SB20261103109 - Ubuntu update for linux, linux-aws, linux-aws-5.15 and more

Description

This security bulletin contains information about 1089 vulnerabilities.

1) NULL pointer dereference (CVE-ID: CVE-2022-1205)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a null pointer dereference and use after free errors in the net/ax25/ax25_timer.c. A local user can simulate Amateur Radio and perform a denial of service (DoS) attack.

2) Out-of-bounds read (CVE-ID: CVE-2022-49234)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the dsa_switch_bridge_leave() function in net/dsa/switch.c. A local user can perform a denial of service (DoS) attack.

3) Use-after-free (CVE-ID: CVE-2022-49359)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the panfrost_job_hw_submit(), panfrost_job_handle_err() and panfrost_job_handle_done() functions in drivers/gpu/drm/panfrost/panfrost_job.c, within the panfrost_ioctl_submit() function in drivers/gpu/drm/panfrost/panfrost_drv.c. A local user can escalate privileges on the system.

4) Input validation error (CVE-ID: CVE-2022-49562)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the arch/x86/kvm/mmu/paging_tmpl.h. A local user can perform a denial of service (DoS) attack.

5) Use-after-free (CVE-ID: CVE-2022-49651)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cleanup_srcu_struct() function in kernel/rcu/srcutree.c. A local user can escalate privileges on the system.

6) Memory leak (CVE-ID: CVE-2022-49858)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the otx2_tx_napi_handler() and otx2_sq_append_skb() functions in drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c, within the otx2_sq_init() function in drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c. A local user can perform a denial of service (DoS) attack.

7) Memory leak (CVE-ID: CVE-2022-50071)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mptcp_sock_destruct() function in net/mptcp/subflow.c, within the __mptcp_wr_shutdown(), mptcp_copy_inaddrs(), mptcp_destroy_common() and mptcp_destroy() functions in net/mptcp/protocol.c. A local user can perform a denial of service (DoS) attack.

8) NULL pointer dereference (CVE-ID: CVE-2022-50303)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the kfd_process_device_init_vm() function in drivers/gpu/drm/amd/amdkfd/kfd_process.c. A local user can perform a denial of service (DoS) attack.

9) NULL pointer dereference (CVE-ID: CVE-2022-50406)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the iomap_writepage_map() function in fs/iomap/buffered-io.c. A local user can perform a denial of service (DoS) attack.

10) Integer overflow (CVE-ID: CVE-2023-52676)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the check_ptr_to_map_access() and check_stack_access_within_bounds() functions in kernel/bpf/verifier.c. A local user can execute arbitrary code.

11) Improper locking (CVE-ID: CVE-2023-53231)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the z_erofs_decompress_kickoff() function in fs/erofs/zdata.c. A local user can perform a denial of service (DoS) attack.

12) Out-of-bounds read (CVE-ID: CVE-2023-53320)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the mpi3mr_get_all_tgt_info() function in drivers/scsi/mpi3mr/mpi3mr_app.c. A local user can perform a denial of service (DoS) attack.

13) Use of uninitialized resource (CVE-ID: CVE-2023-53707)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the amdgpu_cs_pass1() function in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c. A local user can perform a denial of service (DoS) attack.

14) NULL pointer dereference (CVE-ID: CVE-2024-41062)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the l2cap_sock_kill(), l2cap_sock_new_connection_cb() and l2cap_sock_recv_cb() functions in net/bluetooth/l2cap_sock.c. A local user can perform a denial of service (DoS) attack.

15) Input validation error (CVE-ID: CVE-2024-46754)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the net/core/filter.c. A local user can perform a denial of service (DoS) attack.

16) Input validation error (CVE-ID: CVE-2024-49568)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the smc_clc_msg_prop_valid() function in net/smc/smc_clc.c, within the smc_find_rdma_v2_device_serv() function in net/smc/af_smc.c. A local user can perform a denial of service (DoS) attack.

17) Input validation error (CVE-ID: CVE-2024-50017)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ident_pud_init() function in arch/x86/mm/ident_map.c. A local user can perform a denial of service (DoS) attack.

18) Buffer overflow (CVE-ID: CVE-2024-53187)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the io_pin_pages() function in io_uring/memmap.c. A local user can escalate privileges on the system.

19) Memory leak (CVE-ID: CVE-2024-53210)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the iucv_sock_recvmsg() function in net/iucv/af_iucv.c. A local user can perform a denial of service (DoS) attack.

20) Improper locking (CVE-ID: CVE-2024-53220)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the fs/f2fs/segment.h. A local user can perform a denial of service (DoS) attack.

21) Improper locking (CVE-ID: CVE-2024-54683)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the idletimer_tg_destroy() and idletimer_tg_destroy_v1() functions in net/netfilter/xt_IDLETIMER.c. A local user can perform a denial of service (DoS) attack.

22) Out-of-bounds read (CVE-ID: CVE-2024-57945)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the EXPORT_SYMBOL(), setup_bootmem() and setup_vm() functions in arch/riscv/mm/init.c. A local user can perform a denial of service (DoS) attack.

23) Out-of-bounds read (CVE-ID: CVE-2024-57982)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the xfrm_state_deref_prot(), xfrm_dst_hash(), xfrm_src_hash(), xfrm_spi_hash(), xfrm_init_tempstate(), __xfrm_state_lookup_all(), xfrm_input_state_lookup(), EXPORT_SYMBOL(), __xfrm_state_lookup_byaddr(), xfrm_state_find(), xfrm_state_lookup() and xfrm_state_lookup_byaddr() functions in net/xfrm/xfrm_state.c. A local user can perform a denial of service (DoS) attack.

24) Improper locking (CVE-ID: CVE-2024-57999)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the enable_ddw() and spapr_tce_create_table() functions in arch/powerpc/platforms/pseries/iommu.c, within the iommu_table_clear() function in arch/powerpc/kernel/iommu.c. A local user can perform a denial of service (DoS) attack.

25) Input validation error (CVE-ID: CVE-2024-58094)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the jfs_truncate_nolock() function in fs/jfs/inode.c. A local user can perform a denial of service (DoS) attack.

26) Input validation error (CVE-ID: CVE-2024-58095)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the extAlloc() and extRecord() functions in fs/jfs/jfs_extent.c. A local user can perform a denial of service (DoS) attack.

27) Resource management error (CVE-ID: CVE-2024-58096)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ath11k_dp_rx_mon_dest_process(), ath11k_dp_full_mon_process_rx() and ath11k_hal_srng_access_end() functions in drivers/net/wireless/ath/ath11k/dp_rx.c. A local user can perform a denial of service (DoS) attack.

28) NULL pointer dereference (CVE-ID: CVE-2025-21649)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the hclge_ptp_set_tx_info() function in drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c. A local user can perform a denial of service (DoS) attack.

29) Resource management error (CVE-ID: CVE-2025-21651)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the hclge_misc_irq_init(), hclge_init_ae_dev() and hclge_uninit_ae_dev() functions in drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c. A local user can perform a denial of service (DoS) attack.

30) Use-after-free (CVE-ID: CVE-2025-21759)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mld_send_cr() and igmp6_send() functions in net/ipv6/mcast.c. A local user can escalate privileges on the system.

31) Improper locking (CVE-ID: CVE-2025-21801)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ravb_suspend() and ravb_resume() functions in drivers/net/ethernet/renesas/ravb_main.c. A local user can perform a denial of service (DoS) attack.

32) Use-after-free (CVE-ID: CVE-2025-21812)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ax25_rt_autobind() function in net/ax25/ax25_route.c, within the ax25_send_frame() and ax25_queue_xmit() functions in net/ax25/ax25_out.c, within the ax25_ip_xmit() function in net/ax25/ax25_ip.c, within the ax25_dev_device_up() and ax25_dev_device_down() functions in net/ax25/ax25_dev.c, within the ax25_fillin_cb_from_dev() and ax25_setsockopt() functions in net/ax25/af_ax25.c. A local user can escalate privileges on the system.

33) Race condition (CVE-ID: CVE-2025-21947)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the handle_response() function in fs/smb/server/transport_ipc.c. A local user can escalate privileges on the system.

34) Out-of-bounds read (CVE-ID: CVE-2025-22039)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the smb_inherit_dacl() and smb_check_perm_dacl() functions in fs/smb/server/smbacl.c. A local user can perform a denial of service (DoS) attack.

35) Use-after-free (CVE-ID: CVE-2025-22057)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the dst_count_dec() function in net/core/dst.c. A local user can escalate privileges on the system.

36) Memory leak (CVE-ID: CVE-2025-22083)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the vhost_scsi_set_endpoint(), target_undepend_item() and vhost_scsi_flush() functions in drivers/vhost/scsi.c. A local user can perform a denial of service (DoS) attack.

37) NULL pointer dereference (CVE-ID: CVE-2025-22103)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ipvlan_l3s_unregister() function in drivers/net/ipvlan/ipvlan_l3s.c. A local user can perform a denial of service (DoS) attack.

38) Memory leak (CVE-ID: CVE-2025-23160)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mtk_vcodec_fw_scp_init() function in drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c. A local user can perform a denial of service (DoS) attack.

39) Improper locking (CVE-ID: CVE-2025-37861)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the mpi3mr_process_factsdata(), mpi3mr_process_admin_reply_q(), mpi3mr_process_op_reply_q(), mpi3mr_check_op_admin_proc() and mpi3mr_soft_reset_handler() functions in drivers/scsi/mpi3mr/mpi3mr_fw.c. A local user can perform a denial of service (DoS) attack.

40) Improper locking (CVE-ID: CVE-2025-37920)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the xp_create_and_assign_umem() function in net/xdp/xsk_buff_pool.c, within the xsk_generic_rcv() and xsk_create() functions in net/xdp/xsk.c. A local user can perform a denial of service (DoS) attack.

41) Use-after-free (CVE-ID: CVE-2025-38069)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the pci_epf_test_set_bar() and pci_epf_test_free_space() functions in drivers/pci/endpoint/functions/pci-epf-test.c. A local user can escalate privileges on the system.

42) Memory leak (CVE-ID: CVE-2025-38097)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the __xfrm_state_delete() function in net/xfrm/xfrm_state.c, within the esp_ssg_unref(), esp6_find_tcp_sk(), esp_output_tcp_finish() and esp6_output_tcp_encap() functions in net/ipv6/esp6.c, within the esp_ssg_unref(), esp_find_tcp_sk(), esp_output_tcp_finish() and esp_output_tcp_encap() functions in net/ipv4/esp4.c. A local user can perform a denial of service (DoS) attack.

43) Out-of-bounds read (CVE-ID: CVE-2025-38239)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the megasas_set_high_iops_queue_affinity_and_hint() function in drivers/scsi/megaraid/megaraid_sas_base.c. A local user can perform a denial of service (DoS) attack.

44) Memory leak (CVE-ID: CVE-2025-38259)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the WCD9335_SLIM_TX_CH() and wcd9335_parse_dt() functions in sound/soc/codecs/wcd9335.c. A local user can perform a denial of service (DoS) attack.

45) Use-after-free (CVE-ID: CVE-2025-38349)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the __ep_remove() and ep_clear_and_put() functions in fs/eventpoll.c. A local user can escalate privileges on the system.

46) NULL pointer dereference (CVE-ID: CVE-2025-38361)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dce110_blank_stream() function in drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c. A local user can perform a denial of service (DoS) attack.

47) Input validation error (CVE-ID: CVE-2025-38615)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ntfs_rename() function in fs/ntfs3/namei.c, within the ni_add_name() and ni_rename() functions in fs/ntfs3/frecord.c. A local user can perform a denial of service (DoS) attack.

48) Improper locking (CVE-ID: CVE-2025-38643)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the cfg80211_check_and_end_cac() function in net/wireless/reg.c. A local user can perform a denial of service (DoS) attack.

49) Buffer overflow (CVE-ID: CVE-2025-39726)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the ism_cmd() and ism_probe() functions in drivers/s390/net/ism_drv.c. A local user can perform a denial of service (DoS) attack.

50) Improper locking (CVE-ID: CVE-2025-39779)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the btrfs_subpage_set_writeback() function in fs/btrfs/subpage.c. A local user can perform a denial of service (DoS) attack.

51) Buffer overflow (CVE-ID: CVE-2025-39810)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the bnxt_set_xps_mapping(), bnxt_trim_dflt_sh_rings(), bnxt_set_dflt_rings() and bnxt_init_dflt_ring_mode() functions in drivers/net/ethernet/broadcom/bnxt/bnxt.c. A local user can escalate privileges on the system.

52) Resource management error (CVE-ID: CVE-2025-39925)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the j1939_sk_netdev_event_netdown() function in net/can/j1939/socket.c. A local user can perform a denial of service (DoS) attack.

53) Use-after-free (CVE-ID: CVE-2025-40054)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the f2fs_merge_page_bio() function in fs/f2fs/data.c. A local user can escalate privileges on the system.

54) Improper error handling (CVE-ID: CVE-2025-40102)

CWE-ID: CWE-388 - Error Handling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the kvm_arch_vcpu_ioctl() function in arch/arm64/kvm/arm.c. A local user can perform a denial of service (DoS) attack.

55) NULL pointer dereference (CVE-ID: CVE-2025-40123)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __bpf_prog_map_compatible() function in kernel/bpf/core.c. A local user can perform a denial of service (DoS) attack.

56) NULL pointer dereference (CVE-ID: CVE-2025-68190)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the amdgpu_atom_execute_table_locked() function in drivers/gpu/drm/amd/amdgpu/atom.c. A local user can perform a denial of service (DoS) attack.

57) Integer underflow (CVE-ID: CVE-2025-68794)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the iomap_adjust_read_range() function in fs/iomap/buffered-io.c. A local user can execute arbitrary code.

58) Incorrect calculation (CVE-ID: CVE-2026-100070)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose internal network details.

The vulnerability exists due to an incorrect calculation of the Contact-header parsing offset in nf_nat_sip when processing a SIP packet whose NAT address translation changes its length. A remote attacker can send a SIP packet containing subsequent Contact headers to disclose internal network details.

Exploitation requires NAT address translation to shorten the packet.

59) Incomplete cleanup (CVE-ID: CVE-2026-100075)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect send queue credit accounting.

The vulnerability exists due to incomplete cleanup in the srpt_alloc_rw_ctxs() error unwind path when handling an allocation failure partway through a multi-buffer indirect descriptor. A remote attacker can trigger the error path to cause incorrect send queue credit accounting.

60) Use-after-free (CVE-ID: CVE-2026-23191)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the is_access_interleaved() and loopback_check_format() functions in sound/drivers/aloop.c. A local user can escalate privileges on the system.

61) Improper input validation (CVE-ID: CVE-2026-31420)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in br_mrp_start_test(), br_mrp_start_in_test(), and br_mrp_start_in_test_parse() when processing user-supplied netlink attributes. A local user can supply a zero interval value to cause a denial of service.

A zero interval causes delayed work to be rescheduled with no delay, creating a tight loop that allocates and transmits MRP test frames until system memory is exhausted and the kernel panics via OOM deadlock.

62) Use of uninitialized resource (CVE-ID: CVE-2026-43088)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an information exposure caused by uninitialized memory in PF_KEY export paths when exporting aligned sockaddr payloads for certain PF_KEY messages. A local user can trigger affected PF_KEY message handling to disclose sensitive information.

The issue affects the SADB_ACQUIRE, SADB_X_NAT_T_NEW_MAPPING, and SADB_X_MIGRATE export paths, while state and policy dump builders are not affected.

63) Use-after-free (CVE-ID: CVE-2026-43437)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in snd_pcm_drain() when handling a linked stream runtime after releasing the stream lock. A local user can trigger a concurrent close() on the linked stream's file descriptor to cause a denial of service.

The issue occurs because the drain path dereferences stale runtime fields from a linked stream after the runtime can be freed by concurrent unlink and detach operations.

64) Type Confusion (CVE-ID: CVE-2026-43456)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to type confusion in bond_setup_by_slave() when handling header operations for a bonded non-Ethernet slave device. A local user can enslave a non-Ethernet device such as a GRE tunnel to a bond and trigger packet transmission to cause a denial of service.

The issue is triggered because header callbacks from the slave device are invoked with the bond device context, causing device-specific private data to be interpreted as the wrong type.

65) Use-after-free (CVE-ID: CVE-2026-46113)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in KVM shadow paging when handling guest page table changes between VM entries. A local user can modify guest page tables to create a stale reverse-mapping entry and trigger a stale rmap walk to cause a denial of service.

This can be triggered during operations such as dirty logging or MMU notifier invalidations.

66) Improper resource shutdown or release (CVE-ID: CVE-2026-46158)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mptcp path manager ADD_ADDR retransmission handling when retransmitting ADD_ADDR messages. A local user can trigger ADD_ADDR retransmissions to cause a denial of service.

67) Improper resource shutdown or release (CVE-ID: CVE-2026-46170)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the mptcp path manager ADD_ADDR retransmission timer handling when processing ADD_ADDR retransmissions. A local user can trigger ADD_ADDR retransmissions to cause a system hang.

The issue occurs when the last socket reference is released from the timer handler, leading to an indefinite wait on the same timer.

68) Use-after-free (CVE-ID: CVE-2026-46242)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in ep_remove() in fs/eventpoll.c when removing epoll file references during a race with file release handling. A local user can trigger a race condition to cause memory corruption.

The issue involves the epoll-watches-epoll case and a concurrent __fput() path that can lead to operations on freed structures.

69) Improper access control (CVE-ID: CVE-2026-52944)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass permission checks and modify file sparse attributes.

The vulnerability exists due to improper access control in fsctl_set_sparse() when handling FSCTL_SET_SPARSE requests. A remote user can send a crafted FSCTL_SET_SPARSE request on an opened file to bypass permission checks and modify file sparse attributes.

The issue affects both clients on read-only shares and clients on writable shares that lack FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES access.

70) Race condition (CVE-ID: CVE-2026-52988)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nf_tables commit phase hook list handling in netfilter when publishing new hooks while concurrent netlink dump list traversal via rcu is in progress. A local user can trigger concurrent ruleset updates to cause a denial of service.

71) Out-of-bounds read (CVE-ID: CVE-2026-53078)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in BPF sock_ops context field access handling when accessing ctx fields with the same destination and source register. A local user can trigger the flawed register handling to cause a denial of service.

The issue occurs when the fullsock or locked_tcp_sock check is false, causing a stale ctx pointer to be retained and used as a bogus socket pointer.

72) Out-of-bounds read (CVE-ID: CVE-2026-53078)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in BPF sock_ops context field access handling when accessing ctx fields with the same destination and source register. A local user can trigger the flawed register handling to disclose sensitive information.

The issue occurs when the fullsock or locked_tcp_sock check is false, causing a stale ctx pointer to be retained.

73) Use-after-free (CVE-ID: CVE-2026-53089)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() when querying info for an offloaded BPF map or program during network namespace destruction. A local user can query crafted offloaded BPF map or program information to cause a denial of service.

The issue occurs because the associated network namespace may be racing with teardown and its reference count may already have reached zero.

74) NULL pointer dereference (CVE-ID: CVE-2026-64048)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in smc_v2_determine_accepted_chid and smc_conn_create when processing a crafted SMC-Dv2 accept reply with CHID 0. A remote attacker can send a specially crafted reply to trigger a kernel fault and cause a denial of service.

Exploitation requires a malicious peer to reply to an SMC-Dv2-only proposal.

75) Out-of-bounds write (CVE-ID: CVE-2026-64192)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in BPF_MAP_TYPE_INODE_STORAGE handling when creating and updating inode storage maps while the BPF LSM is uninitialized. A local privileged user can create and update a BPF_MAP_TYPE_INODE_STORAGE map to cause a denial of service.

This issue occurs when CONFIG_BPF_LSM is enabled but the BPF LSM is not enabled at boot time, causing the inode security blob offset to remain uninitialized and leading to a kernel panic during later RCU callback execution.

76) Stack-based buffer overflow (CVE-ID: CVE-2026-64270)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to overwrite stack memory and cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in mms114_interrupt() when processing a device-reported packet size from the touchscreen controller over the I2C bus. A local attacker can tamper with the I2C bus or use a malicious controller to supply an oversized packet size to overwrite stack memory and cause a denial of service.

The out-of-bounds write occurs on the IRQ-thread stack and may overwrite the stack canary, saved registers, and the return address.

77) Memory corruption (CVE-ID: CVE-2026-64272)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory access in the mms114 touchscreen driver when processing touch data packets from MMS134S and MMS136 controllers. A local user can trigger crafted touch event data to cause a denial of service.

The issue affects handling of touch events beyond the first one because 6-byte events are parsed using 8-byte structure indexing.

78) Improper input validation (CVE-ID: CVE-2026-64280)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in afu_ioctl_dma_map() when handling a DFL_FPGA_PORT_DMA_MAP ioctl request with a user-supplied length. A local user can provide an excessively large length value to cause a denial of service.

79) Improper access control (CVE-ID: CVE-2026-64294)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in the mincore() and madvise(MADV_PAGEOUT) ownership checks when handling files on idmapped mounts. A local user can access these interfaces on a crafted idmapped mount to disclose sensitive information.

The issue affects side-channel protection logic and occurs because ownership was checked against an idmap that ignored the file's mount idmap.

80) Improper Initialization (CVE-ID: CVE-2026-64561)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the KVM x86 shadow MMU page fault handling code when processing stale page faults after reclaiming shadow pages. A local user can trigger page faults that lead KVM to map memory into an invalid root to cause a denial of service.

The issue occurs when reclaiming shadow pages invalidates an in-use root, causing child shadow pages created during map or fetch operations to inherit an invalid role and violate the invariant that invalid shadow pages must not appear on the list of active MMU pages.

81) Double free (CVE-ID: CVE-2026-64581)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in xfrm_user_policy() when racing a per-socket policy change with packet transmission on a connected UDP socket. A local user can trigger concurrent socket operations to cause a denial of service.

The issue is reachable by an unprivileged user via a user and network namespace.

82) Use-after-free (CVE-ID: CVE-2026-64585)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in esd_usb_disconnect() and unlink_all_urbs() when handling USB device disconnect events. A local user can trigger a device disconnect condition to cause a denial of service.

The issue occurs because per-netdev private data embedded in the net_device allocation is dereferenced after free during teardown.

83) Use-after-free (CVE-ID: CVE-2026-64586)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the brcmfmac bus_reset work handling when a reset is scheduled during device removal. A local user can trigger a bus reset through the debugfs "reset" entry to cause a denial of service.

The issue affects shared bus_reset work across PCIe, SDIO, and USB removal paths, and brcmf_fw_crashed() could also be triggered before driver attachment completed.

84) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-64590)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of overlapping dma mappings in udmabuf scatter-gather table mapping when importing a udmabuf into a DRM driver with DMA API debug enabled. A local user can import a udmabuf to trigger a kernel warning to cause a denial of service.

The issue is observed when CONFIG_DMA_API_DEBUG_SG is enabled.

85) Out-of-bounds read (CVE-ID: CVE-2026-68082)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in decode_lockers() in net/ceph/cls_lock_client.c when parsing OSD-supplied lock information. A remote user can send a specially crafted OSD reply to disclose sensitive information.

Exploitation requires control of a malicious or compromised OSD and can be triggered against kernel clients that issue the lock.get_info class method, such as during RBD exclusive lock acquisition in a multi-tenant Ceph deployment.

86) Deadlock (CVE-ID: CVE-2026-68096)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a recursive locking deadlock in audit_dupe_exe() in the Linux kernel audit subsystem when handling file move events for executable audit rules. A local user can move a file that matches an existing executable audit rule to cause a denial of service.

Exploitation requires an existing executable audit rule that matches the file being moved.

87) Improper access control (CVE-ID: CVE-2026-68130)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in ntlm_authenticate() when processing an NTLM authentication request containing a crafted username field and PreviousSessionId. A remote user can supply a username matching a victim account and a victim session identifier to cause a denial of service.

The issue can destroy another user's SMB session before the NTLMv2 response is validated.

88) Deadlock (CVE-ID: CVE-2026-68132)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in the emergency thaw worker in fs/super.c when thawing frozen block devices. A local user can trigger emergency thaw handling to cause a denial of service.

The issue can deadlock against itself while reacquiring s_umount and can block subsequent unmount, freeze, or thaw operations for the affected filesystem and block device.

89) Race condition (CVE-ID: CVE-2026-68138)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition leading to use-after-free and double-free in qdisc_get_rtab() and qdisc_put_rtab() when processing concurrent RTM_NEWTFILTER requests that add flower filters with a police action carrying the same rate. A local user can send concurrent netlink filter configuration requests to cause a denial of service.

The corrupted qdisc_rate_table object is shared system-wide because the affected rate-table list is process-global rather than per-network-namespace.

90) Race condition (CVE-ID: CVE-2026-68146)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the ftrace trace_parser handling in ftrace_regex_write(), ftrace_graph_write(), ftrace_regex_release(), and ftrace_graph_release() when processing concurrent writes and release operations on a shared trace file descriptor. A local user can issue concurrent operations from multiple threads to cause a denial of service.

The issue occurs when a userspace process shares an opened trace file descriptor across multiple threads, causing corruption of the parser's internal state fields.

91) Out-of-bounds write (CVE-ID: CVE-2026-68159)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack out-of-bounds write in __decode_pg_temp(), __decode_pg_upmap_items(), and OSDMap handling in net/ceph/osdmap.c when processing a crafted OSDMap containing an oversized pg_temp, pg_upmap, or pg_upmap_items entry. A remote attacker can send a specially crafted OSDMap entry to cause a denial of service.

The issue is triggered when the decoded list is later copied into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE].

92) Use-after-free (CVE-ID: CVE-2026-68162)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the SCTP auth_enable sysctl handler when handling writes to an already opened sysctl file during network namespace teardown. A local user can write to the auth_enable sysctl entry to cause a denial of service.

The issue is exposed during initialization before the SCTP control socket exists and during teardown after the control socket has been released.

93) Use-after-free (CVE-ID: CVE-2026-68198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in aggr_reset_state() in the ath6kl wireless driver when handling a race between timer callback execution and TID state teardown. A local user can trigger the race condition to cause a denial of service.

The timer callback may continue accessing rx_tid[] and stat[] fields after the associated aggr_conn structure is freed, and it can re-arm itself while the reset routine is running.

94) Use-after-free (CVE-ID: CVE-2026-68202)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ALSA sequencer queue timer handling in snd_seq_timer_delete() and related queue destruction logic when accessing /dev/snd/seq and re-opening a queue timer during queue teardown. A local user can issue crafted sequencer operations to leave a timer instance live and trigger a dereference of freed queue memory to cause a denial of service.

No queue ownership is required.

95) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68205)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper ownership handling in v4l2_async_register_subdev_sensor() when registering a V4L2 subdevice sensor asynchronously. A local user can trigger registration of a crafted or removable sensor driver module to cause a denial of service.

The issue can leave the sensor driver's module owner unset, allowing the module to be removed while the subdevice is still in use by a notifier such as a CSI-2 receiver bridge driver.

96) Double free (CVE-ID: CVE-2026-68236)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in dm_update_crtc_state() in the AMD display manager when handling error paths after releasing new_stream on the skip_modeset path. A local user can trigger a later error condition after the initial release to cause a denial of service.

The issue occurs because a dangling pointer may be released again after a color management failure reaches the fail label.

97) Out-of-bounds write (CVE-ID: CVE-2026-68253)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the intel_hdcp_required_content_stream function when processing HDCP content stream data. A local user can trigger a stream count overflow to cause a denial of service.

98) Improper input validation (CVE-ID: CVE-2026-68254)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the intel_vrr.c VRR capability handling when processing EDID monitor range data. A local user can provide crafted min/max vertical frequency values to trigger a division by zero and cause a denial of service.

99) Out-of-bounds read (CVE-ID: CVE-2026-68255)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in virtio_get_edid_block() when parsing device-supplied EDID responses. A remote privileged user can supply a crafted virtio-gpu EDID response with a large reported size and high extension count to disclose sensitive information.

Exploitation requires control of a malicious virtio-gpu backend.

100) Out-of-bounds read (CVE-ID: CVE-2026-68277)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the sideband reply parsers in drm_dp_mst_topology.c when parsing crafted sideband reply messages. A local user can provide a crafted message with a truncated 2-byte field to disclose sensitive information.

The out-of-bounds read can access data from adjacent struct fields including curchunk_len, curchunk_idx, and curlen.

101) Out-of-bounds write (CVE-ID: CVE-2026-68278)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to out-of-bounds write in drm_dp_sideband_append_payload() when processing forged DP MST sideband reply messages from a connected device. An attacker with physical access can send crafted sideband reply data to cause memory corruption.

The issue is reachable from a DP MST device over a physical connection.

102) Out-of-bounds read (CVE-ID: CVE-2026-68279)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in drm_dp_sideband_parse_remote_dpcd_read() and drm_dp_sideband_parse_remote_i2c_read_ack() when parsing remote DPCD and I2C sideband reply messages from an MST hub. A remote attacker can send a specially crafted sideband reply with an oversized num_bytes value to disclose sensitive information.

The issue can be triggered by a malicious or misbehaving MST hub.

103) Use-after-free (CVE-ID: CVE-2026-68367)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the f_tcm delayed set_alt work handler when processing delayed USB gadget alternate-setting changes during disconnect or function teardown. A local user can trigger function unlink or teardown while delayed set_alt work is still pending to cause a denial of service.

The issue was reproduced by KASAN in tcm_delayed_set_alt after the function state was freed through configfs unlink operations.

104) Use-after-free (CVE-ID: CVE-2026-68399)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sk_clone() and BPF socket local storage handling when cloning sockets and an early bailout occurs before BPF storage cloning. A local user can trigger socket cloning that fails before storage initialization completes to cause a denial of service.

Only systems with BPF syscall support enabled are vulnerable.

105) Out-of-bounds read (CVE-ID: CVE-2026-68431)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ksmbd connection request handling when processing short SMB2 transform requests on an SMB 2.1 connection. A remote attacker can send a specially crafted truncated transform packet to disclose sensitive information.

The issue occurs when a transform packet is accepted even though the negotiated dialect does not provide transform handling.

106) NULL pointer dereference (CVE-ID: CVE-2026-68434)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mid8250_probe() and mid8250_remove() in the 8250_mid serial driver when handling setup and exit callbacks for affected platforms. A local user can trigger the vulnerable code path to cause a denial of service.

The issue affects Denverton, Ice Lake Xeon D, and Snowridge platforms.

107) Use-after-free (CVE-ID: CVE-2026-68476)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in __ip_vs_get_out_rt() handling of skb head reallocation in net/netfilter/ipvs/ip_vs_xmit.c when processing packets in ip_vs_bypass_xmit(). A local user can trigger skb head reallocation and subsequent use of a stale IP header pointer to cause a denial of service.

108) Double free (CVE-ID: CVE-2026-72015)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in RMID management in fs/resctrl/rdtgroup.c when unmounting and removing pseudo-locked resctrl groups. A local user can create a pseudo-locked group and trigger unmount processing to cause a denial of service.

The issue affects pseudo-locked groups whose RMID is freed during setup and then freed again during cleanup.

109) Memory leak (CVE-ID: CVE-2026-72023)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in otx2_init_hw_resources() and the SQ resource unwind path when handling initialization failures. A local user can trigger an initialization failure to cause a denial of service.

Exploitation requires access to a system using the OcteonTX2 PF driver.

110) NULL pointer dereference (CVE-ID: CVE-2026-72035)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the sch_taprio scheduler when processing ordinary egress through a non-work-conserving child qdisc after a peeked packet is orphaned and queue state is desynchronized. A local attacker can trigger network egress through a qfq child to cause a denial of service.

The issue can panic the kernel from softirq, and the qfq child can be re-entered on an emptied list.

111) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72041)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in espintcp_sendskmsg_locked in net/xfrm/espintcp.c when handling partial sends of sk_msg data. A local user can trigger partial send conditions to cause a denial of service.

112) Improper access control (CVE-ID: CVE-2026-72045)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in rvu_mbox_handler_lmtst_tbl_setup() when handling mailbox requests that specify base_pcifunc. A remote user can supply a crafted base_pcifunc value to disclose sensitive information.

Exploitation requires a VF caller on cn10k hardware, and the issue is limited to redirecting LMTLINE sharing outside the caller's own PF.

113) Improper access control (CVE-ID: CVE-2026-72051)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.

The vulnerability exists due to improper access control in ip6_tnl_changelink() when handling changelink requests for IPv6 tunnel devices across network namespaces. A local privileged user can send a crafted netlink changelink request to modify tunnel configuration across network namespaces.

The issue occurs when the device network namespace differs from the tunnel link network namespace.

114) Improper access control (CVE-ID: CVE-2026-72053)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify IPIP tunnel configuration in another network namespace.

The vulnerability exists due to improper access control in ipip_changelink() in net/ipv4/ipip.c when handling changelink requests for an IPIP device whose tunnel link resides in a different network namespace. A local privileged user can send a changelink request from a network namespace where they have CAP_NET_ADMIN to modify IPIP tunnel configuration in another network namespace.

The issue occurs when dev_net(dev) and the tunnel link namespace differ, such as after the device is created in or moved to a different network namespace.

115) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72057)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper preservation of control-buffer state in tcf_ct_handle_fragments() in the act_ct component when handling fragmented traffic through connection-tracking defragmentation. A remote attacker can send specially crafted fragmented packets to cause a denial of service.

System impact occurs when panic_on_warn is enabled.

116) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72058)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in ixp4xx_hss_probe() when allocating and registering HDLC netdev objects. A local user can trigger device initialization and removal to cause a denial of service.

The issue stems from allocating two different netdev objects and later unregistering and freeing a different object than the one that was registered.

117) Improper locking (CVE-ID: CVE-2026-72063)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper interaction with a mutex in tegra_gpio_direction_input() and tegra_gpio_direction_output() when changing GPIO direction on shared GPIO lines. A local user can trigger GPIO direction operations while a per-line spinlock is held to cause a denial of service.

The issue can lead to sleeping in an atomic context.

118) Improper input validation (CVE-ID: CVE-2026-72065)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper input validation in the mana RX completion queue handling in mana_process_rx_cqe() when processing packet length values reported by the NIC. An attacker with physical access can supply an invalid packet length via a malicious or compromised NIC device to cause a denial of service.

The reported packet length is supplied by the NIC device and is not sufficiently validated before skb processing.

119) Use-after-free (CVE-ID: CVE-2026-72069)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in rt_spin_unlock(), rt_read_unlock(), and rt_write_unlock() when releasing RCU protection before completing unlock operations. A local user can trigger concurrent lock and RCU operations to execute arbitrary code.

The issue affects the RT spinlock and rwlock substitutions where unlock handling does not preserve the expected non-RT RCU protection semantics.

120) Use-after-free (CVE-ID: CVE-2026-72070)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in lbtf_free_adapter() when handling device removal during a firmware command timeout. A local user can trigger concurrent teardown and timer callback execution to cause a denial of service.

121) Use-after-free (CVE-ID: CVE-2026-72073)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in the vub300_probe error path in drivers/mmc/host/vub300.c when handling a failed mmc_add_host() call after the inactivity timer has been armed. A local user can trigger a probe failure race to cause a use-after-free.

Exploitation requires a failure during device probe after the inactivity timer is armed, and the queued deadwork may continue running after the timer callback has completed.

122) Improper resource shutdown or release (CVE-ID: CVE-2026-72077)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the ims-pcu firmware update handler when processing an asynchronous firmware update. A local user can trigger firmware validation failure to cause a denial of service.

123) Memory leak (CVE-ID: CVE-2026-72087)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in lpfc_sli4_driver_resource_setup() in the lpfc driver when handling early exit error paths during driver resource setup. A local user can trigger the affected error paths to cause a denial of service.

124) Race condition (CVE-ID: CVE-2026-72096)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to bypass audit logging of corrupted block errors.

The vulnerability exists due to a race condition in dm-verity error handling in drivers/md/dm-verity-target.c when handling concurrent corrupted block errors. A local attacker can trigger concurrent error conditions to bypass audit logging of corrupted block errors.

125) Incorrect calculation (CVE-ID: CVE-2026-72099)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper calculation in dm-integrity when processing integrity metadata tags. A local user can trigger incorrect hash offset handling to cause a denial of service.

126) Use-after-free (CVE-ID: CVE-2026-72110)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in task BPF storage handling in copy_process() and free_task() when handling a fork operation that aborts before task BPF storage is initialized. A local user can trigger a failed fork from a process inserted into a task storage map to cause a denial of service or execute arbitrary code.

Exploitation is reachable when the calling process has been inserted into a task storage map.

127) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-72142)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the i2c_imx_atomic_read function when processing SMBus block-read operations with a byte count of 0 or a count above I2C_SMBUS_BLOCK_MAX. A local user can trigger a crafted SMBus block read to cause a denial of service.

The issue can leave the i2c bus stuck with SDA held until a power cycle for the affected controller.

128) Race condition (CVE-ID: CVE-2026-72148)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in dw_edma_v0_core_start() when concurrently starting DMA channels. A local user can trigger concurrent channel operations to cause a denial of service.

The DONE_INT_MASK and ABORT_INT_MASK registers are shared by all DMA channels, and the issue arises from a non-atomic read-modify-write sequence while updating them.

129) Improper locking (CVE-ID: CVE-2026-72152)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of task state and wake-up logic in wait_for_tpm_stat() in the TPM TIS core when waiting for TPM status changes on the IRQ wait path. A local user can trigger TPM operations that exercise the affected wait path to cause a denial of service.

The issue is associated with the IRQ-based wait path and can trigger a kernel warning when CONFIG_DEBUG_ATOMIC_SLEEP is enabled.

130) Improper locking (CVE-ID: CVE-2026-72155)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock state handling in the spi_nor_sr_unlock() function in the spi-nor software protection logic when processing unlock requests for locked blocks at the beginning of the device. A local user can request unlocking of the currently locked block or blocks to cause a denial of service.

The issue occurs when the first block, or a few first blocks, are locked and both top and bottom unlocking paths can achieve the same result.

131) Out-of-bounds write (CVE-ID: CVE-2026-72157)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to an out-of-bounds write in tbnet_poll() when processing a multi-frame ThunderboltIP packet with a peer-supplied frame_count that exceeds the fragment array capacity. A remote attacker can send a specially crafted packet with 19 or more small frames to corrupt memory.

The issue occurs because the first frame is placed in the skb linear area while subsequent frames are added as page fragments.

132) Race condition (CVE-ID: CVE-2026-72170)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in v9fs_dec_count in the 9p filesystem inode handling code when processing unlink operations in cacheless mode. A local user can trigger heavy unlink workloads to cause a kernel warning and system instability.

Only systems using the 9p filesystem in cacheless mode are affected.

133) Out-of-bounds write (CVE-ID: CVE-2026-72191)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in indx_insert_into_buffer in the ntfs3 filesystem code when processing a crafted NTFS filesystem image during file creation in a mounted directory. A local user can mount a specially crafted NTFS image and trigger filesystem operations to cause a denial of service.

Triggering the issue requires local mounting of an attacker-supplied filesystem image, such as via loopback, removable media, or USB, and a filesystem operation such as creating a file in the mounted directory.

134) Memory leak (CVE-ID: CVE-2026-72216)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in qcom_add_minidump_segments() when adding custom dump segments. A local user can trigger minidump segment handling failures to cause a denial of service.

135) NULL pointer dereference (CVE-ID: CVE-2026-72242)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in selinux_sctp_bind_connect() when processing SCTP ASCONF operations from the softirq path. A local user can trigger the vulnerable SCTP bind or connect handling to cause a denial of service.

The issue occurs when the hook is invoked from the ASCONF softirq path, where no file reference guarantees that sk->sk_socket is non-NULL.

136) Out-of-bounds write (CVE-ID: CVE-2026-72252)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to out-of-bounds writes in the nft_pipapo_match handling in netfilter nft_set_pipapo when processing set element insertions after a prior memory allocation failure left a cloned match in an invalid state. A local user can trigger an allocation failure and then perform a subsequent insertion in the same batch to cause memory corruption.

The issue can also affect a subsequent transaction because a bad clone may persist when the abort callback is not executed after the initial failure.

137) NULL pointer dereference (CVE-ID: CVE-2026-72253)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the nf_conntrack_sip SIP helper when processing traffic with sip_external_media enabled in subsystems where routing information is unavailable. A local user can send specially crafted network traffic to cause a denial of service.

The issue affects tc ingress and openvswitch when the sip_external_media module parameter is set to 1.

138) Use-after-free (CVE-ID: CVE-2026-72255)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in nf_queue handling of bridge fake dst references when processing bridged packets queued to NFQUEUE. A local user can queue bridged packets to NFQUEUE during bridge device teardown to cause a denial of service.

The issue affects systems with CONFIG_BRIDGE_NETFILTER enabled and involves queued packets carrying a fake rtable associated with a bridge device.

139) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72260)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exception handling in mt8192_afe_pcm_dev_probe() when probing the MT8192 AFE device and reinitializing the regmap cache during runtime power management resume. A local user can trigger device probe under conditions where runtime resume fails to cause a denial of service.

The issue can leave the power management usage count incremented and continue probe while the device may not be accessible.

140) Use-after-free (CVE-ID: CVE-2026-72299)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in TIPC enqueue tracepoint queue dumping in tipc_sk_enqueue() when dumping socket queues during message enqueue processing. A local user can trigger crafted TIPC socket activity to cause a denial of service.

The issue is reachable while the socket is owned by user context, because the held spinlock protects the backlog queue but does not serialize access to sk_receive_queue.

141) Improper Initialization (CVE-ID: CVE-2026-72305)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in VDUSE bounce page allocation when mapping bounce pages to userspace. A local user can trigger bounce page mappings to disclose sensitive information.

142) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-72308)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a reference count leak in mlxsw_sp_port_lag_join() when handling an error from mlxsw_sp_port_lag_index_get(). A local user can trigger the error path to cause a denial of service.

143) Use-after-free (CVE-ID: CVE-2026-72323)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the IGMP timer callback when processing incoming IGMP queries during device teardown. A remote attacker can send a crafted IGMP query to cause a denial of service.

Exploitation requires a race between device destruction and IGMP query processing.

144) Race condition (CVE-ID: CVE-2026-74268)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in tcp_set_state() and tcp_call_bpf() when force-closing a child socket whose inherited sock_ops callback flags remain set after setup failure. A remote attacker can send network traffic that triggers child socket setup failure to cause a denial of service.

The issue occurs before the child socket is ever established and affects forced-close paths that reach tcp_done() without the expected socket lock.

145) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-74378)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a heap-based buffer overflow.

The vulnerability exists due to a time-of-check time-of-use race in get_srq_wqe() when copying a work queue element from a shared receive queue buffer mapped into userspace. A local user can modify num_sge between validation and size calculation to cause a heap-based buffer overflow.

The issue arises because the num_sge field is read twice from shared userspace-accessible memory.

146) Use-after-free (CVE-ID: CVE-2026-74436)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in rxrpc_kernel_charge_accept() and the rxrpc service backlog handling when concurrent socket teardown and kernel accept preallocation occur. A local attacker can trigger concurrent operations that reuse a freed backlog structure to cause a denial of service.

The issue arises from a race condition between kernel preallocation work and socket teardown in the RxRPC subsystem.

147) Out-of-bounds write (CVE-ID: CVE-2026-74470)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the resp_report_zones() function in the scsi_debug driver when processing a REPORT ZONES command with a crafted allocation length on 32-bit systems. A local user can send a specially crafted REPORT ZONES command to cause a denial of service.

The issue occurs when an allocation length in the 0xFFFFFFC1 through 0xFFFFFFFF range causes a zero-sized allocation to be dereferenced on 32-bit systems.

148) Use-after-free (CVE-ID: CVE-2026-74479)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the pktgen proc entry handling in net/core/pktgen.c when concurrently removing and renaming pktgen devices. A local user can trigger a race condition involving proc_remove() on a stale proc_dir_entry to cause a denial of service.

The issue occurs because pktgen_change_name() and pktgen_remove_device() access the same proc entry with inconsistent locking, and exploitation requires winning a race between those paths.

149) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74487)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in binfmt_misc when removing an entry registered with the MISC_FMT_OPEN_FILE flag. A local user can register and remove such an entry to cause a denial of service.

The issue leaves the interpreter inode with a permanently negative write count until the inode is evicted from the inode cache, causing subsequent write attempts to fail with ETXTBSY.

150) Memory leak (CVE-ID: CVE-2026-74494)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in smb2_handle_negotiate() and connection negotiation state handling when sending repeated SMB2 NEGOTIATE requests on one connection before SESSION_SETUP. A remote attacker can send multiple successful SMB2 NEGOTIATE requests to cause a denial of service.

The issue occurs after a dialect has already been selected and before session setup completes.

151) Use-after-free (CVE-ID: CVE-2026-74496)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in fou_create() and fou_from_sock() when handling concurrent socket activity after a failed FOU port creation. A local user can request local port 0 and trigger concurrent receive processing to cause a denial of service.

The issue is reachable when local port 0 is requested and the creation path fails after the object remains reachable through sk_user_data.

152) Use-after-free (CVE-ID: CVE-2026-74575)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the thunderbolt xdomain delayed work handling in tb_xdp_handle_request() and update_xdomain() when queuing delayed work concurrently with xdomain disconnect and removal. A local user can trigger crafted xdomain requests or state changes during disconnect to cause a denial of service.

The issue arises because the request handler runs on the system workqueue and is no longer serialized with the remove path.

153) Out-of-bounds write (CVE-ID: CVE-2026-74582)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in packet_snd() and packet_sendmsg_spkt() in the Linux kernel AF_PACKET implementation when handling non-ring send paths during concurrent device reconfiguration. A local user can send crafted packets while triggering a change in hard_header_len to cause an out-of-bounds write.

The issue affects SOCK_RAW send handling, and packet_sendmsg_spkt() is affected by the same inconsistent header length usage across allocation and packet construction.

154) Use-after-free (CVE-ID: CVE-2026-74594)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in kernel/sched/psi.c when destroying PSI cgroup triggers concurrently with scheduling poll work. A local user can trigger a race that leaves a poll timer pending on freed memory to cause a denial of service.

The issue occurs because a timer may be re-armed during teardown and later execute poll_timer_fn() after the associated group has been freed.

155) Improper access control (CVE-ID: CVE-2026-74595)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass owner checks and set an encryption policy on a file.

The vulnerability exists due to improper access control in fscrypt_ioctl_set_policy() when handling ioctl requests on idmapped mounts. A local user can issue a crafted ioctl on an idmapped mount to bypass owner checks and set an encryption policy on a file.

The issue occurs because the check uses the unmapped on-disk owner rather than the mapped owner on mounts that support idmapping.

156) Race condition (CVE-ID: CVE-2026-74599)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ptdump_walk_pgd() and page table walking logic when walking page tables for an mm other than init_mm. A local user can trigger page table dumping for a non-init_mm memory context to cause a denial of service.

The issue affects cases where kernel memory ranges shared across non-kernel memory contexts are walked concurrently with kernel page table freeing.

157) Race condition (CVE-ID: CVE-2026-74601)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ring_buffer_swap_cpu() when swapping per-cpu ring buffers during an active write operation. A local user can trigger a buffer swap at a moment when the committing counter temporarily drops to zero to cause a denial of service.

The issue can lead to an inconsistent buffer state and trigger the RB_WARN_ON in rb_commit().

158) Improper resource shutdown or release (CVE-ID: CVE-2026-74621)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the act_ct traffic control action when processing malformed fragmented IPv4 or IPv6 packets during header sanity checks. A remote attacker can send a specially crafted malformed packet to cause a denial of service.

The issue can leak one sk_buff and its associated data buffer per malformed packet, which may occur on ingress or egress paths that use the connection tracking action.

159) Improper resource shutdown or release (CVE-ID: CVE-2026-74623)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the atlantic driver TX ring deinitialization logic when tearing down network interfaces under TX or XDP_TX load. A local user can trigger interface teardown while transmit descriptors remain stranded to cause a denial of service.

Under XDP_TX load, stranded frames can keep the page pool inflight count above zero and prevent pool shutdown, with repeated stall warnings during interface down, XDP detach, or ring resize operations.

160) Improper resource shutdown or release (CVE-ID: CVE-2026-74626)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in ntb_netdev_rx_handler() in the ntb_netdev driver when handling received packets and allocating replacement receive buffers. A remote attacker can send packets that trigger allocation failures and exhaust the receive queue to cause a denial of service.

The issue can stall packet reception while the network interface remains up.

161) Use-after-free (CVE-ID: CVE-2026-74628)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the x25 socket timer handlers when processing timer callbacks during socket teardown. A local user can trigger timer activity on an x25 socket being destroyed to cause a denial of service.

The issue involves a race condition in which a timer callback may rearm after the socket has passed its cancel point, leading to use of freed memory on a subsequent timer expiry.

162) Use-after-free (CVE-ID: CVE-2026-74631)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in smc_rx_splice when processing splice operations. A local user can trigger a refcount imbalance to cause a denial of service.

The issue can underflow page refcounts in the VM-backed RMB path.

163) Race condition (CVE-ID: CVE-2026-74632)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in mm/huge_memory.c when handling concurrent page faults and shrinker activity for the huge zero folio. A local user can trigger concurrent memory-management activity to cause a denial of service.

Only systems without CONFIG_PERSISTENT_HUGE_ZERO_FOLIO are affected.

164) Use-after-free (CVE-ID: CVE-2026-74637)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in perf/core group handling when processing a PERF_IOC_FLAG_GROUP ioctl on a detached sibling event after CPU hotplug detachment. A local user can issue a crafted ioctl on a surviving perf event file descriptor to cause a denial of service.

The issue occurs when a sibling event is detached with DETACH_GROUP and kept alive while its group_leader pointer still references a leader that is later freed.

165) Race condition (CVE-ID: CVE-2026-74647)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in fastrpc_req_munmap_impl in the fastrpc driver when processing concurrent buffer unmap requests. A local user can trigger concurrent unmap operations to cause a denial of service.

The issue occurs when multiple threads invoke unmap concurrently for the same buffer.

166) Race condition (CVE-ID: CVE-2026-74662)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in inet_frag_create() and the fragment queue timer handling in net/ipv4/inet_fragment.c when processing fragmented packets with a zero or negative fragment timeout. A remote attacker can send specially crafted fragmented network traffic to cause a denial of service.

The issue occurs because the timer may run before the queue is published in the fqdir rhashtable, which can leave a stale hash node after reference handling becomes unbalanced.

167) Uncontrolled Recursion (CVE-ID: CVE-2026-74663)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in qdisc hierarchy handling in net/sched qdisc grafting logic when creating and grafting a new child qdisc below an already deep parent. A local user can create a deeply nested qdisc hierarchy to cause a denial of service.

The issue affects the create-and-graft path that is not covered by the existing loop check.

168) Race condition (CVE-ID: CVE-2026-74666)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in packet_set_ring() and pressure clearing logic in af_packet when reconfiguring the ring while packet_poll() or packet_recvmsg() accesses receive state. A local user can reconfigure the packet socket ring and trigger packet polling or receive operations to cause a denial of service.

The issue can cause __packet_rcv_has_room() to dereference stale or NULL ring storage.

169) Race condition (CVE-ID: CVE-2026-74668)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an inconsistent use of hard_header_len in the tpacket_snd() transmit ring send path in net/packet/af_packet.c when processing tx ring frames during packet transmission. A local user can trigger concurrent netdevice reconfiguration and send crafted ring frames to cause a denial of service.

The issue can make the reserved headroom smaller than the amount later pushed, or make the computed copy length negative.

170) Out-of-bounds read (CVE-ID: CVE-2026-74737)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds memory access in the am65-cpsw-nuss packet reception path when processing RX DMA descriptor metadata containing the source tag. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue occurs because the driver uses the full 16-bit source tag as the port identifier even though only the lower 8 bits represent the MAC port ID, while the upper 8 bits are hardware-reserved and may contain arbitrary values.

171) Use-after-free (CVE-ID: CVE-2026-74743)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the macvlan network device handling in drivers/net/macvlan.c when processing packets on a macvlan device backed by a lower device that requires additional headroom or tailroom. A remote attacker can send network traffic that triggers insufficient buffer space handling to execute arbitrary code.

The issue can be triggered when the lower device requires extra header or trailer space, such as with macsec, ipsec, wireguard, tunnels, or veth with rx headroom.

172) Use-after-free (CVE-ID: CVE-2026-74746)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the netfilter flowtable subsystem when inserting flow tuple nodes into the rhashtable. A remote attacker can trigger garbage collection to observe a partially installed flow to execute arbitrary code.

KASAN reported read and write access to freed slab memory in the flowtable and rhashtable path.

173) Race condition (CVE-ID: CVE-2026-74748)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in __ip_set_put_byindex() in the netfilter ipset subsystem when list:set garbage collection and set swap operations occur concurrently. A local user can trigger concurrent ipset operations to cause a denial of service.

The issue can lead to a kernel BUG and panic from timer softirq context.

174) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80527)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in __ceph_get_caps() when handling Ceph capability revocation and reacquisition. A remote attacker can trigger conflicting operations that leave stale mds_wanted state and cause a reader to wait indefinitely to cause a denial of service.

The issue occurs when a cap update requesting FILE_RD does not reach the MDS after mds_wanted has been raised, leaving the client without the wanted file read capability while local state still indicates it is wanted.

175) Improper resource shutdown or release (CVE-ID: CVE-2026-80528)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a kernel crash.

The vulnerability exists due to improper resource shutdown or release in handle_reply() in fs/ceph/mds_client.c when processing Ceph MDS replies and filling inode and dentry cache data. A remote attacker can send a specially crafted Ceph MDS reply to cause a kernel crash.

The issue occurs because Ceph-private data stored in current->journal_info may be dereferenced by another filesystem during reclaim.

176) Improper locking (CVE-ID: CVE-2026-80534)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock release in xfs_dq_get_next_id when handling an error from xfs_iread_extents. A local user can trigger the error condition during quota operations to cause a denial of service.

The issue can leave the quota inode locked, causing subsequent quota operations to hang.

177) Out-of-bounds write (CVE-ID: CVE-2026-80536)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in xlog_recover_do_reg_buffer() when processing a crafted XFS filesystem image during mount-time log recovery. A remote attacker can mount a specially crafted filesystem image to execute arbitrary code.

The issue is reachable during mount-time recovery on production kernels where the bounds check was enforced only by an ASSERT().

178) Integer overflow (CVE-ID: CVE-2026-80540)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an integer overflow in the amdgpu UVD decode message handler when processing crafted decode parameters. A local user can supply a crafted pitch value to trigger the overflow and execute arbitrary code.

The issue is in the Linux kernel DRM AMDGPU UVD decode path.

179) Improper input validation (CVE-ID: CVE-2026-80541)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in amdgpu_gem_create_ioctl() when processing GEM create requests with invalid domain combinations. A local user can submit a specially crafted domain combination to cause a denial of service.

The issue is triggered when CPU, GTT, or VRAM domains are combined with DOORBELL, GDS, GWS, or OA domains, causing amdgpu_bo_placement_from_domain() to exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON().

180) Race condition (CVE-ID: CVE-2026-80547)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to a race condition in the vfio_ccw crw handling logic when processing asynchronous hardware events and userspace reads of the crw region. A local user can trigger concurrent access to the crw list to disclose sensitive information, modify data, or cause a denial of service.

The issue affects the s390 vfio_ccw subsystem and involves the crw queue being accessed from asynchronous hardware-driven paths.

181) Race condition (CVE-ID: CVE-2026-80548)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges and compromise confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in the vfio_ccw I/O resource handling and channel program lifecycle management when processing concurrent I/O operations and state transitions. A local user can trigger concurrent operations to escalate privileges and compromise confidentiality, integrity, and availability.

The issue affects the s390 vfio_ccw driver.

182) Out-of-bounds read (CVE-ID: CVE-2026-80550)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ccwchain_calc_length() when processing chained channel command words in a channel program. A remote attacker can supply a crafted channel program to disclose sensitive information.

The issue occurs because the routine may examine a 257th CCW entry before rejecting an oversized chain.

183) Out-of-bounds write (CVE-ID: CVE-2026-80552)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify memory, or cause a denial of service.

The vulnerability exists due to an out-of-bounds access in vfio_ccw region read and write handlers when processing read or write requests for vfio_ccw regions with an out-of-range region index. A local user can supply a crafted region index to disclose sensitive information, modify memory, or cause a denial of service.

The issue affects vfio_ccw read and write region handling on s390.

184) Use-after-free (CVE-ID: CVE-2026-80553)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in the vfio_ccw device workqueue handling when closing or releasing a device with pending work items. A local user can trigger device close or release while queued work is still pending to execute arbitrary code.

185) Improper resource shutdown or release (CVE-ID: CVE-2026-80555)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the vfio_ccw channel program initialization logic when processing channel programs containing Transfer in Channel segments. A remote attacker can trigger cp_init() failure during ccwchain construction to cause a denial of service.

The issue occurs because cleanup does not release all allocated CCW segments if initialization fails before the channel program is marked initialized.

186) Out-of-bounds read (CVE-ID: CVE-2026-80557)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, execute arbitrary code, or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in decode_watchers() when processing a crafted obj_list_watch_response_t reply with struct_len set to 0. A remote attacker can send a specially crafted OSD response to disclose sensitive information, execute arbitrary code, or cause a denial of service.

Exploitation requires a malicious or compromised OSD and can be triggered when a kernel client invokes CEPH_OSD_OP_LIST_WATCHERS.

187) Out-of-bounds read (CVE-ID: CVE-2026-80558)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, corrupt memory, or cause a denial of service.

The vulnerability exists due to out-of-bounds read in ceph_pg_to_up_acting_osds() and calc_target() when processing a corrupted osdmap containing an invalid primary_temp OSD index. A remote attacker can send a crafted osdmap with a nonexistent OSD index to trigger out-of-bounds array access to disclose sensitive information, corrupt memory, or cause a denial of service.

The issue occurs because the primary_temp OSD index was not properly validated before being used as the target OSD for a request.

188) Race condition (CVE-ID: CVE-2026-80559)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a system crash.

The vulnerability exists due to a race condition in the sur40 input device initialization and polling path when opening the input device before the V4L2 video device and vb2_queue are fully initialized. A local user can open the device to trigger the polling worker thread and cause a system crash.

The issue is triggered during device initialization ordering in sur40_probe().

189) Improper privilege management (CVE-ID: CVE-2026-80560)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper access control in restore_sigcontext() in the openrisc signal handling code when returning from a signal handler through a crafted sigframe. A local user can craft a sigframe that modifies privileged SR bits to escalate privileges.

By clearing SPR_SR_DME, data accesses can occur without MMU translation or protection, enabling read and write access to arbitrary physical memory.

190) Out-of-bounds read (CVE-ID: CVE-2026-80561)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to out-of-bounds read in decode_locker() in net/ceph/cls_lock_client.c when decoding locker data from an OSD response. A remote attacker can send a specially crafted OSD response to disclose sensitive information and cause a denial of service.

Exploitation requires a malicious or compromised OSD to interact with a kernel client issuing the lock.get_info class method, such as during RBD exclusive lock acquisition.

191) Improper locking (CVE-ID: CVE-2026-80562)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock type selection in the gpio-ml-ioh driver irq callbacks when invoking irq_set_type, irq_enable, or irq_disable while the IRQ descriptor lock is held in a non-sleepable context. A local user can trigger these callbacks to cause a denial of service.

The issue is specific to PREEMPT_RT kernels.

192) Improper resource shutdown or release (CVE-ID: CVE-2026-80565)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper resource shutdown or release in the qce algorithm registration logic in drivers/crypto/qce/core.c when handling a failure during algorithm registration. A local user can trigger a registration failure to execute arbitrary code.

193) Unchecked Return Value (CVE-ID: CVE-2026-80567)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper handling of worker errors in rmi_f54_buffer_queue() in the synaptics-rmi4 F54 driver when processing queued V4L2 buffers. A local user can trigger a worker failure to disclose sensitive information.

Stale or uninitialized memory may be delivered to userspace if report acquisition fails.

194) Heap-based buffer overflow (CVE-ID: CVE-2026-80568)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the synaptics-rmi4 F54 V4L2 input handling when changing the diagnostic report input while streaming. A local user can switch the input mid-stream to trigger a larger report size than the allocated buffers and execute arbitrary code.

The issue occurs because V4L2 buffers are allocated based on the report size at stream start.

195) Out-of-bounds write (CVE-ID: CVE-2026-80569)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the synaptics-rmi4 F54 diagnostics report handling in rmi_f54_work() when processing a malicious or malfunctioning RMI4 device report with larger F55 electrode counts than F54 counts. A local user can provide a specially crafted device that reports inconsistent electrode counts to execute arbitrary code.

The issue can also cause an out-of-bounds read during the subsequent V4L2 dequeue memcpy().

196) Heap-based buffer overflow (CVE-ID: CVE-2026-80570)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in rmi_f54_buffer_queue() when handling a failed report operation after the V4L2 format has been changed to a smaller size. A local user can trigger an error path that leaves a stale larger report size and cause it to be copied into a smaller buffer to execute arbitrary code or cause a denial of service.

The issue is caused by failure to clear f54->report_size on certain error paths in rmi_f54_work().

197) Out-of-bounds read (CVE-ID: CVE-2026-80573)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the iforce input packet processing logic when parsing crafted USB input packets. A local attacker can send crafted short packets to trigger out-of-bounds reads and cause a denial of service.

Exploitation requires delivery of malformed data through a connected USB device.

198) Out-of-bounds write (CVE-ID: CVE-2026-80574)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in focaltech_process_rel_packet when processing crafted input packets. A remote attacker can trigger a finger index underflow to write before the bounds-checked array and to execute arbitrary code.

The issue occurs because subtracting 1 from a packet finger index of 0 can produce an invalid array index that targets state->fingers[-1].

199) Out-of-bounds write (CVE-ID: CVE-2026-80583)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify memory, or cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the tx_macro_dec_mode_get() and tx_macro_dec_mode_put() kcontrol handlers in sound/soc/codecs/lpass-tx-macro.c when accessing enumerated control values. A local user can access a crafted enumerated control value through the "DEC0 MODE" to "DEC7 MODE" controls to disclose sensitive information, modify memory, or cause a denial of service.

On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the issue is detected as an access overflow and reads of these controls fail with -EINVAL.

200) Out-of-bounds write (CVE-ID: CVE-2026-80584)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the qeth SNMP and ARP query ioctl handlers when processing user-supplied buffer lengths. A remote attacker can supply a crafted length value that causes an integer underflow in a bounds check and trigger a memcpy() past the allocated buffer to execute arbitrary code.

The issue occurs because a user-supplied length smaller than the fixed offset can wrap a u32 subtraction, and a zero-length allocation can also result in an invalid zero-sized buffer.

201) Missing initialization of resource (CVE-ID: CVE-2026-80586)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, corrupt data, or cause a denial of service.

The vulnerability exists due to improper state reset in MPTCP DSS option parsing in net/mptcp/options.c when processing malformed DSS options with an unexpected size. A remote attacker can send crafted MPTCP packets to disclose sensitive information, corrupt data, or cause a denial of service.

The issue can occur when a malformed DSS option is followed by another DSS option or MPC plus data, causing inconsistent state or access to uninitialized data.

202) Improper input validation (CVE-ID: CVE-2026-80587)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in the MPTCP option parser when processing incoming MPTCP suboptions. A remote attacker can send specially crafted packets with inconsistent suboption combinations to execute arbitrary code.

The issue affects handling of mutually exclusive or unexpected combinations of MPTCP suboptions.

203) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-80590)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of gso metadata in inet fragment reassembly when processing crafted IP fragments with attached GSO state. A local user can write specially crafted packets to a tap device to cause a denial of service.

The issue can be triggered by an unprivileged user in its own user namespace, and it may also be reachable in environments where virtio_net_hdr metadata is forwarded to a tap device or where CAP_NET_RAW is available in a network namespace.

204) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exceptional condition handling in register_pid() in tools/perf/builtin-sched.c when reallocating sched->tasks while processing untrusted perf.data. A local user can supply crafted input that triggers realloc failure to cause a denial of service.

Direct reassignment of the realloc result can leak the original pointer and leave task state corrupted because the task count is updated before successful reallocation.

205) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper exceptional condition handling in register_pid() in tools/perf/builtin-sched.c when processing untrusted perf.data that triggers allocation failure. A local user can supply crafted input that causes an allocation failure to cause a denial of service.

The issue is triggered because allocation failures are handled with a BUG_ON condition that terminates the process.

206) Heap-based buffer overflow (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in register_pid() in tools/perf/builtin-sched.c when processing an untrusted comm string from perf.data. A local user can supply a crafted perf.data file containing an oversized comm value to cause a denial of service.

The overflow occurs because the comm value is copied into a fixed 20-byte COMM_LEN buffer without a length check.

207) Integer overflow (CVE-ID: CVE-2026-80671)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in register_pid() in tools/perf/builtin-sched.c when processing untrusted perf.data. A local user can supply a crafted perf.data file with a large pid value to cause a denial of service.

The integer overflow can occur on 32-bit systems and may lead to out-of-bounds writes during task array initialization.

208) Race condition (CVE-ID: CVE-2026-80678)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in i2c_imx_reg_slave() and i2c_imx_isr() when registering an i2c slave device and handling shared interrupts. A local user can trigger concurrent slave registration and interrupt handling to cause a denial of service.

The issue can result in subsequent registration attempts failing with -EBUSY or in a NULL pointer dereference in the interrupt handler.

209) NULL pointer dereference (CVE-ID: CVE-2026-80689)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mmiotrace logging functions __trace_mmiotrace_rw() and __trace_mmiotrace_map() when handling mmiotrace events while mmio_trace_array is NULL. A local user can trigger the affected tracing functionality to cause a denial of service.

This can occur before initialization or after the tracing facility has been disabled.

210) Improper locking (CVE-ID: CVE-2026-80715)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in igc_down() when tearing down an AF_XDP zero-copy application abruptly. A local user can abruptly terminate an AF_XDP zero-copy application to cause a denial of service.

The issue occurs because NAPI keeps polling and the network interface may never go down.

211) Use-after-free (CVE-ID: CVE-2026-80737)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in the AMBA PL011 serial driver's DMA shutdown handling when DMA activity is being terminated. A local user can trigger DMA shutdown while TX callbacks or RX polling remain active to cause memory corruption.

212) Improper input validation (CVE-ID: CVE-2026-80742)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper input validation in tpacket_fill_skb() in the AF_PACKET subsystem when sending zero-byte packets through a TPACKET ring buffer. A local user can send a zero-byte packet through the TPACKET ring buffer to trigger a kernel warning.

The issue occurs on devices with no hard header.

213) NULL pointer dereference (CVE-ID: CVE-2026-80743)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization of IRQ handler data in the Xilinx formatter PCM IRQ handlers when an interrupt occurs after IRQ registration and before driver data is set. A local user can trigger an interrupt during device probing to cause a denial of service.

214) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80744)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel warning.

The vulnerability exists due to improper handling of expected memory allocation failures in nft_flow_rule_offload_abort() in nf_tables_offload when processing a netfilter transaction rollback. A local user can process a netfilter transaction that encounters an -ENOMEM error to cause a kernel warning.

Exploitation requires memory pressure or fault injection to cause the memory allocation failure.

215) NULL pointer dereference (CVE-ID: CVE-2026-80752)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the psxpad_spi_suspend() function of the psxpad-spi driver when the system suspends. A local user can trigger a system suspend to cause a denial of service.

216) Out-of-bounds write (CVE-ID: CVE-2026-80754)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect transmitter electrode count assignment in the Synaptics RMI4 F55 driver when F55 sensor detection handles a device with more receiver than transmitter electrodes. A local user can trigger F55 sensor detection to cause a denial of service.

The incorrect transmitter count is propagated to F54 for diagnostic report size calculations.

217) NULL pointer dereference (CVE-ID: CVE-2026-80756)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in selinux_policy_cancel() when writing a policy during an initial SELinux policy load that fails while building the selinuxfs tree. A local user can write policy data to /sys/fs/selinux/load to cause a denial of service.

218) Out-of-bounds write (CVE-ID: CVE-2026-80757)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause memory corruption.

The vulnerability exists due to an out-of-bounds heap write in the SELinux security_get_permissions() function when loading a crafted SELinux policy. A local privileged user can load a policy containing a class whose permission count is lower than that of its inherited common to cause memory corruption.

219) Out-of-bounds read (CVE-ID: CVE-2026-80765)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in mousevsc_on_receive_device_info() in the Hyper-V HID driver when processing SYNTH_HID_INITIAL_DEVICE_INFO messages. A local privileged user can send a short initial device-info message with an oversized HID report descriptor length to cause a denial of service.

Exploitation requires control of the Hyper-V host or backend.

220) Use-after-free (CVE-ID: CVE-2026-80766)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a use-after-free condition.

The vulnerability exists due to a race condition in the uclogic HID driver's in-range timer teardown when processing pen reports during device removal. An attacker with physical access can send pen reports during device removal to trigger a use-after-free condition.

The freed memory is dereferenced in timer-softirq context.

221) Use-after-free (CVE-ID: CVE-2026-80767)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the HID sensor custom driver's enable_sensor sysfs attribute handling when writing to the enable_sensor sysfs attribute while the driver is being initialized or removed. A local user can write to the enable_sensor sysfs attribute during this condition to cause a denial of service.

222) Use-after-free (CVE-ID: CVE-2026-80768)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to a race condition causing a stack-use-after-return write in the FT260 HID driver's I2C read handling when a device response arrives after an I2C read times out. An attacker with physical access can provide a delayed device response containing an attacker-influenced payload to cause memory corruption.

223) Out-of-bounds read (CVE-ID: CVE-2026-80781)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read memory beyond the bounds of a HID usage array.

The vulnerability exists due to an out-of-bounds read in hid_set_field() when processing an offset for a HID field. An attacker with physical access can attach a HID device that registers a field with fewer usages than the offsets used by picolcd_fb_send_tile() to read memory beyond the bounds of a HID usage array.

The out-of-bounds dereference occurs when CONFIG_DEBUG_FS is enabled during framebuffer deferred-io work.

224) Use-after-free (CVE-ID: CVE-2026-80782)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to use-after-free in the HID magicmouse driver when processing input reports after HID input-device connection failure. An attacker with physical access can cause a subsequent input report to be processed to cause a denial of service.

The affected execution paths are for USB Magic Mouse 2 and Magic Trackpad 2 devices, where hidraw and hiddev remain claimed.

225) Stack-based buffer overflow (CVE-ID: CVE-2026-80783)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service or memory corruption.

The vulnerability exists due to a stack-based buffer overflow in magicmouse_raw_event() when processing a crafted HID report containing nested DOUBLE_REPORT_ID packets. An attacker with physical access can send a crafted HID report to cause a denial of service or memory corruption.

226) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-80788)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in nvmet_tcp_map_data() when processing a command containing an oversized SGL. A remote attacker can send a command with an oversized SGL to cause a denial of service.

Systems configured to panic on kernel warnings can panic when the allocation triggers a page-allocator warning.

227) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-80789)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource allocation in nvmet_tcp_map_data() when processing write commands containing non-inline transport SGL data-block descriptors. A remote attacker can submit a crafted NVMe/TCP command with an oversized SGL length to cause a denial of service.

For write commands, the target waits for host data after issuing an R2T response.

228) Release of invalid pointer or reference (CVE-ID: CVE-2026-80790)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an invalid memory free.

The vulnerability exists due to improper pointer handling in nvmet_fc_alloc_ls_iodlist() when handling request-buffer allocation or response-buffer DMA mapping failures while initializing the LS IOD array. A local user can create a target port under these failure conditions to trigger an invalid memory free.

229) Use-after-free (CVE-ID: CVE-2026-80792)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or cause a denial of service.

The vulnerability exists due to a use-after-free in ip6_finish_output2() when lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE after reallocating the skb head. A local user can trigger IPv6 packet output through an affected lwtunnel transmission path to disclose sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or cause a denial of service.

230) Infinite loop (CVE-ID: CVE-2026-80793)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of the effective MTU in ip_do_fragment() when fragmenting IPv4 packets with an effective MTU smaller than the IPv4 header length plus 8 bytes. A remote attacker can send a packet requiring fragmentation over an affected route or device to cause a denial of service.

The issue can occur while forwarding packets to a device with an MTU of 20 bytes.

231) Use of Uninitialized Variable (CVE-ID: CVE-2026-80794)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized stack memory in the RF discover and RF interface activated notification handlers when processing notifications with zero-length RF technology-specific parameters. A remote attacker can cause the kernel to process a notification reporting zero-length RF technology-specific parameters to disclose sensitive information.

The copied target data is exposed to user space through NFC_CMD_GET_TARGET.

232) Out-of-bounds write (CVE-ID: CVE-2026-80795)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a slab out-of-bounds write.

The vulnerability exists due to a missing bounds check in nci_target_auto_activated() when processing RF_INTF_ACTIVATED_NTF notifications after repeated discovery cycles. A local user can trigger repeated NFC discovery cycles with auto-activated targets to cause a slab out-of-bounds write.

The target list remains populated when RF_DISCOVER_RSP re-enters NCI_DISCOVERY.

233) Out-of-bounds read (CVE-ID: CVE-2026-80796)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read kernel memory beyond activation parameter data.

The vulnerability exists due to improper bounds checking in the NCI activation parameter extractors when processing a crafted NCI RF_INTF_ACTIVATED_NTF notification. A remote attacker can send a crafted NCI notification with an inconsistent inner length byte to read kernel memory beyond activation parameter data.

234) Memory leak (CVE-ID: CVE-2026-80797)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to leak memory.

The vulnerability exists due to improper cleanup of queued fragment skbs in pn53x_common_clean() when a device is removed while transmit fragments are queued. An attacker with physical access can remove a device while transmit fragments are queued to leak memory.

235) Out-of-bounds read (CVE-ID: CVE-2026-80798)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read memory out of bounds.

The vulnerability exists due to insufficient length validation in the LLCP receive path when processing an LLCP PDU shorter than the LLCP header. A remote attacker can send a crafted undersized LLCP PDU to read memory out of bounds.

LLCP link activation occurs automatically after NFC-DEP.

236) Out-of-bounds read (CVE-ID: CVE-2026-80799)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory or cause a denial of service.

The vulnerability exists due to improper bounds checking and integer wraparound in the nfc_llcp_parse_gb_tlv() and nfc_llcp_parse_connection_tlv() functions when processing remote LLCP general bytes. A remote attacker can send malformed TLV data to trigger out-of-bounds reads or infinite parsing loops.

237) Out-of-bounds read (CVE-ID: CVE-2026-80800)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in nfc_llcp_connect_sn() when processing received CONNECT and CC PDUs. A remote attacker can send a malformed NFC LLCP PDU to read out-of-bounds memory.

LLCP link activation occurs automatically after NFC-DEP.

238) Out-of-bounds read (CVE-ID: CVE-2026-80801)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in microread_target_discovered() when processing malformed NFC target discovery payloads. A remote attacker can send a malformed target discovery payload to read out-of-bounds memory.

239) Memory leak (CVE-ID: CVE-2026-80802)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper memory management in fdp_nci_i2c_read() when processing multiple data packets in one call. An attacker with physical access can send two data packets in one call to cause a denial of service.

240) Out-of-bounds read (CVE-ID: CVE-2026-80802)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper validation of a device-reported length in fdp_nci_i2c_read() when processing a packet with a declared length below the minimum frame size. An attacker with physical access can provide a packet with a declared length below the minimum frame size to cause a denial of service.

241) Stack-based buffer overflow (CVE-ID: CVE-2026-80802)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper validation of a device-reported length in fdp_nci_i2c_read() when processing a packet with an oversized declared length. An attacker with physical access can provide a packet with an oversized declared length to cause a denial of service.

242) Stack-based buffer overflow (CVE-ID: CVE-2026-80803)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt stack memory.

The vulnerability exists due to improper length validation in the digital_in_recv_sensf_res() function when processing an NFC-F device response. A remote attacker can send an oversized SENSF_RES response to corrupt stack memory.

243) Out-of-bounds read (CVE-ID: CVE-2026-80805)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in xfs_attr3_leaf_verify_entry() when validating crafted XFS attribute entries. A local user can provide a crafted name index to read out-of-bounds memory.

244) Missing Encryption of Sensitive Data (CVE-ID: CVE-2026-80806)

CWE-ID: CWE-311 - Missing Encryption of Sensitive Data

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause sensitive data to be stored without encryption.

The vulnerability exists due to incorrect initialization order of encryption flags in the ext4 __ext4_new_inode() function when creating a new encrypted regular file on an ext4 filesystem mounted with dax=always. A local user can create a new encrypted regular file and write data to it to cause sensitive data to be stored without encryption.

245) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-80807)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause list corruption.

The vulnerability exists due to improper range validation in the nilfs2 GC ioctl when processing crafted virtual block descriptors. A local user can submit a crafted GC ioctl request to cause list corruption.

The crafted descriptor can specify an invalid virtual block number or offset that results in a page index of ULONG_MAX.

246) Infinite loop (CVE-ID: CVE-2026-80808)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite retry loop in ext4_xattr_block_set() when reusing a saturated extended attribute cache entry on a corrupted filesystem. A local user can trigger repeated selection of the unusable cache entry to cause a denial of service.

Concurrent rmdir callers can remain blocked while the spinning task holds the parent directory's i_rwsem.

247) Reachable assertion (CVE-ID: CVE-2026-80809)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing metadata reservation in the OCFS2 extended attribute allocation code when setting a large extended attribute value on a fragmented filesystem for a file that already has an external extended attribute block. A local user can set a large extended attribute value to cause a denial of service.

248) Out-of-bounds read (CVE-ID: CVE-2026-80812)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to improper validation in snd_dummy_probe() of the ALSA dummy driver when a platform device is manually bound through the sysfs interface with an invalid card index. A local user can bind a platform device with a card index of -1 to cause an out-of-bounds read.

249) Out-of-bounds read (CVE-ID: CVE-2026-80814)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read out-of-bounds data.

The vulnerability exists due to an integer overflow in the rndis_rx_fixup() function when processing a crafted RNDIS message received over USB. An attacker with physical access can supply a crafted RNDIS message with overflowing data offset and length values to read out-of-bounds data.

250) NULL pointer dereference (CVE-ID: CVE-2026-80819)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper synchronization in the RFCOMM deferred setup acceptance path when processing a recvmsg call after a remote DISC frame is received for a deferred data link connection. A remote attacker can send a DISC frame to a deferred RFCOMM data link connection to cause a denial of service.

251) Out-of-bounds read (CVE-ID: CVE-2026-80823)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose kernel memory or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the st21nfca_tm_recv_atr_req() and st21nfca_tm_send_atr_res() ATR_REQ handling path when handling ATR_REQ frames whose declared length exceeds the received frame length. A remote attacker can send a short ATR_REQ frame with an oversized declared length to disclose kernel memory or cause a denial of service.

Exploitation requires an RF peer.

252) Use-after-free (CVE-ID: CVE-2026-80824)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in usbdev_release() in usbfs when draining completed asynchronous URBs after a USB device is disconnected. A local user can mmap a usbfs device node and submit an asynchronous URB using a mapped buffer before unmapping and closing the associated file descriptor to cause a denial of service.

253) Use-after-free (CVE-ID: CVE-2026-80826)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to use-after-free in c67x00_add_iso_urb() when processing an isochronous URB whose final packet encounters TD creation failure. A local user can submit such an isochronous URB to cause a use-after-free condition.

254) Out-of-bounds read (CVE-ID: CVE-2026-80827)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read memory out of bounds.

The vulnerability exists due to improper length validation in the option_instat_callback interrupt URB callback when processing a short interrupt IN packet from a USB device. An attacker with physical access can provide a USB device that sends a crafted short interrupt IN packet to read memory out of bounds.

255) Improper handling of exceptional conditions (CVE-ID: CVE-2026-80828)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper handling of exceptional conditions in the ALSA USB-audio usb_audio_resume() function when processing system-resume failures. An attacker with physical access can trigger a system resume while a USB audio component resume operation fails to cause a denial of service.

The condition applies to system-resume errors; runtime-resume errors follow a distinct error path.

256) Out-of-bounds write (CVE-ID: CVE-2026-80829)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in snd_usbmidi_novation_output() when handling USB MIDI output from a device with an undersized bulk OUT endpoint. An attacker with physical access can connect a malicious USB device that advertises a one-byte bulk OUT endpoint to cause memory corruption.

257) Use-after-free (CVE-ID: CVE-2026-80830)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a race condition in usb_wakeup_notification() when an xHCI IRQ invocation occurs concurrently with hub_disconnect(). A local user can trigger concurrent wakeup notification and device disconnection activity to trigger a use-after-free condition.

258) Incorrect calculation (CVE-ID: CVE-2026-80831)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause encryption and decryption operations to process an incorrect number of bytes.

The vulnerability exists due to improper use of an unmapped DMA scatterlist length in mxs_dcp_aes_block_crypt() when processing source scatterlists. A local user can trigger processing of affected source scatterlists to cause encryption and decryption operations to process an incorrect number of bytes.

The issue occurs when CONFIG_NEED_SG_DMA_LENGTH is enabled.

259) Out-of-bounds read (CVE-ID: CVE-2026-80832)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect CCM authentication tags.

The vulnerability exists due to buffer underallocation in qce_aead_ccm_prepare_buf_assoclen() when preparing CCM associated data. A local user can submit a CCM request with associated data to cause incorrect CCM authentication tags.

260) Out-of-bounds read (CVE-ID: CVE-2026-80833)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the sun8i-ss PRNG generate function when updating the PRNG seed after generating random data. A local user can invoke the PRNG generate function to read out-of-bounds memory.

The issue is limited to systems with sun8i-ss PRNG support enabled.

261) Use-after-free (CVE-ID: CVE-2026-80833)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to failure to stop a DMA operation after an interrupted wait in the sun8i-ss PRNG generate function when a PRNG generation operation is interrupted by a signal. A local user can interrupt a pending PRNG generation operation by sending a signal to cause a use-after-free.

The issue is limited to systems with sun8i-ss PRNG support enabled.

262) Use-after-free (CVE-ID: CVE-2026-80834)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the sun8i-ce crypto_rng interface generate function when an in-progress DMA operation is interrupted by a signal. A local user can interrupt an in-progress PRNG generation operation with a signal to trigger a use-after-free condition.

263) Out-of-bounds write (CVE-ID: CVE-2026-80840)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds write.

The vulnerability exists due to improper initialization of the IPv4 control block in the IPv6 Segment Routing decapsulation path when processing a specially crafted IPv6 packet containing an encapsulated IPv4 TCP SYN packet. A remote attacker can send a specially crafted packet with controlled IPv6 extension-header and IPv4 option data to cause an out-of-bounds write.

264) Use-after-free (CVE-ID: CVE-2026-80842)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to use-after-free in the Linux bridge multicast handling for master VLANs when processing IGMP traffic during master VLAN teardown. A remote attacker can send IGMP traffic to the bridge device while a master VLAN is being removed to cause memory corruption.

265) Memory leak (CVE-ID: CVE-2026-80843)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in xfrm_state_construct() when constructing an XFRM state with a truncated authentication algorithm. A local user can trigger XFRM state construction using a truncated authentication algorithm to cause a denial of service.

The issue occurs when the selected authentication algorithm has no sadb_alg_id, such as cmac(aes).

266) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-80844)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of routing header segments_left values in ipv6_rearrange_rthdr() when processing raw IPv6 HDRINCL packets with a segments_left value larger than the number of addresses described by hdrlen. A local user can send a crafted packet with an oversized segments_left value to cause an out-of-bounds memory access.

267) NULL pointer dereference (CVE-ID: CVE-2026-80846)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the handle_esp function when processing queued ESP-in-TCP data after its ingress device has been removed. A remote attacker can send ESP-in-TCP records to cause a denial of service.

The condition can occur during veth or network namespace teardown.

268) Use-after-free (CVE-ID: CVE-2026-80848)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the espintcp_close routine when closing espintcp sockets while queued reinjection work is running. A local user can race socket closure against queued reinjection work to trigger a use-after-free condition.

269) Use-after-free (CVE-ID: CVE-2026-80854)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the USB gadget f_tcm session teardown path when concurrently unlinking the last LUN and removing a nexus. A local user can overlap last-LUN removal with nexus removal to cause a denial of service.

270) Improper locking (CVE-ID: CVE-2026-80855)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in fuse_open() in fs/fuse/file.c when fuse_dax_break_layouts() fails after a signal interrupts the wait for busy DAX pages to drain during an O_TRUNC open of a DAX-enabled file. A local user can trigger the affected open operation to cause a denial of service.

The stale lock can stall later faults or truncates on the same file.

271) Improper locking (CVE-ID: CVE-2026-80856)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock release in fuse_do_setattr() when processing a DAX truncate operation that requires a writeback flush. A local user can initiate such a setattr operation when the writeback flush fails to cause a denial of service.

272) Out-of-bounds write (CVE-ID: CVE-2026-80863)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in free_rd_atomic_resources() in the RXE RDMA driver when modifying a queue pair's max_dest_rd_atomic setting. A local user can modify a queue pair's max_dest_rd_atomic setting to cause a denial of service.

273) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-80888)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource release in ttm_prime_fd_to_handle() in the vmwgfx DRM driver when importing a non-vmwgfx PRIME file descriptor through the DRM_VMW_GB_SURFACE_REF or DRM_VMW_GB_SURFACE_REF_EXT path. A local user can pass a non-vmwgfx PRIME file descriptor to cause a denial of service.

274) Race condition (CVE-ID: CVE-2026-80889)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the CAN ISO-TP socket transmission state handling when concurrently sending data and releasing an ISO-TP socket. A local user can trigger conflicting transmission-state transitions to cause a denial of service.

275) Incorrect behavior order (CVE-ID: CVE-2026-80906)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect transport header handling.

The vulnerability exists due to incorrect behavior order in packet_parse_headers() when processing a VLAN-tagged frame. A remote attacker can send a VLAN-tagged frame to cause incorrect transport header handling.

276) Integer overflow (CVE-ID: CVE-2026-80908)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an integer overflow in DPB size calculations.

The vulnerability exists due to integer overflow in the amdgpu UVD message decoder when processing a UVD message with dimensions exceeding 4096. A local user can submit a UVD message with oversized dimensions to trigger an integer overflow in DPB size calculations.

277) Integer overflow (CVE-ID: CVE-2026-80909)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an integer overflow during minimum DPB size calculation.

The vulnerability exists due to improper validation of the H.265 reference count in the AMDGPU UVD message decoder when decoding UVD messages. A local user can submit a UVD message with an invalid number of H.265 references to cause an integer overflow during minimum DPB size calculation.

278) Type Confusion (CVE-ID: CVE-2026-80910)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access of an enumerated control value through an integer union member in the lpass-wsa-macro codec driver when reading affected enumerated controls. A local user can read an affected control to cause a denial of service.

The issue occurs on 64-bit kernels with CONFIG_SND_CTL_DEBUG enabled.

279) NULL pointer dereference (CVE-ID: CVE-2026-80912)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in security_get_classes() when processing an SELinux policy with an unclaimed class value. A local user can provide a policy with sparse class values to cause a denial of service.

280) NULL pointer dereference (CVE-ID: CVE-2026-80913)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the SELinux boolean value mapping array when processing a policy image that declares undefined boolean values. A local privileged user can load a crafted SELinux policy to cause a denial of service.

281) Memory corruption (CVE-ID: CVE-2026-80916)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of allocation failure in KCOV initialization and remote-start handling when remote KCOV collection is initiated after initialization buffer allocation fails. A local user can invoke remote KCOV collection from a non-task context to cause a denial of service.

Out-of-bounds access requires the configured remote coverage size to be smaller than CONFIG_KCOV_IRQ_AREA_SIZE.

282) Race condition (CVE-ID: CVE-2026-80916)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data corruption.

The vulnerability exists due to a race condition in the KCOV remote coverage state handling when nested softirq preemption occurs during remote KCOV collection. A local user can trigger nested softirq preemption during remote KCOV collection to cause data corruption.

The issue affects PREEMPT_RT kernels.

283) NULL pointer dereference (CVE-ID: CVE-2026-80917)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the generic PCI host CAM operations when enumerating PCI buses on 32-bit CAM systems. A local user can trigger PCI configuration-space access during bus enumeration to cause a denial of service.

Only 32-bit hosts using the "pci-host-cam-generic" compatible are affected.

284) Type Confusion (CVE-ID: CVE-2026-80918)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose kernel pointer information.

The vulnerability exists due to type confusion in item_udata() and item_sdata() in the HID core when processing long-format HID descriptor items. An attacker with physical access can connect a HID device containing a crafted long-format report size item to disclose kernel pointer information.

The issue affects hid_scan_report(); hid_parse_collections() stops processing when it encounters a long item.

285) Improper access control (CVE-ID: CVE-2026-80921)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access a device that is no longer available.

The vulnerability exists due to improper access control in KVM s390 VSIE APCB shadowing when shadowing crypto access bits from a format 0 APCB. A local user can use stale crypto access bits to access a device that is no longer available.

The issue affects nested guest environments.

286) Use-after-free (CVE-ID: CVE-2026-80923)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a use-after-free.

The vulnerability exists due to a dangling pointer in the xHCI debug tty driver when tty driver registration fails and the module is subsequently unloaded. A local privileged user can unload the module after a tty driver registration failure to trigger a use-after-free.

287) Use-after-free (CVE-ID: CVE-2026-80928)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free of struct cred.

The vulnerability exists due to a use-after-free in smack_file_send_sigiotask() when accessing the credentials of another task during signal delivery. A local user can trigger the affected credential access during a concurrent credential change to trigger a use-after-free of struct cred.

288) Improper handling of exceptional conditions (CVE-ID: CVE-2026-80930)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an IRQ enable/disable imbalance.

The vulnerability exists due to improper handling of exceptional conditions in the TPM I2C Nuvoton driver's i2c_nuvoton_wait_for_stat() function when waiting for a TPM status interrupt times out or is interrupted. A local user can cause a wait to time out or be interrupted to cause an IRQ enable/disable imbalance.

289) Out-of-bounds write (CVE-ID: CVE-2026-80931)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause an out-of-bounds write.

The vulnerability exists due to improper bounds checking in w1_f19_i2c_master_transfer() in the DS28E17 1-Wire-to-I2C bridge driver when handling an I2C_M_RECV_LEN read with an oversized device-controlled length. An attacker with physical access can supply an oversized length byte through a downstream I2C device to cause an out-of-bounds write.

290) Use-after-free (CVE-ID: CVE-2026-80932)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to improper workqueue synchronization in virtio_vsock_remove() when removing a virtio vsock device. A local user can trigger device removal while dependent work items are queued to cause a use-after-free condition.

The race involves tx_work, send_pkt_work, and rx_work.

291) Deadlock (CVE-ID: CVE-2026-80938)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in mt7615_suspend() when synchronously canceling mac_work while holding the mt76 mutex. A local user can initiate system suspend while mac_work is running to cause a denial of service.

292) Memory leak (CVE-ID: CVE-2026-80941)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to failure to free memory in rtw_txq_push_skb() when handling a failed HCI transmission. A local user can trigger the transmission path during an HCI write failure to cause a denial of service.

293) Expired pointer dereference (CVE-ID: CVE-2026-80944)

CWE-ID: CWE-825 - Expired pointer dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an expired pointer dereference in the mwifiex synchronous command response handler when a synchronous command wait is interrupted before a late firmware response is processed. A local user can interrupt a synchronous command wait to cause a denial of service.

The issue was observed during repeated association and disassociation cycles.

294) Memory leak (CVE-ID: CVE-2026-80949)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of memory in brcmf_sdio_read_control() when handling error paths during control-frame reads. A local user can trigger the affected error paths to cause a denial of service.

295) Out-of-bounds write (CVE-ID: CVE-2026-80951)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to write beyond the bounds of the IBI pool.

The vulnerability exists due to improper bounds checking in svc_i3c_master_handle_ibi() when processing in-band interrupt payloads from an I3C device. An attacker with physical access can send an IBI payload larger than the requested maximum payload length to write beyond the bounds of the IBI pool.

296) Use-after-free (CVE-ID: CVE-2026-80952)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel stack contents and cause a use-after-free.

The vulnerability exists due to improper device descriptor lifetime management in i3c_master_unregister_i3c_devs() when unregistering I3C devices. A local user can trigger device unregistration while a modalias is generated to disclose kernel stack contents and cause a use-after-free.

A racing modalias operation can observe a NULL device descriptor and use an uninitialized stack i3c_device_info structure.

297) NULL pointer dereference (CVE-ID: CVE-2026-80963)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the dm-stat_free cleanup function when freeing dm-stats data after per-cpu data allocation fails. A local user can trigger a failed per-cpu data allocation to cause a denial of service.

298) Out-of-bounds read (CVE-ID: CVE-2026-80964)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the ALSA virmidi driver probe function when manually binding a device through the sysfs interface with an invalid card index. A local user can manually bind a device with an invalid card index to perform an out-of-bounds read.

299) Improper Validation of Array Index (CVE-ID: CVE-2026-80965)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds access.

The vulnerability exists due to improper validation of a card index in the ALSA serial-u16550 driver's snd_serial_probe function when manually binding a device through the sysfs interface. A local user can bind a device with an invalid card index to cause an out-of-bounds access.

300) Improper Validation of Array Index (CVE-ID: CVE-2026-80966)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds access.

The vulnerability exists due to improper validation of an array index in the ALSA portman2x4 driver when binding the driver through sysfs with a negative card index. A local user can supply a negative card index to perform an out-of-bounds access.

301) Improper initialization (CVE-ID: CVE-2026-80967)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization of mutexes in the pcxhr_probe() function when handling an early interrupt during device probe. A local user can trigger an early interrupt during device probe to cause a denial of service.

302) Improper Validation of Array Index (CVE-ID: CVE-2026-80968)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds access.

The vulnerability exists due to improper validation of an array index in the ALSA mts64 driver's snd_mts64_probe function when binding a device through sysfs with a negative card index. A local user can provide a negative card index to cause an out-of-bounds access.

303) Improper Validation of Array Index (CVE-ID: CVE-2026-80969)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of an array index in the ALSA mpu401 driver probe routine when manually binding a device through the sysfs interface with an invalid card index. A local user can set an invalid card index to cause an out-of-bounds memory access.

304) Use-after-free (CVE-ID: CVE-2026-80971)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a use-after-free condition.

The vulnerability exists due to use-after-free in the ALSA bcd2000 driver's URB handling when a BCD2000 USB device is disconnected while a rawmidi substream remains open. An attacker with physical access can disconnect the device while the substream remains open to cause a use-after-free condition.

305) Improper Validation of Array Index (CVE-ID: CVE-2026-80972)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds memory access.

The vulnerability exists due to improper validation of a card index in the ALSA aloop driver's loopback_probe function when manually binding a device through the sysfs interface. A local user can provide an invalid card index to perform an out-of-bounds memory access.

306) Out-of-bounds read (CVE-ID: CVE-2026-80973)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose kernel memory.

The vulnerability exists due to an out-of-bounds read in usb6fire_comm_receiver_handler() when processing MIDI events from a connected USB device. An attacker with physical access can provide a MIDI event with an excessive length value to disclose kernel memory.

The receiver is submitted during device probing, and forwarding data through the rawmidi read path requires an open MIDI input substream.

307) Out-of-bounds read (CVE-ID: CVE-2026-80976)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to stale IPv6 control block state in the decap_and_validate() function of the seg6 local processing component when processing a decapsulated IPv6 packet through an End.DX6 or End.DT6 route. A local user can install a local SID and inject a crafted outer IPv6 packet to cause an out-of-bounds read.

The outer packet contains Hop-by-Hop and Destination Options headers followed by an SRH and a minimal inner IPv6 packet.

308) Use-after-free (CVE-ID: CVE-2026-80977)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to improper handling of shared zerocopy state in skb_tx_error() when processing cloned socket buffers. A remote attacker can trigger processing of cloned socket buffers to corrupt memory.

The issue can be reached when Open vSwitch processes a non-last OVS_ACTION_ATTR_RECIRC action, the clone encounters a flow miss, and a later local ESP delivery decrypts data in place.

309) Integer overflow (CVE-ID: CVE-2026-80978)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause skb header offsets to wrap.

The vulnerability exists due to an integer overflow in IP tunnel device headroom configuration when configuring a stack of user-created IP tunnel devices. A local user can create a stacked tunnel-device configuration with excessive headroom to cause skb header offsets to wrap.

The affected skb header offsets use a 16-bit representation.

310) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-80983)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in smc_switch_conns() when handling connection switches during SMC link failover. A local user can initiate a connection switch during link failover to cause a denial of service.

The target link must go down or the connection must be killed while the switch is in progress.

311) Memory leak (CVE-ID: CVE-2026-80987)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak memory.

The vulnerability exists due to improper error handling in the NTB transport transmit queue when submitting an oversized transmit buffer. A local user can submit an oversized transmit buffer to leak memory.

312) Memory leak (CVE-ID: CVE-2026-80988)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in ntb_transport_tx_enqueue() when transmitting packets while the QP link is down. A local user can submit packets during the link-down condition to cause a denial of service.

313) Use-after-free (CVE-ID: CVE-2026-80994)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Open vSwitch flow deletion handling code when processing flow deletion commands. A local user can issue a flow deletion command during a race window to cause a denial of service.

314) Integer underflow (CVE-ID: CVE-2026-81000)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write packet data outside allocated memory.

The vulnerability exists due to an integer underflow in TUN and TAP interface handling in tun_get_user() when processing an oversized headroom request propagated by an OVS port. A local user can configure an OVS port to propagate an oversized headroom request to a TUN or TAP device to write packet data outside allocated memory.

315) Use-after-free (CVE-ID: CVE-2026-81001)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sl_sync() in the SLIP driver when opening a SLIP line discipline concurrently with SLIP device teardown. A local user can trigger a race between SLIP device opening and teardown to cause a denial of service.

316) Out-of-bounds write (CVE-ID: CVE-2026-81002)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in xdp_convert_zc_to_xdp_frame() when processing an AF_XDP zero-copy packet redirected through cpumap. A local user can submit a crafted AF_XDP zero-copy packet to cause a denial of service.

317) Improper access control (CVE-ID: CVE-2026-81003)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to inject data into existing AF_IUCV sockets and cause a denial of service.

The vulnerability exists due to improper ingress device validation in afiucv_hs_rcv() socket selection when processing a raw ETH_P_AF_IUCV frame received on a network device. A local user can send a crafted raw ETH_P_AF_IUCV frame through its loopback device to inject data into existing AF_IUCV sockets and cause a denial of service.

Exploitation requires CAP_NET_RAW in an unprivileged user and network namespace.

318) NULL pointer dereference (CVE-ID: CVE-2026-81005)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown state management in the IPMI message handler failed-registration rollback path when asynchronous redo_bmc_reg work retries BMC device-ID probing after a failed registration. A local user can cause BMC device-ID retrieval to fail and trigger a NULL pointer dereference to cause a denial of service.

The issue occurs after the lower driver's shutdown callback has cleared the SI state machine data.

319) Use of Uninitialized Variable (CVE-ID: CVE-2026-81007)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized stack memory.

The vulnerability exists due to improper length validation in the ipmb_write() function when writing a zero or short IPMB message. A local user can write a zero or short IPMB message to disclose uninitialized stack memory.

320) Use-after-free (CVE-ID: CVE-2026-81008)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to use-after-free in icc_get() and of_icc_get_by_index() when handling a failed dynamic allocation of a path name. A local user can invoke subsequent interconnect path operations to cause memory corruption.

321) Out-of-bounds write (CVE-ID: CVE-2026-81017)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read from and write to memory out of bounds.

The vulnerability exists due to improper bounds checking in cros_ec_sensorhub_ring_handler() when processing EC-reported FIFO events. A local user can trigger processing of an EC FIFO event containing an out-of-range sensor number to read from and write to memory out of bounds.

322) Use-after-free (CVE-ID: CVE-2026-89440)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the via-sdmmc card-detect interrupt handler and carddet_work when handling a card-detect interrupt after mmc_add_host() fails. A local user can trigger card-detect interrupt handling against a freed host object to cause a denial of service.

323) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-89444)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in the dell-wmi-sysman set_attribute() function when setting BIOS attributes. A local user can cause a BIOS attribute request buffer containing a plaintext administrator password to be logged to disclose sensitive information.

324) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89456)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to receive zeroed data for unread portions of a request.

The vulnerability exists due to improper handling of partial-completion length in dasd_default_erp_postaction() when recovering a partially completed ESE read through the ERP chain. A local user can issue a read request that is partially completed and recovered through the ERP chain to receive zeroed data for unread portions of a request.

325) NULL pointer dereference (CVE-ID: CVE-2026-89457)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in s390 DASD sysfs discipline callbacks when reading world-readable sysfs attributes during device initialization. A local user can read a sysfs attribute before private device data is allocated to trigger a kernel panic and cause a denial of service.

326) Unchecked Return Value (CVE-ID: CVE-2026-89458)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an unchecked return value in dasd_int_handler when handling an NRF read of an unallocated ESE track. A local user can trigger a failed ESE read that is completed successfully to disclose sensitive information.

A failed sense-data parse or a current track outside the requested range can leave destination pages untouched.

327) Race condition (CVE-ID: CVE-2026-89461)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause the polling callback to continue accessing the fuel gauge after system suspend.

The vulnerability exists due to improper synchronization in the max17040 fuel-gauge driver's suspend handler when system suspend races with the polling callback. A remote attacker can cause system suspend to race with the polling callback to cause the polling callback to continue accessing the fuel gauge after system suspend.

The polling work requeues itself after each poll.

328) Use-after-free (CVE-ID: CVE-2026-89463)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to use-after-free in the ucs1002 health_poll delayed work when unbinding the ucs1002 driver while health polling work is queued. A local privileged user can cause the driver to be unbound while health polling work is queued to cause a denial of service.

The delayed work can reschedule itself while the chip reports a bad-health condition.

329) Use-after-free (CVE-ID: CVE-2026-89464)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to use-after-free in the twl4030_charger driver's bci work handlers when removing the device while a worker is pending. A local user can trigger device removal while a worker is pending to cause a use-after-free condition.

The USB transceiver notifier can reschedule work after device removal returns.

330) Use-after-free (CVE-ID: CVE-2026-89469)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to improper synchronization in lp8727_release_irq() when the IRQ handler queues delayed work during IRQ release. A local user can trigger a race between IRQ handling and IRQ release to cause a use-after-free condition.

331) Out-of-bounds write (CVE-ID: CVE-2026-89470)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the cros_usbpd-charger driver probe when processing a raw charger port count returned by the embedded controller. An attacker with physical access can cause the embedded controller to report an inaccurate port count to cause memory corruption.

The embedded controller can report a port count of up to 255.

332) Out-of-bounds write (CVE-ID: CVE-2026-89471)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in cros_usbpd_charger_probe() in the cros_usbpd-charger driver when processing EC-reported USB PD and charger port counts. A local privileged user can cause a compromised EC to report port counts exceeding the fixed ports[] array capacity to corrupt kernel memory.

The ports[] array contains eight entries.

333) Use-after-free (CVE-ID: CVE-2026-89474)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the bq256xx charger driver's usb_work handler when queued usb_work executes during device cleanup. A local user can trigger device cleanup while usb_work is queued to cause a denial of service.

334) Use-after-free (CVE-ID: CVE-2026-89475)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the bq24257 charger driver when device removal races with the STAT-pin interrupt handler. A local user can cause the interrupt handler to reschedule delayed work during device removal to cause a denial of service.

The issue applies when input-current-limit autosetting is enabled.

335) Integer underflow (CVE-ID: CVE-2026-89476)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an integer underflow.

The vulnerability exists due to improper tracking of outstanding stream reconfiguration request parameters in SCTP stream reconfiguration response handling when processing duplicate RECONF responses. A remote attacker can send duplicate RECONF responses to cause an integer underflow.

A cached RECONF chunk containing multiple request parameters must have another parameter still outstanding.

336) NULL pointer dereference (CVE-ID: CVE-2026-89477)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in SCTP stream reconfiguration request handling when processing specially crafted SCTP RECONF chunks. A remote attacker can send a specially crafted SCTP RECONF packet to cause a denial of service.

A RECONF chunk containing incoming SSN reset, outgoing SSN reset, and response parameters, or two RECONF chunks in one packet, can trigger the issue.

337) Use-after-free (CVE-ID: CVE-2026-89478)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to access freed memory.

The vulnerability exists due to a use-after-free in the SCTP input queue when processing a DATA chunk after an authenticated ASCONF DEL-IP removes its transport. A remote user can cause a delayed SACK to read the freed transport's state to access freed memory.

338) Use-after-free (CVE-ID: CVE-2026-89479)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access freed memory.

The vulnerability exists due to use-after-free in the SCTP endpoint receive loop when processing a specially crafted SCTP packet containing bundled chunks. A remote attacker can send an SCTP packet that deletes an association before subsequent chunks are processed to access freed memory.

Exploitation requires the packet to be processed from the socket backlog in task context.

339) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-89480)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper validation of the received data length in the NVMe/TCP host driver when processing a short C2HData PDU from an NVMe/TCP controller. A remote attacker can respond to a read request with fewer bytes than requested to disclose sensitive information.

340) Out-of-bounds write (CVE-ID: CVE-2026-89482)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of C2HData requests in the NVMe/TCP receive path when handling C2HData for a WRITE_ZEROES command with a residual iterator on the same tag. A remote attacker can send a C2HData request to trigger a wild memory write and cause a denial of service.

341) Use of uninitialized resource (CVE-ID: CVE-2026-89483)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the NVMe discard fallback page when processing discard commands. A local user can trigger a discard command that causes uninitialized DSM payload data to be sent to the controller to disclose sensitive information.

Exploitation requires the discard-range allocation to fail under memory pressure.

342) Use-after-free (CVE-ID: CVE-2026-89485)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the lockd nlm_traverse_files() file traversal routine when a concurrent nlm_release_file() frees the saved next file while nlm_file_mutex is dropped. A local user can trigger concurrent file release during file traversal to trigger a use-after-free condition.

343) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89487)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify page-cache data.

The vulnerability exists due to improper handling of zero-copy packet buffer flags in the Open vSwitch datapath when a failed USERSPACE upcall is followed by local ESP-in-UDP delivery. A local user can trigger a failed USERSPACE upcall followed by local ESP-in-UDP delivery to modify page-cache data.

Exploitation requires a MSG_ZEROCOPY packet carrying page-cache fragments.

344) Use-after-free (CVE-ID: CVE-2026-89488)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a slab use-after-free.

The vulnerability exists due to a race condition leading to use-after-free in the Open vSwitch conntrack limit state when tearing down a network namespace while packet processing accesses the state. A local user can tear down a network namespace while packet processing accesses CT limit state to trigger a slab use-after-free.

Exploitation requires a user and network namespace.

345) Untrusted Pointer Dereference (CVE-ID: CVE-2026-89489)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code in kernel context.

The vulnerability exists due to improper validation of user pointers in the sys_or1k_atomic syscall when processing syscall arguments. A local user can supply kernel addresses as syscall pointers to execute arbitrary code in kernel context.

346) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-89490)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering indefinite directory re-enumeration.

The vulnerability exists due to an incorrect integer conversion in ocfs2_dir_foreach_blk_el() when reading a non-inline directory that crosses the 4 GiB boundary on a 32-bit kernel. A local user can invoke readdir() on an affected directory to cause a denial of service by triggering indefinite directory re-enumeration.

64-bit kernels are unaffected.

347) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89491)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave heartbeat regions unprotected on subsequent mounts.

The vulnerability exists due to improper error handling in o2hb_region_inc_user() when heartbeat region pinning fails partway through processing. A local user can invoke heartbeat region user registration during a pinning failure to leave heartbeat regions unprotected on subsequent mounts.

Partially pinned regions are not released, and the dependent-user counter remains incremented.

348) Deadlock (CVE-ID: CVE-2026-89491)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a lock order inversion in o2hb_region_pin() when it is invoked from the configfs drop_item callback. A local user can trigger heartbeat-region removal processing to cause a denial of service.

349) Improper locking (CVE-ID: CVE-2026-89491)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in o2hb_region_pin() when calling o2nm_depend_item() while holding o2hb_live_lock. A local user can trigger heartbeat region pinning to cause a denial of service.

The issue manifests as a sleeping-in-atomic-context BUG under CONFIG_DEBUG_ATOMIC_SLEEP.

350) Out-of-bounds write (CVE-ID: CVE-2026-89493)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to perform out-of-bounds memory reads and writes.

The vulnerability exists due to improper validation of refcount record bounds in ocfs2_validate_refcount_block() when processing crafted refcount blocks during reflink operations. A local privileged user can mount a crafted or corrupted ocfs2 image and issue a reflink operation to perform out-of-bounds memory reads and writes.

A raw write to the block device backing an already-mounted ocfs2 filesystem can also introduce a malicious refcount block.

351) Out-of-bounds write (CVE-ID: CVE-2026-89494)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause memory corruption.

The vulnerability exists due to a heap out-of-bounds write in dlm_init_lockres() when processing a DLM_MIG_LOCKRES message with an oversized lock name length. A remote user can send a specially crafted DLM_MIG_LOCKRES message to cause memory corruption.

The sending node must belong to the DLM domain.

352) Out-of-bounds read (CVE-ID: CVE-2026-89494)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dlm_process_recovery_data() when processing a DLM_MIG_LOCKRES message whose claimed number of locks exceeds the message payload. A remote user can send a specially crafted DLM_MIG_LOCKRES message to cause a denial of service.

The sending node must belong to the DLM domain.

353) Out-of-bounds read (CVE-ID: CVE-2026-89495)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in dlm_process_recovery_data when processing recovery data whose lock count exceeds the message payload. A remote user can send a malformed recovery message with an invalid number of lock entries to cause a denial of service.

354) Heap-based buffer overflow (CVE-ID: CVE-2026-89495)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to corrupt memory or cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in dlm_mig_lockres_handler when processing recovery data with an oversized lock name. A remote user can send a malformed recovery message with an oversized lock name length to corrupt memory or cause a denial of service.

355) Heap-based buffer overflow (CVE-ID: CVE-2026-89495)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to corrupt memory or cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in dlm_migrate_request_handler when processing a DLM_MIGRATE_REQUEST message with an oversized name. A remote user can send a malformed migration request with an oversized name length to corrupt memory or cause a denial of service.

356) Memory leak (CVE-ID: CVE-2026-89496)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource release in OCFS2 copy-on-write completion when performing copy_file_range() within the same filesystem. A local user can invoke copy_file_range() to cause a memory leak.

357) Heap-based buffer overflow (CVE-ID: CVE-2026-89497)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write past the end of an allocated keyword buffer.

The vulnerability exists due to a heap-based buffer overflow in orangefs_prepare_cdm_array() when processing a client debug entry that begins with a space. A local user can supply a client debug entry beginning with a space to write past the end of an allocated keyword buffer.

358) Double free (CVE-ID: CVE-2026-89498)

CWE-ID: CWE-415 - Double Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a double-free.

The vulnerability exists due to double free in the OrangeFS readdir downcall handling when processing a readdir downcall with a declared trailer size that exceeds the supplied data. A local user can send a readdir downcall with insufficient trailer data to trigger a double-free.

359) Use-after-free (CVE-ID: CVE-2026-89504)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger use of a dangling device-tree node pointer.

The vulnerability exists due to improper reference counting in as3722_get_regulator_dt_data() when parsing regulator device-tree data. A local user can cause the dangling pointer to be used to trigger use of a dangling device-tree node pointer.

360) Race condition (CVE-ID: CVE-2026-89508)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in ucma_set_ib_path() when concurrently handling SET_OPTION requests and context migration. A local user can trigger a race condition to cause a denial of service.

A bound and address-resolved cm_id and an RDMA device are required.

361) Use-after-free (CVE-ID: CVE-2026-89510)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a use-after-free condition.

The vulnerability exists due to a race condition in the RDMA/cxgb4 device removal and registration work handling when removing an RDMA device while registration work is pending or running. A local privileged user can remove the device while the registration work accesses the device object to cause a use-after-free condition.

362) NULL pointer dereference (CVE-ID: CVE-2026-89511)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the qede driver's TPA fragment processing when handling TPA continuation fragments under memory pressure. A remote attacker can send network traffic that is processed as TPA continuation fragments during memory pressure to cause a denial of service.

363) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89512)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of a resource after effective lifetime in the scp_get function in drivers/remoteproc/mtk_scp.c when looking up SCP driver data before the driver has been bound. A local user can trigger a failed SCP driver-data lookup to cause a denial of service.

364) Use of uninitialized resource (CVE-ID: CVE-2026-89515)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized memory contents.

The vulnerability exists due to use of uninitialized memory in scsi_alloc_sgtables() when processing the last unaligned element of a scatterlist requiring DMA padding. A local user can issue an SCSI generic I/O request with an unaligned final scatterlist element to disclose uninitialized memory contents.

365) Integer underflow (CVE-ID: CVE-2026-89524)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an integer underflow in ath6kl_cfg80211_connect_event() when handling association events with request or response lengths shorter than their fixed information element offsets. A remote attacker can trigger such an association event to disclose sensitive information.

366) Out-of-bounds read (CVE-ID: CVE-2026-89525)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in udf_get_pblock_virt15() when processing a crafted UDF image. A local user can mount a crafted UDF image to cause a denial of service.

The issue affects UDF 1.50 virtual partition mappings that use a VAT.

367) Out-of-bounds read (CVE-ID: CVE-2026-89532)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow resulting in an out-of-bounds read in the pcl_for_each_segment macro when processing a Write or Reply chunk with zero segments. A remote attacker can send a crafted Write or Reply chunk advertising zero segments to cause a denial of service.

The transport must have negotiated Send-With-Invalidate.

368) Integer underflow (CVE-ID: CVE-2026-89533)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer underflow in svc_rdma_read_chunk_range() when processing a Read chunk segment list with crafted offsets and lengths. A remote attacker can submit a crafted Read chunk to cause a denial of service.

369) Improper input validation (CVE-ID: CVE-2026-89538)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in gss_krb5_unwrap_v2() when processing Kerberos v2 wrap tokens with oversized extra count fields. A remote user can send a malformed Kerberos v2 wrap token to cause a denial of service.

The token must be encrypted using a valid GSS context.

370) Race condition (CVE-ID: CVE-2026-89540)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to an initialization race condition in the use-gss-proxy proc entry initialization when writing to the newly published proc entry before gssp_lock is initialized. A local user can win the initialization race and write to the proc entry to cause a resource leak.

The race window can widen when the auth_rpcgss module is loaded for live network namespaces.

371) Out-of-bounds read (CVE-ID: CVE-2026-89541)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to improper length validation in gss_unwrap_resp_priv() when processing a crafted RPCSEC_GSS reply. A remote attacker can return a crafted RPCSEC_GSS reply from a krb5p NFS server to read out-of-bounds memory.

372) Out-of-bounds read (CVE-ID: CVE-2026-89542)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper length validation in gss_krb5_unwrap_v2() and its rotation helpers when processing a short or malformed GSS token. A remote user can provide a token shorter than the required header or with a declared length exceeding the buffer bounds to cause a denial of service.

The flawed length arithmetic can result in an out-of-bounds read, an unsigned underflow during cleanup, or a divide-by-zero during buffer rotation.

373) Use-after-free (CVE-ID: CVE-2026-89548)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper synchronization in the SUNRPC cache cleanup routine when tearing down a network namespace. A local user can cause cache_clean() to access a freed cache_detail to trigger a use-after-free condition.

374) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89549)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a service connection to hang indefinitely.

The vulnerability exists due to improper handling of threadless service pools in svc_pool_for_cpu() when routing a transport to a service pool. A remote attacker can initiate a connection that is enqueued on a pool with no service threads to cause a service connection to hang indefinitely.

The condition can occur when a service has fewer threads than configured pools.

375) Integer underflow (CVE-ID: CVE-2026-89551)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause downstream XDR decoders to use an incorrect stream bound.

The vulnerability exists due to an integer underflow in xdr_buf_trim() when processing GSS Kerberos v2 data whose recorded buffer length is smaller than the associated I/O vector lengths. A remote attacker can cause xdr_buf_trim() to consume more bytes than buf->len records to cause downstream XDR decoders to use an incorrect stream bound.

376) Use of Uninitialized Variable (CVE-ID: CVE-2026-89554)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt the path manager's id-based subflow bookkeeping.

The vulnerability exists due to use of an uninitialized local_id field in mptcp_token_join_cookie_init_state() when reconstructing MP_JOIN request sockets for fourth acknowledgments under SYN cookies. A remote attacker can send concurrent MP_JOIN SYNs to influence the stale address ID and corrupt the path manager's id-based subflow bookkeeping.

377) Use-after-free (CVE-ID: CVE-2026-89555)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to use-after-free in mpls_multipath_hash when processing MPLS packets with inner IP headers in non-linear data and insufficient tailroom in the linear head. A remote attacker can send a legal Geneve packet through a bareudp/MPLS multipath setup to trigger a use-after-free.

The IPv6 processing path can perform a second pull for the larger header.

378) Integer overflow (CVE-ID: CVE-2026-89557)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an integer overflow.

The vulnerability exists due to improper input validation in the super_1_load() MD superblock loader when processing a crafted on-disk superblock. A local user can supply a crafted on-disk superblock to trigger an integer overflow.

379) Integer overflow (CVE-ID: CVE-2026-89559)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds write.

The vulnerability exists due to an integer overflow in __nd_label_validate() in the libnvdimm label handler when processing a crafted nslot namespace index value. A local user can supply crafted configuration data through ND_CMD_SET_CONFIG_DATA to perform an out-of-bounds write.

The nslot field may also originate from DIMM label storage.

380) Missing Authorization (CVE-ID: CVE-2026-89560)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass Landlock filesystem access restrictions.

The vulnerability exists due to improper access control in Landlock whiteout creation checks when creating whiteout objects with mknod(2) or renameat2(2) using RENAME_WHITEOUT. A local user can create a whiteout object despite denied required Landlock access rights to bypass Landlock filesystem access restrictions.

Normal renames within layered OverlayFS mounts are not affected.

381) Incorrect calculation (CVE-ID: CVE-2026-89562)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect tunnel hardware header length handling.

The vulnerability exists due to improper hardware header length calculation in ip6_gre tunnel configuration when configuring an NBMA ip6gre tunnel. A local user can configure an NBMA ip6gre tunnel to cause incorrect tunnel hardware header length handling.

ip6gretap and ip6erspan use fixed Ethernet hardware header lengths.

382) Double free (CVE-ID: CVE-2026-89563)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in ip6_tnl_xmit() when handling errors after expanding packet headroom. A local user can trigger an error after packet headroom expansion to cause a denial of service.

The issue is reachable when collect_md tunnels reject a non-NONE encapsulation type or when ip6_tnl_encap() fails.

383) Use-after-free (CVE-ID: CVE-2026-89569)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access freed RFCOMM session and data link connection objects.

The vulnerability exists due to use-after-free in the RFCOMM security confirmation handler rfcomm_security_cfm() when processing Bluetooth security confirmations concurrently with RFCOMM session teardown. A remote attacker can trigger the concurrent processing to access freed RFCOMM session and data link connection objects.

384) Out-of-bounds read (CVE-ID: CVE-2026-89573)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to improper validation of array block value sizes in dm-array's get_ablock() and __shadow_ablock() functions when processing crafted dm-cache metadata. A local user can cause a mappings array to reference a hint block with a smaller value size to read out-of-bounds memory.

385) Heap-based buffer overflow (CVE-ID: CVE-2026-89575)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a heap-based buffer overflow.

The vulnerability exists due to improper buffer size calculation in build_constructor_string() when formatting a maximum-length u64 value. A local privileged user can cause sprintf() to write a terminating NUL byte beyond the allocated buffer space to cause a heap-based buffer overflow.

386) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89576)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through metadata block exhaustion.

The vulnerability exists due to improper resource release in metadata_take_snap() when incrementing metadata block references fails after allocating a shadow superblock. A local user can cause snapshot creation to fail after a shadow block is allocated to cause a denial of service through metadata block exhaustion.

387) Double free (CVE-ID: CVE-2026-89582)

CWE-ID: CWE-415 - Double Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a double free.

The vulnerability exists due to a double free in bnx2x_init_firmware() when firmware initialization fails and bnx2x_release_firmware() is subsequently called. A local user can cause firmware initialization to fail and invoke the affected cleanup path to trigger a double free.

388) Use-after-free (CVE-ID: CVE-2026-89585)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in the charlcd registration error-handling path when a character LCD registration attempt fails while backlight flashing is enabled. A local user can trigger delayed backlight work after the charlcd object is freed to access freed memory.

389) Incorrect calculation (CVE-ID: CVE-2026-89586)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect calculation in ata_scsi_write_same_xlat() and ata_format_dsm_trim_descr() when issuing SCSI WRITE SAME commands with the UNMAP bit set. A local user can issue a SCSI WRITE SAME command with the UNMAP bit set to cause a denial of service.

The issue affects devices whose logical sector size exceeds 2048 bytes.

390) Improper initialization (CVE-ID: CVE-2026-89594)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the OMAP SSI controller device when performing DMA mapping operations. A local user can trigger DMA mapping operations to cause a denial of service.

391) Race condition (CVE-ID: CVE-2026-89595)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause filesystem monitoring events to be missed.

The vulnerability exists due to a race condition in cached fsnotify object mask recalculation when concurrently updating fanotify or inotify marks on the same connector. A local user can issue concurrent mark updates to cause filesystem monitoring events to be missed.

392) Off-by-one (CVE-ID: CVE-2026-89596)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an off-by-one error in the forcedeth driver's nv_suspend() and nv_resume() functions when suspending or resuming the system. A local user can trigger a system suspend and resume cycle to cause a denial of service.

On systems built with CONFIG_UBSAN_TRAP=y, the out-of-bounds access aborts the running kernel code.

393) Improper resource shutdown or release (CVE-ID: CVE-2026-89597)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leave a v86d connector callback registered after initialization fails.

The vulnerability exists due to improper resource shutdown or release in uvesafb_init() when platform driver registration fails after registering the v86d connector callback. A local privileged user can initialize uvesafb to leave the callback registered.

394) Race condition (CVE-ID: CVE-2026-89599)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a dsicm callback to use an uninitialized mutex.

The vulnerability exists due to a race condition in the dsicm_probe() function of the panel-dsi-cm display driver when a consumer reaches a dsicm callback after the display is registered but before ddata->lock is initialized. A local user can trigger a dsicm callback during this interval to cause a dsicm callback to use an uninitialized mutex.

395) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89605)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to failure to release a message context in ecryptfs messaging when sending a message to the userspace daemon fails. A local user can trigger message delivery failures to exhaust reusable message contexts.

396) Integer underflow (CVE-ID: CVE-2026-89606)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an integer underflow.

The vulnerability exists due to an integer underflow in ecryptfs_parse_tag_70_packet() when parsing malformed tag 70 packets. A local user can provide a tag 70 packet with a body smaller than the required fixed metadata fields to trigger an integer underflow.

397) Out-of-bounds write (CVE-ID: CVE-2026-89607)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to out-of-bounds writes in parse_tag_3_packet() and decrypt_passphrase_encrypted_session_key() when processing a crafted Tag 3 packet through the passphrase decryption path. A local user can supply a crafted Tag 3 packet with an oversized encrypted key size to cause memory corruption.

Only the AES-192 cipher configuration enables exploitation because its key size is set independently of the encrypted key size.

398) Out-of-bounds read (CVE-ID: CVE-2026-89608)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to improper bounds checking in ecryptfs_parse_packet_set() when parsing an eCryptfs version 1 file header. A local user can trigger parsing of an eCryptfs version 1 file header to perform an out-of-bounds read.

399) Improper locking (CVE-ID: CVE-2026-89609)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a race condition.

The vulnerability exists due to improper locking in ecryptfs_exorcise_daemon() when cleaning queued messages from a dying daemon. A local user can move queued message contexts to the free list without holding the required global list lock to trigger a race condition.

400) Out-of-bounds write (CVE-ID: CVE-2026-89615)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in the page_lcns[] array handling of the NTFS3 log replay code when processing a crafted log record. A local user can provide a crafted log record with an lcns_follow count that exceeds the target entry's capacity to perform an out-of-bounds write.

401) Use of uninitialized resource (CVE-ID: CVE-2026-89616)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in ni_read_frame() when reading a crafted compressed NTFS file. A local user can trigger partial LZNT decompression to disclose sensitive information.

Disclosed data can include recently freed kernel page memory and kernel pointers.

402) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-89617)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of an on-disk array length in DIR_PAGE_ENTRY entries during NTFS3 log replay when replaying a crafted NTFS log. A local user can provide a crafted lcns_follow value that exceeds the page_lcns[] entry bounds to cause an out-of-bounds memory access.

403) Out-of-bounds read (CVE-ID: CVE-2026-89621)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose uninitialized kernel memory.

The vulnerability exists due to an out-of-bounds read in mcp2221_raw_event() in the MCP2221 HID driver when handling a short MCP2221_I2C_GET_DATA HID report. An attacker with physical access can send a crafted HID report with a length value exceeding the received report size to disclose uninitialized kernel memory.

404) Use-after-free (CVE-ID: CVE-2026-89626)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to improper cleanup in hid_sensor_custom_add_attributes() when creating sysfs groups for custom sensor fields. A local user can trigger a sysfs group creation failure to cause a use-after-free.

405) Memory leak (CVE-ID: CVE-2026-89627)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory release in the ROCcat HID device destruction paths when destroying a device with buffered reports stored in its circular buffer. A local user can trigger the affected device destruction path while buffered reports remain stored to cause a denial of service.

Up to ROCCAT_CBUF_SIZE report buffers per device can become unreachable.

406) Out-of-bounds read (CVE-ID: CVE-2026-89628)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in picolcd_debug_eeprom_read() when reading EEPROM data through the debugfs "eeprom" file. A local privileged user can use a crafted or spoofed picoLCD device to supply an oversized length value to disclose sensitive information.

The debugfs file is accessible only to root.

407) Use-after-free (CVE-ID: CVE-2026-89643)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in audit_del_rule() when fsnotify automatically removes mixed AUDIT_DIR and AUDIT_EXE rules that share an audit tree. A local privileged user can trigger fsnotify autoremove events to cause a denial of service.

408) Out-of-bounds read (CVE-ID: CVE-2026-89649)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the CephFS __build_xattrs() function when processing metadata-server-supplied extended attribute blobs. A remote privileged user can provide a crafted extended attribute blob with a final attribute value length that exceeds the available data to disclose sensitive information.

A local user must invoke getxattr(2) on a CephFS file.

409) Out-of-bounds read (CVE-ID: CVE-2026-89650)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds read in the kernel.

The vulnerability exists due to an out-of-bounds read in ceph_mdsmap_decode() in fs/ceph/mdsmap.c when processing an MDS map with a per-mds info version of 2 or 3 and an oversized num_export_targets field. A remote attacker can send a specially crafted MDS map to cause an out-of-bounds read in the kernel.

On-path exploitation applies to unsigned or unencrypted messenger sessions.

410) Out-of-bounds write (CVE-ID: CVE-2026-89653)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause an out-of-bounds write.

The vulnerability exists due to improper bounds checking in the fixed stack bitmap used by check_new_map() when processing a decoded MDSMap whose export_targets entries contain an out-of-range rank. A remote user can cause an MDSMap containing an out-of-range export target rank to be decoded to cause an out-of-bounds write.

411) Use-after-free (CVE-ID: CVE-2026-89655)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in __kick_flushing_caps() when processing FLUSH_ACK messages during cap flushing. A remote attacker can send a FLUSH_ACK message during cap flushing to trigger a use-after-free condition.

Exploitation requires the FLUSH_ACK to be processed after i_ceph_lock is released and before list iteration resumes.

412) Out-of-bounds write (CVE-ID: CVE-2026-89656)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write beyond the CRUSH workspace.

The vulnerability exists due to improper validation of bucket IDs in the libceph CRUSH map decoder, crush_decode(), when processing a malformed CRUSH map containing a bucket ID that does not match its array slot. A local user can cause the kernel to process such a map and write past a permutation array into memory beyond the CRUSH workspace.

413) Use-after-free (CVE-ID: CVE-2026-89662)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the NFSD __destroy_client() function when processing DESTROY_CLIENTID requests. A remote attacker can trigger client teardown while blocked locks are reaped to cause a denial of service.

The race can result in a NULL dereference in remove_blocked_locks().

414) Use-after-free (CVE-ID: CVE-2026-89663)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the NFS server copy-notify stateid revocation logic when revoking copy-notify stateids while concurrent holders retain references. A remote attacker can trigger concurrent copy-notify stateid revocation to cause a denial of service.

The issue involves parent-stateid draining, OFFLOAD_CANCEL handling, and laundromat expiry.

415) Integer overflow (CVE-ID: CVE-2026-89665)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause improper filesystem timestamp handling.

The vulnerability exists due to an integer overflow in the NFSv2 sattr decoder in svcxdr_decode_sattr() when decoding NFSv2 SETATTR or CREATE time attributes. A remote attacker can send a crafted NFSv2 request containing an out-of-range useconds value to cause improper filesystem timestamp handling.

The overflow affects 32-bit ILP32 platforms.

416) Use-after-free (CVE-ID: CVE-2026-89669)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in copy-notify state initialization when racing a crafted OFFLOAD_CANCEL request against COPY_NOTIFY processing. A remote attacker can send a crafted OFFLOAD_CANCEL request to trigger a use-after-free condition.

Exploitation requires a matching client ID and a guessable state object ID.

417) Improper Handling of Length Parameter Inconsistency (CVE-ID: CVE-2026-89673)

CWE-ID: CWE-130 - Improper Handling of Length Parameter Inconsistency

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose stale reply-page content.

The vulnerability exists due to an incorrect XDR padding calculation in nfsd4_ff_encode_getdeviceinfo() when encoding flexfile GETDEVICEINFO replies. A remote attacker can send a GETDEVICEINFO request to disclose stale reply-page content.

The incorrect declared address-body length can also mis-align decoding of the subsequent version list.

418) Out-of-bounds write (CVE-ID: CVE-2026-89674)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.

The vulnerability exists due to an incorrect XDR buffer size calculation in nfsd4_ff_encode_layoutget() when encoding layoutget responses with short user or group strings and an odd-sized file handle. A remote attacker can request a layoutget operation to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.

419) Race condition (CVE-ID: CVE-2026-89684)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in the NFS server copy-notification state handling when processing concurrent NFSv4.2 OFFLOAD_CANCEL requests. A remote attacker can send racing OFFLOAD_CANCEL requests to cause a denial of service.

420) Missing Authorization (CVE-ID: CVE-2026-89694)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper access control in the NFS server copy-notify state management function when processing OFFLOAD_CANCEL requests. A remote user can send an OFFLOAD_CANCEL request for another client's copy-notify stateid to cause a denial of service.

Copy-notify stateid object identifiers are allocated cyclically and are guessable.

421) NULL pointer dereference (CVE-ID: CVE-2026-89696)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the NFS server compound request dispatch loop when processing a crafted NFSv4 COMPOUND request involving an inter-SSC COPY operation. A remote attacker can send a crafted NFSv4 COMPOUND request with an operation between a foreign PUTFH and SAVEFH to cause a denial of service.

Only systems with CONFIG_NFSD_V4_2_INTER_SSC enabled are affected.

422) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89697)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a SETATTR operation without a mount write reference.

The vulnerability exists due to missing mount write reference acquisition in nfsd_proc_setattr() when processing a SETATTR request in the BOTH_TIME_SET branch. A remote attacker can submit a SETATTR request with both time attributes set to perform a SETATTR operation without a mount write reference.

423) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-89699)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in nfsd4_decode_create() when processing NFSv4 CREATE requests for symbolic links. A remote attacker can send crafted requests containing an oversized symbolic-link target length to cause a denial of service.

The allocation can persist until COMPOUND operation teardown.

424) Race condition (CVE-ID: CVE-2026-89704)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause silent data loss.

The vulnerability exists due to a race condition in _nfsd_copy_file_range() when processing asynchronous NFS COPY operations. A remote user can issue concurrent COPY and COMMIT or stable WRITE operations to cause silent data loss.

425) Improper handling of exceptional conditions (CVE-ID: CVE-2026-89706)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause copied data to be silently lost.

The vulnerability exists due to improper handling of writeback errors in the NFS server async COPY operation in _nfsd_copy_file_range() when processing an asynchronous COPY request whose writeback fails. A remote attacker can issue an asynchronous COPY request that encounters a writeback failure to cause copied data to be silently lost.

426) Memory leak (CVE-ID: CVE-2026-89710)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a memory leak.

The vulnerability exists due to improper resource cleanup in pnfs_layout_process() in the NFSv4.1 pNFS implementation when processing a new layout stateid returned while a valid stateid is still held. A remote attacker can operate an NFSv4.1 server that returns a new layout stateid to cause a memory leak.

427) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89711)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a kernel warning.

The vulnerability exists due to an incorrect warning condition in nfsd_mode_check when processing NFS client LOOKUP requests for exported NFS filesystems that lack a lookup method. A remote attacker can issue a LOOKUP request to trigger a kernel warning.

The condition can occur when reexporting an NFS filesystem.

428) Use-after-free (CVE-ID: CVE-2026-89712)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in nfsd4_ssc_expire_umount() when processing concurrent NFS server operations while an expired inter-server source mount is being unmounted. A remote attacker can trigger concurrent operations that cause the expiration walk to dereference a freed nfsd4_ssc_umount_item to cause a denial of service.

429) Out-of-bounds read (CVE-ID: CVE-2026-89720)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond allocated memory.

The vulnerability exists due to an out-of-bounds read in ubifs_sb_verify_signature() when mounting a crafted signed UBIFS image. A local user can provide an image with an inflated signature length to read beyond allocated memory.

The signature is processed before it is cryptographically checked.

430) Out-of-bounds read (CVE-ID: CVE-2026-89723)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds memory access.

The vulnerability exists due to improper deletion of an intermediate B-tree node in the NILFS2 block mapping implementation when truncating a file causes a B-tree mapping to collapse into a direct mapping. A local user can truncate a file to cause a residual B-tree node to be processed as a direct mapping entry and trigger an out-of-bounds memory access.

The residual node remains dirty in the B-tree node cache and can subsequently be processed by the log writer.

431) Out-of-bounds write (CVE-ID: CVE-2026-89724)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt adjacent kernel heap memory.

The vulnerability exists due to an out-of-bounds write in the vicodec FWHT encoder when encoding a four-component pixel format whose planes take the unencoded fallback. A local user can submit a crafted frame to corrupt adjacent kernel heap memory.

432) Out-of-bounds write (CVE-ID: CVE-2026-89725)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write peer-controlled bytes out of bounds into surrounding memory.

The vulnerability exists due to an out-of-bounds write in stm32_rx_done() in the STM32 CEC driver when processing an overlong CEC message from a peer. A remote attacker can send a CEC message without ending it to write peer-controlled bytes out of bounds into surrounding memory.

The driver must be probed and receiving must be enabled.

433) Out-of-bounds read (CVE-ID: CVE-2026-89726)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory beyond the specified length.

The vulnerability exists due to an off-by-one out-of-bounds read in ucs2_strnlen() in lib/ucs2_string.c when processing a UCS-2 string that is not NUL-terminated within the caller-provided maximum length. A local user can supply a non-NUL-terminated UCS-2 string to read memory beyond the specified length.

434) Out-of-bounds write (CVE-ID: CVE-2026-89729)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in sensor_hub_get_feature() when processing a malicious HID descriptor. An attacker with physical access can provide a HID descriptor advertising a large feature field size to cause an out-of-bounds write.

An IIO caller supplying a small stack buffer can be affected.

435) Out-of-bounds read (CVE-ID: CVE-2026-89730)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in altera_cvp_send_block() in the Altera CvP FPGA driver when processing an input buffer with one to three trailing bytes. A local user can provide a crafted FPGA image with trailing bytes to cause a denial of service.

436) Deadlock (CVE-ID: CVE-2026-89732)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in ffs_ep0_read() in the FunctionFS USB gadget function when a userspace daemon repeatedly reads ep0 while the gadget is asynchronously torn down via configfs. A local user can repeatedly read ep0 during asynchronous gadget teardown to cause a denial of service.

437) Use-after-free (CVE-ID: CVE-2026-89733)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in the UVC gadget function cleanup paths when handling bind errors or unbinding the function. A local user can trigger the affected cleanup paths to access freed memory.

438) Use-after-free (CVE-ID: CVE-2026-89736)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to use-after-free in the USB gadget u_audio sound card cleanup handling when accessing or closing open ALSA control file descriptors after sound card teardown is initiated. A local user can access or close open ALSA control file descriptors to cause memory corruption.

ALSA control callbacks can dereference private data associated with a freed sound card context.

439) Double free (CVE-ID: CVE-2026-89741)

CWE-ID: CWE-415 - Double Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a double-free condition.

The vulnerability exists due to a double free in __video_register_device() when handling a device_register() failure. A local user can trigger a device registration failure to cause a double-free condition.

440) Use-after-free (CVE-ID: CVE-2026-89742)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in dma_req_free() when freeing DMA requests through the RapidIO mport character device interface. A local user can trigger the release of a mapping whose final reference is dropped and subsequently unlock a mutex through the freed mapping to cause a denial of service.

441) Unchecked Return Value (CVE-ID: CVE-2026-89749)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an unchecked return value in event_test_stuff() when kthread creation fails. A local user can trigger a kthread creation failure that results in an error pointer being passed to kthread_stop() to cause a denial of service.

The failure can occur under memory pressure during the boot-time event self-test.

442) Race condition (CVE-ID: CVE-2026-89752)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the memory.high and memory.max limit update handlers when concurrently updating memory cgroup limits through separate open files. A local user can lower a memory.max limit and restore it through another open file to cause a denial of service.

Exploitation requires a cgroup populated with anonymous memory and swapping disabled.

443) Improper locking (CVE-ID: CVE-2026-89753)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause RCU Tasks stalls.

The vulnerability exists due to improper RCU quiescent-state handling in shrink_lruvec() in mm/vmscan.c when performing direct memory reclaim. A local user can trigger direct memory reclaim to cause RCU Tasks stalls.

The issue occurs on PREEMPTION kernels, where cond_resched() does not report a Tasks-RCU quiescent state.

444) Use of Uninitialized Variable (CVE-ID: CVE-2026-89765)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose uninitialized kernel stack memory.

The vulnerability exists due to use of uninitialized memory in put_itimerval() when calling getitimer() on native sparc64 systems. A remote attacker can invoke getitimer() to disclose uninitialized kernel stack memory.

445) Use-after-free (CVE-ID: CVE-2026-89777)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free caused by a dangling pointer in vfio pci MSI permission-table handling when MSI permission-table initialization fails. A local user can cause MSI permission-table initialization to fail and subsequently access MSI configuration to compromise system confidentiality, integrity, and availability.

The per-device structure persists across open and close cycles.

446) Out-of-bounds read (CVE-ID: CVE-2026-89778)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in zisofs_fill_pages() when reading a compressed file on a mounted ISO9660 image containing a crafted ZF Rock Ridge record. A remote attacker can provide a crafted ISO9660 image to read memory out of bounds.

The issue is triggered when an empty zisofs block follows a sub-page block with a nonzero page offset.

447) Out-of-bounds read (CVE-ID: CVE-2026-89779)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper bounds validation in the NTFS3 extended-attribute record parser when processing a crafted NTFS image. A remote attacker can provide an extended-attribute record with an undersized size field to disclose sensitive information.

448) NULL pointer dereference (CVE-ID: CVE-2026-89780)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rmnet_map_deaggregate() when processing an aggregated frame containing a flow-control command. A local user can write a crafted aggregated frame to a tap device file descriptor to cause a denial of service.

Exploitation requires an rmnet link over a tap device with ingress deaggregation and ingress MAP commands enabled.

449) Out-of-bounds read (CVE-ID: CVE-2026-89781)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper validation of an on-disk offset in read_log_rec_buf() when mounting a crafted NTFS image. A remote attacker can mount a crafted NTFS image to compromise confidentiality, integrity, and availability.

450) Numeric Truncation Error (CVE-ID: CVE-2026-89782)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds memory access.

The vulnerability exists due to integer truncation in the NTFS3 restart table handling in fs/ntfs3/fslog.c when replaying a crafted NTFS $LogFile. A remote attacker can mount a crafted NTFS image to cause an out-of-bounds memory access.

451) Out-of-bounds write (CVE-ID: CVE-2026-89783)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to an out-of-bounds write in xfrm6_input_addr() when processing an inner IPv6 packet containing a destination-options HAO option or a type-2 routing header. A remote attacker can send a specially crafted packet to compromise confidentiality, integrity, and availability.

Exploitation requires the transport-mode receive path to re-enter IPv6 input with a secpath whose length is at the maximum depth.

452) NULL pointer dereference (CVE-ID: CVE-2026-89784)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in rpcb_register_inet4() and rpcb_register_inet6() when an in-kernel RPC service registers with the local rpcbind after an address-string allocation fails. A local user can cause an in-kernel RPC service to register with the local rpcbind to cause a denial of service.

Exploitation requires sufficient memory pressure for a small GFP_KERNEL allocation to fail.

453) Out-of-bounds read (CVE-ID: CVE-2026-89785)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read beyond the allocated buffer.

The vulnerability exists due to an out-of-bounds read in ntfs_reparse_init() and ntfs_objid_init() when mounting a crafted NTFS filesystem image containing a malformed resident INDEX_ROOT attribute. A local privileged user can mount a crafted filesystem image to read beyond the allocated buffer.

Exploitation requires CAP_SYS_ADMIN.

454) Out-of-bounds read (CVE-ID: CVE-2026-89786)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ext4_read_inline_dir() when processing inline directory entries during getdents64() calls. A remote attacker can cause the kernel to process an inline directory entry whose header extends beyond the inline buffer to disclose sensitive information and cause a denial of service.

455) Out-of-bounds read (CVE-ID: CVE-2026-89787)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in ext4_search_dir() when processing a crafted directory entry during a directory lookup. A local user can provide a crafted directory entry to read out-of-bounds memory.

The issue affects casefolded encrypted directories that store hash values in directory entries on the sb_no_casefold_compat_fallback() path.

456) Use-after-free (CVE-ID: CVE-2026-89789)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose and modify sensitive information and cause a denial of service.

The vulnerability exists due to use-after-free in the gtp_newlink() error path in drivers/net/gtp.c when handling gtp_newlink() error paths concurrently with gtp encapsulation receive operations. A local user can trigger the race condition to disclose and modify sensitive information and cause a denial of service.

457) Out-of-bounds read (CVE-ID: CVE-2026-89792)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to out-of-bounds read in the ksmbd share configuration response handling when processing IPC share configuration responses with malformed variable-length fields. A local user can provide a crafted share configuration response to disclose sensitive information and cause a denial of service.

458) Integer overflow (CVE-ID: CVE-2026-89796)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in kdamond_merge_regions() in the DAMON core when merging DAMON regions after online parameter updates. A local user can configure DAMON with an excessively large aggregation interval and numerous non-contiguous regions to cause a denial of service.

Exploitation requires the region count to remain above the user-defined upper limit after aggressive merging.

459) Improper update of reference count (CVE-ID: CVE-2026-89816)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper reference counting in complete_signaling() in the DRM atomic UAPI when an atomic DRM ioctl using DRM_MODE_PAGE_FLIP_EVENT is blocked while waiting for fences. A local user can issue the atomic DRM ioctl with a sw_sync fence and send a signal to the blocked thread to cause a memory leak.

The condition was observed with amdgpu and vkms.

460) Improper Null Termination (CVE-ID: CVE-2026-89817)

CWE-ID: CWE-170 - Improper Null Termination

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to perform an out-of-bounds read.

The vulnerability exists due to improper null termination in gud_connector_add_tv_mode() when processing TV mode names received from a USB device. An attacker with physical access can provide TV mode names that are not NUL-terminated to perform an out-of-bounds read.

461) Division by zero (CVE-ID: CVE-2026-89821)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a divide-by-zero error in the __is_lut_linear() function when processing a single-entry lookup table. A local user can trigger processing of a single-entry lookup table to cause a denial of service.

462) Race condition (CVE-ID: CVE-2026-89823)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in drm_dev_register() error handling when a partially registered DRM minor is opened and an ioctl is processed. A local user can open the registered minor and issue an ioctl while device resources are being torn down to compromise confidentiality, integrity, and availability.

463) Use of uninitialized resource (CVE-ID: CVE-2026-89843)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized stack memory in qla2xxx BSG handlers when processing a short user-supplied BSG request payload. A local user can submit a specially crafted short BSG request to disclose sensitive information.

The information leak occurs in qla2x00_read_fru_status() and qla2x00_read_i2c().

464) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-89845)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a time-of-check to time-of-use race condition in qla2x00_error_entry() when handling error entries during request-queue teardown. A local user can trigger processing of an error entry while the request queue is being torn down to cause a denial of service.

The response-queue interrupt can remain registered while request queues are being torn down.

465) Out-of-bounds read (CVE-ID: CVE-2026-89846)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in qla2x00_status_entry() in the qla2xxx SCSI driver when processing an FCP response containing an oversized response information length. A remote attacker can send a crafted FCP response with an oversized rsp_info_len value to disclose sensitive information.

466) Use-after-free (CVE-ID: CVE-2026-89847)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in qla2x00_async_iocb_timeout() in the qla2xxx SCSI driver when an async IOCB timeout races with response interrupt completion. A remote attacker can trigger the race condition to compromise confidentiality, integrity, and availability.

467) Type Confusion (CVE-ID: CVE-2026-89849)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a wild pointer dereference.

The vulnerability exists due to type confusion in the qla2x00_status_entry() SCSI fast path when processing an unexpected STATUS_TYPE IOCB for a non-SCSI handle. A remote attacker can cause an unexpected STATUS_TYPE IOCB for a non-SCSI handle to be processed to cause a wild pointer dereference.

468) Improper locking (CVE-ID: CVE-2026-89850)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in qla2x00_fw_state_show() when querying firmware state while the chip is down or EEH is busy. A local user can query the firmware state to cause a denial of service.

469) NULL pointer dereference (CVE-ID: CVE-2026-89851)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in qla2x00_dfs_fce_write() when parsing a value written to the debugfs FCE trace interface. A local user can write a valid numeric value to the interface to cause a denial of service.

Invalid values can unintentionally enable FCE tracing.

470) Use of Uninitialized Variable (CVE-ID: CVE-2026-89852)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of an uninitialized variable in qla2x00_get_firmware_state() when querying firmware state through sysfs during a mailbox command failure. A local user can read firmware state through the fw_state or mpi_fw_state sysfs handlers during such a failure to disclose sensitive information.

471) Use-after-free (CVE-ID: CVE-2026-89853)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a race condition in qla2xxx FCE trace buffer handling when a debugfs FCE disable occurs during firmware dump processing. A local user can disable FCE tracing through debugfs during a firmware dump to trigger a use-after-free.

472) Use-after-free (CVE-ID: CVE-2026-89854)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in the qla2xxx driver's 84xx_fw_version sysfs attribute handler when concurrently reading the attribute during host teardown. A local user can read the 84xx_fw_version sysfs attribute during host teardown to compromise confidentiality, integrity, and availability.

473) Race condition (CVE-ID: CVE-2026-89855)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause corruption of flash version reads.

The vulnerability exists due to improper synchronization in the qla2x00_sysfs_write_reset reset handler when the update cache versions without reset sysfs reset operation is invoked concurrently with a VPD or optrom flash operation. A local user can invoke the reset operation while a concurrent flash operation accesses the same hardware flash registers to cause corruption of flash version reads.

474) Numeric Truncation Error (CVE-ID: CVE-2026-89856)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory or cause a denial of service.

The vulnerability exists due to numeric truncation in the qla2xxx MSI-X queue-count calculation when deriving queue counts from MSI-X vector counts. A remote attacker can cause a zero queue count to be used for queue allocation to corrupt memory or cause a denial of service.

Target mode can also underflow the queue count after decrementing it.

475) Out-of-bounds read (CVE-ID: CVE-2026-89858)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel stack memory to a device.

The vulnerability exists due to an out-of-bounds read in qla2x00_update_fru_versions() when processing BSG requests with an oversized declared image count. A local user can submit a crafted BSG request to disclose kernel stack memory to a device.

476) Use-after-free (CVE-ID: CVE-2026-89861)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in qla24xx_report_id_acquisition() in the qla2xxx SCSI driver when a virtual port is concurrently deallocated after it is found in the virtual port list. A remote attacker can trigger the race condition to compromise confidentiality, integrity, and availability.

477) NULL pointer dereference (CVE-ID: CVE-2026-89863)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in qla_chk_edif_rx_sa_delete_pending() when processing a firmware status completion for a command that has already been returned or aborted. A remote attacker can trigger processing of such a status completion to cause a denial of service.

The kernel crash occurs in interrupt context.

478) Out-of-bounds write (CVE-ID: CVE-2026-89864)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel heap and stack memory.

The vulnerability exists due to improper bounds checking in the qla2x00_write_i2c() and qla2x00_read_i2c() I2C BSG handlers when processing a user-supplied I2C length. A local privileged user can submit a crafted I2C BSG request with an oversized length to corrupt kernel heap and stack memory.

Exploitation requires CAP_SYS_RAWIO.

479) Use of uninitialized resource (CVE-ID: CVE-2026-89865)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and modify device flash contents.

The vulnerability exists due to use of uninitialized memory in the qla2xxx FRU and I2C BSG handlers when processing a user-controlled payload that overrides the transfer length. A local user can send a crafted BSG request to disclose sensitive information and modify device flash contents.

480) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89871)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in the video-i2c driver's streaming functions when a capture-thread startup fails. A local user can invoke streaming operations after a capture-thread startup failure to cause a denial of service.

481) Memory leak (CVE-ID: CVE-2026-89872)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak fwnode references.

The vulnerability exists due to a missing reference release in v4l2_fwnode_parse_link when parsing a link. A local user can trigger link parsing to leak fwnode references.

482) Integer overflow (CVE-ID: CVE-2026-89876)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger undefined behavior.

The vulnerability exists due to an integer overflow in the tda18250 media driver when exp equals zero. A local user can cause exp to equal zero to trigger undefined behavior.

483) Out-of-bounds read (CVE-ID: CVE-2026-89878)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in s2255_probe() when processing a firmware blob shorter than eight bytes. A local user can supply a firmware blob shorter than eight bytes to read out-of-bounds memory.

484) Out-of-bounds write (CVE-ID: CVE-2026-89879)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to write beyond the destination buffer.

The vulnerability exists due to an out-of-bounds write in the s2255_fillbuff() JPEG/MJPEG frame handling code when processing a device-supplied JPEG frame header. An attacker with physical access can provide a crafted frame header with an oversized jpg_size value to write beyond the destination buffer.

485) Improper resource shutdown or release (CVE-ID: CVE-2026-89880)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper error-path resource cleanup in rtl2832_sdr_start_streaming() when starting streaming after a prior failed streaming attempt. A local user can initiate streaming again after a failed streaming attempt to compromise confidentiality, integrity, and availability.

The out-of-bounds access occurs during URB cleanup when urbs_initialized exceeds MAX_BULK_BUFS.

486) Memory leak (CVE-ID: CVE-2026-89881)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by leaking DMA resources.

The vulnerability exists due to improper resource cleanup in the rtl2832_sdr driver removal handling when a USB device is disconnected while streaming remains active. A local user can close a file descriptor after the disconnection to cause a denial of service by leaking DMA resources.

487) Improper resource shutdown or release (CVE-ID: CVE-2026-89883)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper resource cleanup in the sunxi-cir driver when probe initialization fails after rc device registration. A local user can trigger a probe failure to compromise confidentiality, integrity, and availability.

488) Double free (CVE-ID: CVE-2026-89887)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel panic.

The vulnerability exists due to improper resource lifecycle management in the ov7740_remove() function when removing the ov7740 driver. A local user can trigger driver removal to cause a kernel panic.

489) Use-after-free (CVE-ID: CVE-2026-89888)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code, disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to use-after-free in the ov02a10_check_hwcfg() function of the ov02a10 media I2C driver when handling endpoint configuration. A local user can trigger hardware configuration checking to execute arbitrary code, disclose sensitive information, modify data, or cause a denial of service.

490) Use-after-free (CVE-ID: CVE-2026-89890)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in go7007 ALSA PCM callbacks when a capture PCM remains open during V4L2 device release. A local user can retain an open capture PCM during V4L2 device release to compromise confidentiality, integrity, and availability.

491) Use-after-free (CVE-ID: CVE-2026-89891)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to use-after-free in the em28xx device-list handling during extension closure when disconnecting a dual transport-stream device through the audio-only path. An attacker with physical access can connect a USB device with crafted endpoint descriptors to cause a denial of service.

492) Use-after-free (CVE-ID: CVE-2026-89892)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a use-after-free.

The vulnerability exists due to improper device list management in the em28xx audio-only extension registration path when connecting and disconnecting a dual-TS board. An attacker with physical access can connect and disconnect a dual-TS board to trigger a use-after-free.

The condition affects audio-only paths on dual-TS boards.

493) Use-after-free (CVE-ID: CVE-2026-89893)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read or modify sensitive information and cause a denial of service.

The vulnerability exists due to a use-after-free in the NetUP CI status work handling in drivers/media/pci/cx23885/cimax2.c when tearing down a NetUP CI device while CI status work is pending or running. A local user can trigger device teardown while the queued status worker can still access freed state to read or modify sensitive information and cause a denial of service.

494) Out-of-bounds write (CVE-ID: CVE-2026-89894)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a heap-based out-of-bounds write.

The vulnerability exists due to a heap-based buffer overflow in cx231xx VBI buffer handling in cx231xx_do_vbi_copy() when changing video geometry while a VBI stream is running. A local user can allocate a small VBI buffer and change the video width or standard to write past the allocated buffer.

Exploitation requires the device to deliver a field-2 VBI payload.

495) Double free (CVE-ID: CVE-2026-89895)

CWE-ID: CWE-415 - Double Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in the cobalt ALSA initialization error cleanup path when initializing cobalt ALSA support. A local user can cause cobalt_alsa_init() to fail after snd_cobalt_card_create() to cause a denial of service.

496) Memory leak (CVE-ID: CVE-2026-89896)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the V4L2 control handler in cedrus_init_ctrls() when allocation of ctx->ctrls fails. A local user can trigger the allocation failure path to cause a denial of service.

497) Race condition (CVE-ID: CVE-2026-89897)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in cec_receive_notify() when handling CEC messages concurrently with follower mode changes or release. A remote attacker can send CEC messages during concurrent follower mode changes or release to compromise confidentiality, integrity, and availability.

498) NULL pointer dereference (CVE-ID: CVE-2026-89901)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the Airspy USB driver when closing a streaming device after it has been disconnected. A local user can close the streaming device after disconnection to cause a denial of service.

499) Memory leak (CVE-ID: CVE-2026-89923)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in KVM s390 vCPU destruction when destroying a vCPU while hardware breakpoints remain armed. A local user can destroy a vCPU with armed hardware breakpoints to cause a denial of service.

The leaked allocations are charged to memory cgroups and can pin dying memory cgroups.

500) Memory leak (CVE-ID: CVE-2026-89924)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the s390 KVM guest debug watchpoint import error path when importing watchpoint data from a KVM_SET_GUEST_DEBUG request. A local user can submit a KVM_SET_GUEST_DEBUG request in which a later watchpoint fails to import to cause a denial of service.

The request can be repeated, leaking up to MAX_BP_COUNT - 1 buffers of up to MAX_WP_SIZE bytes per failed request.

501) Memory leak (CVE-ID: CVE-2026-89925)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of memory in KVM s390 guest debug handling when successfully processing KVM_SET_GUEST_DEBUG requests. A local user can repeatedly issue successful KVM_SET_GUEST_DEBUG requests to cause a denial of service.

502) Numeric Truncation Error (CVE-ID: CVE-2026-89926)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to numeric truncation in the KVM s390 __import_wp_info() function when importing user-supplied hardware breakpoint information. A local user can supply an oversized breakpoint length value to trigger a kernel warning.

503) Integer overflow (CVE-ID: CVE-2026-89927)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow in the KVM x86 Hyper-V synthetic timer deadline calculation when programming a synthetic timer with a count value close to U64_MAX. A remote attacker can program a synthetic timer with a crafted count value to cause a denial of service.

504) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89930)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause stale TLB translations to be used.

The vulnerability exists due to failure to service queued local TLB flush requests in KVM nVMX nested VM-entry handling when a nested VM entry fails after switching to the L2 context. A remote attacker can change L2's VPID and trigger a failed nested VM entry to cause stale TLB translations to be used.

505) Improper initialization (CVE-ID: CVE-2026-89932)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose or modify sensitive information, or cause a denial of service.

The vulnerability exists due to improper initialization of last_vpid in KVM nested VMX VPID management when reusing a VPID after an L1 guest transitions from VMXOFF to VMXON and runs an L2 guest. A local user can cause stale TLB entries associated with a previous VPID lifetime to be used to disclose or modify sensitive information, or cause a denial of service.

506) Improper resource shutdown or release (CVE-ID: CVE-2026-89936)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave the Vcc regulator enabled indefinitely.

The vulnerability exists due to improper resource shutdown or release in m62332_set_value() when writing successive non-zero values to a channel before writing zero. A local user can write successive non-zero values to a channel before writing zero to leave the Vcc regulator enabled indefinitely.

507) Unchecked Return Value (CVE-ID: CVE-2026-89937)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an error return in the SGP30 driver sgp_probe() and sgp_remove() functions when IAQ thread creation fails. A local user can cause IAQ thread creation to fail and subsequently trigger device removal to cause a denial of service.

508) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89939)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent the device from autosuspending.

The vulnerability exists due to a missing release of a runtime PM reference in atlas_buffer_postenable() when enabling an IIO buffer and interrupt configuration fails. A local user can enable an IIO buffer to prevent the device from autosuspending.

509) Race condition (CVE-ID: CVE-2026-89945)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause improper hardware register operations.

The vulnerability exists due to a race condition in the cs35l34 runtime suspend handler when runtime power management suspends the codec while critical fault IRQs remain unmasked. A local user can trigger runtime power management to cause improper hardware register operations.

510) Race condition (CVE-ID: CVE-2026-89946)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect processing of amplifier fault release paths.

The vulnerability exists due to a race condition in the cs35l33 codec driver's runtime suspend and threaded IRQ handling when a threaded IRQ handler executes after runtime suspend has disabled live register access. A local user can cause a threaded IRQ handler to execute during runtime suspend to cause incorrect processing of amplifier fault release paths.

Critical fault IRQs must remain unmasked during runtime power management.

511) Out-of-bounds read (CVE-ID: CVE-2026-89947)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, modify data, and cause a denial of service.

The vulnerability exists due to an incorrect parent count in the gxbb_32k_clk_sel clock mux when registering the clock mux. A remote attacker can trigger registration of the affected clock mux to disclose sensitive information, modify data, and cause a denial of service.

512) Incomplete cleanup (CVE-ID: CVE-2026-89948)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause bridge loop avoidance claims to remain after mesh interface deletion.

The vulnerability exists due to incomplete cleanup of claims in the batman-adv bridge loop avoidance claim cleanup logic when deleting a mesh interface. A local user can delete a mesh interface to cause bridge loop avoidance claims to remain after mesh interface deletion.

513) Reliance on undefined behavior (CVE-ID: CVE-2026-89949)

CWE-ID: CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of unaligned memory access in the batman-adv distributed ARP table IP extraction functions when processing ARP packets with unaligned data in socket buffers. A remote attacker can send an ARP packet to cause a denial of service.

Only hardware without native support for unaligned reads is affected.

514) Use-after-free (CVE-ID: CVE-2026-89951)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in batadv_batman_skb_recv() when processing reassembled fragmented packets. A remote attacker can send fragmented packets to compromise confidentiality, integrity, and availability.

Exploitation requires a hard interface to be deleted before fragment reassembly completes.

515) Out-of-bounds read (CVE-ID: CVE-2026-89952)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read beyond allocated memory.

The vulnerability exists due to an out-of-bounds read in nand_flash_detect_ext_param_page() when parsing an ONFI extended parameter page with invalid section lengths. An attacker with physical access can supply a malformed ONFI extended parameter page to read beyond allocated memory.

516) Memory leak (CVE-ID: CVE-2026-89953)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a memory leak in the mtdoops notification removal handler when a configured backing MTD device is removed and registered again while mtdoops remains loaded. A local privileged user can repeatedly remove and register the configured backing MTD device to exhaust vmalloc memory.

The issue is only exposed when the backing MTD device can disappear and later be registered again; typical static MTD configurations do not expose it.

517) Out-of-bounds read (CVE-ID: CVE-2026-89954)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, modify data, or cause a denial of service through an out-of-bounds memory access.

The vulnerability exists due to improper bounds checking in the AFS v2 parser when parsing a crafted AFS v2 image. A remote attacker can supply an image with a footer offset or region count that exceeds expected bounds to disclose sensitive information, modify data, or cause a denial of service through an out-of-bounds memory access.

518) Infinite loop (CVE-ID: CVE-2026-89964)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to failure to advance the parsing position in eisa_irq_setup() when processing an invalid eisa_irq_edge kernel command line parameter. A local privileged user can supply an invalid comma-separated IRQ value to cause a denial of service.

519) Out-of-bounds write (CVE-ID: CVE-2026-89965)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the nvdimm/btt arena I/O path when processing a crafted or foreign arena whose nfree value is below the lane count. A local user can provide a crafted or foreign arena to write past per-lane freelist and rtt array allocations and execute arbitrary code.

520) Improper Enforcement of Behavioral Workflow (CVE-ID: CVE-2026-89968)

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of protocol state in nvmet_tcp_handle_h2c_data_pdu() when processing an unsolicited H2CData PDU before transmitting a requested data transfer (R2T). A remote attacker can send an H2CData PDU for a write command before the R2T is transmitted to cause a denial of service.

The affected subsystem must be configured with allow_any_host.

521) Out-of-bounds write (CVE-ID: CVE-2026-89969)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in nvmet_tcp_try_recv_pdu() when receiving an over-long NVMe/TCP PDU. A remote attacker can send a duplicate ICReq PDU after header digest negotiation to execute arbitrary code.

The attacker-controlled overflow can overwrite the adjacent header and data digest fields before the duplicate ICReq is rejected.

522) Improper input validation (CVE-ID: CVE-2026-89973)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in nvme_tcp_handle_c2h_data() when processing a C2HData PDU for a write command. A remote attacker can send a C2HData PDU in response to a write command to cause a denial of service.

On hosts booted with panic_on_warn, the triggered kernel warning is fatal.

523) Race condition (CVE-ID: CVE-2026-89979)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause inconsistent PCM state transitions.

The vulnerability exists due to a race condition in ALSA PCM trigger-start handling when concurrently performing non-atomic PCM operations. A local user can concurrently issue a PCM start trigger and non-atomic PCM operations to cause inconsistent PCM state transitions.

524) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89982)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to missing release of a Device Tree channel node reference in i2c_mux_add_adapter() when adapter registration fails. A local user can trigger an adapter registration failure to cause a memory leak.

525) Use-after-free (CVE-ID: CVE-2026-89983)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the I2C core adapter debugfs directory handling when a write to the new_device sysfs attribute races with adapter removal. A local user can write to the new_device sysfs attribute during adapter removal to cause a denial of service.

526) Improper access control (CVE-ID: CVE-2026-89984)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel addresses.

The vulnerability exists due to improper privilege-level validation in the intel_pmu_lbr_filter() LBR stack filtering function when filtering sampled LBR entries for user-only branch stacks. A local user can request a user-only branch stack through perf to disclose kernel addresses.

The issue affects systems where architectural LBR lacks CPL filtering support.

527) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-89989)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of error return values in validate_hash_algo() in IMA appraisal when processing a dentry path that exceeds the buffer. A local user can trigger an extended attribute operation that causes dentry_path() to return an error pointer to cause a denial of service.

528) NULL pointer dereference (CVE-ID: CVE-2026-89993)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a null pointer dereference.

The vulnerability exists due to improper initialization of IRQ data in dw_edma_irq_request() when a shared interrupt is handled before dw_edma_channel_setup() initializes the back pointer. A local user can trigger a shared interrupt during initialization to trigger a null pointer dereference.

529) Race condition (CVE-ID: CVE-2026-89997)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a race condition in the device-mapper resume and remove handling when issuing resume and remove ioctls concurrently. A local user can issue resume and remove ioctls concurrently to cause a use-after-free condition.

In the dm-integrity target, the reboot notifier can remain registered after device removal.

530) Out-of-bounds read (CVE-ID: CVE-2026-89999)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in wacom_intuos_pro2_bt_irq in the HID Wacom driver when processing undersized Bluetooth reports. A remote attacker can send a crafted undersized Bluetooth report to disclose sensitive information and cause a denial of service.

The peripheral must be paired or spoofed and advertise a matching VID/PID.

531) Out-of-bounds write (CVE-ID: CVE-2026-90000)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, corrupt memory, or cause a denial of service.

The vulnerability exists due to out-of-bounds read and write operations in the hid-rmi driver when handling undersized RMI reports. A remote attacker can send specially crafted RMI reports to disclose sensitive information, corrupt memory, or cause a denial of service.

A zero-length reply can cause the read loop to run indefinitely with page_mutex held.

532) Improper resource shutdown or release (CVE-ID: CVE-2026-90007)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave previously registered interrupt handlers installed.

The vulnerability exists due to incorrect rollback index handling in the pm8001_request_msix() function when handling a request_irq() failure during MSI-X vector registration. A local user can trigger the faulty rollback loop to leave previously registered interrupt handlers installed.

533) Out-of-bounds read (CVE-ID: CVE-2026-90011)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the iSCSI target login payload buffer when processing a crafted login PDU without a terminating null byte. A remote attacker can send a crafted login PDU to disclose sensitive information and cause a denial of service.

Exploitation is reachable through the CHAP authentication path on a portal configured for CHAP.

534) Improper resource shutdown or release (CVE-ID: CVE-2026-90015)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data corruption and leak DMA mappings.

The vulnerability exists due to improper handling of bounce buffers in the xHCI transfer descriptor bounce-buffer cleanup logic when processing sufficiently large fragmented bulk USB transfers that span multiple ring segments. A local user can submit a crafted bulk transfer to cause data corruption and leak DMA mappings.

For IN transfers, unreturned bounce-buffer data can leave a wMaxPacketSize-sized region of the destination buffer containing its previous contents.

535) Out-of-bounds read (CVE-ID: CVE-2026-90017)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rtw_action_frame_parse() in the rtl8723bs driver when processing a short management action frame. A remote attacker can send a crafted management action frame to cause a denial of service.

The frame can be as short as the 24-byte IEEE 802.11 three-address header.

536) Stack-based buffer overflow (CVE-ID: CVE-2026-90018)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a stack-based buffer overflow in rtw_get_wps_attr() when processing a crafted WPS information element in a wireless management frame. A remote attacker can send a crafted beacon or probe response during scanning to compromise confidentiality, integrity, and availability.

537) NULL pointer dereference (CVE-ID: CVE-2026-90019)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in usb_put_function_instance() when handling an error during UVC function instance allocation. A remote attacker can trigger the error path to cause a denial of service.

The issue occurs before the fd member of the function instance is allocated.

538) Race condition (CVE-ID: CVE-2026-90020)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in gadget_dev_ioctl() when handling ioctl requests concurrently with device binding. A local user can issue ioctl requests during a concurrent bind operation to cause a denial of service.

539) Out-of-bounds read (CVE-ID: CVE-2026-90025)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the UCSI DisplayPort driver's port altmode array when processing an invalid GET_CURRENT_CAM response from the PPM. A remote attacker can cause the PPM to return an altmode array index above UCSI_MAX_ALTMODES to cause a denial of service.

540) Race condition (CVE-ID: CVE-2026-90031)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a warning that a URB is already active.

The vulnerability exists due to a race condition in the ENE UB6250 USB-storage driver when delayed scan work runs concurrently with card-type probing. An attacker with physical access can cause concurrent access to us->current_urb during device probing to trigger a warning that a URB is already active.

541) Use-after-free (CVE-ID: CVE-2026-90032)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in snd_usbtv_pcm_close() in the usbtv audio driver when closing an ALSA PCM file after USB disconnect. A local user can close a previously opened ALSA PCM file after USB disconnect to compromise confidentiality, integrity, and availability.

542) Out-of-bounds write (CVE-ID: CVE-2026-90033)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in snd_usbmidi_us122l_output() when processing MIDI output for a USB device that declares a bulk endpoint smaller than the expected transfer count. An attacker with physical access can connect a crafted USB device to cause a denial of service.

543) Use of uninitialized resource (CVE-ID: CVE-2026-90034)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the mdc800 USB driver buffer initialization when receiving shorter messages. An attacker with physical access can send a shorter message to disclose sensitive information.

544) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-90049)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause data corruption.

The vulnerability exists due to improper resource lifetime management in skb_zerocopy() when processing a packet through Open vSwitch's OVS_ACTION_ATTR_USERSPACE path after skb_orphan_frags() fails. A remote attacker can trigger the error path to cause data corruption.

545) Infinite loop (CVE-ID: CVE-2026-90053)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop in the HTB packet classifier htb_classify() when processing packets with cyclic inner-class filter selections. A local user can configure cyclic HTB filters and send a packet to cause a denial of service.

Exploitation is reachable through an unprivileged user namespace that provides CAP_NET_ADMIN.

546) Incorrect calculation (CVE-ID: CVE-2026-90054)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt TCP stream data.

The vulnerability exists due to incorrect calculation of the retransmission length in the TCP retransmission path when retransmitting TCP urgent data across multiple segments. A remote attacker can send TCP urgent data that is retransmitted across multiple segments to corrupt TCP stream data.

547) Reliance on undefined behavior (CVE-ID: CVE-2026-90055)

CWE-ID: CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger undefined behavior.

The vulnerability exists due to improper initialization of ci_range bit counts in usbatm_atm_init() when processing ATM PVC bind requests. A remote attacker can bind an ATM PVC to trigger undefined behavior.

548) Use of uninitialized resource (CVE-ID: CVE-2026-90056)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of an uninitialized resource in the FEC Ethernet driver PTP cleanup paths when handling failed device initialization or device removal. A local user can trigger failed device initialization or device removal to cause a denial of service.

PTP initialization is performed only when extended buffer descriptors are available.

549) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-90058)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of user-supplied size table values in __qdisc_calculate_pkt_len() when processing a crafted TCA_STAB configuration that amplifies packet length values. A local user can configure a DRR or ETS qdisc with a crafted size table, set a tiny quantum, and send a small packet to cause a denial of service.

The issue requires NET_SCHED and either the DRR or ETS scheduler to be enabled.

550) Incorrect behavior order (CVE-ID: CVE-2026-90062)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an inconsistent state between hardware-offloaded and software rulesets.

The vulnerability exists due to incorrect behavior order in nf_tables commit processing when committing rulesets with hardware flow-rule offload. A local user can commit a ruleset with hardware flow-rule offload to cause an inconsistent state between hardware-offloaded and software rulesets.

The inconsistency can occur if chain blob preparation fails after the hardware ruleset has been offloaded.

551) Integer overflow (CVE-ID: CVE-2026-90063)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a 16-bit gso_segs field overflow.

The vulnerability exists due to improper validation of gso_size in virtio_net_hdr_to_skb when processing TCP packets crafted through an AF_PACKET PACKET_VNET_HDR socket. A local user can submit a TCP packet with a gso_size smaller than TCP_MIN_GSO_SIZE to cause a 16-bit gso_segs field overflow.

The condition applies to TCP packets; UDP GSO permits a gso_size of 1.

552) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-90067)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a kernel warning.

The vulnerability exists due to improper validation of banner payload length in the Ceph messenger v2 banner parser when parsing a crafted protocol banner. A remote attacker can send a banner with a zero-length payload to trigger a kernel warning.

The protocol requires banner payloads to contain at least two 64-bit feature fields.

553) Off-by-one (CVE-ID: CVE-2026-90068)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to an off-by-one error in snd_soc_dapm_put_enum_double() when writing a second enum channel value. A local user can set the second enum channel value equal to the number of enum items to read one element past the end of the value table.

The affected adav80x control reports two values, and core input validation is disabled by default.

554) Unchecked Return Value (CVE-ID: CVE-2026-90070)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause TPM status checks to complete spuriously.

The vulnerability exists due to an unchecked return value in the st33zp24_status callback when processing failed TPM transport reads. A local user can trigger a TPM status read to cause TPM status checks to complete spuriously.

On I2C transports, this can occur when the register-select write is short or fails.

555) Use-after-free (CVE-ID: CVE-2026-90071)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to failure to restore the skb->dev device pointer in the sch_teql TEQL scheduler when transmitting packets through TEQL slave devices. A local user can cause a packet to retain a stale device pointer after a slave transmission failure.

Exploitation requires a later slave device without a resolved neighbour and deletion of the previous slave while the packet remains queued.

556) Integer overflow (CVE-ID: CVE-2026-90072)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in sfq_init() of the SFQ queueing discipline when initializing SFQ on a device with an MTU that wraps psched_mtu() into the sign bit. A local user can configure a device with a crafted MTU value to cause a denial of service.

Exploitation requires CAP_NET_ADMIN in a user namespace.

557) Integer overflow (CVE-ID: CVE-2026-90073)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an integer overflow in the HHF queuing discipline's hhf_dequeue() function when configuring an HHF qdisc on a device with an oversized MTU. A local user can configure the HHF qdisc to trigger an infinite loop to cause a denial of service.

Exploitation requires CAP_NET_ADMIN in a user namespace and a device whose MTU plus hard-header length wraps psched_mtu() into the sign bit.

558) Integer overflow (CVE-ID: CVE-2026-90074)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to signed integer overflow in the fq_pie queuing discipline when initializing the default quantum from a device MTU. A local privileged user can configure a device with a huge MTU to cause a denial of service.

Exploitation requires CAP_NET_ADMIN in a user namespace and a device whose MTU plus hard header length causes psched_mtu() to wrap into the sign bit.

559) Integer overflow (CVE-ID: CVE-2026-90075)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an integer overflow in the fq_codel queueing discipline initialization when initializing fq_codel on a device whose MTU causes psched_mtu() to wrap into the sign bit. A local privileged user can configure a device with an oversized MTU to cause a denial of service.

560) Integer underflow (CVE-ID: CVE-2026-90078)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper length calculation in tcf_skbmod_act() when processing short IP packets at TC ingress. A remote attacker can send a short IP packet to cause a denial of service.

Exploitation requires the skbmod action to process ECN modifications at TC ingress.

561) Race condition (CVE-ID: CVE-2026-90081)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in rds_cong_map_updated() when handling congestion map updates. A local user can race congestion map updates with waiter registration to cause a denial of service.

A sender waiting on a congested port can remain blocked until another congestion update arrives or a signal is delivered, and poll() waiters can miss map-update notifications.

562) Improper input validation (CVE-ID: CVE-2026-90088)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in rfcomm_apply_pn() when processing remote parameter negotiation frames. A remote attacker can send a parameter negotiation frame with an MTU value of zero to cause a denial of service.

563) NULL pointer dereference (CVE-ID: CVE-2026-90102)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper cache keying in the NFSv4 pNFS data server cache when processing GETDEVICEINFO data. A remote attacker can supply device information for two device IDs using the same data server address with different major NFS versions to cause a denial of service.

564) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-90103)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to incorrect buffer size calculation in the NFSv4.2 flexfiles layoutstats encoder when encoding layout statistics for a flexfiles layout. A remote attacker can provide crafted server-controlled filehandle and network-address data to exhaust the send buffer and leave a lock permanently held to cause a denial of service.

565) Memory leak (CVE-ID: CVE-2026-90107)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in smc_llc_flow_stop() when a late duplicate CONFIRM_LINK or ADD_LINK_CONT message arrives before the flow completes. A remote attacker can send a duplicate message during this window to cause a denial of service.

566) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-90114)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unpredictable request return values.

The vulnerability exists due to an incorrect signed-to-unsigned conversion in br_process_vlan_tunnel_info when processing bridge VLAN tunnel range requests. A local user can submit a bridge VLAN tunnel range with descending VLAN IDs to cause unpredictable request return values.

567) Memory leak (CVE-ID: CVE-2026-90126)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the pcf8563 RTC driver's CLKOUT clock provider registration when repeatedly binding and unbinding a device. A local privileged user can repeatedly bind and unbind a device or reload the module to cause a denial of service.

568) Memory leak (CVE-ID: CVE-2026-90128)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through memory resource exhaustion.

The vulnerability exists due to improper resource cleanup in add_direct_chain() in the vdpa/mlx5 memory-region handling code when handling allocation errors while creating a direct memory-region chain. A local user can trigger an allocation error to cause a denial of service through memory resource exhaustion.

Newly allocated direct memory-region entries are kept on a temporary list until the operation succeeds.

569) Use-after-free (CVE-ID: CVE-2026-90140)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the cuse module's pending RCU callback handling when unloading the cuse module while a fuse connection release callback remains pending. A local privileged user can close /dev/cuse and unload the cuse module before the callback executes to cause a denial of service.

570) Integer overflow (CVE-ID: CVE-2026-90141)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause the FTP helper to configure a data connection with a truncated port or address.

The vulnerability exists due to integer overflow in the ip_vs_ftp_get_addrport() function of the IPVS FTP helper when parsing a crafted FTP PASV or EPSV response. A remote attacker can send a crafted FTP PASV or EPSV response to cause the FTP helper to configure a data connection with a truncated port or address.

571) Improper locking (CVE-ID: CVE-2026-90143)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel warning.

The vulnerability exists due to improper locking in kcm_parse_func_strparser() when executing a KCM strparser BPF program. A local user can invoke BPF map operations from the program to cause a kernel warning.

572) Use-after-free (CVE-ID: CVE-2026-90151)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the NFSv4 callback identifier IDR when an NFSv4.0 callback lookup occurs after a client allocation failure. A remote attacker can trigger an NFSv4.0 callback lookup using the stale callback identifier to trigger a use-after-free.

Exploitation requires an NFSv4.0 client allocation to fail after a callback identifier has been allocated.

573) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-90157)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a hardened usercopy warning.

The vulnerability exists due to an improper signed-to-unsigned conversion in __cgroup_bpf_run_filter_getsockopt_kern() when a cgroup getsockopt BPF program modifies ctx.optlen after the kernel getsockopt handler has run. A local user can set ctx.optlen to a negative value to trigger a hardened usercopy warning.

The issue affects the kernel-buffer getsockopt path used by TCP_ZEROCOPY_RECEIVE.

574) Off-by-one (CVE-ID: CVE-2026-90160)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an off-by-one headroom validation error in the lwt_bpf bpf_xmit() path when an LWT_XMIT BPF program modifies skb headroom. A local privileged user can call bpf_skb_change_head() to leave insufficient headroom and cause a denial of service.

On Ethernet, cached hardware-header output requires 16 bytes of headroom although the device hard-header length is 14 bytes.

575) Use-after-free (CVE-ID: CVE-2026-90198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in snd_card_do_free() when a managed sound card is unbound while an application retains an open file descriptor. A local user can close the open file descriptor while the managed sound card is being unbound to trigger a use-after-free.

576) NULL pointer dereference (CVE-ID: CVE-2026-90202)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the _base_release_memory_pools() function of the mpt3sas driver when releasing PCIe SGL buffers after a partial allocation failure. A local user can trigger memory-pool cleanup after a partial allocation failure to cause a denial of service.

577) Memory corruption (CVE-ID: CVE-2026-90203)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of a negative block offset in squashfs_copy_data() when reading a crafted file from a mounted crafted Squashfs filesystem. A local user can read a crafted file with a negative offset to cause an out-of-bounds memory access.

Mounting the crafted Squashfs filesystem requires CAP_SYS_ADMIN.

578) Deadlock (CVE-ID: CVE-2026-90209)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in the s390 debug subsystem's debug area unregistration handling when a debugfs file associated with a debug area is written concurrently with debug area unregistration. A local user can write to an associated debugfs file while debug area unregistration occurs to cause a denial of service.

579) Use-after-free (CVE-ID: CVE-2026-90214)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper error handling in xlnx_formatter_pcm_open() in the ASoC Xilinx formatter PCM driver when handling errors during PCM stream initialization. A local user can open a PCM stream that encounters a constraint setup error to trigger a use-after-free condition.

ALSA does not invoke the close callback when opening a stream fails.

580) Incomplete cleanup (CVE-ID: CVE-2026-90216)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leave UBI devices attached after failed module initialization.

The vulnerability exists due to incomplete cleanup in ubi_init_attach() when rolling back initialization after an mtd= parameter specifies an explicit UBI device number. A local privileged user can configure an explicit UBI device number and trigger a later initialization failure to leave UBI devices attached after failed module initialization.

581) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-90218)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper handling of an error condition in the RDMA connection manager addr_handler() function when asynchronous address resolution fails to acquire an RDMA device. A local user can initiate asynchronous address resolution for which RDMA device acquisition fails to trigger a kernel warning.

582) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90219)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to missing release of debugfs resources in c4iw_dealloc() when RDMA device registration fails. A local user can trigger a failed RDMA device registration to cause a resource leak.

583) Use of uninitialized resource (CVE-ID: CVE-2026-90221)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read uninitialized slab memory.

The vulnerability exists due to improper length validation in the nci_core_init_rsp_packet_v1() and nci_core_init_rsp_packet_v2() CORE_INIT_RSP parsers when processing a malformed CORE_INIT_RSP packet injected through virtual_ncidev. A local user can inject a malformed response with an inflated number of supported RF interfaces to read uninitialized slab memory.

584) Use-after-free (CVE-ID: CVE-2026-90222)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the PN533 NFC driver send path when command completion races frame transmission. A local user can trigger the race condition to cause a denial of service.

585) Out-of-bounds read (CVE-ID: CVE-2026-90223)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in nfc_llcp_recv_snl() when processing malformed SNL TLVs. A remote attacker can send a malformed SNL frame to perform an out-of-bounds read.

LLCP link activation occurs automatically after NFC-DEP.

586) Use-after-free (CVE-ID: CVE-2026-90224)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a race condition in nci_data_exchange_complete when concurrently closing an NCI device and processing received data. A local user can race device closure with received-data processing to trigger a use-after-free condition.

587) Use-after-free (CVE-ID: CVE-2026-90225)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in nfc_llcp_getsockopt() when racing a getsockopt call with an in-flight bind operation. A local user can invoke getsockopt() while bind() modifies and frees the cached local pointer to trigger a use-after-free condition.

588) Out-of-bounds write (CVE-ID: CVE-2026-90226)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write past a user-supplied buffer.

The vulnerability exists due to improper validation of option-buffer length in nfc_llcp_getsockopt() when handling getsockopt calls with an option length smaller than four bytes. A local user can supply an option buffer with an option length smaller than four bytes to write past a user-supplied buffer.

The issue affects all five supported option names.

589) NULL pointer dereference (CVE-ID: CVE-2026-90228)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in nvmet_execute_identify_ns_zns() when processing a host-supplied Identify command with CNS 05h and CSI 02h targeting a file-backed namespace. A remote attacker can send a crafted Identify command targeting a file-backed namespace to cause a denial of service.

The issue is reachable only when CONFIG_BLK_DEV_ZONED is enabled.

590) Integer overflow (CVE-ID: CVE-2026-90245)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect overlay viewport register configuration.

The vulnerability exists due to integer overflow in the kyro framebuffer driver's overlay viewport coordinate calculations when processing oversized overlay viewport coordinates. A local user can supply oversized viewport coordinate values to cause incorrect overlay viewport register configuration.

591) Race condition (CVE-ID: CVE-2026-90248)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to silently unlink an active traffic classifier.

The vulnerability exists due to improper ownership tracking in tc_new_tfilter() when handling concurrent traffic-control filter insertions. A local user can race another request to insert a traffic-control filter at the same chain and priority to silently unlink an active traffic classifier.

592) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-90249)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper runtime power-management reference handling in the gp2ap002_write_event_config() function when writing duplicate event enable values. A local user can write the same event enable state twice to cause a denial of service.

593) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-90251)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause the kernel to read data beyond the controller response.

The vulnerability exists due to improper validation of an event prefix length in the Bluetooth MSFT read_supported_features() handler when handling an MSFT read supported features response from a Bluetooth controller. A remote attacker can provide a response whose declared event-prefix length exceeds its actual length to cause the kernel to read data beyond the controller response.

The copied data is later used to match incoming vendor events.

594) Out-of-bounds read (CVE-ID: CVE-2026-90257)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in virtbt_setup_zephyr() when processing a status-only Read Build Information response from a Bluetooth virtio backend. A local user can provide a response containing only a status byte to disclose sensitive information.

Adjacent slab memory bytes may be exposed through the kernel log and the firmware-info debugfs file.

595) Integer underflow (CVE-ID: CVE-2026-90274)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds memory access.

The vulnerability exists due to an integer underflow in the ETM4x CoreSight trace driver when handling sequencer state transition controls. A local user can configure sequence state controls to trigger an out-of-bounds memory access.

The issue occurs on trace units for which TRCIDR5.NUMSEQSTATE is zero.

596) NULL pointer dereference (CVE-ID: CVE-2026-90281)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the Qualcomm SNPS Femto v2 PHY driver's runtime PM callbacks when a runtime suspend callback runs during PHY initialization. A local user can trigger a runtime suspend callback before the PHY instance is ready to cause a denial of service.

597) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90283)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause huge page reservations to remain charged.

The vulnerability exists due to improper resource cleanup in the hugetlbfs_fill_super() failure path when initiating a hugetlbfs mount with size or min_size options and root dentry creation fails. A local user can trigger the mount failure path to cause huge page reservations to remain charged.

598) Race condition (CVE-ID: CVE-2026-90284)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the firmware sysfs fallback loader when a userspace helper completes a firmware request after the loading interface is exposed but before the request is added to the pending request list. A local user can write 0 to the loading attribute to cause a denial of service.

599) Race condition (CVE-ID: CVE-2026-90285)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger concurrent flash access operations.

The vulnerability exists due to improper synchronization in qla2x00_sysfs_read_vpd() in the qla2xxx driver when reading VPD data through sysfs while concurrent optrom operations are occurring. A local user can read VPD data through sysfs during concurrent optrom operations to trigger concurrent flash access operations.

600) Race condition (CVE-ID: CVE-2026-90286)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause GPU command submissions to execute out of order.

The vulnerability exists due to improper synchronization in the AMDGPU GFX6 compute queue handling when submitting GPU compute workloads. A local user can submit GPU compute workloads to cause GPU command submissions to execute out of order.

GFX6 compute queues share the command processing path used by graphics queues.

601) Improper handling of exceptional conditions (CVE-ID: CVE-2026-90290)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper handling of exceptional conditions in swsusp_arch_suspend() when handling a failure from swsusp_mte_save_tags(). A local privileged user can trigger the hibernation error path to cause a denial of service.

602) Use-after-free (CVE-ID: CVE-2026-90292)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to improper reference counting in the RDMA/siw siw_accept() function when handling a userspace-supplied queue pair that is already in the RTS state. A local user can supply such a queue pair to cause a use-after-free condition.

603) Race condition (CVE-ID: CVE-2026-90293)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in the iSER target login receive-buffer handling when processing a SCSI command before the final Login Response. A remote attacker can send a SCSI command before receiving the final Login Response to cause a denial of service.

604) Race condition (CVE-ID: CVE-2026-90294)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in iSER target login-response handling when an initiator submits a SCSI command immediately after receiving the final Login Response. A remote attacker can send a specially timed SCSI command to cause a denial of service.

605) Out-of-bounds write (CVE-ID: CVE-2026-90295)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the imx6q cpufreq driver when probing the driver after it has been unbound. A local user can rebind the driver to cause memory corruption.

606) Memory leak (CVE-ID: CVE-2026-90296)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the imx6q cpufreq driver when rebinding the driver. A local user can repeatedly rebind the driver to cause a denial of service.

607) NULL pointer dereference (CVE-ID: CVE-2026-90297)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in sun4i_crtc_init() when initializing display layers. A local user can trigger a layer initialization failure to cause a denial of service.

608) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90298)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak device references.

The vulnerability exists due to improper resource release in the sun8i_r40_tcon_tv_set_mux function when configuring the TCON TV multiplexer. A local user can trigger TCON TV multiplexer configuration to leak device references.

609) Use-after-free (CVE-ID: CVE-2026-90302)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the OCFS2 o2net heartbeat callback handling when local-node teardown overlaps heartbeat node-down callback processing. A local user can initiate local-node teardown during heartbeat callback processing to cause a denial of service.

610) Use-after-free (CVE-ID: CVE-2026-90303)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in show_pte() when handling user faults concurrently with munmap() calls. A local user can trigger a user fault while another thread in the same process calls munmap() to cause a denial of service.

Exploitation requires CONFIG_DEBUG_USER=y and the user_debug=31 command-line setting.

611) Out-of-bounds read (CVE-ID: CVE-2026-90307)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the SRP response-processing handlers when processing truncated SRP requests. A remote attacker can send a crafted truncated SRP_CRED_REQ or SRP_AER_REQ to disclose sensitive information.

Exploitation requires an SRP target to advertise a small max_ti_iu_len value during login.

612) Out-of-bounds read (CVE-ID: CVE-2026-90314)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to improper signedness handling in rsc_table_for_each_entry() when processing a firmware resource table. A local user can provide a crafted firmware resource table containing an offset interpreted as negative to read memory out of bounds.

613) Use-after-free (CVE-ID: CVE-2026-90316)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in OMAP DSI interrupt service routine table handling when unregistering interrupts while they are being handled. A local user can unregister interrupts during interrupt handling to trigger a use-after-free condition.

614) Improper resource shutdown or release (CVE-ID: CVE-2026-90318)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a resource leak.

The vulnerability exists due to improper resource release in fat_rebuild_parent() when rebuilding parent inodes through the nostale_ro NFS export path. A remote user can trigger parent inode reconstruction without releasing the buffer head to cause a resource leak.

615) Use-after-free (CVE-ID: CVE-2026-90319)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the RapidIO rio_scan_alloc_net() failure path when handling a rio_add_net() failure. A local user can trigger a subsequent mport unregister path to dereference a dangling mport->net pointer and attempt to free the rio_net object again.

616) Out-of-bounds write (CVE-ID: CVE-2026-90327)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write up to three bytes beyond a user-supplied buffer.

The vulnerability exists due to an out-of-bounds write in the phonet PEP socket option handler pep_getsockopt() when calling getsockopt() with an optlen smaller than sizeof(int). A local user can invoke getsockopt() with a small optlen to write up to three bytes beyond a user-supplied buffer.

617) Use-after-free (CVE-ID: CVE-2026-90329)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in HID failed-probe cleanup when a HID report callback runs concurrently with a failed device probe. A local user can cause a HID report to be processed while a device probe fails to trigger a use-after-free.

618) Use-after-free (CVE-ID: CVE-2026-90334)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to use-after-free in tty_cdev_add() when handling a cdev_add() failure. A local user can trigger tty device unregistration after cdev_add() fails to cause a use-after-free.

619) Integer overflow (CVE-ID: CVE-2026-90341)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory outside the platform resource.

The vulnerability exists due to integer overflow and insufficient bounds validation in coreboot_table_probe() when processing a malformed coreboot table. A local user can supply a malformed coreboot table to access memory outside the platform resource.

620) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-90348)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper handling of device-memory mappings in ath10k_msa_dump_memory() when collecting an MSA firmware crash dump. A local privileged user can cause firmware crash dump collection to cause a denial of service.

621) Race condition (CVE-ID: CVE-2026-90360)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning during system suspend.

The vulnerability exists due to a race condition involving a non-freezable workqueue in the regulator core when delayed regulator cleanup runs concurrently with system suspend. A local user can cause system suspend to overlap with delayed regulator cleanup to trigger a kernel warning during system suspend.

The cleanup work runs approximately 30 seconds after boot to disable unused regulators via I2C. If the I2C adapter is already suspended, the transfer triggers a -ESHUTDOWN warning in __i2c_transfer().

622) Memory leak (CVE-ID: CVE-2026-90361)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory cleanup in ath11k_service_ready_ext_event() when parsing service-ready extension TLVs. A local user can cause parsing to fail after mac_phy_caps has been allocated to cause a denial of service.

623) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-90362)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the DSI link clock to run without necessary power backing.

The vulnerability exists due to improper power-state management in dsi_link_clk_disable_6g() when disabling DSI link clocks. A local user can trigger the DSI link clock disable path to cause the DSI link clock to run without necessary power backing.

624) Integer underflow (CVE-ID: CVE-2026-90372)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-range spatial-stream value to be written to firmware beamforming fields.

The vulnerability exists due to an integer underflow in mt7915_mcu_get_sta_nss when processing a peer VHT/HE MCS map with no supported spatial streams. A remote attacker can advertise a crafted VHT/HE MCS map to cause an out-of-range spatial-stream value to be written to firmware beamforming fields.

625) Memory leak (CVE-ID: CVE-2026-90378)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper memory management in the mt76 SDIO transmit path when tx_prepare_skb() returns an error while processing zero-length frames. A local user can submit a zero-length frame to cause a memory leak.

626) Reachable assertion (CVE-ID: CVE-2026-90382)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a kernel panic and denial of service.

The vulnerability exists due to a reachable assertion in the mt76x02 receive-processing path when processing a corrupted wireless frame with a receive descriptor length larger than the received buffer. A remote attacker can transmit a corrupted over-the-air frame to cause a kernel panic and denial of service.

Exploitation requires monitor mode with the fcsfail filter enabled and panic_on_warn set.

627) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-90386)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a shift-out-of-bounds condition.

The vulnerability exists due to an incorrect bitwise shift calculation in the DesignWare I3C master DAA handler when ENTDAA assigns no devices on an empty I3C bus. A local user can initiate dynamic address assignment on an empty I3C bus to trigger a shift-out-of-bounds condition.

628) Unchecked Return Value (CVE-ID: CVE-2026-90388)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an IOMMU mapping to be attempted after an allocation failure.

The vulnerability exists due to improper check of an allocation return value in iommu_dma_alloc when executing the non-blocking, non-coherent allocation path. A local user can invoke the affected allocation path during an allocation failure to cause an IOMMU mapping to be attempted after an allocation failure.

The affected path requires CONFIG_DMA_DIRECT_REMAP and non-coherent allocation.

629) Infinite loop (CVE-ID: CVE-2026-90391)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in dmirror_fault() in lib/test_hmm.c when handling dmirror read or write ioctl operations after the mirrored mm has exited. A local user can issue dmirror read or write ioctl operations to cause a denial of service.

The loop is reached after a missing device page table entry is encountered.

630) Use-after-free (CVE-ID: CVE-2026-90393)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a race condition in bpf_netns_link_update_prog when concurrently executing BPF_LINK_UPDATE operations on the same network namespace link. A local user can race program updates to trigger a use-after-free condition.

631) Use-after-free (CVE-ID: CVE-2026-90394)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed driver data.

The vulnerability exists due to use-after-free in the sc2731_charger driver's remove path when queued or running work executes after driver data is released. A local user can cause the driver to be removed while work remains queued or running to access freed driver data.

632) Use-after-free (CVE-ID: CVE-2026-90395)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to access freed power supply state.

The vulnerability exists due to a use-after-free in the isp1704 charger driver's remove path when queued or running work executes during device removal. A local privileged user can cause work scheduled by USB notification or initial VBUS detection to execute after the power supply state is torn down to access freed power supply state.

633) Incomplete cleanup (CVE-ID: CVE-2026-90403)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.

The vulnerability exists due to incomplete cleanup caused by an incorrect goto label in the rtl_pci_probe() function when handling an IRQ handler registration failure. A local user can trigger this error path to compromise system confidentiality, integrity, and availability.

634) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90411)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a DMA mapping resource leak.

The vulnerability exists due to improper resource cleanup in __nvme_fc_init_request() when handling a response IU DMA mapping failure. A local user can trigger request initialization with a response IU DMA mapping failure to cause a DMA mapping resource leak.

635) Out-of-bounds read (CVE-ID: CVE-2026-90413)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the iSER login PDU handling code when processing a login PDU whose declared data segment length exceeds the received payload length. A remote attacker can send a crafted login PDU with an oversized declared data segment length to read out-of-bounds memory.

The issue can be triggered before authentication.

636) Out-of-bounds read (CVE-ID: CVE-2026-90414)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause an out-of-bounds read and write heap contents beyond the receive descriptor to backing storage.

The vulnerability exists due to missing validation of the declared data segment length in isert_recv_done() when processing iSER/iSCSI PDUs. A remote user can send a PDU that declares a data segment larger than the received data to cause an out-of-bounds read and write heap contents beyond the receive descriptor to backing storage.

Exploitation requires the full feature phase and negotiated parameters that permit unsolicited or immediate data.

637) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90415)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the RDMA/cxgb4 write_tpt_entry() function when programming a TPT entry. A local user can trigger a failed TPT entry write to cause a denial of service.

638) Out-of-bounds read (CVE-ID: CVE-2026-90416)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the get_param() function of the cc_params debugfs interface when reading a congestion parameter. A local user can read a crafted congestion parameter value through the debugfs interface to disclose sensitive information.

The issue is triggered when the parameter value has bit 31 set.

639) Out-of-bounds read (CVE-ID: CVE-2026-90419)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to improper input validation in nilfs2 super-root block parsing when processing a malformed filesystem image. A local user can supply a malformed filesystem image to perform an out-of-bounds read.

640) Infinite loop (CVE-ID: CVE-2026-90420)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of terminal errors in nilfs_clean_segments() when the cleaner ioctl encounters repeated -EROFS errors from nilfs_segctor_construct(). A local user can invoke the cleaner ioctl to cause a denial of service.

The issue can occur when the device is remounted read-only after an I/O error.

641) Use-after-free (CVE-ID: CVE-2026-90431)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the remoteproc crash-handler work when crash reporting races with remoteproc deletion. A local user can trigger concurrent crash reporting and remoteproc removal to cause a denial of service.

642) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90434)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust buffer-head resources.

The vulnerability exists due to failure to release a buffer-head reference in zisofs_fill_pages() when successfully reading compressed block pointer tables. A local user can cause zisofs_fill_pages() to read compressed block pointer tables to exhaust buffer-head resources.

643) Integer overflow (CVE-ID: CVE-2026-90435)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to integer overflow in the mlx5 RDMA driver's set_user_buf_size() function when processing user-supplied QP buffer parameters. A local user can supply an excessively large rq.wqe_cnt value to cause memory corruption.

The same unchecked shift calculation is also used to compute qp->sq.offset during user QP creation.

644) Use of uninitialized resource (CVE-ID: CVE-2026-92476)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger use of an uninitialized completion.

The vulnerability exists due to use of an uninitialized resource in the Keem Bay OCS AES driver's kmb_ocs_aes_probe() routine when a device interrupt occurs after IRQ registration and before completion initialization. A local user can trigger a device interrupt during this initialization window to trigger use of an uninitialized completion.

645) Memory leak (CVE-ID: CVE-2026-92494)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a buffer_head reference leak.

The vulnerability exists due to improper resource release in ext4_init_orphan_info() when processing orphan file blocks with an invalid magic value or checksum. A local user can cause ext4_init_orphan_info() to process such orphan file blocks to cause a buffer_head reference leak.

646) Out-of-bounds read (CVE-ID: CVE-2026-92496)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in ath11k_wmi_tlv_op_rx() when processing a firmware buffer shorter than a WMI command header. A local user can supply a malformed firmware buffer to read out-of-bounds memory.

647) Out-of-bounds read (CVE-ID: CVE-2026-92498)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read beyond the bounds of WMI event buffers.

The vulnerability exists due to an out-of-bounds read in ath6kl WMI event handlers when processing undersized WMI events. A remote attacker can provide a malformed WMI event to read beyond the bounds of event buffers.

648) Race condition (CVE-ID: CVE-2026-92501)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in ext4_buffered_write_iter() when a direct I/O write falls back to buffered I/O while concurrent direct I/O completes. A local user can issue concurrent direct I/O operations to cause a denial of service.

The issue can also occur when non-overlapping direct I/O writes share a large folio and the block size is smaller than the folio size.

649) Improper resource shutdown or release (CVE-ID: CVE-2026-92504)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak.

The vulnerability exists due to improper resource cleanup in the int3400 thermal driver's ODVP handling when driver probing fails after evaluate_odvp() has created ODVP sysfs files. A local user can trigger a driver probe failure after ODVP evaluation to cause a resource leak.

650) Use-after-free (CVE-ID: CVE-2026-92508)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in the RDMA/core ib_free_cq() completion queue destruction function when accessing a completion queue through the netlink path while it is being destroyed. A local user can access a completion queue through netlink during its destruction to trigger a use-after-free condition.

651) Use-after-free (CVE-ID: CVE-2026-92521)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger use of freed memory.

The vulnerability exists due to a use-after-free in ACPI PCI root handling when processing hot-add failures or root bridge removal. A local user can invoke a later acpi_pci_find_root() lookup to trigger use of freed memory.

The freed root object remains referenced by device->driver_data.

652) Out-of-bounds read (CVE-ID: CVE-2026-92522)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read out-of-bounds memory.

The vulnerability exists due to improper bounds validation in the ACPI IOAPIC hotplug lookup when parsing MADT and _MAT records. A local privileged user can provide a malformed record with a truncated header, an oversized declared length, or an incomplete IOAPIC body to read out-of-bounds memory.

Only builds with CONFIG_ACPI_HOTPLUG_IOAPIC enabled include the affected code.

653) Improper resource shutdown or release (CVE-ID: CVE-2026-92524)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in its_vpe_irq_domain_alloc() when an interrupt allocation fails. A local user can trigger an allocation failure to cause a denial of service.

654) Unchecked Return Value (CVE-ID: CVE-2026-93037)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause improper processing of a request.

The vulnerability exists due to an unchecked return value in the set_txreq_header_ahg() function when initializing an accelerated header generation transmit request. A local user can submit a request for which sdma_txinit_ahg() fails to cause improper processing of a request.

655) Use-after-free (CVE-ID: CVE-2026-93039)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free and double free.

The vulnerability exists due to a stale pointer after reallocation in meson_card_reallocate_links() when handling failure of the second memory reallocation after the first reallocation moves the DAI link array. A local user can cause the second memory reallocation to fail after the first reallocation moves the DAI link array to trigger a use-after-free and double free.

656) Race condition (CVE-ID: CVE-2026-93040)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the DesignWare eDMA channel state handling when pause(), resume(), or issue_pending() evaluates channel state concurrently with interrupt handlers. A local user can invoke DMA channel operations during a concurrent state transition to cause a denial of service.

657) Race condition (CVE-ID: CVE-2026-93041)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the dw-edma abort interrupt handler when aborting a DMA request while queued descriptors are being started. A local user can trigger an abort during the state transition to leave queued descriptors unprocessed and the channel idle.

658) Memory corruption (CVE-ID: CVE-2026-93046)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory out of bounds.

The vulnerability exists due to improper bounds checking in software_node_get_reference_args() when handling a reference argument index value of UINT_MAX. A local user can provide an index value of UINT_MAX to access memory out of bounds.

659) Integer underflow (CVE-ID: CVE-2026-93048)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to integer underflow in mtd_add_partition() when processing BLKPG ioctl requests on NAND devices. A local user can pass MTDPART_OFS_RETAIN (-3) as a partition offset to trigger a kernel warning.

Depending on the size calculation, an empty disabled partition can be created.

660) Double free (CVE-ID: CVE-2026-93049)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in mtdswap_add_mtd() cleanup handling when debugfs setup fails after blktrans device registration. A local user can trigger the debugfs failure sequence to cause a denial of service.

661) Use-after-free (CVE-ID: CVE-2026-93051)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel ad525x_dpot driver's sysfs attribute handling when removing a device without removing its command sysfs attributes before freeing driver data. A local user can access command sysfs attributes that remain exposed after the driver data is freed to cause a denial of service.

The command sysfs attributes are exposed only for devices supporting the F_CMD_INC feature.

662) Race condition (CVE-ID: CVE-2026-93052)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access message queues using stale cached queue information.

The vulnerability exists due to improper synchronization in the bcm-vk message queue initialization and driver access checks when initializing message queues concurrently with driver access. A local user can race message queue initialization with driver access to access message queues using stale cached queue information.

663) Out-of-bounds write (CVE-ID: CVE-2026-93053)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause an out-of-bounds write.

The vulnerability exists due to improper validation of function-name initial characters in the speakup keyhelp letter_offsets[] handling when processing function names overridden through sysfs. A local privileged user can override a function name with an initial character outside the a-z range to cause an out-of-bounds write.

664) Use-after-free (CVE-ID: CVE-2026-93054)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the __uio_register_device() UIO registration failure path when an opener races with a failed registration after device_add(). A local user can race opening /dev/uioX with a failed device registration to cause a denial of service.

665) Out-of-bounds read (CVE-ID: CVE-2026-93055)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in udf_pc_to_char() when processing malformed UDF symlink data containing a partial pathComponent header. A local user can provide malformed UDF symlink data containing a partial pathComponent header to cause an out-of-bounds read.

666) NULL pointer dereference (CVE-ID: CVE-2026-93056)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the f_uac1_legacy configfs string attribute store handler when writing to the fn_play, fn_cap, or fn_cntl attribute during a memory-allocation failure. A local user can write to an affected configfs attribute while memory allocation fails to cause a denial of service.

667) Buffer Over-read (CVE-ID: CVE-2026-93061)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in host1x_debug_output() and host1x_debug_cont() when generating debug output longer than 256 bytes. A local user can access affected debugfs output to disclose sensitive information.

Only debugfs files are affected; the printk debug sink ignores the supplied byte count.

668) Stack-based buffer overflow (CVE-ID: CVE-2026-93067)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a stack-based buffer overflow.

The vulnerability exists due to improper validation of controller-reported AUX byte counts in tc_aux_transfer() and tc_aux_read_data() when handling AUX read transfers. A local user can trigger processing of an AUX read response that reports a byte count larger than requested to cause a stack-based buffer overflow.

The controller-reported byte count can be as high as 255 despite the 16-byte auxrdata stack buffer.

669) Out-of-bounds write (CVE-ID: CVE-2026-93095)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds write.

The vulnerability exists due to improper validation of catalog thread records in hfsplus_delete_cat() when rebuilding a catalog key from a corrupted HFS+ image. A local user can supply a corrupted HFS+ image with an oversized thread name length to cause an out-of-bounds write.

670) Deadlock (CVE-ID: CVE-2026-93098)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a deadlock in GLINK endpoint destruction when detaching an rpmsg driver. A local privileged user can trigger driver detachment to cause a denial of service.

671) Memory leak (CVE-ID: CVE-2026-93102)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource cleanup in the hfi1 init_one() cleanup path when hfi1_init() or hfi1_register_ib_device() fails after RX support allocation. A local user can trigger a late probe failure to cause a denial of service.

672) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-93103)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of an allocation failure in hfi1_free_devdata() when allocating a unit ID for an HFI1 device. A local user can cause unit ID allocation to fail to cause a denial of service.

The issue occurs when cleanup runs before the device has been inserted into the unit table.

673) Race condition (CVE-ID: CVE-2026-93108)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper synchronization in the IPoIB module teardown path when unloading the module while RCU callbacks remain pending. A local privileged user can initiate module teardown before queued RCU callbacks complete to cause a denial of service.

The condition can also occur after client registration failure removes already-added devices and queues callbacks.

674) Use-after-free (CVE-ID: CVE-2026-93109)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a failure to wait for queued RCU callbacks in mlx5_ib module teardown when closing a DevX event file or detaching auxiliary driver devices. A local user can close a DevX event file to cause a denial of service.

The issue can also occur during registration error unwinding after driver registration attaches existing devices before failing.

675) Use-after-free (CVE-ID: CVE-2026-93110)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free condition in the RDMA core ib_core cleanup routine when unloading the ib_core module after RCU callbacks have been queued. A local privileged user can cause queued callbacks to invoke unloaded module code to cause a denial of service.

Exploitation requires RCU callbacks queued by put_gid_ndev() before module unloading.

676) NULL pointer dereference (CVE-ID: CVE-2026-93114)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in san_probe when the Surface ACPI notification driver is force-bound to a device without an ACPI companion. A local user can force-bind the driver to such a device to cause a denial of service.

677) NULL pointer dereference (CVE-ID: CVE-2026-93115)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the mlxbf_pmc_probe() function of the mlxbf-pmc driver when force-binding the driver to a device without an ACPI companion object. A local user can force-bind the driver to such a device to cause a denial of service.

678) Out-of-bounds read (CVE-ID: CVE-2026-93120)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in os_desc_qw_sign_show() in the USB gadget configfs implementation when converting a stored signature from UTF-16 to UTF-8. A local user can store a signature that fills the buffer without a NUL terminator and read the configfs attribute to disclose sensitive information.

679) Improper resource shutdown or release (CVE-ID: CVE-2026-93130)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a resource leak.

The vulnerability exists due to improper resource shutdown or release in the dell-wmi-base module initialization routine when module initialization fails. A local privileged user can trigger a module load failure to cause a resource leak.

680) Use-after-free (CVE-ID: CVE-2026-93131)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to a use-after-free race condition in the Dell privacy WMI driver when accessing the features_present field without holding the list mutex. A local user can trigger concurrent access to the field while the associated privacy data is freed to access freed memory.

681) Race condition (CVE-ID: CVE-2026-93138)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access incompletely initialized vmlinux BTF data.

The vulnerability exists due to a race condition in bpf_get_btf_vmlinux when concurrently invoking the function during first-time vmlinux BTF parsing. A local user can invoke the affected function concurrently to access incompletely initialized vmlinux BTF data.

The race can occur on weakly ordered architectures when CONFIG_DEBUG_INFO_BTF is enabled.

682) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-93140)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a spurious kernel warning.

The vulnerability exists due to improper handling of an exceptional I/O condition in the UDF Logical Volume Integrity Descriptor buffer when marking the buffer dirty after a write I/O error. A local user can remount the filesystem read-write or synchronize it to trigger a spurious kernel warning.

683) Double free (CVE-ID: CVE-2026-93141)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in r8a66597_probe() when usb_add_gadget_udc() fails. A local user can trigger the probe error path to cause a denial of service.

684) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-93145)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to failure to release generic power-domain structures in gdsc_unregister() when performing a provider unbind and rebind cycle. A local privileged user can trigger a provider unbind and rebind cycle to cause a denial of service.

685) Memory leak (CVE-ID: CVE-2026-93151)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a memory leak.

The vulnerability exists due to failure to release response resources in the nvmet-rdma queue teardown routine when an RDMA connection is forcefully disconnected while I/O operations are in flight. A remote attacker can disconnect an RDMA connection while I/O operations are in flight to cause a memory leak.

686) Unchecked Return Value (CVE-ID: CVE-2026-93158)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause crypto request setup failures.

The vulnerability exists due to unchecked return value handling in sa_ul_probe() when security-context DMA pool creation fails. A local user can initiate use of the driver after DMA pool creation fails to cause crypto request setup failures.

687) Incomplete cleanup (CVE-ID: CVE-2026-93159)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to incomplete cleanup in the atmel-sha204a nonblocking RNG path when an asynchronous I2C transfer fails. A local user can make subsequent read attempts after a failed I2C transfer to disclose sensitive information.

688) Key management errors (CVE-ID: CVE-2026-93160)

CWE-ID: CWE-320 - Key Management Errors

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to derive a shared secret using a private key not generated for the current transform context.

The vulnerability exists due to improper cryptographic key management in atmel_ecdh_compute_shared_secret() when processing hardware ECDH shared-secret requests without a cached public key. A local user can submit a hardware ECDH shared-secret request without a cached public key to derive a shared secret using a private key not generated for the current transform context.

689) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-93161)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive key material.

The vulnerability exists due to failure to clear sensitive information from stack memory in qat_alg_xts_reverse_key() when expanding a forward XTS AES key. A local user can access residual AES key material in stack memory to disclose sensitive key material.

690) Out-of-bounds read (CVE-ID: CVE-2026-93165)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to overread memory.

The vulnerability exists due to an out-of-bounds read in cros_ec_sensorhub_ring_handler() when processing FIFO information responses from EC firmware. A local privileged user can cause the handler to process a response whose length is shorter than expected to overread memory.

The condition can occur when EC firmware reports inconsistent maximum response and sensor-count values.

691) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2026-93167)

CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect stack offset handling in the C-SKY syscall trace path when tracing system calls with fifth or sixth arguments. A local user can trace a process executing a system call with five or six arguments to cause a denial of service.

The issue is limited to the C-SKY ABIv2 syscall trace path.

692) Race condition (CVE-ID: CVE-2026-93170)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause descriptor corruption or missed DMA completions.

The vulnerability exists due to a race condition in the Xilinx AXIDMA and MCDMA interrupt handlers when handling descriptor-completion interrupts. A local user can queue multiple active descriptors before a completion interrupt occurs to cause descriptor corruption or missed DMA completions.

Exploitation requires descriptors to remain in the active list after completed descriptors are moved to the done list.

693) Out-of-bounds read (CVE-ID: CVE-2026-93177)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the Vega10 PowerPlay hardware manager when parsing VBIOS-provided voltage dependency tables. A local user can provide voltage table entries containing out-of-range lookup indices to read out-of-bounds memory.

694) Out-of-bounds read (CVE-ID: CVE-2026-93178)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the SMU7 powerplay voltage lookup handling when processing VBIOS-parsed voltage table entries containing out-of-range voltage indices. A local user can provide VBIOS-parsed table entries with out-of-range voltage indices to perform an out-of-bounds read.

695) Improper initialization (CVE-ID: CVE-2026-93183)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization order in lima_device_init() when initializing the Lima device. A local user can trigger creation of an empty Lima VM before its allocation range is configured to cause a denial of service.

The kernel BUG condition is triggered when DRM_DEBUG_MM is enabled.

696) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-93185)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause active timer or work objects to remain after device removal.

The vulnerability exists due to improper cancellation of delayed work in rt700_sdw_remove() when removing an RT700 SoundWire codec after the SoundWire slave becomes unattached while jack work is pending. A local privileged user can cause the remove path to skip cancellation of pending jack work.

Practical reachability depends on SoundWire core remove ordering after an unattached status update.

697) Out-of-bounds read (CVE-ID: CVE-2026-93188)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose out-of-bounds data.

The vulnerability exists due to an out-of-bounds read in the Roccat Kone HID driver's profile handling when processing a device-supplied profile index. An attacker with physical access can connect a malicious USB device claiming the Roccat Kone ID and send a switch-profile event or provide a startup profile value during probing to disclose out-of-bounds data.

The out-of-bounds read result is exposed through the actual_dpi sysfs attribute.

698) Use-after-free (CVE-ID: CVE-2026-93189)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to failure to quiesce HID input before freeing objects in hid_hw_stop() in the HID core when a driver probe unwinds after HID input has been enabled while HID reports are in flight. A local user can trigger a failed driver initialization while HID reports are being processed to trigger a use-after-free condition.

699) Incorrect authorization (CVE-ID: CVE-2026-93191)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose messages to an unauthorized receiver.

The vulnerability exists due to improper authorization in smack_msg_queue_msgrcv when processing messages through the pipelined_send optimization for a waiting receiver. A local user can send a message to a queue while an unauthorized target task is waiting to receive it to disclose messages to an unauthorized receiver.

700) Race condition (CVE-ID: CVE-2026-93203)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt backbone gateway CRC values.

The vulnerability exists due to a race condition in batadv_bla_add_claim() when processing concurrent CLAIM frames for the same client. A remote attacker can send concurrent CLAIM frames to corrupt backbone gateway CRC values.

701) Race condition (CVE-ID: CVE-2026-93204)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to poison an ARP cache.

The vulnerability exists due to a race condition caused by non-atomic MAC address updates in batadv_dat_entry_add() in the batman-adv distributed ARP table when a MAC address is updated concurrently with a reader accessing the entry. A remote attacker can cause a MAC address update to race with a reader to poison an ARP cache.

702) Incorrect authorization (CVE-ID: CVE-2026-93206)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose PCI configuration-space information.

The vulnerability exists due to improper authorization using the credentials of the calling task rather than the opening process in proc_bus_pci_read() when reading PCI configuration space through procfs. A local privileged user can pass a file descriptor opened with CAP_SYS_ADMIN to an unprivileged process to disclose PCI configuration-space information.

703) Out-of-bounds read (CVE-ID: CVE-2026-93213)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the of_alias_scan() stem parser when parsing a property name that is empty or consists only of digits. A local user can trigger parsing of such a property name to perform an out-of-bounds read.

704) Deadlock (CVE-ID: CVE-2026-93214)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock ordering in usbg_make_tpg() when performing configfs dependency operations across subsystems. A local user can trigger concurrent configfs operations to cause a denial of service.

Exploitation requires a circular lock dependency involving configfs_rmdir().

705) Incorrect calculation (CVE-ID: CVE-2026-93219)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an incorrect minimum interval calculation in the sun4i clockevent timer driver when processing timer events. A local user can trigger timer events to cause a denial of service.

The issue can leave the next timer event stuck during oneshot, high-resolution, or nohz timer operation.

706) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-93222)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause signal sender identifiers to be incorrectly rewritten.

The vulnerability exists due to improper handling of shared siginfo data in the signal delivery logic when delivering group signals across namespaces. A local user can send a group signal to cause sender identifiers rewritten for one recipient to affect subsequent recipients.

707) Race condition (CVE-ID: CVE-2026-93226)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a race condition.

The vulnerability exists due to an unsafe iteration of an RCU-protected list in rt6_nh_dump_exceptions() when dumping IPv6 route exceptions while exception entries are concurrently added. A local user can initiate an IPv6 route dump during concurrent route exception insertion to trigger a race condition.

708) Out-of-bounds read (CVE-ID: CVE-2026-93234)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in gud_connector_add_tv_mode() when processing TV mode names returned by a GUD device. An attacker with physical access can provide a device response containing a TV mode name without a NUL terminator to perform an out-of-bounds read.

709) NULL pointer dereference (CVE-ID: CVE-2026-93236)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in vdec_try_fmt_common() when processing a VIDIOC_TRY_FMT request with an unsupported pixel format on the OUTPUT queue. A local user can submit a crafted VIDIOC_TRY_FMT request to cause a denial of service.

The issue occurs when MPEG2 support has been locally removed and is absent from the platform format table.

710) Off-by-one (CVE-ID: CVE-2026-93242)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause legitimate firmware responses to be dropped.

The vulnerability exists due to an off-by-one error in __qla_consume_iocb() in the qla2xxx response queue handler when processing response queue IOCBs. A local user can trigger response queue processing to consume an unrelated IOCB and cause legitimate firmware responses to be dropped.

711) Improper initialization (CVE-ID: CVE-2026-93245)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper initialization of list heads in AppArmor policy initialization when handling a profile creation failure before initialization completes. A local user can attempt to load a profile that fails during creation to trigger a kernel warning.

712) Deadlock (CVE-ID: CVE-2026-93252)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper lock ordering in the OCFS2 ACL initialization and extended attribute handling paths when concurrently performing extended attribute updates and filesystem node-creation operations. A local user can perform concurrent extended attribute updates and mkdir or mknod operations to cause a denial of service.

Exploitation depends on a pending writer on the journal transaction barrier causing the conflicting lock acquisition paths to block.

713) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-93256)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper exception masking in the arm64 hibernation resume code when resuming from hibernation. A local privileged user can resume a hibernated system while exceptions are unmasked to cause a denial of service.

Pseudo-NMI support can permit pseudo-NMI exceptions during the resume process.

714) NULL pointer dereference (CVE-ID: CVE-2026-93261)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing null check in __lock_set_class() when register_lock_class() returns NULL. A local user can cause lock class registration to fail to cause a denial of service.

Lock class registration can fail when the lock class pool is exhausted, graph_lock() fails, or key validation fails.

715) Use-after-free (CVE-ID: CVE-2026-93262)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in ppl_do_flush() when processing RAID5 PPL flushes. A local user can cause ppl_io_unit_finished() to free the io object while the loop continues accessing io->pending_flushes to trigger a use-after-free condition.

716) Out-of-bounds read (CVE-ID: CVE-2026-93264)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory registration to be rejected.

The vulnerability exists due to an incorrect chunk length calculation in the EFA RDMA driver's pbl_chunk_list_create function when registering a memory region whose PBL page count is a multiple of 510. A local user can register such a memory region to cause memory registration to be rejected.

The issue can also result in an out-of-bounds access to the chunks array.

717) Improper locking (CVE-ID: CVE-2026-93268)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper lock management in ext4_try_to_expand_extra_isize() when expanding inode extra isize during filesystem mount. A local privileged user can trigger orphan processing during mount to cause a denial of service.

The circular lock dependency involves s_writepages_rwsem, an active jbd2 handle, and xattr_sem.

718) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-93271)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper range validation in ath11k_dp_rx_h_rate() when processing HT, VHT, or HE frames with a reported MCS above the corresponding mac80211 rate-space maximum. A remote attacker can send a wireless frame with an out-of-range reported MCS value to cause a denial of service.

The affected frame decodes correctly despite its reported MCS value exceeding the corresponding mac80211 rate space.

719) NULL pointer dereference (CVE-ID: CVE-2026-93274)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in bcm2835_pinctrl_probe() when handling a failed pin controller registration. A local user can trigger a failed pin controller registration to cause a denial of service.

720) Out-of-bounds read (CVE-ID: CVE-2026-93280)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the Greybus audio topology parser when parsing a topology blob supplied by a connected module. An attacker with physical access can supply a topology blob with section sizes exceeding the fetched size to read out-of-bounds memory.

721) Use-after-free (CVE-ID: CVE-2026-93283)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in i3c_master_register_new_i3c_devs() when handling a device_register() failure. A local user can trigger a device registration failure followed by device unregistration to cause a denial of service.

722) NULL pointer dereference (CVE-ID: CVE-2026-93286)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing null pointer check in aarp_send_ddp() when sending AppleTalk packets through the LocalTalk fast path on a device without an AppleTalk interface configured. A local user can send an AppleTalk packet to cause a denial of service.

723) Memory corruption (CVE-ID: CVE-2026-93287)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper bounds checking in the i2c-stub driver's stub_xfer function when processing caller-supplied I2C_SMBUS_I2C_BLOCK_DATA transfers. A local user can issue a crafted SMBus block transfer with an oversized length to cause a denial of service.

724) Out-of-bounds read (CVE-ID: CVE-2026-93287)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in the smbus_write tracepoint when processing caller-supplied oversized SMBus block writes. A local user can issue an SMBus block write with an oversized length to read memory out of bounds.

725) Use-after-free (CVE-ID: CVE-2026-93288)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to failure to wait for an RCU grace period in nfnetlink_log per-network state when processing packets concurrently with network namespace teardown. A local user can trigger concurrent packet processing and network namespace teardown to trigger a use-after-free.

726) Race condition (CVE-ID: CVE-2026-93782)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write response data to an unrelated userspace object.

The vulnerability exists due to a race condition in vhost-scsi ioctl handling when replacing the memory table while commands are in flight. A local user can submit commands and issue VHOST_SET_MEM_TABLE to write response data to an unrelated userspace object.

727) Out-of-bounds read (CVE-ID: CVE-2026-93783)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read uninitialized memory.

The vulnerability exists due to an out-of-bounds read in rfcomm_recv_frame() when processing truncated Bluetooth RFCOMM frames. A remote attacker can send a truncated Bluetooth RFCOMM frame to read uninitialized memory.

A zero-length frame can cause a length underflow and make skb_tail_pointer() read past the buffer.

728) Out-of-bounds read (CVE-ID: CVE-2026-93784)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of information element buffers in cfg80211_wext_siwgenie() when storing a malformed buffer through SIOCSIWGENIE. A local user can submit a malformed information element buffer and trigger a connection attempt to cause a denial of service.

The issue is triggered when a subsequent SIOCSIWESSID operation initiates connection processing.

729) Numeric Truncation Error (CVE-ID: CVE-2026-93785)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause inconsistent payload length interpretation.

The vulnerability exists due to improper validation of payload length in the cifs.idmap key type when processing oversized preparsed payloads. A local user can provide an oversized preparsed payload to cause inconsistent payload length interpretation.

730) Integer underflow (CVE-ID: CVE-2026-93789)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a length underflow.

The vulnerability exists due to improper validation of aligned TLV lengths in the iwlwifi firmware parser when processing malformed TLVs in a firmware image. A local user can cause the parser to process a firmware image containing malformed TLVs to cause a length underflow.

731) Memory leak (CVE-ID: CVE-2026-93795)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause resource exhaustion.

The vulnerability exists due to improper reference count management in the blkg_create() error path when radix_tree_insert() fails. A local user can trigger a radix_tree_insert() failure during blkcg creation to cause resource exhaustion.

The blkcg group may be marked online despite not being fully inserted.

732) Out-of-bounds read (CVE-ID: CVE-2026-93797)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in the iwl_mvm_check_he_obss_narrow_bw_ru_iter function when processing an extended capability information element shorter than 11 bytes. A remote attacker can supply a malformed extended capability information element to read memory out of bounds.

733) Race condition (CVE-ID: CVE-2026-93798)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause inconsistent relocation-root state.

The vulnerability exists due to improper synchronization in merge_reloc_roots() when merging relocation roots. A local user can trigger relocation-root cleanup to cause inconsistent relocation-root state.

The issue occurs when a root has zero root references in its root item.

734) Use-after-free (CVE-ID: CVE-2026-93800)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the btrfs relocation root cleanup logic when handling errors returned by btrfs_update_reloc_root() during relocation. A local user can trigger relocation that encounters an error and unmount the filesystem to cause a denial of service.

735) Out-of-bounds write (CVE-ID: CVE-2026-93802)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in rsi_prepare_beacon() when preparing an oversized beacon frame. A local user can provide an oversized beacon frame to cause a denial of service.

736) Out-of-bounds read (CVE-ID: CVE-2026-93803)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in libipw_rx() when processing crafted Wi-Fi frames. A remote attacker can send a specially crafted Wi-Fi frame to read out-of-bounds memory.

737) Out-of-bounds read (CVE-ID: CVE-2026-93805)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to improper frame length validation in the cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() callbacks when processing truncated MLME management frames. A local user can supply a truncated management frame to read out-of-bounds memory.

738) Out-of-bounds read (CVE-ID: CVE-2026-93807)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in rsi_hal_load_key() in the rsi wireless driver when processing non-TKIP cipher keys. A local user can provide a non-TKIP cipher key with a shorter key layout to cause an out-of-bounds read.

739) Out-of-bounds read (CVE-ID: CVE-2026-93808)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause an out-of-bounds read.

The vulnerability exists due to improper length validation in the ALSA USB CAIAQ EP1 reply handling code when processing undersized EP1 replies. An attacker with physical access can provide a malformed EP1 reply to cause an out-of-bounds read.

740) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-93811)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak and an incorrect success result.

The vulnerability exists due to improper exceptional-condition handling in ksmbd_vfs_get_sd_xattr() when validating a decoded security descriptor size. A local user can trigger validation of a security descriptor smaller than struct smb_ntsd to cause a memory leak and an incorrect success result.

741) Memory leak (CVE-ID: CVE-2026-93811)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper error-path resource cleanup in ksmbd_vfs_get_sd_xattr() when decoding an NT ACL. A local user can trigger an ndr_decode_v4_ntacl() failure to cause a memory leak.

742) Memory leak (CVE-ID: CVE-2026-93812)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper memory release in ksmbd_vfs_set_sd_xattr when encoding NT ACL data. A remote attacker can cause an encoding operation to return an error after memory allocation to cause a denial of service.

743) Out-of-bounds read (CVE-ID: CVE-2026-93813)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Btrfs INODE_REF item handler when processing a crafted Btrfs image. A local user can provide a crafted Btrfs image with an oversized INODE_REF name length to cause a denial of service.

744) Improper locking (CVE-ID: CVE-2026-93815)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an invalid wait context.

The vulnerability exists due to improper locking in au1000_close() in the au1000 Ethernet driver when stopping the network device. A local user can invoke the affected close operation to trigger an invalid wait context.

745) Out-of-bounds read (CVE-ID: CVE-2026-93816)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the f2fs inline dentry conversion routine when processing a corrupted filesystem image. A local user can provide a corrupted filesystem image containing an overlong inline dentry name to read out-of-bounds memory.

746) Use-after-free (CVE-ID: CVE-2026-93819)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the MediaTek PCIe controller driver's root bus removal routine when stopping and removing a root bus concurrently with rescan or hotplug operations triggered via sysfs. A local user can trigger concurrent rescan or hotplug operations via sysfs to cause a denial of service.

747) Use-after-free (CVE-ID: CVE-2026-93820)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race condition in Rockchip PCIe host controller root bus removal when rescan or hotplug operations are triggered concurrently via sysfs. A local user can race root bus removal with concurrent rescan or hotplug operations to cause a denial of service.

748) Race condition (CVE-ID: CVE-2026-93821)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the Altera PCIe controller driver's root bus removal routine when concurrent rescan or hotplug operations are triggered through sysfs. A local user can trigger concurrent rescan or hotplug operations through sysfs to cause a denial of service.

749) Use-after-free (CVE-ID: CVE-2026-93822)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a system crash.

The vulnerability exists due to a race condition in PCI iProc root bus removal when concurrently triggering sysfs rescan or hotplug operations. A local user can trigger concurrent sysfs rescan or hotplug operations to cause a system crash.

750) NULL pointer dereference (CVE-ID: CVE-2026-93825)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing null pointer check in spi_get_device_match_data() when processing an SPI device using driver_override without a matching SPI ID entry. A local user can use driver_override without a matching SPI ID entry to cause a denial of service.

751) Resource exhaustion (CVE-ID: CVE-2026-93830)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper interrupt masking in the XGMAC2 stmmac driver when the DMA runs out of receive descriptors under heavy receive pressure. A remote attacker can generate heavy receive traffic to cause a denial of service.

752) Unchecked Return Value (CVE-ID: CVE-2026-97407)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access hardware registers while the device state is undefined.

The vulnerability exists due to an unchecked return value in rockchip_pdm_set_fmt() when resuming runtime power management. A local user can request an audio interface format change during a runtime resume failure to access hardware registers while the device state is undefined.

753) Out-of-bounds read (CVE-ID: CVE-2026-97408)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read beyond the advertised skb payload.

The vulnerability exists due to an out-of-bounds read in l2cap_recv_frame() when processing malformed connectionless L2CAP frames. A remote attacker can send a connectionless frame with an incomplete PSM payload to read beyond the advertised skb payload.

The read can use tailroom bytes as part of the PSM.

754) Infinite loop (CVE-ID: CVE-2026-97411)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper state management in the mal_remove() function of the IBM EMAC MAL driver when removing the affected module after NAPI has not been enabled or has already been disabled. A local privileged user can remove the affected module to cause a denial of service.

The condition can occur when no MACs were registered or when registered MACs were subsequently unregistered.

755) Integer underflow (CVE-ID: CVE-2026-97413)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds memory access.

The vulnerability exists due to integer underflow in the rtrs-srv process_read and process_write functions when processing a network-supplied RDMA message with usr_len greater than off. A remote attacker can send a crafted RDMA message with usr_len greater than off to cause an out-of-bounds memory access.

756) NULL pointer dereference (CVE-ID: CVE-2026-97416)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in btrfs_may_alloc_data_chunk() when processing corrupted Btrfs metadata during a balance operation. A local user can trigger a Btrfs balance operation on a filesystem whose chunk tree contains a chunk without a corresponding block group to cause a denial of service.

The issue occurs when CONFIG_BTRFS_ASSERT is disabled.

757) Type conversion (CVE-ID: CVE-2026-97417)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an unaligned memory access.

The vulnerability exists due to an unsafe pointer cast in the tcp_sack() timestamp-only fast path when processing TCP options. A remote attacker can send a TCP packet containing unaligned options to trigger an unaligned memory access.

758) NULL pointer dereference (CVE-ID: CVE-2026-97418)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in snd_es18xx_mixer when handling control allocation failures. A local user can trigger mixer control creation during an allocation failure to cause a denial of service.

759) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-97419)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to improper network namespace isolation in HSR generic netlink notification handling when broadcasting ring error and node down events. A local privileged user can listen for notifications from HSR devices in other network namespaces in init_net to disclose sensitive information.

The notifications expose the peer node MAC address and slave port interface index.

760) Out-of-bounds read (CVE-ID: CVE-2026-97420)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read out-of-bounds memory.

The vulnerability exists due to a missing NUL terminator in the bpf_sysctl_set_new_value helper when replacing a pending sysctl value through a cgroup/sysctl BPF program. A local privileged user can provide a replacement sysctl value without a terminating NUL byte to read out-of-bounds memory.

761) Integer overflow (CVE-ID: CVE-2026-97421)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect page-size selection.

The vulnerability exists due to integer overflow in ib_umem_find_best_pgsz() in the RDMA/umem subsystem when handling a virtual address and length. A local user can provide values that trigger boundary conditions to cause incorrect page-size selection.

The issue is especially important on 32-bit systems.

762) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-97430)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to queue new commands on the command ring while the xHC is inaccessible.

The vulnerability exists due to an improper check for an inaccessible hardware state in the xHCI command-ring queueing logic when the controller is suspended or resumed. A local user can initiate command queueing while the xHC is inaccessible to queue new commands on the command ring.

763) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97434)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause active NAPI instances to be deleted.

The vulnerability exists due to improper resource lifecycle management in the dpaa2-switch device removal path when removing a DPSW device. A local privileged user can trigger the device removal path to cause active NAPI instances to be deleted.

All NAPI instances are attached to the first switch port's net_device but are shared by all switch ports.

764) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-97435)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to redirect traffic to an unintended port or trigger an out-of-bounds access.

The vulnerability exists due to improper validation of a destination port index in the SJA1105 flower classifier when configuring a redirect action to a switch port on a different switch chip. A local privileged user can configure a redirect action referencing a port from another switch chip to redirect traffic to an unintended port or trigger an out-of-bounds access.

765) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97436)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause multiple ports to share a forwarding database.

The vulnerability exists due to improper forwarding database state management in dpaa2_switch_port_set_fdb() when a port leaves a bridge while other ports continue to use the same forwarding database. A local privileged user can change bridge membership to cause multiple ports to share a forwarding database.

The issue occurs when multiple bridges have ports from the same DPSW instance.

766) Out-of-bounds read (CVE-ID: CVE-2026-97437)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to improper bounds validation in the NTFS3 directory enumeration and index lookup paths when processing crafted NTFS index entries. A local user can provide a crafted NTFS image to cause an out-of-bounds read.

767) Out-of-bounds read (CVE-ID: CVE-2026-97438)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a slab out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the NTFS3 index entry processing when processing a malformed NTFS directory index entry during directory lookup. A local user can trigger directory lookup on an entry whose key_size exceeds the bytes available in its NTFS_DE payload to cause a slab out-of-bounds read.

768) NULL pointer dereference (CVE-ID: CVE-2026-97439)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the ntfs3 extended attribute handler when modifying system.ntfs_attrib and system.dos_attrib on the same file in a corrupted ntfs3 image. A local user can toggle system.ntfs_attrib, overwrite system.dos_attrib, and write to the file to cause a denial of service.

769) Memory leak (CVE-ID: CVE-2026-97440)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing reference release in qrtr_send_resume_tx() when allocation of a QRTR control packet fails. A local user can trigger the allocation failure path to cause a denial of service.

770) Improper input validation (CVE-ID: CVE-2026-97441)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper validation of the mapped BAR size in the AHCI driver when probing an AHCI controller whose HOST_CAP register claims more ports than fit within the mapped BAR region. An attacker with physical access can trigger access to port registers beyond the BAR boundary to cause a denial of service.

771) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-97443)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper state validation in perf_ftrace_function_unregister() when cleaning up a perf event whose ftrace operations registration failed or was already torn down. A local user can cause perf event cleanup to invoke unregister_ftrace_function() for ftrace operations that are not enabled to trigger a kernel warning.

772) Out-of-bounds read (CVE-ID: CVE-2026-97444)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds access.

The vulnerability exists due to missing boundary checks in the ACPICA AML parser when parsing ACPI AML input. A local user can supply malformed AML input to cause an out-of-bounds access.

773) Out-of-bounds read (CVE-ID: CVE-2026-97445)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond the end of a buffer.

The vulnerability exists due to improper buffer validation in acpi_ut_walk_aml_resources() when processing malformed AML resource descriptors. A local user can provide a malformed AML resource descriptor whose length exceeds the remaining buffer size to read beyond the end of a buffer.

774) NULL pointer dereference (CVE-ID: CVE-2026-97446)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in acpi_ns_custom_package() when processing a firmware-provided _BIX package whose first element is an unresolvable reference. A local user can cause the kernel to process such a package to cause a denial of service.

775) Use-after-free (CVE-ID: CVE-2026-97448)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to improper validation of a namespace node in acpi_ns_build_normalized_path() when processing an invalid ACPI namespace node. A local user can cause the function to process an invalid namespace node to trigger a use-after-free condition.

776) Memory corruption (CVE-ID: CVE-2026-97449)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds access.

The vulnerability exists due to improper restriction of operations within bounds in ACPICA parser functions when parsing package data with invalid package limits. A local user can trigger parsing of package data with invalid package limits to perform an out-of-bounds access.

777) Type Confusion (CVE-ID: CVE-2026-97450)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access fields of a handler object without validating its type.

The vulnerability exists due to improper type validation in the ACPICA handler-list processing routines when walking handler lists. A local user can cause ACPICA to process a handler object with an invalid type to access fields of a handler object without validating its type.

778) Integer overflow (CVE-ID: CVE-2026-97451)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to an integer overflow in acpi_ex_opcode_3A_1T_1R() when calculating the truncation length for a String or Buffer operand. A local user can trigger the vulnerable operation with values that cause Index + Length to overflow to cause memory corruption.

779) Improper input validation (CVE-ID: CVE-2026-97452)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of reference classes in acpi_ut_copy_simple_object() when copying local, argument, or debug ACPI reference objects. A local user can cause the function to add a reference to an invalid object pointer to cause a denial of service.

780) Out-of-bounds read (CVE-ID: CVE-2026-97453)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond the bounds of an ACPI package buffer.

The vulnerability exists due to improper validation of an encoded package length byte count in acpi_ps_get_next_package_length() when parsing ACPI package lengths. A local user can cause the function to process an encoded byte count exceeding the remaining available bytes to read beyond the bounds of an ACPI package buffer.

781) Out-of-bounds read (CVE-ID: CVE-2026-97454)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read beyond buffer bounds.

The vulnerability exists due to an out-of-bounds read in acpi_ps_get_next_field() when parsing malformed AML field data. A local user can cause malformed AML field data to be parsed to read beyond buffer bounds.

782) Use-after-free (CVE-ID: CVE-2026-97455)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in acpi_ds_terminate_control_method() when terminating a control method whose return value is a ref_of reference. A local user can cause a control method to return a ref_of reference to trigger a use-after-free condition.

The affected reference can point to a method local variable or argument.

783) Out-of-bounds read (CVE-ID: CVE-2026-97456)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory out of bounds.

The vulnerability exists due to an out-of-bounds read in acpi_ps_parse_loop() when checking for AML_ELSE_OP after skipping a While/If block. A local user can trigger the affected AML parsing condition to access memory out of bounds.

784) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97472)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to prevent generation of temporary IPv6 privacy addresses for an IPv6 prefix.

The vulnerability exists due to improper state management in the IPv6 addrconf temporary address management logic when handling router advertisements that deprecate and later restore an IPv6 prefix. A remote attacker can send router advertisements that temporarily deprecate and later restore a prefix to prevent temporary address regeneration.

785) Use-after-free (CVE-ID: CVE-2026-97475)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a use-after-free.

The vulnerability exists due to failure to unregister thermal cooling devices in the Tegra SoCTherm driver when the platform driver is removed. A local privileged user can cause the driver to be removed and trigger use of a stale thermal framework reference to trigger a use-after-free.

The stale cooling-device references retain devdata pointers to memory freed during platform-device cleanup.

786) Missing Authorization (CVE-ID: CVE-2026-97476)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive network and socket information.

The vulnerability exists due to improper access control in the RDS_INFO_* getsockopt handlers when querying RDS information from a separate network namespace. A local user can call getsockopt with RDS_INFO_* options to disclose sensitive network and socket information.

Exploitation requires a fresh user namespace and network namespace.

787) Improper handling of exceptional conditions (CVE-ID: CVE-2026-97481)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper handling of FIFO error interrupts in the 8250 serial driver when the serial interface receives a flood of messages during startup and encounters a FIFO error with no data ready. An attacker with physical access can send a flood of messages to the serial interface during startup to cause a denial of service.

788) NULL pointer dereference (CVE-ID: CVE-2026-97482)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the goku_irq() interrupt handler when handling an INT_USBRESET event before a gadget driver is bound. An attacker with physical access can trigger an INT_USBRESET event before a gadget driver is bound to cause a denial of service.

789) Deadlock (CVE-ID: CVE-2026-97483)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of memory allocation flags in USB core root hub control transfer handling when processing root hub control transfers during device-reset handling. A local user can trigger device-reset handling that submits a root hub control transfer to cause a denial of service.

The condition occurs in SCSI error-handler paths involving UAS or the storage driver.

790) NULL pointer dereference (CVE-ID: CVE-2026-97484)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in status_show_vhci() in drivers/usb/usbip/vhci_sysfs.c when reading VHCI status after a VHCI host controller probe failure. A local user can read the VHCI status sysfs entry to cause a denial of service.

791) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-97485)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of set_blocksize failures in the OMFS filesystem superblock initialization routine when mounting an OMFS filesystem with a block size larger than PAGE_SIZE. A local user can mount a specially crafted OMFS filesystem to cause a denial of service.

792) Unchecked Return Value (CVE-ID: CVE-2026-97486)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an unchecked return value in the HPFS superblock mount handler when mounting an HPFS filesystem on a device with a block size greater than the page size. A local privileged user can mount the filesystem to trigger a kernel BUG condition and cause a denial of service.

793) Unchecked Return Value (CVE-ID: CVE-2026-97487)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an unchecked return value in the JFS superblock initialization function jfs_fill_super when mounting a JFS filesystem with a block size greater than the page size. A local user can mount such a filesystem to cause a denial of service.

794) Unchecked Return Value (CVE-ID: CVE-2026-97488)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an unchecked return value in qnx4_fill_super when mounting a QNX4 filesystem on a device whose block size causes sb_set_blocksize to fail. A local privileged user can mount the filesystem to trigger a kernel BUG.

795) Unchecked Return Value (CVE-ID: CVE-2026-97489)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an unchecked return value in the bfs filesystem superblock initialization routine when mounting a BFS file system on a block device with a block size greater than PAGE_SIZE. A local user can mount a BFS file system on such a block device to cause a denial of service.

796) Unchecked Return Value (CVE-ID: CVE-2026-97490)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of block size configuration failures in the AFFS filesystem mounting code when mounting an AFFS filesystem with a block size greater than PAGE_SIZE. A local user can mount a specially crafted AFFS filesystem to cause a denial of service.

797) Resource exhaustion (CVE-ID: CVE-2026-97491)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in rds_ib_conn_path_shutdown when tearing down InfiniBand network configurations. A local user can initiate teardown of InfiniBand network configurations to cause a denial of service.

798) Expired pointer dereference (CVE-ID: CVE-2026-97492)

CWE-ID: CWE-825 - Expired pointer dereference

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave drivers with dangling pointers.

The vulnerability exists due to improper state cleanup in the mac80211 ieee80211_reconfig NAN reconfiguration failure handling when handling a failed NAN reconfiguration while other interfaces are present. A local user can trigger NAN reconfiguration processing that fails to leave drivers with dangling pointers.

The stale pointers can reference station and link objects.

799) NULL pointer dereference (CVE-ID: CVE-2026-97502)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the mmc_davinci_irq() handler in the DaVinci MMC host driver when processing read data timeout or data CRC error interrupt status while no data request is present. A local user can trigger the affected interrupt handling condition to cause a denial of service.

800) NULL pointer dereference (CVE-ID: CVE-2026-97506)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a null-pointer dereference.

The vulnerability exists due to improper handling of an allocation failure in chainup_buffers() in the ixp4xx crypto driver when constructing a buffer descriptor chain for a scatterlist. A local user can submit a crypto request that encounters an allocation failure to trigger a null-pointer dereference.

801) Unchecked Return Value (CVE-ID: CVE-2026-97507)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an unchecked return value in dm1105_hw_init() when initializing dm1105 hardware after DMA memory allocation fails. A local user can trigger dm1105 hardware initialization to cause a denial of service.

802) Use-after-free (CVE-ID: CVE-2026-97508)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the Thunderbolt XDomain request handler when handling a request from a remote host while a domain is stopped. A remote attacker can send a request during domain shutdown to cause a denial of service.

803) Use-after-free (CVE-ID: CVE-2026-97509)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference counting in the Thunderbolt XDomain service lifetime handling when releasing an XDomain service. A local user can trigger service release after the parent XDomain is released to cause a denial of service.

804) Memory leak (CVE-ID: CVE-2026-97510)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to a missing release of allocated memory in __tb_xdomain_response() when tb_cfg_request() fails to set up a request. A local user can trigger the failed request setup to cause a memory leak.

The issue can occur when the control channel has already been shut down.

805) Race condition (CVE-ID: CVE-2026-97523)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in the mptcp scheduler when subflow socket states change. A remote attacker can trigger the race condition to cause a denial of service.

806) Deadlock (CVE-ID: CVE-2026-97524)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in the MPTCP receive path when processing a subflow reset under exceptional error conditions. A remote attacker can trigger the exceptional error condition during MPTCP receive processing to cause a denial of service.

807) Use of Uninitialized Variable (CVE-ID: CVE-2026-97568)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect handling of MPTCP backup state.

The vulnerability exists due to use of an uninitialized variable in MPTCP syncookie state handling when copying MPTCP subflow information. A remote attacker can trigger copying of MPTCP subflow information to cause incorrect handling of MPTCP backup state.

808) Unchecked Return Value (CVE-ID: CVE-2026-97572)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a zeroed DMA address to be handed out.

The vulnerability exists due to an unchecked return value in bnxt_init_nic() when initializing RX rings after an allocation failure. A local user can trigger NIC initialization after RX ring allocation fails to cause a zeroed DMA address to be handed out.

809) Unchecked Return Value (CVE-ID: CVE-2026-97573)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a loss of confidentiality, integrity, and availability.

The vulnerability exists due to unchecked return value in bnxt_rx_ring_reset() when resetting receive ring buffers after a buffer allocation failure. A remote attacker can trigger the vulnerable receive-ring reset to cause a loss of confidentiality, integrity, and availability.

810) Out-of-bounds read (CVE-ID: CVE-2026-97576)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to an out-of-bounds read in stateless HEVC decoder tile processing when processing a V4L2 HEVC PPS control with excessive tile counts. A local user can submit a crafted HEVC PPS control to compromise confidentiality, integrity, and availability.

811) Use-after-free (CVE-ID: CVE-2026-97582)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in the gpio-fan alarm work handler when unbinding a GPIO fan device while alarm work is pending. A local user can unbind the device after alarm work has been queued to access freed memory.

812) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-97592)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to failure to clear sensitive data from memory in the s390 AES CTR and GCM cryptographic routines when processing cryptographic requests. A local user can process cryptographic requests that leave sensitive data in temporary buffers to disclose sensitive information.

813) Improper Validation of Array Index (CVE-ID: CVE-2026-97596)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an out-of-bounds transition table access.

The vulnerability exists due to improper validation of array indices in IPVS connection template synchronization record processing when processing a crafted IPVS synchronization record containing an invalid template state. A remote attacker can send a crafted IPVS synchronization record with an invalid template state to trigger an out-of-bounds transition table access.

The version 1 synchronization path handles both IPv4 and IPv6 records.

814) Resource exhaustion (CVE-ID: CVE-2026-97598)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in fib_empty_table() in IPv4 FIB rules when adding an IPv4 rule with automatic table assignment. A local user can populate table IDs and add a table-0 rule to cause a denial of service.

Only the IPv4 automatic table-assignment path is affected.

815) NULL pointer dereference (CVE-ID: CVE-2026-97601)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the lowpan_newlink function when processing an RTM_NEWLINK request for a TUN device whose link-layer type has been changed to ARPHRD_IEEE802154. A local privileged user can issue an RTM_NEWLINK request to cause a denial of service.

816) Use-after-free (CVE-ID: CVE-2026-97604)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a use-after-free in vfb colormap cleanup when a concurrent driver unbind occurs while FBIOGETCMAP copies a colormap to userspace. A local user can retain an open framebuffer file reference and invoke FBIOGETCMAP during a driver unbind to disclose sensitive information.

817) Use-after-free (CVE-ID: CVE-2026-97608)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service, disclose sensitive information, or modify data.

The vulnerability exists due to a race condition leading to a use-after-free in the netfilter nf_log logger backends when unregistering logger backends during per-network namespace teardown. A local user can rebind a logger through a sysctl or netlink writer after the prior per-network logger selection has been cleared to cause a denial of service, disclose sensitive information, or modify data.

818) Use-after-free (CVE-ID: CVE-2026-97611)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code, disclose sensitive information, or cause a denial of service.

The vulnerability exists due to a use-after-free in the Open vSwitch flow table mask array when processing packets during flow table statistics lookup. A local user can trigger concurrent flow table mask array reallocation and packet processing to execute arbitrary code, disclose sensitive information, or cause a denial of service.

819) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-97612)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to stale inner protocol state in skb_mpls_pop() when Open vSwitch re-pushes MPLS after all labels have been popped and the packet has been recirculated. A local user can trigger MPLS label push, pop, recirculation, and a subsequent label push to cause memory corruption.

820) Memory leak (CVE-ID: CVE-2026-97899)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper memory release in query_perf_config_list() when memory reallocation fails. A local user can trigger a performance configuration list query when memory reallocation fails to cause a memory leak.

821) Improper initialization (CVE-ID: CVE-2026-97904)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to an uninitialized semaphore.

The vulnerability exists due to improper initialization in cpufreq_policy_alloc() when accessing policy sysfs attributes during policy creation. A local user can access a policy sysfs attribute before policy->rwsem is initialized to trigger access to an uninitialized semaphore.

822) Use of uninitialized resource (CVE-ID: CVE-2026-97905)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to invoke sysfs attribute callbacks on an uninitialized cpufreq policy.

The vulnerability exists due to use of uninitialized memory in the policy->cpus cpumask in cpufreq_policy_alloc() when a cpufreq policy is published to sysfs before initialization completes. A local user can access sysfs attributes during this initialization window to invoke callbacks on the uninitialized policy.

Only systems configured with CONFIG_CPUMASK_OFFSTACK=y are affected by the uninitialized separately allocated bitmap.

823) Use of uninitialized resource (CVE-ID: CVE-2026-97909)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger use of an uninitialized IRQ lock.

The vulnerability exists due to improper initialization in the ASoC STI UniPerif reader initialization routine when a pending shared interrupt is handled before the IRQ lock is initialized. A local user can cause the shared interrupt handler to run during initialization to trigger use of an uninitialized IRQ lock.

824) Out-of-bounds write (CVE-ID: CVE-2026-97910)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper validation of buffer sizes in sprd_platform_compr_copy() in the ASoC sprd PCM compression driver when handling user-configured compression buffer parameters and write data. A local user can configure oversized compression buffer parameters and write data to overflow fixed IRAM or DDR buffer allocations.

The copy callback can be reached while the stream is in the setup state without starting it.

825) Memory leak (CVE-ID: CVE-2026-97923)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper memory management in create_var_ref() in the tracing histogram implementation when initialization of a VAR_REF histogram field fails. A local user can trigger VAR_REF histogram field initialization failure to cause a memory leak.

826) Out-of-bounds write (CVE-ID: CVE-2026-97926)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an out-of-bounds memory access.

The vulnerability exists due to improper validation of cylinder group metadata in ufs_read_cylinder() when processing a crafted UFS filesystem image. A remote attacker can provide malformed cylinder group metadata to cause an out-of-bounds memory access.

User interaction is required.

827) NULL pointer dereference (CVE-ID: CVE-2026-97927)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in UFS superblock teardown when mounting a crafted writable UFS filesystem image whose first cylinder group cannot be read. A local user can mount a crafted UFS filesystem image to cause a denial of service.

828) Out-of-bounds read (CVE-ID: CVE-2026-97930)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to read memory beyond the source buffer.

The vulnerability exists due to an out-of-bounds read in the ALSA usbusx2y driver when handling USB interrupt data during initialization. An attacker with physical access can trigger the initialization path to read three bytes past the end of the in04_buf allocation.

829) Improper privilege management (CVE-ID: CVE-2026-97931)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to improper memory mapping permission handling in the ALSA us122l hwdep mmap callback when using mprotect() on a read-buffer mapping after opening the hwdep node O_RDWR. A local user can upgrade the read-buffer mapping to writable and modify the read_size member to cause memory corruption.

The read VMA remains expandable because pcm_usb_stream uses mremap() after reading read_size.

830) Use-after-free (CVE-ID: CVE-2026-97940)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service, disclose sensitive information, or modify information.

The vulnerability exists due to a use-after-free in the IPv6 FIB route iterator walker handling when stopping an IPv6 route iterator while routes are deleted. A local user can trigger a race that leaves a freed walker on the IPv6 FIB walker list to cause a denial of service, disclose sensitive information, or modify information.

The same stop helper is used by /proc/net/ipv6_route and the BPF IPv6 route iterator.

831) Deadlock (CVE-ID: CVE-2026-97948)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to recursive locking in eeh_rmv_device when handling EEH error events. A local user can trigger the affected EEH error-handling path to cause a denial of service.

The issue occurs for errors detected directly on the PHB or when a driver requests a reset but does not provide EEH error handlers.

832) Deadlock (CVE-ID: CVE-2026-97951)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper command completion in the iSCSI target dataout handler when processing final dataout PDUs for a WRITE command aborted by a LUN reset. A remote user can send remaining dataout PDUs to cause a denial of service.

833) Out-of-bounds read (CVE-ID: CVE-2026-97954)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt the TCP RDS stream.

The vulnerability exists due to an out-of-bounds read in rds_message_map_pages() when transmitting RDS-TCP data on systems with page sizes greater than 8192 bytes. A remote attacker can trigger transmission of the congestion map to corrupt the TCP RDS stream.

834) Heap-based buffer overflow (CVE-ID: CVE-2026-97957)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a heap-based buffer overflow.

The vulnerability exists due to improper bounds checking in check_mbox_seq_id_and_seg_len() in the hinic driver mailbox receive handler when processing mailbox segments. A local user can send a mailbox segment whose final sequence segment exceeds the remaining receive-buffer space to cause a heap-based buffer overflow.

835) Infinite loop (CVE-ID: CVE-2026-97958)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of EAGAIN errors in tc_ctl_chain() when processing repeated RTM_GETCHAIN requests without consuming netlink responses. A local user can send repeated RTM_GETCHAIN requests without reading the responses to cause a denial of service.

836) Memory leak (CVE-ID: CVE-2026-97959)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to a failure to free an emptied route4 bucket in net/sched/cls_route.c route4_change when moving an existing route filter to a different top-level bucket and deleting it. A local user can move an existing route filter to a different top-level bucket and then delete it to cause a memory leak.

The issue requires CONFIG_NET_CLS_ROUTE4, CONFIG_NET_SCH_INGRESS, and CONFIG_NET_CLS_ACT to be enabled.

837) Improper initialization (CVE-ID: CVE-2026-97963)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger undefined behavior.

The vulnerability exists due to improper initialization in the stmmac driver's ptp_lock when offloading a TAPRIO schedule while the interface is down. A local user can configure a TAPRIO schedule to trigger undefined behavior.

The issue occurs when the interface has never been opened.

838) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97964)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify data visible to an AF_PACKET socket.

The vulnerability exists due to failure to ensure a writable skb header in ppp_sync_txmunge() when bridging a received PPP frame to a synchronous tty channel. A remote attacker can send a PPPoE frame that is bridged to a synchronous tty channel to modify data visible to an AF_PACKET socket.

Exploitation requires the frame buffer to be shared with a clone queued to an AF_PACKET socket.

839) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-97969)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in msc313e_wdt_settimeout() when setting a watchdog timeout. A local user can set a watchdog timeout to cause a denial of service.

840) Division by zero (CVE-ID: CVE-2026-97970)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to division by zero in the msc313e watchdog driver's msc313e_wdt_probe function when initializing a watchdog device with a zero clock rate. A local privileged user can trigger watchdog device initialization with a zero clock rate to cause a denial of service.

841) Resource exhaustion (CVE-ID: CVE-2026-97981)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper NAPI work budget accounting in the Cortina Gemini Ethernet driver's gmac_rx receive loop when processing malformed Ethernet frames. A remote attacker can send a stream of malformed Ethernet frames to cause a denial of service.

842) Incorrect calculation (CVE-ID: CVE-2026-97982)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to incorrect budget accounting in gmac_rx() and gmac_napi_poll() when handling received packets during NAPI polling. A remote attacker can cause an idle poll to report a full budget and remain scheduled to cause a denial of service.

843) Out-of-bounds write (CVE-ID: CVE-2026-97991)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read from and write to out-of-bounds memory.

The vulnerability exists due to improper range validation in vdpasim_blk_check_range() when processing virtio block requests with an out-of-range sector start. A local user can submit a crafted virtio block request to read from and write to out-of-bounds memory.

844) Race condition (CVE-ID: CVE-2026-97993)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in vhost_vdpa_set_config_call() when installing a configuration eventfd context. A local user can supply an invalid eventfd descriptor while setting the configuration callback to cause a denial of service.

A configuration interrupt delivered during the error-handling window can pass an error pointer to eventfd_signal().

845) Out-of-bounds read (CVE-ID: CVE-2026-97995)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause an out-of-bounds read.

The vulnerability exists due to type confusion in the virtio_console remove_vqs() function when unbinding a device with a control message remaining on the control-out virtqueue. A local privileged user can unbind the device while the control message is queued to cause an out-of-bounds read.

846) Race condition (CVE-ID: CVE-2026-97998)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the nfnetlink_log instance destruction handler when concurrently processing a netlink close event and an UNBIND request from sockets using the same port ID. A local user can trigger concurrent instance destruction and unbinding to cause a denial of service.

847) Use-after-free (CVE-ID: CVE-2026-98006)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the ALSA caiaq USB driver's ep1_in_urb and midi_out_urb handling when processing a command timeout after a submitted URB is unlinked by the dummy HCD driver. A local user can trigger the affected initialization failure to trigger a use-after-free.

848) Infinite loop (CVE-ID: CVE-2026-98009)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of ETS quantum values in the ETS queuing discipline when configuring an ETS qdisc with crafted quantum values. A local user can configure a crafted ETS qdisc to cause a denial of service.

The issue requires CONFIG_NET_SCH_ETS and CAP_NET_ADMIN; namespace-local capabilities are sufficient.

849) Resource exhaustion (CVE-ID: CVE-2026-98010)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of DRR quantum values in drr_change_class() when configuring DRR qdisc classes with a low quantum value. A local user can configure a DRR qdisc class with the quantum set to 1 to cause a denial of service.

Exploitation requires CONFIG_NET_SCH_DRR=y and CAP_NET_ADMIN; the capability can be namespace-local through unshare -Urn.

850) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-98011)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of the quantum value in the HHF queueing discipline when configuring an HHF qdisc with quantum set to 1 and a crafted size table. A local user can configure the qdisc with these values to cause a deficit-refill loop to spin under the qdisc lock and cause a denial of service.

Exploitation requires CONFIG_NET_SCH_HHF=y and CAP_NET_ADMIN in a network namespace.

851) Improper input validation (CVE-ID: CVE-2026-98012)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the SFQ qdisc change path when processing crafted qdisc configuration. A local user can configure a quantum value of 1 with a crafted size table to cause a denial of service.

The SFQ scheduler must be enabled, and exploitation requires CAP_NET_ADMIN, which can be namespace-local.

852) Resource exhaustion (CVE-ID: CVE-2026-98013)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of quantum values in fq_pie_change() when changing fq_pie qdisc configuration with a crafted size table. A local user can configure a quantum value of 1 and a crafted size table to cause a denial of service.

Exploitation requires CONFIG_NET_SCH_FQ_PIE to be enabled.

853) Use-after-free (CVE-ID: CVE-2026-98014)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cleanup ordering in the mlx5 E-Switch vport disable path when handling firmware-fatal recovery. A local user can trigger a PCI device reset to cause a denial of service.

854) Use-after-free (CVE-ID: CVE-2026-98015)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to use-after-free in mlx5_eswitch_termtbl_put when two callers concurrently release the same mlx5_termtbl_handle. A local user can invoke concurrent calls on the same handle to access freed memory.

855) Use-after-free (CVE-ID: CVE-2026-98016)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access freed memory.

The vulnerability exists due to a use-after-free race in sample_restore_put() when concurrently tearing down TC sample rules sharing the same restore context. A local user can concurrently tear down shared TC sample rules to access freed memory.

856) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-98022)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits in netif_change_tx_queue_len() when processing tx queue length changes. A local user can set an oversized tx_queue_len value to cause a denial of service.

User and network namespaces must be enabled.

857) Use-after-free (CVE-ID: CVE-2026-98023)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to use-after-free in the VXLAN forwarding database entry handling when configuring dynamic FDB entries that reference an FDB nexthop. A local user can configure dynamic entries on VXLAN devices that share an FDB nexthop to cause memory corruption.

The race can occur when an entry is aged while another device adds or deletes an entry associated with the shared FDB nexthop.

858) Heap-based buffer overflow (CVE-ID: CVE-2026-98025)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to corrupt memory.

The vulnerability exists due to a heap-based buffer overflow in the cx82310_rx_fixup function of the cx82310_eth USB network driver when processing a crafted USB network receive URB beginning with the 0xffff reboot sentinel. An attacker with physical access can send a crafted USB network receive URB to corrupt memory.

859) Out-of-bounds write (CVE-ID: CVE-2026-98027)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or compromise confidentiality and integrity.

The vulnerability exists due to an out-of-bounds write in the mv88e6xxx_get_rxnfc() policy rule dump handler when processing an ETHTOOL_GRXCLSRLALL request with fewer caller-provided slots than policy rules. A local user can issue a request specifying an insufficient rule count to write beyond the allocated buffer.

Exploitation requires policy rules to have been installed for the targeted port.

860) Out-of-bounds write (CVE-ID: CVE-2026-98030)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to an out-of-bounds write in bcm_sf2_cfp_rule_get_all() in the Broadcom Starfighter 2 DSA driver when processing ETHTOOL_GRXCLSRLALL ioctl requests with a caller-supplied rule count. A local user can request fewer rule slots than installed CFP rules to compromise confidentiality, integrity, and availability.

Exploitation requires CFP rules to have already been installed.

861) Access of Uninitialized Pointer (CVE-ID: CVE-2026-98031)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to access of an uninitialized pointer in remove_nh_grp_entry() when replacing a reduced nexthop group after a listener allocation failure. A local user can trigger removal of a nexthop group entry to cause a denial of service.

862) NULL pointer dereference (CVE-ID: CVE-2026-98063)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in btf_var_show() when bpf_snprintf_btf() renders a BTF_KIND_VAR from base vmlinux BTF. A local user can load and run a BPF program that passes the type ID of a BTF_KIND_VAR to bpf_snprintf_btf() to cause a denial of service.

863) NULL pointer dereference (CVE-ID: CVE-2026-98064)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in btf_modifier_show() when processing a BPF program-supplied const void BTF type. A local user can supply a BPF program with a const void BTF type to bpf_snprintf_btf() to cause a denial of service.

864) Double free (CVE-ID: CVE-2026-98066)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in the ALSA caiaq driver's audio resource cleanup when handling audio initialization errors. A local user can trigger an audio initialization error after URB resources have been freed to cause a denial of service.

865) Race condition (CVE-ID: CVE-2026-98068)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in RDS TCP connection path shutdown handling when connection teardown races with acceptance of a new socket. A remote attacker can trigger concurrent connection teardown and socket acceptance to cause a denial of service.

The affected path can remain in RDS_CONN_DOWN with an established socket and a growing receive queue.

866) Race condition (CVE-ID: CVE-2026-98069)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper synchronization in rds_conn_shutdown() in the RDS networking subsystem when tearing down an RDS connection path. A remote attacker can race transmission or receive-refill operations with connection teardown to cause a denial of service.

Exploitation occurs on weakly ordered architectures.

867) Race condition (CVE-ID: CVE-2026-98070)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in rds_tcp_reset_callbacks() in the RDS TCP transport when concurrent transmit and connection-reset operations access connection state. A remote attacker can trigger concurrent RDS transmission and connection-reset activity to compromise confidentiality, integrity, and availability.

868) Race condition (CVE-ID: CVE-2026-98071)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause connection state updates to be lost.

The vulnerability exists due to a data race in rds_conn_path_reset() when resetting RDS connection path flags concurrently with atomic flag operations. A local user can trigger concurrent connection reset and transmission operations to cause connection state updates to be lost.

869) Race condition (CVE-ID: CVE-2026-98072)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory ordering in release_in_xmit() in the RDS networking component when concurrently releasing transmit state and checking for waiters. A local user can trigger a race between waiter registration and transmit-state release to cause a denial of service.

A lost wake-up can leave shutdown workers waiting indefinitely in uninterruptible wait operations.

870) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98074)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leave a physical device in promiscuous mode after bond teardown.

The vulnerability exists due to improper state management in __bond_release_one() when releasing all slaves during bond destruction. A local privileged user can destroy a bond containing active and backup slaves to leave a physical device in promiscuous mode after bond teardown.

The backup slave must be released before the active slave.

871) Improper input validation (CVE-ID: CVE-2026-98075)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the BPF verifier when loading a BPF program that references the main program as a callback. A local user can load a crafted BPF program using a BPF_PSEUDO_FUNC reference to the main program to cause a denial of service.

872) Use-after-free (CVE-ID: CVE-2026-98076)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to use-after-free in probe-based dynamic event field handling when looking up event fields after removing the first of several attached probes. A local user can create multiple probes for an event, remove the probe that defined its fields, and perform a field lookup to trigger a use-after-free.

873) Out-of-bounds read (CVE-ID: CVE-2026-98077)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in sip_skip_whitespace() in nf_conntrack_sip when processing a SIP payload containing a recognized header name followed by whitespace at the end of the payload. A remote attacker can send such a crafted SIP payload to trigger an out-of-bounds read.

874) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-98078)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose stale heap data and corrupt connection sequence state.

The vulnerability exists due to incorrect function call argument ordering in the version 1 IPVS synchronization sender when serializing connection sequence data. A remote attacker can send traffic that causes connection sequence data to be synchronized to disclose stale heap data and corrupt connection sequence state.

Only connections with sequence-state flags set are affected.

875) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98080)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause filesystem metadata corruption and force the filesystem read-only.

The vulnerability exists due to improper reloc root creation in the Btrfs qgroup snapshot accounting path when accounting snapshots during block-group relocation. A local user can perform Btrfs operations that account snapshots during relocation to cause filesystem metadata corruption and force the filesystem read-only.

The issue occurs on Btrfs filesystems with quotas enabled.

876) Out-of-bounds read (CVE-ID: CVE-2026-98088)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to improper handling of an invalid NUMA node value in _base_assign_reply_queues() when assigning high IOPS reply queues for a PCI device without NUMA-node affinity. A local user can trigger reply queue assignment to cause an out-of-bounds read.

The issue occurs when dev_to_node() returns NUMA_NO_NODE (-1).

877) Use-after-free (CVE-ID: CVE-2026-98090)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Btrfs active device pointers when handling a failed sprout setup. A local user can trigger a failed sprout setup to cause a denial of service.

878) Use-after-free (CVE-ID: CVE-2026-98091)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel warning.

The vulnerability exists due to use-after-free in the btrfs device transaction update list when system chunk creation fails while creating the first metadata chunk for a sprout filesystem. A local user can create a sprout filesystem that encounters a system chunk creation failure to cause a kernel warning.

879) Deadlock (CVE-ID: CVE-2026-98094)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an IRQ-unsafe locking mechanism in the fbtft dirty_lock handling in fbtft_mkdirty() and fbtft_deferred_io() when framebuffer console rendering occurs in hardirq context concurrently with deferred I/O workqueue processing. A local user can trigger concurrent framebuffer console rendering and deferred I/O processing to cause a denial of service.

880) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-98095)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper numeric type conversion in tpacket_parse_header() in af_packet when processing a user-provided tpacket_hdr with tp_len larger than INT_MAX. A local user can provide a crafted packet header to cause a denial of service.

881) Out-of-bounds write (CVE-ID: CVE-2026-98096)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption or a denial of service.

The vulnerability exists due to improper network header offset restoration in the Linux kernel ipv6_srh_rcv() function when processing IPv6 Segment Routing Header packets preceded by another extension header. A remote attacker can send a specially crafted IPv6 packet to cause memory corruption or a denial of service.

882) NULL pointer dereference (CVE-ID: CVE-2026-98098)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in tipc_named_node_up() when processing node state publications after the local publication limit is reached. A local user can bind a large number of local-scope service addresses to sockets to cause a denial of service.

Subscribers to node or link up/down events may stop receiving notifications.

883) Stack-based buffer overflow (CVE-ID: CVE-2026-98108)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to a stack-based buffer overflow in the Bluetooth L2CAP deferred enhanced credit-based response handling when processing L2CAP LE connection requests. A remote attacker can send specially crafted L2CAP LE connection requests to cause memory corruption.

The issue involves deferred-setup channels and listening parent channels configured for extended flow control.

884) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-98113)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to flood the kernel log.

The vulnerability exists due to missing rate limiting in the ksmbd DACL SID mapping error logging path when processing a DACL containing unmapped SIDs. A remote user can submit a DACL with many structurally valid but unmapped SIDs to flood the kernel log.

885) Use-after-free (CVE-ID: CVE-2026-98116)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a use-after-free in ALSA PCM mmap handling when concurrently mapping PCM data during buffer reallocation. A local user can race an mmap operation against buffer reallocation to obtain a stale writable mapping of freed pages and escalate privileges.

886) NULL pointer dereference (CVE-ID: CVE-2026-98121)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the msc313e watchdog driver's power management callbacks when handling system suspend or resume operations. A local user can trigger the power management callbacks to cause a denial of service.

887) Out-of-bounds read (CVE-ID: CVE-2026-98123)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to read memory out of bounds.

The vulnerability exists due to an out-of-bounds read in sctp_get_asconf_response() when processing a truncated SCTP_PARAM_ERR_CAUSE parameter in an ASCONF-ACK. A remote user can send a crafted ASCONF-ACK containing an error-cause parameter without a complete error header to read memory out of bounds.

The association must have ADD-IP enabled and an outstanding ASCONF request.

888) Infinite loop (CVE-ID: CVE-2026-98123)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper parameter iteration in sctp_get_asconf_response() when processing a crafted ASCONF-ACK. A remote user can send an ASCONF-ACK containing an odd-length parameter that causes the parameter-processing loop to make no progress and spin in softirq context to cause a denial of service.

The association must have ADD-IP enabled and an outstanding ASCONF request.

889) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-98130)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a use-after-free.

The vulnerability exists due to a time-of-check to time-of-use race condition in the SCTP_CMD_TIMER_START handler when processing SCTP timer start commands. A remote attacker can trigger the race condition to trigger a use-after-free.

890) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98154)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper cleanup of completed requests in the nvme_rdma_queue_rq function when handling an -EIO error in the NVMe RDMA queue request path. A local user can trigger an -EIO error during queue request processing to compromise confidentiality, integrity, and availability.

891) Numeric Truncation Error (CVE-ID: CVE-2026-98157)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to numeric truncation and insufficient input validation in the poll_msec sysfs store handler when processing user-supplied polling-delay values. A local user can write a zero value or an oversized value that truncates to zero to cause a denial of service.

892) Out-of-bounds write (CVE-ID: CVE-2026-98158)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of skb headroom in ppp_async's process_input_packet() when processing a bad-FCS PPP frame followed by a crafted frame. A remote attacker can send malformed PPP frames to cause a denial of service.

When CCP compression is enabled, decompression can read before the skb head.

893) Mismatched Memory Management Routines (CVE-ID: CVE-2026-98160)

CWE-ID: CWE-762 - Mismatched Memory Management Routines

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to mismatched memory management routines in rtw_sdio_if1_init() when handling an initialization failure after allocating HalData. A local user can trigger the initialization error path to cause memory corruption.

894) Out-of-bounds write (CVE-ID: CVE-2026-98181)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to write beyond the bounds of an allocated properties array.

The vulnerability exists due to incorrect indexing that causes an out-of-bounds write in the GUD plane property loop when processing properties advertised by a USB device. An attacker with physical access can advertise the maximum number of properties through a USB device to write beyond the bounds of an allocated properties array.

895) Integer underflow (CVE-ID: CVE-2026-98185)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger out-of-bounds reads.

The vulnerability exists due to integer underflow in mwifiex_ret_802_11_scan() when processing firmware-provided scan responses. A local user can supply a short response or a response with an oversized BSS length to trigger out-of-bounds reads.

The affected processing handles both normal and background scan responses.

896) Out-of-bounds read (CVE-ID: CVE-2026-98186)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read beyond the bounds of a kernel beacon buffer.

The vulnerability exists due to an out-of-bounds read in mwifiex_search_oui_in_ie() when processing RSN or WPA information elements in beacon or probe-response frames during scan-result parsing. A remote attacker can transmit a crafted information element with a pairwise-cipher count exceeding the element's available length to read beyond the bounds of a kernel beacon buffer.

897) Out-of-bounds read (CVE-ID: CVE-2026-98187)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the p54_parse_eeprom() function when parsing a truncated trailing record in a PDR_INTERFACE_LIST entry. A local user can provide a malformed EEPROM buffer to disclose sensitive information.

The variant value read from the record also feeds synth front-end selection.

898) Out-of-bounds read (CVE-ID: CVE-2026-98188)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds reads past the EEPROM buffer.

The vulnerability exists due to an out-of-bounds read in p54_convert_rev0() and p54_convert_rev1() when processing device-supplied EEPROM calibration curve entries with channel and points-per-channel counts that exceed the available entry data. A local user can supply an EEPROM entry declaring more calibration curve data than it contains to cause out-of-bounds reads past the EEPROM buffer.

Exploitation requires control over the device-supplied EEPROM entry.

899) Out-of-bounds write (CVE-ID: CVE-2026-98189)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to corrupt neighboring kernel memory.

The vulnerability exists due to an out-of-bounds write in wilc_wlan_handle_isr_ext() in the wilc1000 wireless driver when processing receive transfers whose device-reported size exceeds the receive buffer capacity. An attacker with physical access can supply an oversized transfer containing controlled data through a bogus SDIO device to corrupt neighboring kernel memory.

The receive buffer is 96 KiB, while the device-reported transfer size can reach 131068 bytes. An oversized transfer can also leave the buffer offset beyond its end, allowing subsequent overflows to repeat.

900) Out-of-bounds read (CVE-ID: CVE-2026-98190)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the wilc1000 driver's wilc_wfi_p2p_rx() and mgmt_tx() functions when processing public action frames shorter than the 32-byte P2P public action header. A remote attacker can transmit a specially crafted 25- to 31-byte public action frame over the air to cause a denial of service.

Exploitation through the receive path requires the host to be in P2P listen mode. No wireless association is required.

901) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98191)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a runtime power-management reference leak.

The vulnerability exists due to failure to release a runtime power-management reference in wlcore_regdomain_config() when handling a failed regulatory-domain command. A local user can trigger a regulatory-domain command failure to cause a runtime power-management reference leak.

The recovery worker acquires a separate runtime power-management reference and cannot release the reference held by this function.

902) Use-after-free (CVE-ID: CVE-2026-98194)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the kernel to dereference freed memory.

The vulnerability exists due to use-after-free in lbtf_free_adapter() in the libertas_tf wireless driver when freeing command buffers while the command timer callback is still running. A local user can cause adapter cleanup to overlap with an active command timer callback to cause the kernel to dereference freed memory.

The command_timer_fn callback accesses priv->cur_cmd->cmdbuf.

903) Double free (CVE-ID: CVE-2026-98195)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in the iwlegacy driver's broadcast station deallocation when handling an error during driver startup. A local user can toggle RF_KILL during driver startup to cause a denial of service.

904) Use-after-free (CVE-ID: CVE-2026-98196)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause access to freed kernel memory.

The vulnerability exists due to use-after-free in the brcmsmac driver's brcms_free_timer() function when freeing a timer while its delayed-work callback is still running. A local user can trigger this overlapping timer cleanup and callback execution to cause access to freed kernel memory.

The non-synchronous cancel_delayed_work() call returns without waiting for an already-running callback, which accesses the timer structure through container_of().

905) Use-after-free (CVE-ID: CVE-2026-98197)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger accesses to freed driver data.

The vulnerability exists due to use-after-free in the w83791d driver's fan/pwm 4-5 sysfs callbacks when accessing leftover sysfs files after driver unbind. A local user can access these leftover files to trigger accesses to freed driver data.

The optional sysfs group is created only when the fan/pwm 4-5 pins are not used as GPIO.

906) Out-of-bounds write (CVE-ID: CVE-2026-98199)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to out-of-bounds writes in the PMBus core when probing chips with more than 10 phases per page. A local user can trigger probing of an affected chip to corrupt kernel memory.

The mp2975 driver supports up to 14 phases per page, and the mp2856 driver supports up to 12 phases per page.

907) Use of Uninitialized Variable (CVE-ID: CVE-2026-98201)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel stack memory.

The vulnerability exists due to use of an uninitialized stack variable in input_ff_effect_from_user() when copying a smaller compatibility structure into the native struct ff_effect. A local user can submit a force feedback effect through EVIOCSFF and retrieve the stored native structure through UI_BEGIN_FF_UPLOAD to disclose kernel stack memory.

The readback path requires a uinput-based force feedback daemon.

908) NULL pointer dereference (CVE-ID: CVE-2026-98202)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the synaptics-rmi4 driver's rmi_driver_suspend() and rmi_driver_resume() functions when handling system power management events for an unbound RMI device. A local user can trigger system suspend or resume to cause a denial of service.

909) Out-of-bounds read (CVE-ID: CVE-2026-98203)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in soc_button_get_button_info() in drivers/input/misc/soc_button_array.c when processing an empty ACPI button descriptor package. A local user can trigger access to btns_desc->package.elements[0] with a zero package count to trigger an out-of-bounds read.

910) Out-of-bounds read (CVE-ID: CVE-2026-98204)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to incorrect block-length calculation in rmi_smb_write_block() when splitting writes into SMBus blocks. A local user can trigger a write with an input length greater than 32 bytes and a partial final block to cause an out-of-bounds read.

The final partial block causes smb_block_write() to read 32 bytes even when fewer bytes remain in the input buffer.

911) Use of Uninitialized Variable (CVE-ID: CVE-2026-98205)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of an uninitialized stack variable in the evdev_do_ioctl() function when processing EVIOCSABS ioctl requests with user-supplied sizes. A local user can submit an EVIOCSABS request with a short size and retrieve the resulting absolute axis information through EVIOCGABS to disclose sensitive information.

The disclosed data consists of stale kernel stack bytes left in the portion of the input_absinfo structure not supplied by the caller.

912) Incorrect calculation (CVE-ID: CVE-2026-98207)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause transfer completion accounting to report incorrect byte counts.

The vulnerability exists due to failure to reset the transferred-byte counter in mmc_spi_request() when retrying a multi-block request after a data CRC error. A local user can issue a multi-block transfer request that encounters a CRC error followed by a successful internal retry to cause transfer completion accounting to report incorrect byte counts.

The data itself is retried. Exploitation depends on an MMC-over-SPI system encountering a data CRC error during the transfer.

913) Memory leak (CVE-ID: CVE-2026-98208)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to consume kernel memory through a transmit FIFO leak.

The vulnerability exists due to failure to release allocated memory in sdio_uart_add_port() when attempting to add a port after all UART_NR slots in sdio_uart_table[] are occupied. A local user can trigger a port-addition attempt with a full port table to consume kernel memory through a transmit FIFO leak.

914) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98209)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave SDHCI child devices registered after their parent resources have been released.

The vulnerability exists due to improper resource lifecycle management in the Aspeed SDHCI controller driver when probe failure or device removal occurs. A local user can trigger these lifecycle paths to leave SDHCI child devices registered after their parent resources have been released.

The released parent resources include the controller clock and managed resources.

915) Use-after-free (CVE-ID: CVE-2026-98210)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to freed host memory.

The vulnerability exists due to use-after-free in the mxcmmc driver's asynchronous callbacks when removing the driver without draining pending work and the watchdog timer. A local user can trigger driver removal while asynchronous callbacks remain pending to trigger access to freed host memory.

The watchdog is armed on the DMA path with a 10-second timeout. The datawork callback is scheduled by the IRQ handler on the PIO path.

916) Use-after-free (CVE-ID: CVE-2026-98217)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free during device cleanup.

The vulnerability exists due to use-after-free in the mlx4 InfiniBand driver's pkey sysfs cleanup when cleaning up a device after a per-slave pkey sysfs registration failure. A local user can trigger cleanup of a failed slave tree with stale parent kobject pointers to trigger a use-after-free.

Registration continues for the remaining slaves despite per-slave registration errors.

917) Out-of-bounds read (CVE-ID: CVE-2026-98221)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds memory reads.

The vulnerability exists due to incorrect bounds checking in tpm2_load_cmd() when loading an ASN.1-encoded TPM 2.0 trusted key blob. A local user can supply a crafted trusted key blob to cause out-of-bounds memory reads.

The boundary checks use the ASN.1-encoded payload size rather than the decoded blob size.

918) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98233)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service in packet ring reception.

The vulnerability exists due to failure to release ring slot ownership in tpacket_rcv() when virtio-net header conversion fails for an unsupported UDP GSO packet. A local user can send an unsupported UDP GSO packet to cause a denial of service in packet ring reception.

With a one-frame TPACKET_V2 ring, the only slot becomes unavailable and the next valid packet is dropped. TPACKET_V3 is not affected by this error path.

919) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-98234)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits in the heavy-hitter filter (HHF) queuing discipline when processing heavy-hitter flows with an excessively large configured flow limit. A local user can configure an oversized hh_limit and generate spoofed traffic to cause a denial of service.

Exploitation requires CAP_NET_ADMIN in a user namespace.

920) Unchecked Return Value (CVE-ID: CVE-2026-98236)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel heap memory to the network stack.

The vulnerability exists due to an unchecked return value from skb_copy_bits() in mhi_mbim_rx() when processing modem-supplied network transfer blocks. A local user can supply a datagram pointer entry that references data outside the received socket buffer, causing a failed copy and subsequent delivery of an uninitialized buffer to netif_rx(), to disclose kernel heap memory to the network stack.

921) Infinite loop (CVE-ID: CVE-2026-98237)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop caused by unchecked cyclic NDP chains in mhi_mbim_rx() when processing modem-supplied NTBs. A local user can supply a crafted NTB containing an NDP that points to itself or an earlier NDP to cause a denial of service.

922) Out-of-bounds read (CVE-ID: CVE-2026-98241)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger out-of-bounds reads in kernel memory.

The vulnerability exists due to out-of-bounds reads caused by treating request sockets as full IPv6 sockets in xfrm6_local_rxpmtu() and xfrm6_local_error() when accessing inet_sock or ipv6_pinfo state through skb->sk. A remote attacker can trigger local PMTU or error handling for TCP SYN-ACK packets owned by a request socket to trigger out-of-bounds reads in kernel memory.

The vulnerable path is reachable when rerouting selects an IPv6 XFRM tunnel route with a lower MTU while a TCP_NEW_SYN_RECV request socket remains attached to the packet.

923) Use-after-free (CVE-ID: CVE-2026-98251)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause access to freed kernel memory.

The vulnerability exists due to use-after-free in ovs_ct_get_conn_labels() when adding a labels extension to a confirmed conntrack entry while another CPU accesses its extension block. A local user can trigger label extension allocation during concurrent access to cause access to freed kernel memory.

Exploitation requires a confirmed conntrack entry that does not already have a labels extension.

924) Race condition (CVE-ID: CVE-2026-98252)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in reference count initialization in iwpm_get_nlmsg_request() in the Linux kernel RDMA core when publishing a request to a global list before initializing its reference count. A local user can trigger concurrent access to the incompletely initialized request to compromise system confidentiality, integrity, and availability.

925) Use-after-free (CVE-ID: CVE-2026-98253)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to a use-after-free in ucma_process_join() in the RDMA/ucma subsystem when handling concurrent multicast joins and a copy_to_user() failure. A local user can issue concurrent JOIN_MCAST calls for the same address and trigger a response-copy failure to trigger a use-after-free in the kernel.

Multicast leave operations match entries by socket address and destroy the first matching entry. This can cancel the newer RoCE work while an older worker still references the freed ucma_multicast object.

926) Improper input validation (CVE-ID: CVE-2026-98255)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to improperly modify TCP connection state.

The vulnerability exists due to improper acknowledgment validation in the TCP receive fast path of tcp_rcv_established() when processing segments with acknowledgment sequence numbers before SND.UNA. A remote attacker can send a TCP segment carrying payload and an excessively old acknowledgment to improperly modify TCP connection state.

The segment's sequence number must match RCV.NXT, and its TCP flags must match the fast-path prediction flags.

927) Deadlock (CVE-ID: CVE-2026-98257)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by permanently stalling the RDS connection workqueues.

The vulnerability exists due to a deadlock between synchronous connection teardown and shutdown work in rds_ib_cm_connect_complete() when a peer negotiates a protocol version older than RDS_PROTOCOL_COMPAT_VERSION. A remote attacker can negotiate such a protocol version to cause a denial of service by permanently stalling the RDS connection workqueues.

928) Improper initialization (CVE-ID: CVE-2026-98262)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization of the PxCLBU and PxFBU registers in ahci_start_fis_rx() in drivers/ata/libahci.c when probing the ahci driver. A local user can trigger initialization of an affected AHCI controller to cause a denial of service.

The issue occurs on HBAs that support 64-bit addressing but operate with the AHCI_HFLAG_32BIT_ONLY flag. The reported failure leaves a JMicron JMB585 controller unusable.

929) Memory corruption (CVE-ID: CVE-2026-98272)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory.

The vulnerability exists due to a buffer overflow in the mvpp2 driver's page_pool array during mvpp2_bm_init() when changing the network interface MTU triggers a switch to per-CPU buffering without checking the pool count. A local user can trigger this buffering switch with a receive-queue configuration that exceeds the array capacity to corrupt memory.

The per-CPU buffering scheme requires two pools per receive queue and supports a maximum of eight pools.

930) Incorrect calculation (CVE-ID: CVE-2026-98275)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave RX overrun interrupts unacknowledged.

The vulnerability exists due to incorrect interrupt acknowledgment bit selection in the Cortina Gemini Ethernet driver's gmac_irq() function when handling RX overrun interrupts. A local user can trigger RX overrun interrupt handling to leave RX overrun interrupts unacknowledged.

For GMAC0, the acknowledgment writes the GMAC1 overrun bit instead; for GMAC1, the shift leaves no bit set in the 32-bit register.

931) Use-after-free (CVE-ID: CVE-2026-98276)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sock_gettstamp() in net/core/sock.c when non-atomic socket flag updates race without holding the socket lock. A local user can race a SIOCGSTAMPNS_NEW ioctl with bind() on a UDP socket to cause a denial of service.

932) Integer overflow (CVE-ID: CVE-2026-98282)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass I/O bus address range validation.

The vulnerability exists due to incomplete integer overflow and range validation in iommu_tce_check_ioba() in the PowerPC IOMMU code when validating multi-page requests for H_STUFF_TCE or H_PUT_TCE_INDIRECT. A local user can supply a multi-page range that causes arithmetic overflow or exceeds the TCE table capacity to bypass I/O bus address range validation.

The affected validation function is shared by KVM and VFIO.

933) Use of Uninitialized Variable (CVE-ID: CVE-2026-98287)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger reads of uninitialized packet headroom or corrupt packet-buffer state.

The vulnerability exists due to an unsafe protocol-compression undo heuristic in pppoatm_send() when transmit admission fails with protocol compression enabled. A local user can submit packets that encounter transmit admission failure to trigger reads of uninitialized packet headroom or corrupt packet-buffer state through an unbalanced skb_push() operation.

The affected protocol-compression option is SC_COMP_PROT.

934) Out-of-bounds read (CVE-ID: CVE-2026-98287)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds memory read.

The vulnerability exists due to an out-of-bounds read in pppoatm_send() when inspecting the first data byte of zero-length or non-linear packet buffers. A local user can submit zero-length or non-linear frames to trigger an out-of-bounds memory read.

Frames can reach the affected function through PPP channel bridging (PPPIOCBRIDGECHAN).

935) Memory corruption (CVE-ID: CVE-2026-98287)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt shared packet headers.

The vulnerability exists due to failure to ensure that packet headers are writable in pppoatm_send() when applying LLC encapsulation to packets received through PPP channel bridging. A local user can submit packets with shared headers through a bridged PPP channel to corrupt shared packet headers.

The affected encapsulation operation prepends a four-byte LLC header.

936) Deadlock (CVE-ID: CVE-2026-98290)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to lock order inversion in rfcomm_sock_cleanup_listen() when closing unaccepted child sockets concurrently with RFCOMM worker activity. A local user can initiate shutdown of an RFCOMM listening socket while the worker handles connections or DLC state changes to cause a denial of service.

937) Out-of-bounds read (CVE-ID: CVE-2026-98298)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds reads and silent data loss.

The vulnerability exists due to incorrect scatterlist entry length selection in mmp_pdma_prep_slave_sg() when preparing DMA transfers from scatterlists containing entries of different lengths. A local user can trigger processing of such a scatterlist to cause out-of-bounds reads and silent data loss.

938) Division by zero (CVE-ID: CVE-2026-98299)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to division by zero in the Linux kernel functions tcp_rcvbuf_grow() and tcp_rcv_space_adjust() when processing incoming TCP data with a zero receive-queue space value. A remote attacker can send TCP data that triggers a kernel crash to cause a denial of service.

Exploitation requires tcp_rmem[1] to be configured to a very small value, such as 1.

939) Race condition (CVE-ID: CVE-2026-98300)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to a race condition in tcp_v6_do_rcv() when processing incoming IPv6 TCP packets concurrently with closure of a listening socket. A local user can close a listening socket during the race window between tcp_v6_rcv() and tcp_v6_do_rcv() to trigger a kernel warning.

The affected path requires IPv6 receive options to be enabled through np->rxopt.all.

940) NULL pointer dereference (CVE-ID: CVE-2026-98302)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the Linux kernel skfp FDDI driver's adapter reset path when setting the MAC address on a down interface that has never been brought up. A local privileged user can set the interface's MAC address to trigger a kernel oops and cause a denial of service.

Exploitation requires the CAP_NET_ADMIN capability.

941) Improper access control (CVE-ID: CVE-2026-98306)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass VRF socket isolation.

The vulnerability exists due to improper access control caused by failure to propagate the VRF interface flag in decap_and_validate() in net/ipv6/seg6_local.c when decapsulating IPv4 traffic from SRv6 packets received on VRF-enslaved interfaces. A remote attacker can send SRv6 packets carrying IPv4 traffic that is delivered to an unbound socket outside the ingress VRF to bypass VRF socket isolation.

The behavior is observable with the End.DX4 action during delivery to a local address of the node.

942) NULL pointer dereference (CVE-ID: CVE-2026-98308)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the ALSA HDA PCM open tracepoint when stream assignment fails because hardware streams are exhausted. A local user can attempt to open a PCM substream under these conditions to cause a denial of service.

The tracepoint payload accesses the assigned stream tag before checking whether stream assignment succeeded.

943) Use-after-free (CVE-ID: CVE-2026-98311)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to use-after-free in virt_wifi_newlink() when transferring operational state before device registration. A local user can attempt to create a virtual wireless device with an invalid name while its lower device is dormant to trigger a use-after-free in the kernel.

Exploitation requires device registration to fail and a subsequent linkwatch_fire_event() call to access the queued list entry after the device object has been freed.

944) NULL pointer dereference (CVE-ID: CVE-2026-98314)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ALSA PCM timer initialization when concurrent timer callbacks execute before the registered timer's private data is initialized. A local user can read /proc/asound/timers concurrently with PCM timer initialization to cause a denial of service.

945) Memory leak (CVE-ID: CVE-2026-98319)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to deplete kernel memory.

The vulnerability exists due to a memory leak caused by incomplete error-path cleanup in prepare_signaling() in the DRM subsystem when handling a request that provides an out_fence_ptr without DRM_MODE_PAGE_FLIP_EVENT and encounters an allocation failure or a failure in setup_out_fence(). A local user can trigger an error path that leaves a drm_pending_vblank_event unreleased to deplete kernel memory.

946) Use-after-free (CVE-ID: CVE-2026-98320)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in the netfilter flowtable component when the flowtable datapath accesses connection-tracking state after its reference has been released. A local user can access prematurely released connection-tracking state to compromise confidentiality, integrity, and availability.

RCU typesafe semantics also allow a flowtable datapath reference to resolve to the wrong connection-tracking object.

947) Use of Uninitialized Variable (CVE-ID: CVE-2026-98322)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause uninitialized stack data to be used during IPv4 address mapping.

The vulnerability exists due to use of an uninitialized variable in nft_nat_setup_netmap() when constructing an IPv4 netmap address. A local user can trigger IPv4 netmap processing to cause uninitialized stack data to be used during IPv4 address mapping.

Only the 4-byte IPv4 member of the 16-byte address union is initialized before the entire union is copied into the address range passed to nf_nat_setup_info(). The IPv6 path initializes all 16 bytes and is not affected.

948) Out-of-bounds write (CVE-ID: CVE-2026-98323)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt receive-state memory.

The vulnerability exists due to an out-of-bounds write in the Linux kernel RDMA/siw siw_get_hdr() function when receiving an extended DDP/RDMAP header across multiple TCP callbacks. A remote attacker can send a fragmented extended DDP/RDMAP header to corrupt receive-state memory.

949) Incorrect comparison (CVE-ID: CVE-2026-98339)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a kernel warning.

The vulnerability exists due to incorrect BSS type comparison in cfg80211_update_assoc_bss_entry() when updating an associated access point's BSS entry after a channel change. A remote attacker can operate a rogue access point that switches to a channel containing an existing BSS entry with a mismatched advertised type to trigger a kernel warning.

The retained entry collides with the associated access point's entry in the BSS red-black tree during cfg80211_rehash_bss().

950) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98340)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger kernel warnings and prevent beacon data from being populated or updated for grouped BSS entries.

The vulnerability exists due to improper validation of beacon data presence in cfg80211 BSS grouping when processing probe responses and subsequent hidden-SSID beacons. A remote attacker can transmit probe responses that cause entries without beacon data to be grouped, followed by a hidden-SSID beacon with the same BSSID and channel, to trigger kernel warnings and prevent beacon data from being populated or updated for grouped BSS entries.

A hidden SSID can be zero-length or NUL-filled.

951) Use-after-free (CVE-ID: CVE-2026-98342)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel DMA engine when releasing a DMA device while concurrent RCU readers traverse the device list. A local user can trigger concurrent device release and list traversal to trigger a use-after-free.

Holding a dmaengine reference to the provider module no longer guarantees that the DMA device remains alive.

952) Use-after-free (CVE-ID: CVE-2026-98343)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free read in the kernel.

The vulnerability exists due to use-after-free in dma_chan_put() and dma_release_channel() when releasing a DMA channel drops the last reference to its device and frees the device and its channels. A local user can trigger DMA channel release to trigger a use-after-free read in the kernel.

953) Improper update of reference count (CVE-ID: CVE-2026-98344)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference counting in dma_chan_put() in drivers/dma/dmaengine.c when releasing DMA channels acquired through the fast path. A local user can cycle dmaengine_get() and dmaengine_put() to cause a denial of service.

Exploitation requires a non-private DMA provider with a persistent client keeping chan->client_count greater than zero.

954) Use of Uninitialized Variable (CVE-ID: CVE-2026-98345)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect classification of transmitted IP frames.

The vulnerability exists due to use of uninitialized memory caused by missing IP header length checks in cfg80211_classify8021d() when processing outgoing frames with undersized IP headers. A local user can transmit a frame marked as IPv4 or IPv6 with an incomplete IP header to cause incorrect classification of transmitted IP frames.

955) Race condition (CVE-ID: CVE-2026-98347)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the Linux kernel IPoIB interface state handling when a light multicast flush overlaps with interface shutdown. A local user can bring an IPoIB interface down during a multicast flush to cause a denial of service by leaving IPOIB_FLAG_OPER_UP set after shutdown, resulting in endless workqueue retries and an interface teardown deadlock.

956) Out-of-bounds read (CVE-ID: CVE-2026-98348)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an out-of-bounds read.

The vulnerability exists due to unsigned length arithmetic wrapping in libipw_handle_assoc_resp() when processing association response frames shorter than the 30-byte fixed prefix. A remote attacker can send a truncated association response frame to trigger an out-of-bounds read.

The ipw2100 and ipw2200 management receive paths check only for the generic 24-byte three-address header before reaching this function. The wrapped length is truncated to a 16-bit value near 64 KiB and passed to libipw_parse_info_param(), which reads beyond the receive buffer.

957) Out-of-bounds read (CVE-ID: CVE-2026-98349)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger reads beyond the allocated receive buffer.

The vulnerability exists due to an out-of-bounds read in libipw_network_init() and libipw_parse_info_param() when processing beacon or probe response frames shorter than the required 36-byte prefix. A remote attacker can send a specially crafted wireless management frame to trigger reads beyond the allocated receive buffer.

A 24-byte frame causes the information element length calculation to wrap and truncate to 65524, making the parser treat the buffer as containing almost 64 KiB of information elements.

958) Memory leak (CVE-ID: CVE-2026-98351)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause kernel memory leaks.

The vulnerability exists due to failure to free socket buffers in virt_wifi_start_xmit() when transmitting packets while the simulated link is disconnected. A local user can send packets through the disconnected simulated link to cause kernel memory leaks.

959) Race condition (CVE-ID: CVE-2026-98352)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a shared completion queue credit leak.

The vulnerability exists due to a race condition in the Linux kernel RDMA RTRS client when handling address resolution concurrently with connection teardown after an interrupted connection attempt. A local user can interrupt a connection attempt while the address resolution handler races with teardown to cause a shared completion queue credit leak.

Subsequent RDMA device unregistration triggers a kernel warning in ib_cq_pool_cleanup() if completion queue credits remain allocated.

960) Memory leak (CVE-ID: CVE-2026-98354)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service through memory exhaustion.

The vulnerability exists due to a receive buffer memory leak in ib_mad_complete_recv() in the RDMA MAD subsystem when processing management datagrams that fail PKey enforcement. A remote attacker can repeatedly send management datagrams with an incorrect PKey to cause a denial of service through memory exhaustion.

Each rejected datagram leaks approximately 300 bytes for an InfiniBand port or approximately 2 KB for OPA.

961) Use-after-free (CVE-ID: CVE-2026-98357)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Linux kernel iSER target's deferred control PDU completion handling when queued completion work executes after connection teardown has freed the connection objects. A local user can trigger connection teardown while control PDU completions remain queued to cause a denial of service.

The affected completion states are ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and ISTATE_SEND_TEXTRSP. ISTATE_SEND_LOGOUTRSP follows a separate logout wait path.

962) NULL pointer dereference (CVE-ID: CVE-2026-98358)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the iSER initiator's iser_check_remote_inv() and iser_inv_desc() functions when processing remote invalidations for unregistered data directions. A remote attacker can respond to a write command with IB_WR_SEND_WITH_INV to cause a denial of service.

The triggering write command sends all of its data as immediate data. Exploitation requires control of the target responding to the initiator.

963) Out-of-bounds read (CVE-ID: CVE-2026-98362)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect clock rates to be reported to consumers.

The vulnerability exists due to an out-of-bounds read in scpi_dvfs_recalc_rate() in the SCPI clock driver when recalculating a clock rate using an out-of-range DVFS index returned by SCP firmware. A local user can trigger clock-rate recalculation using such an index to cause incorrect clock rates to be reported to consumers.

The SCP firmware may supply the invalid index because it is buggy or returns a stale value.

964) Out-of-bounds read (CVE-ID: CVE-2026-98363)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds reads and populate the operating performance point table with invalid entries.

The vulnerability exists due to an out-of-bounds read caused by a missing upper-bound check in scpi_dvfs_get_info() when processing operating performance point counts from SCP firmware replies. A local user can supply a firmware reply with a count greater than MAX_DVFS_OPPS to cause out-of-bounds reads and populate the operating performance point table with invalid entries.

965) Use-after-free (CVE-ID: CVE-2026-98367)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to use-after-free in the RDMA/siw siw_accept() function when cleaning up after a failed siw_qp_modify() call. A local user can trigger a concurrent queue pair transition to the error state to corrupt kernel memory.

Exploitation requires the concurrent transition to occur after the queue pair state lock is released but before connection endpoint cleanup completes.

966) Improper locking (CVE-ID: CVE-2026-98369)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger kernel RCU lockdep warnings.

The vulnerability exists due to missing RCU read-side locking and insufficient object lifetime management in xfrm_trans_reinject() and xfrm_trans_queue_net() when reinjecting transport-mode packets through a workqueue. A local user can cause transport-mode packets to undergo deferred reinjection to trigger kernel RCU lockdep warnings.

Under CONFIG_PREEMPT_RCU, workqueue workers run in process context where local_bh_disable() does not establish an RCU read-side critical section. Queued packets may carry non-reference-counted destination entries, and network-device unregistration can replace a destination's device with blackhole_netdev.

967) Use-after-free (CVE-ID: CVE-2026-98370)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to use-after-free in xfrm_alloc_userspi() and xfrm_user_rcv_msg() when processing compat ALLOCSPI requests. A local user can submit a compat ALLOCSPI request that causes a translated child buffer to be attached to the inbound request to trigger a use-after-free in the kernel.

Exploitation depends on a multicast clone sharing skb_shared_info with the request and a compat receiver still copying from the translated child when the request handler frees it.

968) Use-after-free (CVE-ID: CVE-2026-98374)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tcp_send_synack() when replacing a cloned SYN socket buffer in the retransmit queue without updating the retransmission hint. A local user can initiate a TCP Fast Open connection using sendmsg(MSG_FASTOPEN) and supply an ICMP fragmentation-needed message to cause a denial of service.

Exploitation requires a simultaneous open after the retransmission hint has been armed.

969) NULL pointer dereference (CVE-ID: CVE-2026-98379)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to a null pointer dereference in the Linux kernel IPv6 reverse-path filtering component when processing a route without an inet6_dev. A local user can use rtnetlink to lower an external nexthop device's MTU below IPV6_MIN_MTU and trigger an IPv6 reverse-path filtering lookup to cause a denial of service by triggering a kernel panic.

An unprivileged user can construct the required state within a private user namespace and network namespace.

970) Race condition (CVE-ID: CVE-2026-98380)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition and improper error-pointer validation in tcf_idr_delete_index() in net/sched/act_api.c when deleting traffic control actions. A local user can trigger concurrent action deletion and reservation of the same IDR slot to cause a denial of service.

971) Use-after-free (CVE-ID: CVE-2026-98381)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the veth driver's XDP program handling when resizing receive channels and detaching or replacing an XDP program. A local user can reduce the receive channel count, detach or replace the XDP program, and subsequently increase the channel count to cause a denial of service.

972) Use-after-free (CVE-ID: CVE-2026-98383)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to use-after-free in BPF LWT_SEG6LOCAL handling when performing post-program SRH validation. A local user can run an LWT_SEG6LOCAL program that invalidates its cached SRH with bpf_lwt_seg6_adjust_srh() and then calls bpf_skb_pull_data() to corrupt kernel memory.

Reallocation of skb->head leaves the per-CPU SRH pointer dangling, and subsequent SRH validation writes through that pointer.

973) Deadlock (CVE-ID: CVE-2026-98388)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a deadlock in do_close_on_exec() in fs/exec.c when closing file descriptors during process execution while holding exec_update_lock. A local user can trigger process execution involving a FUSE filesystem that attempts to inspect the calling process to cause a denial of service.

974) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98398)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt kernel lock dependency validation.

The vulnerability exists due to insufficient validation of stale lock-class cache entries in the kernel lock dependency validator when acquiring locks whose cached classes have been invalidated. A local user can trigger acquisition of a lock retaining a stale class-cache entry to disrupt kernel lock dependency validation.

The issue can arise after module unloading or lock-key unregistration. Reported behavior includes kernel warnings; reuse of an invalidated class slot can also cause an unrelated lock class to be matched.

975) NULL pointer dereference (CVE-ID: CVE-2026-98404)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in drm_mode_addfb2() when virtio_gpu_user_framebuffer_create() returns a null pointer on an error path. A local user can trigger the framebuffer creation error path to cause a denial of service.

976) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98406)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to insufficient validation of the interface's driver-presence state in ieee80211_set_bitrate_mask() when handling wireless bitrate-setting requests. A local user can issue a SIOCSIWRATE ioctl for an interface marked as running but absent from the driver to trigger a kernel warning.

The affected state can occur during interface teardown or during bringup before the interface is added to the driver.

977) Out-of-bounds write (CVE-ID: CVE-2026-98407)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt unrelated kernel heap objects.

The vulnerability exists due to incorrect pointer arithmetic resulting in an out-of-bounds write in the rsi_hal_load_key() function when removing a key with a null data pointer. A local user can trigger a key-removal operation to corrupt unrelated kernel heap objects.

The write occurs on every DISABLE_KEY callback, including during disconnects, roaming, and interface teardown. It writes 144 zero bytes approximately 2.4 KB beyond the end of a 160-byte heap buffer.

978) Use of Uninitialized Variable (CVE-ID: CVE-2026-98413)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause SELinux to use uninitialized access-decision data.

The vulnerability exists due to use of an uninitialized stack variable in the SELinux avc_has_perm_noaudit() function when handling an empty requested permission set. A local user can trigger a permission check with an empty requested permission set to cause SELinux to use uninitialized access-decision data.

Callers pass the resulting decision to avc_audit(), and the inode hook also stores it in the per-task decision cache.

979) NULL pointer dereference (CVE-ID: CVE-2026-98416)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in k3_udma_glue_release_rx_chn() in the Linux kernel TI K3 UDMA glue driver when handling a receive-channel request after memory allocation fails. A local user can trigger the affected cleanup path to cause a denial of service.

The failure occurs when devm_kcalloc() cannot allocate the receive-channel flow array and cleanup subsequently calls k3_udma_glue_release_rx_flow().

980) Numeric Truncation Error (CVE-ID: CVE-2026-98417)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a kernel warning.

The vulnerability exists due to integer truncation in the handle_esp() function in net/xfrm/espintcp.c when processing ESP-in-TCP packets after the stream parser trims the TCP envelope. A remote attacker can supply packets whose transport header offset cannot be represented to trigger a kernel warning.

981) Out-of-bounds write (CVE-ID: CVE-2026-98419)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in reset_per_cpu_data() in the Linux kernel drop_monitor component when zeroing an alert message buffer. A local user can trigger an oversized memset() operation to corrupt kernel memory.

The write extends four bytes beyond the allocated buffer and corrupts skb_shared_info.

982) Improper initialization (CVE-ID: CVE-2026-98422)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper reinitialization of the crypto_tx_tailroom_needed_cnt counter in mac80211 AP_VLAN interface handling when bringing an AP_VLAN interface down. A local user can repeatedly bring the same AP_VLAN interface down and up while its parent AP interface remains up to trigger a kernel warning.

The sanity check detects a mismatch between the AP_VLAN interface's counter and the parent AP interface's counter.

983) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98426)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak interrupt resources.

The vulnerability exists due to incorrect resource cleanup using the wrong context index in mwifiex_pcie_request_irq() when handling an MSI-X interrupt registration failure. A local user can trigger this error path to leak interrupt resources.

984) Memory leak (CVE-ID: CVE-2026-98433)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by exhausting secure memory resources.

The vulnerability exists due to a memory leak in the Linux kernel KVM PowerPC Book3S HV kvmppc_svm_page_in() function when uv_page_in() fails after a secure device page has been allocated. A local user can trigger page-in operations that encounter this error to leave secure device pages and associated metadata unreclaimed, potentially exhausting the firmware-bounded secure memory pool and making affected guest frame numbers unusable for the lifetime of the VM.

The issue is reachable on POWER9/10 systems using Ultravisor/PEF.

985) NULL pointer dereference (CVE-ID: CVE-2026-98455)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service by triggering a Linux kernel crash.

The vulnerability exists due to a null pointer dereference in the Bluetooth RFCOMM_CONNINFO getsockopt handler when processing an accepted socket whose deferred setup flag remains set after its session has been removed. A remote attacker on the local network can send a Bluetooth RFCOMM DISC frame for a channel accepted with BT_DEFER_SETUP enabled to cause a kernel crash if a local application subsequently calls getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on that socket.

986) Out-of-bounds read (CVE-ID: CVE-2026-98457)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to trigger out-of-bounds reads that may cause a denial of service or disclose kernel memory.

The vulnerability exists due to out-of-bounds reads in the Linux kernel Bluetooth L2CAP receive path when processing short ERTM or streaming-mode frames. A remote attacker on the local network can send a frame with an incomplete two-byte or four-byte control field, or an insufficient CRC16 frame check sequence, to trigger reads beyond the frame boundary. In the CRC16 case, subtracting two from the remaining length can wrap, leaving the buffer unchanged before the frame check sequence is read.

987) Incorrect authorization (CVE-ID: CVE-2026-98460)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass Bluetooth HCI command restrictions and submit reserved opcodes through an unprivileged raw HCI socket.

The vulnerability exists due to improper authorization in the Linux kernel Bluetooth raw HCI socket security filter when checking command opcodes. A local user can submit a reserved opcode whose 10-bit opcode command field (OCF) aliases an allowlisted command after masking with 127 to bypass the command security filter.

A conforming controller should reject reserved opcodes.

988) Out-of-bounds read (CVE-ID: CVE-2026-98461)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering an out-of-bounds read in the kernel.

The vulnerability exists due to an out-of-bounds read in the Bluetooth is_filtered_packet() function when filtering event packets before their lengths are validated. A local user can supply a malformed event through a controller or vhci device to trigger reads beyond an empty event buffer or a truncated command event, potentially causing a kernel crash.

989) NULL pointer dereference (CVE-ID: CVE-2026-98476)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel null pointer dereference.

The vulnerability exists due to a missing null-pointer check in ccw_device_get_util_str() in the Linux kernel s390 channel I/O subsystem when a subchannel's PMCW still references a CHPID whose channel path registry entry has been removed. A local user can trigger the affected lookup under this condition to potentially crash the kernel when the null pointer returned by chpid_to_chp() is dereferenced.

990) Improper input validation (CVE-ID: CVE-2026-98479)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt application write buffers and cached file data on an iSCSI initiator.

The vulnerability exists due to insufficient validation of command data direction in the Linux kernel's libiscsi_tcp component when processing a Data-In PDU referencing a WRITE command. A remote attacker can operate a malicious iSCSI target and send a Data-In PDU naming an outstanding WRITE command's initiator task tag to overwrite the caller's pinned pages for a direct write or page cache pages for a buffered write with target-supplied data.

991) Out-of-bounds read (CVE-ID: CVE-2026-98481)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to trigger an out-of-bounds kernel memory read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel NFC port100 driver when validating device-supplied response frames without checking their declared length against the actual received length. An attacker with physical access to system can supply a response with a 16-bit datalen value exceeding the received data length to make port100_data_checksum() read past the transfer buffer, potentially causing a kernel crash.

992) Use of Uninitialized Variable (CVE-ID: CVE-2026-98482)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause the kernel to process uninitialized memory as NFC LLCP sequence data.

The vulnerability exists due to use of uninitialized memory in nfc_llcp_recv_hdlc() when processing truncated NFC LLCP PDUs without checking that the sequence byte is present. A remote attacker on the local network can send a two-byte I, RR or RNR PDU to cause the kernel to read uninitialized skb tailroom and use the byte as N(R)/N(S) sequence data.

993) Use-after-free (CVE-ID: CVE-2026-98483)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel NFC functions nfc_llcp_general_bytes() and nfc_get_local_general_bytes() when retrieving local general bytes. Releasing the local object's reference can free the object before callers access the returned pointer. A local user can potentially trigger affected NFC operations that dereference this stale pointer to cause a kernel crash and denial of service.

994) Out-of-bounds read (CVE-ID: CVE-2026-98485)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to an out-of-bounds read in the Linux kernel netfilter rt_mt6() function when processing IPv6 routing addresses under a non-strict address-matching rule with IP6T_RT_FST_MASK set and rtinfo->addrnr equal to zero. A remote attacker can send a crafted IPv6 packet containing matching routing addresses to advance the address index beyond the 16-entry array and cause a denial of service through a kernel panic.

995) Infinite loop (CVE-ID: CVE-2026-98488)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a CPU soft lockup.

The vulnerability exists due to an unreachable loop termination condition in the Linux kernel atl1e driver's atl1e_clean_tx_irq() function when hardware reports an out-of-range hw_next_to_clean value during a PCIe link or MAC reset. A local user can trigger the affected transmit cleanup path under these conditions to cause an infinite loop and a CPU soft lockup.

996) Infinite loop (CVE-ID: CVE-2026-98489)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service through a kernel CPU soft lockup.

The vulnerability exists due to an infinite loop with an unreachable exit condition in the Linux kernel atl1c driver's transmit cleanup routine when the hardware reports an out-of-range transmit descriptor consumer index during a PCIe link or MAC reset. A remote attacker on the local network can trigger a link reset by rebooting a directly connected network device to cause the cleanup loop to spin indefinitely if the hardware returns the invalid index.

997) Use-after-free (CVE-ID: CVE-2026-98491)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to use-after-free in the Linux kernel Open vSwitch connection-tracking component when cloned packets sharing an unconfirmed connection-tracking entry are committed with different extension sets. A remote attacker can trigger packet processing through the affected commit sequence to invalidate an extension pointer in the expectation list, potentially causing a kernel crash when the entry is later destroyed.

998) Infinite loop (CVE-ID: CVE-2026-98494)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a soft lockup.

The vulnerability exists due to an unreachable loop exit condition in the Linux kernel atl1 driver's atl1_intr_tx() function when hardware reports an out-of-range transmit descriptor consumer index during a PCIe link or MAC reset. A local user can potentially induce an infinite transmit cleanup loop to cause a denial of service if able to trigger this hardware condition.

999) Out-of-bounds read (CVE-ID: CVE-2026-98495)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read of kernel stack memory, potentially causing a denial of service.

The vulnerability exists due to missing NUL termination of the arp_dev field in the Linux kernel ARP ioctl handler when looking up a user-supplied interface name. A local user can submit a struct arpreq containing IFNAMSIZ bytes without a NUL terminator in arp_dev to cause strcmp() to read beyond the stack object during lookup through dev_get_by_name_rcu() or __dev_get_by_name() when a matching alternative interface name exists.

1000) Improper update of reference count (CVE-ID: CVE-2026-98498)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause resource retention that may lead to a denial of service.

The vulnerability exists due to a missing reference count decrement in mlx5_tc_ct_shared_counter_get() in the Linux kernel mlx5 driver when a reverse entry is found but its counter is already being released. A local user can trigger shared counter lookups under this condition to leave reverse entries permanently referenced, potentially exhausting resources and causing a denial of service.

1001) Out-of-bounds read (CVE-ID: CVE-2026-98499)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel memory contents.

The vulnerability exists due to an out-of-bounds read in the Linux kernel Wacom HID driver's wacom_wac_pen_serial_enforce() function when processing reports whose HID descriptor declares more usages than its report count reserves space for. A local user can supply a crafted HID descriptor and report to cause hid_field_extract() to read beyond the report buffer and expose the extracted value to userspace through an MSC_SERIAL event.

1002) Use-after-free (CVE-ID: CVE-2026-98501)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel ALPS HID driver when handling input reports after input device registration fails. A local user can trigger processing of a U1_SP_ABSOLUTE_REPORT_ID report during the registration failure window to cause u1_raw_event() to dereference the freed input2 device, potentially causing a kernel crash.

1003) Improper update of reference count (CVE-ID: CVE-2026-98511)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning during buffer-object release.

The vulnerability exists due to incorrect pin-count accounting in the nouveau driver's buffer-object pinning logic when processing a re-pin request for an already pinned buffer object in an incompatible memory domain. A local user can trigger a failed re-pin request that nevertheless increments the pin count, leaving an unmatched pin that triggers a warning in ttm_bo_release() when the buffer object is released.

1004) Memory leak (CVE-ID: CVE-2026-98514)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust kernel resources, potentially causing a denial of service.

The vulnerability exists due to an unreleased GEM object reference in the Linux kernel nouveau driver's validate_init() function when ttm_bo_reserve() fails or a virtual memory area lookup returns no matching entry. A local user can trigger these error paths repeatedly to accumulate unreleased objects and potentially exhaust kernel resources, causing a denial of service.

1005) Double free (CVE-ID: CVE-2026-98515)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to a double-free in the nouveau driver's nvif_vmm_dtor() function when handling client initialization failure while opening a DRM device. A local user can trigger the affected failure path to cause repeated cleanup calls that free the same vmm->page allocation twice, corrupting kernel memory and potentially causing a denial of service.

1006) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98516)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a resource leak that may degrade system availability.

The vulnerability exists due to a missing release of a PCI device reference in the nouveau driver's nv1a_ram_new() function when reading the memory size from the PCI bridge's configuration space. A local user can potentially trigger the affected initialization path to leave the bridge reference unreleased, which may retain resources and degrade system availability.

1007) Use-after-free (CVE-ID: CVE-2026-98524)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the affected system.

The vulnerability exists due to use-after-free in the Linux kernel RDS InfiniBand memory-region handling code when a failed mapping or registration leaves a freed scatterlist referenced by a pooled memory region. A local user can trigger this failure condition and subsequent memory-region teardown to access freed memory, potentially escalating privileges.

1008) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-98526)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to potentially cause a denial of service by triggering a kernel socket-buffer headroom underflow.

The vulnerability exists due to insufficient link-layer headroom allocation in llc_alloc_frame() when allocating LLC response frames for stacked Ethernet devices such as VLAN devices. A remote attacker on the local network can send LLC traffic that elicits a response through an affected device to trigger a headroom underflow in eth_header() and potentially cause a denial of service.

1009) Improper update of reference count (CVE-ID: CVE-2026-98527)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent the Zynq GPIO controller from entering runtime suspend, leaving its clock enabled.

The vulnerability exists due to failure to release a runtime power management reference in zynq_gpio_request() when pm_runtime_get_sync() fails during a GPIO request. A local user can trigger a GPIO request that encounters this failure to leave the usage counter incremented and prevent the controller from entering runtime suspend.

1010) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98529)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to interfere with runtime power management, potentially preventing a parent device from entering runtime suspend.

The vulnerability exists due to a missing runtime power-management reference release in arizona_gpio_direction_out() in the Linux kernel's Arizona GPIO driver when a register update fails while switching a persistent GPIO line from input to output. A local user can initiate this direction change and, if regmap_update_bits() fails, leave an outstanding reference that may prevent the parent device from entering runtime suspend.

1011) Out-of-bounds read (CVE-ID: CVE-2026-98531)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose uninitialized kernel heap memory.

The vulnerability exists due to an out-of-bounds read in the Linux kernel IPv6 segment routing Generic Netlink interface when processing a SEG6_ATTR_DST attribute shorter than an IPv6 address. A local privileged user can send a SEG6_CMD_SET_TUNSRC message containing a zero-length SEG6_ATTR_DST attribute, followed by SEG6_CMD_GET_TUNSRC, to disclose 16 bytes of uninitialized kernel heap memory because the attribute policy enforces only a maximum length while seg6_genl_set_tunsrc() copies a full 16-byte address.

1012) Out-of-bounds write (CVE-ID: CVE-2026-98532)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to out-of-bounds memory access in the Linux kernel's ipv6_find_hdr() function when processing IPv6 extension headers whose declared lengths exceed the remaining packet data. A local user can submit a specially crafted IPv6 packet for processing through Open vSwitch to cause update_ipv6_checksum() to read and write a transport checksum field outside the packet buffer, corrupting kernel memory and potentially causing a kernel crash.

1013) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98535)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a clock reference leak that may contribute to resource exhaustion.

The vulnerability exists due to failure to release a clock reference in the read_dts_node() function of the Freescale FMan Ethernet driver when reading a clock rate during device-tree processing. A local privileged user can trigger the affected processing path to leave an incremented clock reference unreleased, potentially contributing to resource exhaustion.

1014) Resource exhaustion (CVE-ID: CVE-2026-98536)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through prolonged task stalls and a possible kernel panic.

The vulnerability exists due to failure to report Tasks-RCU quiescent states in cleanup_offline_cgwbs_workfn() when draining offline cgroup writeback domains on kernels where cond_resched() is disabled by the preemption configuration. A local user can cause prolonged draining of a writeback domain with many attached inodes to delay concurrent BPF or ftrace detach operations, blocking tasks and potentially triggering a kernel panic.

1015) NULL pointer dereference (CVE-ID: CVE-2026-98537)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to a NULL pointer dereference in the Linux kernel workqueue function check_flush_dependency() when checking flush dependencies for a worker that is not executing a work item. A local user can potentially trigger this condition during worker creation when memory allocation invokes an out-of-memory notifier, causing the function to dereference worker->current_pwq while it is NULL and potentially cause a denial of service.

1016) Memory leak (CVE-ID: CVE-2026-98541)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to exhaust kernel memory and cause a denial of service.

The vulnerability exists due to a failure to release packet buffers in the Linux kernel FOU receive handler when a direct encapsulation socket has a zero protocol value. A local privileged user can submit a FOU_CMD_ADD Generic Netlink request with FOU_ATTR_TYPE set to FOU_ENCAP_DIRECT while omitting FOU_ATTR_IPPROTO, then send UDP packets to the resulting socket to leak an sk_buff for each received packet and potentially exhaust kernel memory.

1017) Integer overflow (CVE-ID: CVE-2026-98547)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by exhausting CPU resources.

The vulnerability exists due to integer overflow in the Linux kernel's prb_calc_retire_blk_tmo() function when calculating the block retirement timeout for TPACKET_V3 packet rings. A local user can use CAP_NET_RAW privileges to configure a packet ring with a specially crafted block size, causing a negative timeout that makes the retirement timer repeatedly fire at the maximum rate and consume CPU resources.

The demonstrated trigger requires a 1 Gbps NIC; QEMU e1000 is a working example.

1018) Use-after-free (CVE-ID: CVE-2026-98548)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service through kernel memory corruption.

The vulnerability exists due to a use-after-free in the Linux kernel SCTP implementation when processing a bundled stale-cookie ERROR chunk and DATA chunk received from a non-primary peer address while an association is in the COOKIE-ECHOED state. A remote attacker can send this crafted packet as an SCTP peer to leave the association referencing a freed transport object, which a subsequent FWD-TSN chunk or delayed SACK timer can cause the kernel to access, potentially resulting in memory corruption and a denial of service.

1019) Improper synchronization (CVE-ID: CVE-2026-98550)

CWE-ID: CWE-662 - Improper Synchronization

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to potentially cause a denial of service by leaving a TIPC group socket blocked after a group member departs.

The vulnerability exists due to improper synchronization in tipc_group_delete_member() when a departing member causes the outstanding broadcast acknowledgment counter to reach zero without restoring the group's open state or triggering a socket wakeup. A remote attacker on the local network can potentially cause a member departure under this condition to leave socket operations blocked despite completion of the outstanding acknowledgment accounting.

1020) Integer underflow (CVE-ID: CVE-2026-98550)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service by blocking future TIPC group broadcasts on an affected socket.

The vulnerability exists due to integer underflow caused by incomplete acknowledgment validation in tipc_group_proto_rcv() when processing TIPC group acknowledgment messages. A remote attacker on the local network can send unexpected or incorrectly sequenced GRP_ACK_MSG messages to decrement the broadcast acknowledgment counter improperly, potentially wrapping it to 65535 and causing persistent congestion on the affected socket.

1021) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98553)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through kernel resource exhaustion.

The vulnerability exists due to missing release of a pipe file reference in the Linux kernel autofs subsystem when mount setup fails or is abandoned before AUTOFS_SBI_CATATONIC is cleared. A local privileged user can trigger repeated unsuccessful mount setup operations to accumulate leaked file references and potentially exhaust kernel resources. During cleanup, autofs_kill_sb() calls autofs_catatonic_mode(), which returns early because the flag remains set, leaving the sbi->pipe reference unreleased.

1022) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-98554)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to insufficient packet buffer headroom in vlan_dev_hard_header() when constructing VLAN headers with VLAN_FLAG_REORDER_HDR unset. A local user can trigger packet transmission using buffers with insufficient reserved headroom to cause an skb_under_panic() kernel panic.

1023) Use-after-free (CVE-ID: CVE-2026-98555)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through kernel memory corruption or memory exhaustion.

The vulnerability exists due to use-after-free, double-free, and memory leaks in the Linux kernel LLC subsystem when llc_mac_hdr_init() fails during packet handling. A local user can trigger the affected error-handling paths to potentially cause a kernel crash or exhaust kernel memory through leaked packet buffers.

1024) Use-after-free (CVE-ID: CVE-2026-98559)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through invalid kernel memory access.

The vulnerability exists due to use-after-free in the Linux kernel SMC function smcr_port_err() when traversing smc_lgr_list.list without holding smc_lgr_list.lock. A local user can potentially trigger a race between this traversal and concurrent smc_lgr_terminate_sched() execution to cause a denial of service by dereferencing a freed link group.

1025) Out-of-bounds write (CVE-ID: CVE-2026-98567)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an out-of-bounds write in __netif_set_xps_queue() when updating transmit packet steering (XPS) mappings after reducing the number of traffic classes. A local privileged user can trigger an XPS mapping update for a transmit queue whose stale traffic class is outside the current valid range to write beyond the allocated mapping array and potentially cause a kernel crash.

1026) Improper input validation (CVE-ID: CVE-2026-98569)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by disrupting metadata receive lookup for GRE, GRETAP, or ERSPAN tunnel devices.

The vulnerability exists due to missing validation of metadata tunnel uniqueness in ipgre_netlink_parms() when enabling collect_md on an existing tunnel device through changelink. A local privileged user can convert a non-metadata device to metadata mode, replacing another device's metadata receive entry of the same type in the same network namespace, and then delete either device to disrupt metadata receive lookup for the surviving device.

1027) Integer underflow (CVE-ID: CVE-2026-98573)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption that may result in a denial of service.

The vulnerability exists due to an unsigned integer underflow in skb_maybe_pull_tail(), called by skb_checksum_setup_ipv6(), when parsing IPv6 extension headers. A remote attacker can supply crafted IPv6 packet data to trigger subtraction of skb_headlen(skb) from a smaller max value, producing a negative delta after conversion to a signed integer. This delta reaches skb_copy_bits() through __pskb_pull_tail(), where it can become a very large copy length and potentially cause memory corruption and a kernel crash.

The triggering condition requires an skb whose linear area exceeds MAX_IPV6_HDR_LEN and parsing that needs data beyond that linear area.

1028) Out-of-bounds read (CVE-ID: CVE-2026-98575)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to trigger an out-of-bounds kernel memory read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in pn533_acr122_is_rx_frame_valid() when validating USB response frames from an ACR122 device. An attacker with physical access to system can supply a crafted USB response through a malicious device with an unchecked frame->ccid.datalen value to read beyond the received buffer and potentially crash the kernel.

1029) Out-of-bounds read (CVE-ID: CVE-2026-98576)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disclose kernel memory contents through debug output.

The vulnerability exists due to an out-of-bounds read in the Linux kernel NFC LLCP functions nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() when logging non-null-terminated service names. A local user can supply a non-null-terminated service name that is passed to pr_debug() with the %s format specifier to trigger reads beyond the allocated buffer and potentially expose adjacent kernel memory in debug output.

1030) Partial String Comparison (CVE-ID: CVE-2026-98577)

CWE-ID: CWE-187 - Partial String Comparison

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to hijack well-known service access points in the Linux kernel NFC subsystem.

The vulnerability exists due to a partial string comparison in nfc_llcp_wks_sap() when resolving NFC logical link control service names. A local user can supply a short service name such as "u" that matches the prefix of "urn:nfc:sn:snep" to obtain the service access point associated with the longer well-known service name.

1031) Out-of-bounds read (CVE-ID: CVE-2026-98578)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to trigger an out-of-bounds read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel's st21nfca_get_iso15693_inventory() helper when processing truncated ISO15693 inventory responses. A remote attacker on the local network can supply an inventory response with an insufficient length to trigger a read of data[1] as the DSFID beyond the available data, potentially causing a denial of service.

1032) Memory leak (CVE-ID: CVE-2026-98579)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak kernel memory, potentially causing a denial of service through memory exhaustion.

The vulnerability exists due to missing deallocation of queued TLV nodes in the Linux kernel NFC LLCP function nfc_genl_llc_sdreq() when nested netlink attribute parsing, TLV allocation, or service discovery request transmission fails. A local user can repeatedly submit requests that trigger these error paths after TLV nodes have been queued to leak kernel memory and potentially exhaust available memory.

1033) Use-after-free (CVE-ID: CVE-2026-98580)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by potentially crashing the Linux kernel.

The vulnerability exists due to improper synchronization in the Linux kernel NFC LLCP accept queue lifecycle when socket release and accept operations run concurrently. A local user can trigger overlapping operations that unlink and release the same child socket, causing use-after-free or a NULL pointer dereference in nfc_llcp_accept_unlink() that may crash the kernel.

1034) Improper locking (CVE-ID: CVE-2026-98581)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by exhausting kernel memory through unbounded socket leaks.

The vulnerability exists due to improper locking and inconsistent socket list membership in the Linux kernel NFC LLCP nfc_llcp_recv_dm() function when handling DM(NOBOUND) or DM(REJ) messages. A local user can race socket release against concurrent connection operations while a remote peer supplies these messages over an established LLCP link to corrupt the connecting socket list, disrupt reference counting, and leak kernel sockets until memory is exhausted.

1035) Out-of-bounds read (CVE-ID: CVE-2026-98582)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to trigger out-of-bounds reads that may cause a denial of service.

The vulnerability exists due to out-of-bounds reads in the Linux kernel's st21nfca_hci_i2c_repack() function when processing malformed received frames. A remote attacker on the local network can supply a frame with an EOF marker immediately after the start marker or a trailing escape marker to cause CRC processing or byte unstuffing to read beyond the received frame boundary, potentially causing a kernel crash.

1036) Out-of-bounds read (CVE-ID: CVE-2026-98583)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the nfcmrvl firmware download receive path when processing a short helper command frame. A local user can supply a truncated frame to cause the kernel to remove the NCI data header and read the helper command before validating the packet length, potentially causing a kernel fault and denial of service.

1037) Use-after-free (CVE-ID: CVE-2026-98586)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel SCTP implementation when timer rearming races with timer cleanup. A remote attacker can potentially trigger this race during SCTP processing, causing a timer handler to access a freed association or transport object and underflow its reference count, which may result in a denial of service.

1038) Out-of-bounds write (CVE-ID: CVE-2026-98588)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory or cause a denial of service.

The vulnerability exists due to an out-of-bounds write in sock_map_free() when freeing a SOCKMAP whose entry count exceeds the range of its signed integer iterator. A local privileged user can create and destroy a SOCKMAP with max_entries = 0xffffffff to trigger signed integer overflow and write outside the socket array, corrupting an unrelated allocation or crashing the kernel.

Exploitation requires the 32 GiB allocation to succeed on a large-memory host.

1039) Unexpected Sign Extension (CVE-ID: CVE-2026-98590)

CWE-ID: CWE-194 - Unexpected Sign Extension

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass BPF verifier assumptions about the range of runtime register values.

The vulnerability exists due to unexpected sign extension and incorrect destination-size accounting in bpf_sock context access code generation when processing access to the rx_queue_mapping field. A local user can execute a specially crafted BPF program that right-shifts the sign-extended value to produce a runtime value outside the bounds assumed by the verifier.

1040) NULL pointer dereference (CVE-ID: CVE-2026-98593)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to a NULL pointer dereference in the Linux kernel s390 debug_info_copy() function when copying a debug area after debug_register_static() fails and clears its pointers without resetting its bounds. A local user can trigger copying of the affected area by opening its view file or through debug_dump() to cause a denial of service.

1041) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98594)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through unreleased kernel driver resources.

The vulnerability exists due to missing release of PHYLIB resources in the Linux kernel tg3 driver's initialization error path when device probing fails after an MDIO bus has been registered and a PHY connected. A local privileged user can potentially trigger this failure path to leave those resources associated with released mappings and network-device state, which may disrupt system operation.

1042) Out-of-bounds read (CVE-ID: CVE-2026-98597)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read that may disclose kernel memory or cause a denial of service.

The vulnerability exists due to incorrect receive-length validation in the Linux kernel's sr9700_rx_fixup() function when processing receive buffers. A local user can supply receive data with an inconsistent reported packet length to cause a copy to read beyond the receive buffer, because the length check does not account for the three-byte header and four-byte Ethernet CRC.

1043) Out-of-bounds read (CVE-ID: CVE-2026-98602)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel heap information.

The vulnerability exists due to an out-of-bounds read in Bluetooth BNEP transmit processing when handling AF_PACKET frames shorter than the 14-byte Ethernet header. A local user can submit a specially crafted short frame to cause Ethernet header processing to read beyond the available packet data and disclose kernel heap information.

1044) Out-of-bounds read (CVE-ID: CVE-2026-98602)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to potentially cause a denial of service through out-of-bounds reads in the Linux kernel.

The vulnerability exists due to out-of-bounds reads in Bluetooth BNEP receive-frame and control processing when handling truncated frames or control frames that fall through to Ethernet frame submission. A remote attacker on the local network can send specially crafted BNEP frames to trigger reads beyond available packet data, potentially causing a kernel crash.

1045) Use-after-free (CVE-ID: CVE-2026-98606)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger invalid kernel memory accesses and potentially cause a denial of service.

The vulnerability exists due to use-after-free in virtio_gpu_vram_create() in the Linux kernel virtio GPU driver when handling object creation failures. A local user can trigger an error path that frees a GEM object without removing its registered VMA offset node, causing subsequent offset lookups or insertions to access freed memory and potentially crash the system.

1046) Memory leak (CVE-ID: CVE-2026-98607)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust resources and potentially cause a denial of service.

The vulnerability exists due to improper release of object references in virtio_gpu_resource_create_blob_ioctl() when UUID assignment or GEM handle creation fails. A local user can invoke resource-creation operations that encounter these error paths to leak virtio_gpu_object allocations, resource identifiers, and host-side resources, potentially causing resource exhaustion and a denial of service.

1047) Memory leak (CVE-ID: CVE-2026-98608)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust resources and potentially cause a denial of service.

The vulnerability exists due to failure to release an owned object reference in virtio_gpu_resource_create_ioctl() when handling a drm_gem_handle_create() failure. A local user can exercise this error path to leak the GPU object, its pages and scatter-gather table, the resource identifier, and the host-side resource, potentially exhausting resources and causing a denial of service.

1048) Memory leak (CVE-ID: CVE-2026-98609)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak guest memory and host-side graphics resources, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to improper reference-count management in virtio_gpu_gem_create() when graphics handle creation fails. A local user can trigger object creation operations that encounter drm_gem_handle_create() failures to leave graphics objects allocated without a remaining reference, leaking guest memory and host-side resources and potentially causing a denial of service.

1049) Infinite loop (CVE-ID: CVE-2026-98610)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering an infinite packet-classification loop and a CPU soft lockup in the Linux kernel.

The vulnerability exists due to an infinite loop in hfsc_classify() in net/sched/sch_hfsc.c when class-level changes leave previously valid flowid bindings forming a cycle that bypasses the downward-level check. A local user can configure cyclic HFSC filter bindings and send a single packet through the affected queue to cause packet classification to loop indefinitely with the qdisc lock held and bottom halves disabled.

The required network configuration is reachable by an unprivileged user through unshare -Urn, which provides CAP_NET_ADMIN within the new user and network namespaces.

1050) Out-of-bounds read (CVE-ID: CVE-2026-98612)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to potentially cause a denial of service or disclose kernel memory.

The vulnerability exists due to out-of-bounds reads and acceptance of undersized packets in the Linux kernel's catc_rx_done() function when processing USB receive transfers. An attacker with physical access to system can supply malformed packet lengths or truncated transfers to trigger reads beyond the receive buffer or from uninitialized socket-buffer tailroom, potentially causing a kernel crash or memory disclosure.

1051) NULL pointer dereference (CVE-ID: CVE-2026-98614)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through a NULL pointer dereference in the Linux kernel's SCTP implementation.

The vulnerability exists due to a missing NULL pointer check in sctp_assoc_update_retran_path() when assigning a replacement retransmission path without an eligible transport. A remote attacker can trigger affected SCTP retransmission-path processing when all remaining transports are SCTP_UNCONFIRMED to leave the retransmission path NULL, potentially causing a NULL pointer dereference during subsequent path use or debug logging.

1052) Infinite loop (CVE-ID: CVE-2026-98614)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service through an infinite loop in the Linux kernel's SCTP implementation.

The vulnerability exists due to an unreachable loop termination condition in sctp_assoc_update_retran_path() when selecting a retransmission path while every remaining transport, including the current retransmission path, is SCTP_UNCONFIRMED. A remote attacker can trigger affected SCTP retransmission-path processing under these conditions to cause the transport-selection loop to run indefinitely.

1053) Out-of-bounds write (CVE-ID: CVE-2026-98621)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an integer underflow leading to an out-of-bounds write in the Linux kernel's GUE REMCSUM processing when the checksum field offset is less than the checksum start offset. A remote attacker can send a specially crafted GUE packet to underflow the checksum offset stored in skb->csum_offset and trigger a two-byte write approximately 64 KiB beyond the destination buffer if the forwarded packet retains CHECKSUM_PARTIAL and reaches a NETIF_F_HW_CSUM driver that trusts this metadata.

1054) Reachable assertion (CVE-ID: CVE-2026-98622)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to a reachable warning assertion in tcf_ct_flow_table_add() in net/sched/act_ct.c when flow_offload_alloc() returns NULL during packet processing through a tc action ct commit classifier. A local user can race a conntrack flush against traffic handled by the classifier to trigger a warning on an expected allocation failure and cause a kernel panic.

The kernel panic requires panic_on_warn=1.

1055) Out-of-bounds read (CVE-ID: CVE-2026-98623)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger an out-of-bounds kernel memory read, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds read in the Nouveau driver's nvkm_clk_ustate_update() function when processing a power-state identifier supplied through the pstate debugfs file. A local privileged user can request an identifier absent from clk->states, including any identifier when the list is empty, to cause the function to dereference the list head as a struct nvkm_pstate after an unsuccessful search, potentially causing a denial of service.

1056) Race condition (CVE-ID: CVE-2026-98624)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel fault.

The vulnerability exists due to a race condition in the Linux kernel nfnetlink_queue component when socket release notifications and queue configuration requests are processed concurrently. A local user can race a socket close() operation against an UNBIND request from another socket using the same portid to trigger concurrent queue destruction and cause a denial of service.

1057) Use-after-free (CVE-ID: CVE-2026-98625)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a use-after-free in the Linux kernel.

The vulnerability exists due to a use-after-free in the netfilter flowtable hardware offload worker when flow destruction overlaps with garbage collection. A local user can potentially trigger a race in which NF_FLOW_HW_DEAD is set before NF_FLOW_HW_PENDING is cleared, allowing garbage collection and an RCU callback to free the flow before the worker resumes accessing it, to cause a denial of service.

1058) Improper input validation (CVE-ID: CVE-2026-98626)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass relocation-target validation and cause unintended replacement of BPF instructions.

The vulnerability exists due to improper validation of relocation targets before instruction poisoning in bpf_core_patch_insn(), shared by libbpf and in-kernel CO-RE, when processing unresolved CO-RE relocations. A local user can supply malformed relocation metadata targeting instructions that are not eligible for relocation to replace jumps, calls, exits, register-source arithmetic, or non-immediate loads instead of triggering a relocation error.

1059) Out-of-bounds read (CVE-ID: CVE-2026-98631)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read out-of-bounds kernel memory, potentially disclosing sensitive information.

The vulnerability exists due to an out-of-bounds read in the Linux kernel's xsk_map_gen_lookup() function when generated lookup code compares a zero-extended 32-bit key against a sign-extended 64-bit bound. A local user can supply an out-of-range lookup key that bypasses the bounds check to read beyond the xsk_map[] array.

Exploitation requires a map with max_entries set to 0x80000000 or higher.

1060) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-98636)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger undefined kernel behavior that may cause a denial of service.

The vulnerability exists due to an incorrect bitwise shift in the squashfs_xz_comp_opts() function when processing a SquashFS image with the COMP_OPTS flag set to 1 and a dictionary size of zero. A local privileged user can cause a specially crafted image to be mounted to trigger a shift with an exponent of -1, resulting in undefined behavior that may cause a denial of service.

1061) Out-of-bounds read (CVE-ID: CVE-2026-98640)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a kernel page fault.

The vulnerability exists due to an out-of-bounds read in the Linux kernel amd_sfh driver's PCI probe code when accessing MMIO registers without validating that PCI BAR 2 covers the required offsets. A local privileged user can trigger probing of a device with an undersized BAR 2 to cause an access beyond the mapped region and a kernel page fault.

1062) Out-of-bounds read (CVE-ID: CVE-2026-98643)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose adjacent kernel memory, including portions of kernel pointers.

The vulnerability exists due to an out-of-bounds read in the Linux kernel BPF sock_ops context conversion code when processing rtt_min access on the tcp_conn_request() path. A local privileged user can use a sockops BPF program that reads skops->rtt_min during BPF_SOCK_OPS_RWND_INIT to disclose adjacent kernel memory because a request_sock is incorrectly treated as a full tcp_sock without checking the socket type.

1063) Excessive Iteration (CVE-ID: CVE-2026-98644)

CWE-ID: CWE-834 - Excessive Iteration

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering prolonged CPU stalls and soft lockups.

The vulnerability exists due to excessive iteration without rescheduling points in __htab_map_lookup_and_delete_batch() when processing BPF hash map batch operations. A local user can invoke batch lookups on a sufficiently large map to cause prolonged CPU stalls, because the batch count limits entries copied rather than buckets visited, and consecutive empty buckets are traversed within a single RCU read-side, instrumentation-disabled critical section.

1064) Division by zero (CVE-ID: CVE-2026-98647)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel divide-by-zero exception.

The vulnerability exists due to an unchecked zero divisor in btf_struct_walk() when validating an access beyond a structure ending in a flexible array whose element type has zero size. A local privileged user can load a specially crafted BPF program that accesses the structure through a PTR_TO_BTF_ID pointer not marked MEM_ALLOC to trigger a modulo-by-zero operation during verification and cause a denial of service.

1065) Reachable assertion (CVE-ID: CVE-2026-98872)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by crashing the Linux kernel.

The vulnerability exists due to a reachable assertion in the freevxfs vxfs_bmap_typed() function when processing an on-disk typed extent with an unsupported type value. A local privileged user can trigger processing of such an extent through ioctl(FIBMAP) on a regular file to invoke BUG() and crash the kernel.

1066) Missing initialization of resource (CVE-ID: CVE-2026-98873)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially disclose sensitive information from uninitialized kernel memory.

The vulnerability exists due to missing initialization of connection-tracking expectation objects in the Linux kernel netfilter subsystem when expectation data is returned to userspace through ctnetlink. A local privileged user can obtain expectation data through ctnetlink to potentially read uninitialized kernel memory exposed in the returned data.

1067) NULL pointer dereference (CVE-ID: CVE-2026-98876)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to a missing NULL pointer check in host1x_device_init() in the Linux kernel host1x bus component when handling initialization error teardown for a client whose operations pointer is NULL. A local user can trigger the affected teardown paths to cause a NULL pointer dereference that may crash the kernel.

1068) NULL pointer dereference (CVE-ID: CVE-2026-98877)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to a null pointer dereference in the Linux kernel GICv4 interrupt controller support when kvm-arm.vgic_v4_enable=1 is set on a GICv4 system without an MSI controller device tree node or an available ITS. A local user can trigger an access to the null gic_domain pointer to cause a kernel panic and denial of service.

1069) Unchecked Return Value (CVE-ID: CVE-2026-98879)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel assertion failure.

The vulnerability exists due to an unchecked return value from sb_set_blocksize() in isofs_fill_super() when mounting an ISO filesystem with a block size greater than PAGE_SIZE. A local privileged user can cause such a filesystem to be mounted to trigger the BUG_ON(offset >= folio_size(folio)) assertion in folio_set_bh() during the first __bread_gfp() call, causing a denial of service.

1070) Resource exhaustion (CVE-ID: CVE-2026-98881)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by prolonging the blocking of network configuration operations.

The vulnerability exists due to excessive synchronization waits in the Linux kernel br_multicast_dev_del() function when tearing down bridge devices. A local user can trigger bridge device teardown to cause excessive RTNL lock contention through a stale rcu_barrier() call, delaying other network operations.

1071) Numeric Truncation Error (CVE-ID: CVE-2026-98884)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to integer truncation in the Linux kernel MMC core when an excessively large host-provided max_segs value is truncated to zero. A local user can trigger MMC request initialization with such an invalid host configuration to cause a zero-size scatter-gather allocation and a subsequent invalid memory access in sg_init_table(), crashing the kernel.

1072) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98885)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger kernel warnings during file integrity appraisal.

The vulnerability exists due to insufficient checks for file write restrictions in the Linux kernel's ima_fix_xattr() function when updating extended attributes during integrity appraisal. A local user can open a file subject to appraisal on a read-only ext4 filesystem to trigger an extended attribute update that attempts to start an invalid filesystem transaction, producing a kernel warning.

1073) Unchecked Return Value (CVE-ID: CVE-2026-98886)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by causing HDMI I2C read operations to wait indefinitely.

The vulnerability exists due to unchecked timeout and interruption return values in the xfer_read() function of the Oaktrail HDMI I2C driver when waiting for a read transaction to complete. A local user can trigger an affected read operation under conditions where the interrupt does not advance the transaction state to cause an indefinite wait, potentially blocking subsequent HDMI I2C transfers.

1074) Out-of-bounds read (CVE-ID: CVE-2026-98887)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger an out-of-bounds kernel memory read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel mac80211_hwsim function hwsim_tx_info_frame_received_nl() when processing an undersized HWSIM_ATTR_TX_INFO netlink attribute. A local privileged user can submit a short or zero-length attribute that passes the maximum-length-only validation to trigger an unconditional eight-byte read beyond the attribute payload, potentially causing a kernel fault.

1075) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98888)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of nested probe state in the Linux kernel arm64 kprobes implementation when a probe is hit while another probe is preparing or executing its out-of-line single-step instruction. A local user can trigger this condition through execution paths involving configured probes to cause a denial of service, as recoverable reentry is treated as unrecoverable and nested probes can overwrite the outer probe's saved interrupt state, leaving interrupts permanently disabled.

1076) Out-of-bounds write (CVE-ID: CVE-2026-98889)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds write in the iwlwifi MVM driver's scheduled scan handling when building probe requests before validating information element lengths. A local user can supply oversized information elements for a scheduled scan to overflow the fixed-size probe request buffer, potentially causing a kernel crash.

1077) Out-of-bounds read (CVE-ID: CVE-2026-98890)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger an out-of-bounds kernel memory read, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel libertas driver's lbs_hard_start_xmit() function when processing short transmit frames in monitor mode. A local privileged user can submit a frame containing insufficient data for the radiotap TX header and the 802.11 destination address field to trigger a read beyond the socket buffer data, potentially causing a kernel crash.

1078) Out-of-bounds read (CVE-ID: CVE-2026-98891)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to trigger an out-of-bounds read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the mac80211 ieee80211_rx_mgmt_deauth() function when processing truncated Wi-Fi deauthentication frames. A remote attacker on the local network can transmit a frame missing the reason code field to trigger a read beyond the received frame data before its length is checked, potentially causing a denial of service.

1079) Out-of-bounds read (CVE-ID: CVE-2026-98892)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read that may cause a denial of service.

The vulnerability exists due to insufficient payload-length validation in the Linux kernel ARM SCMI BASE_ERROR_EVENT notification parser when processing variable-length message reports. A local user can supply a truncated notification payload whose error_status specifies more reports than the payload contains to trigger reads beyond the received data, potentially causing a kernel crash.

1080) Out-of-bounds read (CVE-ID: CVE-2026-98893)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the ARM SCMI sensor notification parser when processing truncated SENSOR_UPDATE notifications. A local user can supply a truncated notification, if able to control notification payloads, to cause the parser to read beyond the received buffer, potentially causing a denial of service.

1081) Use-after-free (CVE-ID: CVE-2026-98896)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel Thunderbolt hotplug handling code when queued work executes after its associated domain has been removed. A local privileged user can trigger device-router hotplug events concurrently with driver unloading to cause the hotplug handler to access freed domain memory, potentially crashing the kernel.

1082) Use of uninitialized resource (CVE-ID: CVE-2026-98898)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to use of an uninitialized resource in the Linux kernel AMD GPU power management component when processing interrupts that schedule thermal work. A local user can potentially trigger work scheduling on an uninitialized thermal work queue to cause a kernel crash and denial of service.

The vulnerable condition occurs when dynamic power management is disabled with the amdgpu.dpm=0 module parameter.

1083) Improper locking (CVE-ID: CVE-2026-98899)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to improper locking in the Linux kernel netfilter ipset hash-table implementation when garbage collection accesses a shared hash table without the required read-copy-update protection. A local user can potentially trigger concurrent hash-table operations to cause unsafe table access and a denial of service.

1084) Integer overflow (CVE-ID: CVE-2026-98900)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through excessive kernel memory allocation and bypass grant-count limits.

The vulnerability exists due to insufficient grant-count validation and integer overflow in the Xen grant allocation function gntalloc_ioctl_alloc() when processing user-controlled grant allocation requests. A local user can supply excessive grant counts to trigger memory allocation before limit enforcement or cause arithmetic wraparound in grant accounting, potentially exhausting kernel memory or bypassing grant-count limits.

1085) Integer overflow (CVE-ID: CVE-2026-98902)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to interfere with RAID5 stripe batching, potentially compromising storage consistency.

The vulnerability exists due to integer wraparound and an incorrect sequence-number comparison in the Linux kernel RAID5 stripe batching logic when a 32-bit sequence counter wraps. A local user can potentially exercise stripe batching across this wraparound condition to cause newer bm_seq values to be treated as older values, potentially compromising storage consistency.

1086) Race condition (CVE-ID: CVE-2026-98907)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by disrupting Btrfs superblock reads.

The vulnerability exists due to a race condition in the Btrfs sb_write_pointer() function when reading a superblock from the block device page cache concurrently with block size changes. A local privileged user can attempt to overlap block size changes through BLKBSZSET with reads through read_cache_page_gfp() to potentially cause inconsistent reads and disrupt filesystem operations.

1087) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98909)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through unreleased kernel resources.

The vulnerability exists due to missing resource cleanup in the Linux kernel CPSW Ethernet driver's cpsw_probe() function when port registration fails after successful devlink registration. A local privileged user can potentially exploit this failure path to leave a devlink instance and its parameters registered after underlying resources have been released, which may disrupt system operation.

1088) Release of invalid pointer or reference (CVE-ID: CVE-2026-98911)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service.

The vulnerability exists due to an invalid pointer release in the Linux kernel dpaa2-switch driver's dpaa2_switch_rx() function when handling errors during received-frame processing. A remote attacker can potentially trigger the affected error path through network traffic to cause a kernel crash when a receive frame descriptor is incorrectly treated as a transmit frame descriptor and its software annotation data is used as a socket-buffer pointer for deallocation.

1089) Incorrect comparison (CVE-ID: CVE-2026-98912)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data to be written beyond the requested userspace buffer length.

The vulnerability exists due to an inverted buffer-length comparison in snd_seq_oss_read() when processing reads of queued OSS sequencer events. A local user can request a read shorter than the next queued event to cause the event to be copied beyond the requested userspace buffer length.