookup for the surviving device.

1985) Integer underflow (CVE-ID: CVE-2026-98573)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption that may result in a denial of service.

The vulnerability exists due to an unsigned integer underflow in skb_maybe_pull_tail(), called by skb_checksum_setup_ipv6(), when parsing IPv6 extension headers. A remote attacker can supply crafted IPv6 packet data to trigger subtraction of skb_headlen(skb) from a smaller max value, producing a negative delta after conversion to a signed integer. This delta reaches skb_copy_bits() through __pskb_pull_tail(), where it can become a very large copy length and potentially cause memory corruption and a kernel crash.

The triggering condition requires an skb whose linear area exceeds MAX_IPV6_HDR_LEN and parsing that needs data beyond that linear area.

1986) Out-of-bounds read (CVE-ID: CVE-2026-98575)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to trigger an out-of-bounds kernel memory read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in pn533_acr122_is_rx_frame_valid() when validating USB response frames from an ACR122 device. An attacker with physical access to system can supply a crafted USB response through a malicious device with an unchecked frame->ccid.datalen value to read beyond the received buffer and potentially crash the kernel.

1987) Out-of-bounds read (CVE-ID: CVE-2026-98576)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disclose kernel memory contents through debug output.

The vulnerability exists due to an out-of-bounds read in the Linux kernel NFC LLCP functions nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() when logging non-null-terminated service names. A local user can supply a non-null-terminated service name that is passed to pr_debug() with the %s format specifier to trigger reads beyond the allocated buffer and potentially expose adjacent kernel memory in debug output.

1988) Partial String Comparison (CVE-ID: CVE-2026-98577)

CWE-ID: CWE-187 - Partial String Comparison

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to hijack well-known service access points in the Linux kernel NFC subsystem.

The vulnerability exists due to a partial string comparison in nfc_llcp_wks_sap() when resolving NFC logical link control service names. A local user can supply a short service name such as "u" that matches the prefix of "urn:nfc:sn:snep" to obtain the service access point associated with the longer well-known service name.

1989) Out-of-bounds read (CVE-ID: CVE-2026-98578)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to trigger an out-of-bounds read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel's st21nfca_get_iso15693_inventory() helper when processing truncated ISO15693 inventory responses. A remote attacker on the local network can supply an inventory response with an insufficient length to trigger a read of data[1] as the DSFID beyond the available data, potentially causing a denial of service.

1990) Memory leak (CVE-ID: CVE-2026-98579)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak kernel memory, potentially causing a denial of service through memory exhaustion.

The vulnerability exists due to missing deallocation of queued TLV nodes in the Linux kernel NFC LLCP function nfc_genl_llc_sdreq() when nested netlink attribute parsing, TLV allocation, or service discovery request transmission fails. A local user can repeatedly submit requests that trigger these error paths after TLV nodes have been queued to leak kernel memory and potentially exhaust available memory.

1991) Use-after-free (CVE-ID: CVE-2026-98580)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by potentially crashing the Linux kernel.

The vulnerability exists due to improper synchronization in the Linux kernel NFC LLCP accept queue lifecycle when socket release and accept operations run concurrently. A local user can trigger overlapping operations that unlink and release the same child socket, causing use-after-free or a NULL pointer dereference in nfc_llcp_accept_unlink() that may crash the kernel.

1992) Improper locking (CVE-ID: CVE-2026-98581)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by exhausting kernel memory through unbounded socket leaks.

The vulnerability exists due to improper locking and inconsistent socket list membership in the Linux kernel NFC LLCP nfc_llcp_recv_dm() function when handling DM(NOBOUND) or DM(REJ) messages. A local user can race socket release against concurrent connection operations while a remote peer supplies these messages over an established LLCP link to corrupt the connecting socket list, disrupt reference counting, and leak kernel sockets until memory is exhausted.

1993) Out-of-bounds read (CVE-ID: CVE-2026-98582)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to trigger out-of-bounds reads that may cause a denial of service.

The vulnerability exists due to out-of-bounds reads in the Linux kernel's st21nfca_hci_i2c_repack() function when processing malformed received frames. A remote attacker on the local network can supply a frame with an EOF marker immediately after the start marker or a trailing escape marker to cause CRC processing or byte unstuffing to read beyond the received frame boundary, potentially causing a kernel crash.

1994) Out-of-bounds read (CVE-ID: CVE-2026-98583)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the nfcmrvl firmware download receive path when processing a short helper command frame. A local user can supply a truncated frame to cause the kernel to remove the NCI data header and read the helper command before validating the packet length, potentially causing a kernel fault and denial of service.

1995) Use-after-free (CVE-ID: CVE-2026-98586)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel SCTP implementation when timer rearming races with timer cleanup. A remote attacker can potentially trigger this race during SCTP processing, causing a timer handler to access a freed association or transport object and underflow its reference count, which may result in a denial of service.

1996) Out-of-bounds write (CVE-ID: CVE-2026-98588)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory or cause a denial of service.

The vulnerability exists due to an out-of-bounds write in sock_map_free() when freeing a SOCKMAP whose entry count exceeds the range of its signed integer iterator. A local privileged user can create and destroy a SOCKMAP with max_entries = 0xffffffff to trigger signed integer overflow and write outside the socket array, corrupting an unrelated allocation or crashing the kernel.

Exploitation requires the 32 GiB allocation to succeed on a large-memory host.

1997) Unexpected Sign Extension (CVE-ID: CVE-2026-98590)

CWE-ID: CWE-194 - Unexpected Sign Extension

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass BPF verifier assumptions about the range of runtime register values.

The vulnerability exists due to unexpected sign extension and incorrect destination-size accounting in bpf_sock context access code generation when processing access to the rx_queue_mapping field. A local user can execute a specially crafted BPF program that right-shifts the sign-extended value to produce a runtime value outside the bounds assumed by the verifier.

1998) NULL pointer dereference (CVE-ID: CVE-2026-98593)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to a NULL pointer dereference in the Linux kernel s390 debug_info_copy() function when copying a debug area after debug_register_static() fails and clears its pointers without resetting its bounds. A local user can trigger copying of the affected area by opening its view file or through debug_dump() to cause a denial of service.

1999) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98594)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through unreleased kernel driver resources.

The vulnerability exists due to missing release of PHYLIB resources in the Linux kernel tg3 driver's initialization error path when device probing fails after an MDIO bus has been registered and a PHY connected. A local privileged user can potentially trigger this failure path to leave those resources associated with released mappings and network-device state, which may disrupt system operation.

2000) Out-of-bounds read (CVE-ID: CVE-2026-98597)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read that may disclose kernel memory or cause a denial of service.

The vulnerability exists due to incorrect receive-length validation in the Linux kernel's sr9700_rx_fixup() function when processing receive buffers. A local user can supply receive data with an inconsistent reported packet length to cause a copy to read beyond the receive buffer, because the length check does not account for the three-byte header and four-byte Ethernet CRC.

2001) Out-of-bounds read (CVE-ID: CVE-2026-98602)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel heap information.

The vulnerability exists due to an out-of-bounds read in Bluetooth BNEP transmit processing when handling AF_PACKET frames shorter than the 14-byte Ethernet header. A local user can submit a specially crafted short frame to cause Ethernet header processing to read beyond the available packet data and disclose kernel heap information.

2002) Out-of-bounds read (CVE-ID: CVE-2026-98602)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to potentially cause a denial of service through out-of-bounds reads in the Linux kernel.

The vulnerability exists due to out-of-bounds reads in Bluetooth BNEP receive-frame and control processing when handling truncated frames or control frames that fall through to Ethernet frame submission. A remote attacker on the local network can send specially crafted BNEP frames to trigger reads beyond available packet data, potentially causing a kernel crash.

2003) Use-after-free (CVE-ID: CVE-2026-98606)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger invalid kernel memory accesses and potentially cause a denial of service.

The vulnerability exists due to use-after-free in virtio_gpu_vram_create() in the Linux kernel virtio GPU driver when handling object creation failures. A local user can trigger an error path that frees a GEM object without removing its registered VMA offset node, causing subsequent offset lookups or insertions to access freed memory and potentially crash the system.

2004) Memory leak (CVE-ID: CVE-2026-98607)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust resources and potentially cause a denial of service.

The vulnerability exists due to improper release of object references in virtio_gpu_resource_create_blob_ioctl() when UUID assignment or GEM handle creation fails. A local user can invoke resource-creation operations that encounter these error paths to leak virtio_gpu_object allocations, resource identifiers, and host-side resources, potentially causing resource exhaustion and a denial of service.

2005) Memory leak (CVE-ID: CVE-2026-98608)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust resources and potentially cause a denial of service.

The vulnerability exists due to failure to release an owned object reference in virtio_gpu_resource_create_ioctl() when handling a drm_gem_handle_create() failure. A local user can exercise this error path to leak the GPU object, its pages and scatter-gather table, the resource identifier, and the host-side resource, potentially exhausting resources and causing a denial of service.

2006) Memory leak (CVE-ID: CVE-2026-98609)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak guest memory and host-side graphics resources, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to improper reference-count management in virtio_gpu_gem_create() when graphics handle creation fails. A local user can trigger object creation operations that encounter drm_gem_handle_create() failures to leave graphics objects allocated without a remaining reference, leaking guest memory and host-side resources and potentially causing a denial of service.

2007) Infinite loop (CVE-ID: CVE-2026-98610)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering an infinite packet-classification loop and a CPU soft lockup in the Linux kernel.

The vulnerability exists due to an infinite loop in hfsc_classify() in net/sched/sch_hfsc.c when class-level changes leave previously valid flowid bindings forming a cycle that bypasses the downward-level check. A local user can configure cyclic HFSC filter bindings and send a single packet through the affected queue to cause packet classification to loop indefinitely with the qdisc lock held and bottom halves disabled.

The required network configuration is reachable by an unprivileged user through unshare -Urn, which provides CAP_NET_ADMIN within the new user and network namespaces.

2008) Out-of-bounds read (CVE-ID: CVE-2026-98612)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to potentially cause a denial of service or disclose kernel memory.

The vulnerability exists due to out-of-bounds reads and acceptance of undersized packets in the Linux kernel's catc_rx_done() function when processing USB receive transfers. An attacker with physical access to system can supply malformed packet lengths or truncated transfers to trigger reads beyond the receive buffer or from uninitialized socket-buffer tailroom, potentially causing a kernel crash or memory disclosure.

2009) NULL pointer dereference (CVE-ID: CVE-2026-98614)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through a NULL pointer dereference in the Linux kernel's SCTP implementation.

The vulnerability exists due to a missing NULL pointer check in sctp_assoc_update_retran_path() when assigning a replacement retransmission path without an eligible transport. A remote attacker can trigger affected SCTP retransmission-path processing when all remaining transports are SCTP_UNCONFIRMED to leave the retransmission path NULL, potentially causing a NULL pointer dereference during subsequent path use or debug logging.

2010) Infinite loop (CVE-ID: CVE-2026-98614)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service through an infinite loop in the Linux kernel's SCTP implementation.

The vulnerability exists due to an unreachable loop termination condition in sctp_assoc_update_retran_path() when selecting a retransmission path while every remaining transport, including the current retransmission path, is SCTP_UNCONFIRMED. A remote attacker can trigger affected SCTP retransmission-path processing under these conditions to cause the transport-selection loop to run indefinitely.

2011) Out-of-bounds write (CVE-ID: CVE-2026-98621)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an integer underflow leading to an out-of-bounds write in the Linux kernel's GUE REMCSUM processing when the checksum field offset is less than the checksum start offset. A remote attacker can send a specially crafted GUE packet to underflow the checksum offset stored in skb->csum_offset and trigger a two-byte write approximately 64 KiB beyond the destination buffer if the forwarded packet retains CHECKSUM_PARTIAL and reaches a NETIF_F_HW_CSUM driver that trusts this metadata.

2012) Reachable assertion (CVE-ID: CVE-2026-98622)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to a reachable warning assertion in tcf_ct_flow_table_add() in net/sched/act_ct.c when flow_offload_alloc() returns NULL during packet processing through a tc action ct commit classifier. A local user can race a conntrack flush against traffic handled by the classifier to trigger a warning on an expected allocation failure and cause a kernel panic.

The kernel panic requires panic_on_warn=1.

2013) Out-of-bounds read (CVE-ID: CVE-2026-98623)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger an out-of-bounds kernel memory read, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds read in the Nouveau driver's nvkm_clk_ustate_update() function when processing a power-state identifier supplied through the pstate debugfs file. A local privileged user can request an identifier absent from clk->states, including any identifier when the list is empty, to cause the function to dereference the list head as a struct nvkm_pstate after an unsuccessful search, potentially causing a denial of service.

2014) Race condition (CVE-ID: CVE-2026-98624)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel fault.

The vulnerability exists due to a race condition in the Linux kernel nfnetlink_queue component when socket release notifications and queue configuration requests are processed concurrently. A local user can race a socket close() operation against an UNBIND request from another socket using the same portid to trigger concurrent queue destruction and cause a denial of service.

2015) Use-after-free (CVE-ID: CVE-2026-98625)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a use-after-free in the Linux kernel.

The vulnerability exists due to a use-after-free in the netfilter flowtable hardware offload worker when flow destruction overlaps with garbage collection. A local user can potentially trigger a race in which NF_FLOW_HW_DEAD is set before NF_FLOW_HW_PENDING is cleared, allowing garbage collection and an RCU callback to free the flow before the worker resumes accessing it, to cause a denial of service.

2016) Improper input validation (CVE-ID: CVE-2026-98626)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass relocation-target validation and cause unintended replacement of BPF instructions.

The vulnerability exists due to improper validation of relocation targets before instruction poisoning in bpf_core_patch_insn(), shared by libbpf and in-kernel CO-RE, when processing unresolved CO-RE relocations. A local user can supply malformed relocation metadata targeting instructions that are not eligible for relocation to replace jumps, calls, exits, register-source arithmetic, or non-immediate loads instead of triggering a relocation error.

2017) Out-of-bounds read (CVE-ID: CVE-2026-98631)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds kernel memory, potentially disclosing sensitive information.

The vulnerability exists due to an out-of-bounds read in the Linux kernel's xsk_map_gen_lookup() function when generated lookup code compares a zero-extended 32-bit key against a sign-extended 64-bit bound. A local user can supply an out-of-range lookup key that bypasses the bounds check to read beyond the xsk_map[] array.

Exploitation requires a map with max_entries set to 0x80000000 or higher.

2018) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-98636)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger undefined kernel behavior that may cause a denial of service.

The vulnerability exists due to an incorrect bitwise shift in the squashfs_xz_comp_opts() function when processing a SquashFS image with the COMP_OPTS flag set to 1 and a dictionary size of zero. A local privileged user can cause a specially crafted image to be mounted to trigger a shift with an exponent of -1, resulting in undefined behavior that may cause a denial of service.

2019) Out-of-bounds read (CVE-ID: CVE-2026-98640)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a kernel page fault.

The vulnerability exists due to an out-of-bounds read in the Linux kernel amd_sfh driver's PCI probe code when accessing MMIO registers without validating that PCI BAR 2 covers the required offsets. A local privileged user can trigger probing of a device with an undersized BAR 2 to cause an access beyond the mapped region and a kernel page fault.

2020) Out-of-bounds read (CVE-ID: CVE-2026-98643)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose adjacent kernel memory, including portions of kernel pointers.

The vulnerability exists due to an out-of-bounds read in the Linux kernel BPF sock_ops context conversion code when processing rtt_min access on the tcp_conn_request() path. A local privileged user can use a sockops BPF program that reads skops->rtt_min during BPF_SOCK_OPS_RWND_INIT to disclose adjacent kernel memory because a request_sock is incorrectly treated as a full tcp_sock without checking the socket type.

2021) Excessive Iteration (CVE-ID: CVE-2026-98644)

CWE-ID: CWE-834 - Excessive Iteration

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering prolonged CPU stalls and soft lockups.

The vulnerability exists due to excessive iteration without rescheduling points in __htab_map_lookup_and_delete_batch() when processing BPF hash map batch operations. A local user can invoke batch lookups on a sufficiently large map to cause prolonged CPU stalls, because the batch count limits entries copied rather than buckets visited, and consecutive empty buckets are traversed within a single RCU read-side, instrumentation-disabled critical section.

2022) Division by zero (CVE-ID: CVE-2026-98647)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel divide-by-zero exception.

The vulnerability exists due to an unchecked zero divisor in btf_struct_walk() when validating an access beyond a structure ending in a flexible array whose element type has zero size. A local privileged user can load a specially crafted BPF program that accesses the structure through a PTR_TO_BTF_ID pointer not marked MEM_ALLOC to trigger a modulo-by-zero operation during verification and cause a denial of service.

2023) Reachable assertion (CVE-ID: CVE-2026-98872)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by crashing the Linux kernel.

The vulnerability exists due to a reachable assertion in the freevxfs vxfs_bmap_typed() function when processing an on-disk typed extent with an unsupported type value. A local privileged user can trigger processing of such an extent through ioctl(FIBMAP) on a regular file to invoke BUG() and crash the kernel.

2024) Missing initialization of resource (CVE-ID: CVE-2026-98873)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially disclose sensitive information from uninitialized kernel memory.

The vulnerability exists due to missing initialization of connection-tracking expectation objects in the Linux kernel netfilter subsystem when expectation data is returned to userspace through ctnetlink. A local privileged user can obtain expectation data through ctnetlink to potentially read uninitialized kernel memory exposed in the returned data.

2025) NULL pointer dereference (CVE-ID: CVE-2026-98876)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to a missing NULL pointer check in host1x_device_init() in the Linux kernel host1x bus component when handling initialization error teardown for a client whose operations pointer is NULL. A local user can trigger the affected teardown paths to cause a NULL pointer dereference that may crash the kernel.

2026) NULL pointer dereference (CVE-ID: CVE-2026-98877)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to a null pointer dereference in the Linux kernel GICv4 interrupt controller support when kvm-arm.vgic_v4_enable=1 is set on a GICv4 system without an MSI controller device tree node or an available ITS. A local user can trigger an access to the null gic_domain pointer to cause a kernel panic and denial of service.

2027) Unchecked Return Value (CVE-ID: CVE-2026-98879)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel assertion failure.

The vulnerability exists due to an unchecked return value from sb_set_blocksize() in isofs_fill_super() when mounting an ISO filesystem with a block size greater than PAGE_SIZE. A local privileged user can cause such a filesystem to be mounted to trigger the BUG_ON(offset >= folio_size(folio)) assertion in folio_set_bh() during the first __bread_gfp() call, causing a denial of service.

2028) Resource exhaustion (CVE-ID: CVE-2026-98881)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by prolonging the blocking of network configuration operations.

The vulnerability exists due to excessive synchronization waits in the Linux kernel br_multicast_dev_del() function when tearing down bridge devices. A local user can trigger bridge device teardown to cause excessive RTNL lock contention through a stale rcu_barrier() call, delaying other network operations.

2029) Numeric Truncation Error (CVE-ID: CVE-2026-98884)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to integer truncation in the Linux kernel MMC core when an excessively large host-provided max_segs value is truncated to zero. A local user can trigger MMC request initialization with such an invalid host configuration to cause a zero-size scatter-gather allocation and a subsequent invalid memory access in sg_init_table(), crashing the kernel.

2030) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98885)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger kernel warnings during file integrity appraisal.

The vulnerability exists due to insufficient checks for file write restrictions in the Linux kernel's ima_fix_xattr() function when updating extended attributes during integrity appraisal. A local user can open a file subject to appraisal on a read-only ext4 filesystem to trigger an extended attribute update that attempts to start an invalid filesystem transaction, producing a kernel warning.

2031) Unchecked Return Value (CVE-ID: CVE-2026-98886)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by causing HDMI I2C read operations to wait indefinitely.

The vulnerability exists due to unchecked timeout and interruption return values in the xfer_read() function of the Oaktrail HDMI I2C driver when waiting for a read transaction to complete. A local user can trigger an affected read operation under conditions where the interrupt does not advance the transaction state to cause an indefinite wait, potentially blocking subsequent HDMI I2C transfers.

2032) Out-of-bounds read (CVE-ID: CVE-2026-98887)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger an out-of-bounds kernel memory read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel mac80211_hwsim function hwsim_tx_info_frame_received_nl() when processing an undersized HWSIM_ATTR_TX_INFO netlink attribute. A local privileged user can submit a short or zero-length attribute that passes the maximum-length-only validation to trigger an unconditional eight-byte read beyond the attribute payload, potentially causing a kernel fault.

2033) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98888)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of nested probe state in the Linux kernel arm64 kprobes implementation when a probe is hit while another probe is preparing or executing its out-of-line single-step instruction. A local user can trigger this condition through execution paths involving configured probes to cause a denial of service, as recoverable reentry is treated as unrecoverable and nested probes can overwrite the outer probe's saved interrupt state, leaving interrupts permanently disabled.

2034) Out-of-bounds write (CVE-ID: CVE-2026-98889)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds write in the iwlwifi MVM driver's scheduled scan handling when building probe requests before validating information element lengths. A local user can supply oversized information elements for a scheduled scan to overflow the fixed-size probe request buffer, potentially causing a kernel crash.

2035) Out-of-bounds read (CVE-ID: CVE-2026-98890)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger an out-of-bounds kernel memory read, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel libertas driver's lbs_hard_start_xmit() function when processing short transmit frames in monitor mode. A local privileged user can submit a frame containing insufficient data for the radiotap TX header and the 802.11 destination address field to trigger a read beyond the socket buffer data, potentially causing a kernel crash.

2036) Out-of-bounds read (CVE-ID: CVE-2026-98891)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to trigger an out-of-bounds read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the mac80211 ieee80211_rx_mgmt_deauth() function when processing truncated Wi-Fi deauthentication frames. A remote attacker on the local network can transmit a frame missing the reason code field to trigger a read beyond the received frame data before its length is checked, potentially causing a denial of service.

2037) Out-of-bounds read (CVE-ID: CVE-2026-98892)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read that may cause a denial of service.

The vulnerability exists due to insufficient payload-length validation in the Linux kernel ARM SCMI BASE_ERROR_EVENT notification parser when processing variable-length message reports. A local user can supply a truncated notification payload whose error_status specifies more reports than the payload contains to trigger reads beyond the received data, potentially causing a kernel crash.

2038) Out-of-bounds read (CVE-ID: CVE-2026-98893)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the ARM SCMI sensor notification parser when processing truncated SENSOR_UPDATE notifications. A local user can supply a truncated notification, if able to control notification payloads, to cause the parser to read beyond the received buffer, potentially causing a denial of service.

2039) Use-after-free (CVE-ID: CVE-2026-98896)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel Thunderbolt hotplug handling code when queued work executes after its associated domain has been removed. A local privileged user can trigger device-router hotplug events concurrently with driver unloading to cause the hotplug handler to access freed domain memory, potentially crashing the kernel.

2040) Use of uninitialized resource (CVE-ID: CVE-2026-98898)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to use of an uninitialized resource in the Linux kernel AMD GPU power management component when processing interrupts that schedule thermal work. A local user can potentially trigger work scheduling on an uninitialized thermal work queue to cause a kernel crash and denial of service.

The vulnerable condition occurs when dynamic power management is disabled with the amdgpu.dpm=0 module parameter.

2041) Improper locking (CVE-ID: CVE-2026-98899)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to improper locking in the Linux kernel netfilter ipset hash-table implementation when garbage collection accesses a shared hash table without the required read-copy-update protection. A local user can potentially trigger concurrent hash-table operations to cause unsafe table access and a denial of service.

2042) Integer overflow (CVE-ID: CVE-2026-98900)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through excessive kernel memory allocation and bypass grant-count limits.

The vulnerability exists due to insufficient grant-count validation and integer overflow in the Xen grant allocation function gntalloc_ioctl_alloc() when processing user-controlled grant allocation requests. A local user can supply excessive grant counts to trigger memory allocation before limit enforcement or cause arithmetic wraparound in grant accounting, potentially exhausting kernel memory or bypassing grant-count limits.

2043) Integer overflow (CVE-ID: CVE-2026-98902)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to interfere with RAID5 stripe batching, potentially compromising storage consistency.

The vulnerability exists due to integer wraparound and an incorrect sequence-number comparison in the Linux kernel RAID5 stripe batching logic when a 32-bit sequence counter wraps. A local user can potentially exercise stripe batching across this wraparound condition to cause newer bm_seq values to be treated as older values, potentially compromising storage consistency.

2044) Race condition (CVE-ID: CVE-2026-98907)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by disrupting Btrfs superblock reads.

The vulnerability exists due to a race condition in the Btrfs sb_write_pointer() function when reading a superblock from the block device page cache concurrently with block size changes. A local privileged user can attempt to overlap block size changes through BLKBSZSET with reads through read_cache_page_gfp() to potentially cause inconsistent reads and disrupt filesystem operations.

2045) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98909)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through unreleased kernel resources.

The vulnerability exists due to missing resource cleanup in the Linux kernel CPSW Ethernet driver's cpsw_probe() function when port registration fails after successful devlink registration. A local privileged user can potentially exploit this failure path to leave a devlink instance and its parameters registered after underlying resources have been released, which may disrupt system operation.

2046) Release of invalid pointer or reference (CVE-ID: CVE-2026-98911)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service.

The vulnerability exists due to an invalid pointer release in the Linux kernel dpaa2-switch driver's dpaa2_switch_rx() function when handling errors during received-frame processing. A remote attacker can potentially trigger the affected error path through network traffic to cause a kernel crash when a receive frame descriptor is incorrectly treated as a transmit frame descriptor and its software annotation data is used as a socket-buffer pointer for deallocation.

2047) Incorrect comparison (CVE-ID: CVE-2026-98912)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data to be written beyond the requested userspace buffer length.

The vulnerability exists due to an inverted buffer-length comparison in snd_seq_oss_read() when processing reads of queued OSS sequencer events. A local user can request a read shorter than the next queued event to cause the event to be copied beyond the requested userspace buffer length.